Skip to content

Commit 558fed6

Browse files
jandro996jandro996
committed
Add tomcat host console support
1 parent 0e0654b commit 558fed6

File tree

5 files changed

+73
-27
lines changed

5 files changed

+73
-27
lines changed

‎dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/ApplicationModuleImpl.java‎

Lines changed: 17 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -44,32 +44,26 @@ public class ApplicationModuleImpl extends SinkModuleBase implements Application
4444

4545
private static final String CONTEXT_LOADER_LISTENER =
4646
"org.springframework.web.context.ContextLoaderListener";
47-
4847
private static final String DISPATCHER_SERVLET =
4948
"org.springframework.web.servlet.DispatcherServlet";
50-
5149
private static final String DEFAULT_HTML_ESCAPE = "defaultHtmlEscape";
52-
53-
private static final String TOMCAT_MANAGER_APPLICATION = "Tomcat Manager Application";
54-
5550
private static final String LISTINGS_PATTERN = "<param-name>listings</param-name>";
56-
5751
private static final String SESSION_TIMEOUT_START_TAG = "<session-timeout>";
58-
5952
private static final String SESSION_TIMEOUT_END_TAG = "</session-timeout>";
60-
6153
private static final String SECURITY_CONSTRAINT_START_TAG = "<security-constraint>";
62-
6354
private static final String SECURITY_CONSTRAINT_END_TAG = "</security-constraint>";
64-
6555
public static final String PARAM_VALUE_START_TAG = "<param-value>";
66-
6756
public static final String PARAM_VALUE_END_TAG = "</param-value>";
68-
57+
public static final String DISPLAY_NAME_START_TAG = "<display-name>";
58+
public static final String DISPLAY_NAME_END_TAG = "</display-name>";
59+
static final String TOMCAT_MANAGER_APP = "Tomcat Manager Application";
60+
private static final String TOMCAT_MANAGER_APP_PATTERN =
61+
DISPLAY_NAME_START_TAG + TOMCAT_MANAGER_APP + DISPLAY_NAME_END_TAG;
62+
static final String TOMCAT_HOST_MANAGER_APP = "Tomcat Host Manager Application";
63+
private static final String TOMCAT_HOST_MANAGER_APP_PATTERN =
64+
DISPLAY_NAME_START_TAG + TOMCAT_HOST_MANAGER_APP + DISPLAY_NAME_END_TAG;
6965
public static final String WEB_INF = "WEB-INF";
70-
7166
public static final String WEB_XML = "web.xml";
72-
7367
static final String SESSION_REWRITING_EVIDENCE_VALUE = "Servlet URL Session Tracking Mode";
7468

7569
private static final Pattern PATTERN =
@@ -78,7 +72,8 @@ public class ApplicationModuleImpl extends SinkModuleBase implements Application
7872
CONTEXT_LOADER_LISTENER,
7973
DISPATCHER_SERVLET,
8074
DEFAULT_HTML_ESCAPE,
81-
TOMCAT_MANAGER_APPLICATION,
75+
TOMCAT_MANAGER_APP_PATTERN,
76+
TOMCAT_HOST_MANAGER_APP_PATTERN,
8277
LISTINGS_PATTERN,
8378
SESSION_TIMEOUT_START_TAG,
8479
SECURITY_CONSTRAINT_START_TAG)
@@ -150,8 +145,11 @@ private void checkWebXmlVulnerabilities(@Nonnull Path path, AgentSpan span) {
150145
case DEFAULT_HTML_ESCAPE:
151146
defaultHtmlEscapeIndex = matcher.start();
152147
break;
153-
case TOMCAT_MANAGER_APPLICATION:
154-
reportAdminConsoleActive(span);
148+
case TOMCAT_MANAGER_APP_PATTERN:
149+
reportAdminConsoleActive(span, TOMCAT_MANAGER_APP);
150+
break;
151+
case TOMCAT_HOST_MANAGER_APP_PATTERN:
152+
reportAdminConsoleActive(span, TOMCAT_HOST_MANAGER_APP);
155153
break;
156154
case LISTINGS_PATTERN:
157155
checkDirectoryListingLeak(webXmlContent, matcher.start(), span);
@@ -196,14 +194,14 @@ private void checkDefaultHtmlEscapeInvalid(
196194
}
197195
}
198196

199-
private void reportAdminConsoleActive(AgentSpan span) {
197+
private void reportAdminConsoleActive(AgentSpan span, final String evidence) {
200198
// No deduplication is needed as same service can have multiple applications
201199
reporter.report(
202200
span,
203201
new Vulnerability(
204202
VulnerabilityType.ADMIN_CONSOLE_ACTIVE,
205203
Location.forSpan(span),
206-
new Evidence("Tomcat Manager Application")));
204+
new Evidence(evidence)));
207205
}
208206

209207
private void checkDirectoryListingLeak(

‎dd-java-agent/agent-iast/src/test/groovy/com/datadog/iast/sink/ApplicationModuleTest.groovy‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,8 @@ class ApplicationModuleTest extends IastModuleImplTestBase {
6666
'application/directorylistingleak/secure' | null | null | _
6767
'application/directorylistingleak/insecure' | DIRECTORY_LISTING_LEAK | 'Directory listings configured' | 14
6868
'application/adminconsoleactive/secure' | null | null | _
69-
'application/adminconsoleactive/insecure' | ADMIN_CONSOLE_ACTIVE | 'Tomcat Manager Application' | NO_LINE
69+
'application/adminconsoleactive/insecure/tomcat/manager' | ADMIN_CONSOLE_ACTIVE | 'Tomcat Manager Application' | NO_LINE
70+
'application/adminconsoleactive/insecure/tomcat/host' | ADMIN_CONSOLE_ACTIVE | ApplicationModuleImpl.TOMCAT_HOST_MANAGER_APP | NO_LINE
7071
'application/defaulthtmlescapeinvalid/secure' | null | null | _
7172
'application/defaulthtmlescapeinvalid/secure_tag' | null | null | _
7273
'application/defaulthtmlescapeinvalid/false_tag' | DEFAULT_HTML_ESCAPE_INVALID | 'defaultHtmlEscape tag should be true' | 8

‎dd-java-agent/agent-iast/src/test/resources/application/adminconsoleactive/insecure/WEB-INF/web.xml‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎dd-java-agent/agent-iast/src/test/resources/application/adminconsoleactive/insecure/tomcat/host/WEB-INF/web.xml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
19+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
20+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
21+
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
22+
version="4.0"
23+
metadata-complete="true">
24+
25+
<display-name>Tomcat Host Manager Application</display-name>
26+
27+
</web-app>

‎dd-java-agent/agent-iast/src/test/resources/application/adminconsoleactive/insecure/tomcat/manager/WEB-INF/web.xml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
19+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
20+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
21+
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
22+
version="4.0"
23+
metadata-complete="true">
24+
25+
<display-name>Tomcat Manager Application</display-name>
26+
27+
</web-app>

0 commit comments

Comments
 (0)