Skip to content

Commit e1e520f

Browse files
jandro996jandro996
committed
Add new Default app deployed vulnerability for Tomcat and Jetty
1 parent 7a54b98 commit e1e520f

File tree

13 files changed

+175
-2
lines changed

13 files changed

+175
-2
lines changed

‎dd-java-agent/agent-iast/src/main/java/com/datadog/iast/model/VulnerabilityType.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ public interface VulnerabilityType {
8989
VulnerabilityType SESSION_REWRITING =
9090
new ServiceVulnerabilityType(VulnerabilityTypes.SESSION_REWRITING);
9191

92+
VulnerabilityType DEFAULT_APP_DEPLOYED =
93+
new ServiceVulnerabilityType(VulnerabilityTypes.DEFAULT_APP_DEPLOYED);
94+
9295
String name();
9396

9497
/** A bit flag to ignore tainted ranges for this vulnerability. Set to 0 if none. */

‎dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/ApplicationModuleImpl.java‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,27 @@ public class ApplicationModuleImpl extends SinkModuleBase implements Application
6868
static final String TOMCAT_HOST_MANAGER_APP = "Tomcat Host Manager Application";
6969
private static final String TOMCAT_HOST_MANAGER_APP_PATTERN =
7070
DISPLAY_NAME_START_TAG + TOMCAT_HOST_MANAGER_APP + DISPLAY_NAME_END_TAG;
71+
static final String TOMCAT_SAMPLES_APP = "Servlet and JSP Examples";
72+
private static final String TOMCAT_SAMPLES_APP_PATTERN =
73+
DISPLAY_NAME_START_TAG + TOMCAT_SAMPLES_APP + DISPLAY_NAME_END_TAG;
74+
static final String JETTY_ASYNC_REST_APP = "Async REST Webservice Example";
75+
private static final String JETTY_ASYNC_REST_APP_PATTERN =
76+
DISPLAY_NAME_START_TAG + JETTY_ASYNC_REST_APP + DISPLAY_NAME_END_TAG;
77+
static final String JETTY_JAVADOC_APP = "Transparent Proxy WebApp";
78+
private static final String JETTY_JAVADOC_APP_PATTERN =
79+
DISPLAY_NAME_START_TAG + JETTY_JAVADOC_APP + DISPLAY_NAME_END_TAG;
80+
static final String JETTY_JAAS_APP = "JAAS Test";
81+
private static final String JETTY_JAAS_APP_PATTERN =
82+
DISPLAY_NAME_START_TAG + JETTY_JAAS_APP + DISPLAY_NAME_END_TAG;
83+
static final String JETTY_JNDI_APP = "Test JNDI WebApp";
84+
private static final String JETTY_JNDI_APP_PATTERN =
85+
DISPLAY_NAME_START_TAG + JETTY_JNDI_APP + DISPLAY_NAME_END_TAG;
86+
static final String JETTY_SPEC_APP = "Test Annotations WebApp";
87+
private static final String JETTY_SPEC_APP_PATTERN =
88+
DISPLAY_NAME_START_TAG + JETTY_SPEC_APP + DISPLAY_NAME_END_TAG;
89+
static final String JETTY_TEST_APP = "Test WebApp";
90+
private static final String JETTY_TEST_APP_PATTERN =
91+
DISPLAY_NAME_START_TAG + JETTY_TEST_APP + DISPLAY_NAME_END_TAG;
7192
public static final String WEB_INF = "WEB-INF";
7293
public static final String WEB_XML = "web.xml";
7394
public static final String WEBLOGIC_XML = "weblogic.xml";
@@ -83,6 +104,13 @@ public class ApplicationModuleImpl extends SinkModuleBase implements Application
83104
DEFAULT_HTML_ESCAPE,
84105
TOMCAT_MANAGER_APP_PATTERN,
85106
TOMCAT_HOST_MANAGER_APP_PATTERN,
107+
TOMCAT_SAMPLES_APP_PATTERN,
108+
JETTY_ASYNC_REST_APP_PATTERN,
109+
JETTY_JAVADOC_APP_PATTERN,
110+
JETTY_JAAS_APP_PATTERN,
111+
JETTY_JNDI_APP_PATTERN,
112+
JETTY_SPEC_APP_PATTERN,
113+
JETTY_TEST_APP_PATTERN,
86114
LISTINGS_PATTERN,
87115
JETTY_LISTINGS_PATTERN,
88116
SESSION_TIMEOUT_START_TAG,
@@ -212,6 +240,27 @@ private void checkWebXmlVulnerabilities(@Nonnull Path path, AgentSpan span) {
212240
case TOMCAT_HOST_MANAGER_APP_PATTERN:
213241
reportAdminConsoleActive(span, TOMCAT_HOST_MANAGER_APP);
214242
break;
243+
case TOMCAT_SAMPLES_APP_PATTERN:
244+
reportDefaultAppDeployed(span, TOMCAT_SAMPLES_APP);
245+
break;
246+
case JETTY_ASYNC_REST_APP_PATTERN:
247+
reportDefaultAppDeployed(span, JETTY_ASYNC_REST_APP);
248+
break;
249+
case JETTY_JAVADOC_APP_PATTERN:
250+
reportDefaultAppDeployed(span, JETTY_JAVADOC_APP);
251+
break;
252+
case JETTY_JAAS_APP_PATTERN:
253+
reportDefaultAppDeployed(span, JETTY_JAAS_APP);
254+
break;
255+
case JETTY_JNDI_APP_PATTERN:
256+
reportDefaultAppDeployed(span, JETTY_JNDI_APP);
257+
break;
258+
case JETTY_SPEC_APP_PATTERN:
259+
reportDefaultAppDeployed(span, JETTY_SPEC_APP);
260+
break;
261+
case JETTY_TEST_APP_PATTERN:
262+
reportDefaultAppDeployed(span, JETTY_TEST_APP);
263+
break;
215264
case LISTINGS_PATTERN:
216265
case JETTY_LISTINGS_PATTERN:
217266
checkDirectoryListingLeak(webXmlContent, matcher.start(), span);
@@ -266,6 +315,15 @@ private void reportAdminConsoleActive(AgentSpan span, final String evidence) {
266315
new Evidence(evidence)));
267316
}
268317

318+
private void reportDefaultAppDeployed(final AgentSpan span, final String evidence) {
319+
reporter.noDedupReport(
320+
span,
321+
new Vulnerability(
322+
VulnerabilityType.DEFAULT_APP_DEPLOYED,
323+
Location.forSpan(span),
324+
new Evidence(evidence)));
325+
}
326+
269327
private void checkDirectoryListingLeak(
270328
final String webXmlContent, int index, final AgentSpan span) {
271329
int valueIndex =

‎dd-java-agent/agent-iast/src/test/groovy/com/datadog/iast/sink/ApplicationModuleTest.groovy‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import datadog.trace.api.iast.InstrumentationBridge
88
import datadog.trace.api.iast.sink.ApplicationModule
99

1010
import static com.datadog.iast.model.VulnerabilityType.ADMIN_CONSOLE_ACTIVE
11+
import static com.datadog.iast.model.VulnerabilityType.DEFAULT_APP_DEPLOYED
1112
import static com.datadog.iast.model.VulnerabilityType.DEFAULT_HTML_ESCAPE_INVALID
1213
import static com.datadog.iast.model.VulnerabilityType.DIRECTORY_LISTING_LEAK
1314
import static com.datadog.iast.model.VulnerabilityType.INSECURE_JSP_LAYOUT
@@ -71,6 +72,14 @@ class ApplicationModuleTest extends IastModuleImplTestBase {
7172
'noDedupReport' | 'application/adminconsoleactive/secure' | null | null | _
7273
'noDedupReport' | 'application/adminconsoleactive/insecure/tomcat/manager' | ADMIN_CONSOLE_ACTIVE | ApplicationModuleImpl.TOMCAT_MANAGER_APP | NO_LINE
7374
'noDedupReport' | 'application/adminconsoleactive/insecure/tomcat/host' | ADMIN_CONSOLE_ACTIVE | ApplicationModuleImpl.TOMCAT_HOST_MANAGER_APP | NO_LINE
75+
'noDedupReport' | 'application/defaultappdeployed/secure' | null | null | _
76+
'noDedupReport' | 'application/defaultappdeployed/insecure/tomcat/samples' | DEFAULT_APP_DEPLOYED | ApplicationModuleImpl.TOMCAT_SAMPLES_APP | NO_LINE
77+
'noDedupReport' | 'application/defaultappdeployed/insecure/jetty/async' | DEFAULT_APP_DEPLOYED | ApplicationModuleImpl.JETTY_ASYNC_REST_APP | NO_LINE
78+
'noDedupReport' | 'application/defaultappdeployed/insecure/jetty/jaas' | DEFAULT_APP_DEPLOYED | ApplicationModuleImpl.JETTY_JAAS_APP | NO_LINE
79+
'noDedupReport' | 'application/defaultappdeployed/insecure/jetty/javadoc' | DEFAULT_APP_DEPLOYED | ApplicationModuleImpl.JETTY_JAVADOC_APP | NO_LINE
80+
'noDedupReport' | 'application/defaultappdeployed/insecure/jetty/jndi' | DEFAULT_APP_DEPLOYED | ApplicationModuleImpl.JETTY_JNDI_APP | NO_LINE
81+
'noDedupReport' | 'application/defaultappdeployed/insecure/jetty/spec' | DEFAULT_APP_DEPLOYED | ApplicationModuleImpl.JETTY_SPEC_APP | NO_LINE
82+
'noDedupReport' | 'application/defaultappdeployed/insecure/jetty/test' | DEFAULT_APP_DEPLOYED | ApplicationModuleImpl.JETTY_TEST_APP | NO_LINE
7483
'report' | 'application/defaulthtmlescapeinvalid/secure' | null | null | _
7584
'report' | 'application/defaulthtmlescapeinvalid/secure_tag' | null | null | _
7685
'report' | 'application/defaulthtmlescapeinvalid/false_tag' | DEFAULT_HTML_ESCAPE_INVALID | 'defaultHtmlEscape tag should be true' | 8

‎dd-java-agent/agent-iast/src/test/resources/application/defaultappdeployed/insecure/jetty/async/WEB-INF/web.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<?xml version="1.0"?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
5+
version="3.1">
6+
7+
<display-name>Async REST Webservice Example</display-name>
8+
9+
</web-app>

‎dd-java-agent/agent-iast/src/test/resources/application/defaultappdeployed/insecure/jetty/jaas/WEB-INF/web.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<web-app
2+
xmlns="http://java.sun.com/xml/ns/javaee"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
5+
version="2.5">
6+
7+
<display-name>JAAS Test</display-name>
8+
9+
</web-app>

‎dd-java-agent/agent-iast/src/test/resources/application/defaultappdeployed/insecure/jetty/javadoc/WEB-INF/web.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns="http://java.sun.com/xml/ns/javaee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" metadata-complete="false" version="3.0">
3+
4+
<display-name>Transparent Proxy WebApp</display-name>
5+
6+
</web-app>

‎dd-java-agent/agent-iast/src/test/resources/application/defaultappdeployed/insecure/jetty/jndi/WEB-INF/web.xml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app
3+
xmlns="http://java.sun.com/xml/ns/javaee"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
6+
metadata-complete="true"
7+
version="2.5">
8+
9+
<display-name>Test JNDI WebApp</display-name>
10+
11+
12+
</web-app>
13+
14+

‎dd-java-agent/agent-iast/src/test/resources/application/defaultappdeployed/insecure/jetty/spec/WEB-INF/web.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app
3+
xmlns="http://xmlns.jcp.org/xml/ns/javaee"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
6+
metadata-complete="false"
7+
version="3.1">
8+
9+
<display-name>Test Annotations WebApp</display-name>
10+
11+
</web-app>

‎dd-java-agent/agent-iast/src/test/resources/application/defaultappdeployed/insecure/jetty/test/WEB-INF/web.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app
3+
xmlns="http://xmlns.jcp.org/xml/ns/javaee"
4+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
6+
metadata-complete="false"
7+
version="3.1">
8+
9+
<display-name>Test WebApp</display-name>
10+
11+
</web-app>
12+
13+

‎dd-java-agent/agent-iast/src/test/resources/application/defaultappdeployed/insecure/tomcat/samples/WEB-INF/web.xml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Licensed to the Apache Software Foundation (ASF) under one or more
4+
contributor license agreements. See the NOTICE file distributed with
5+
this work for additional information regarding copyright ownership.
6+
The ASF licenses this file to You under the Apache License, Version 2.0
7+
(the "License"); you may not use this file except in compliance with
8+
the License. You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
-->
18+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
19+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
20+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
21+
http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
22+
version="4.0"
23+
metadata-complete="true">
24+
25+
<description>
26+
Servlet and JSP Examples.
27+
</description>
28+
<display-name>Servlet and JSP Examples</display-name>
29+
30+
</web-app>

0 commit comments

Comments
 (0)