Skip to content

Commit 449d681

Browse files
jandro996jandro996
committed
Fix org.json iast instrumentation test for latest dependency
1 parent added74 commit 449d681

File tree

6 files changed

+55
-133
lines changed

6 files changed

+55
-133
lines changed

‎dd-java-agent/instrumentation/org-json/build.gradle

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,5 +18,5 @@ dependencies {
1818
testRuntimeOnly project(':dd-java-agent:instrumentation:iast-instrumenter')
1919

2020
//FIXME: ASM
21-
latestDepTestImplementation group: 'org.json', name: 'json', version: '20240303'
21+
latestDepTestImplementation group: 'org.json', name: 'json', version: '+'
2222
}

‎dd-java-agent/instrumentation/org-json/gradle.lockfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ org.hamcrest:hamcrest-core:1.3=latestDepTestCompileClasspath,latestDepTestRuntim
116116
org.hamcrest:hamcrest:2.2=latestDepTestCompileClasspath,latestDepTestRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
117117
org.jctools:jctools-core:3.3.0=instrumentPluginClasspath,latestDepTestRuntimeClasspath,muzzleTooling,runtimeClasspath,testRuntimeClasspath
118118
org.json:json:20230227=compileClasspath,testCompileClasspath,testRuntimeClasspath
119-
org.json:json:20240303=latestDepTestCompileClasspath,latestDepTestRuntimeClasspath
119+
org.json:json:20250107=latestDepTestCompileClasspath,latestDepTestRuntimeClasspath
120120
org.junit.jupiter:junit-jupiter-api:5.9.2=latestDepTestCompileClasspath,latestDepTestRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
121121
org.junit.jupiter:junit-jupiter-engine:5.9.2=latestDepTestRuntimeClasspath,testRuntimeClasspath
122122
org.junit.platform:junit-platform-commons:1.9.2=latestDepTestCompileClasspath,latestDepTestRuntimeClasspath,testCompileClasspath,testRuntimeClasspath

‎dd-java-agent/instrumentation/org-json/src/main/java/datadog/trace/instrumentation/json/JSONArrayInstrumentation.java

-27
Original file line numberDiff line numberDiff line change
@@ -35,13 +35,6 @@ public void methodAdvice(MethodTransformer transformer) {
3535
transformer.applyAdvice(
3636
isConstructor().and(takesArguments(String.class)),
3737
getClass().getName() + "$ConstructorAdvice");
38-
transformer.applyAdvice(
39-
isMethod()
40-
.and(isPublic())
41-
.and(returns(Object.class))
42-
.and(named("get"))
43-
.and(takesArguments(1)),
44-
getClass().getName() + "$GetAdvice");
4538
transformer.applyAdvice(
4639
isMethod().and(isPublic()).and(returns(Object.class)).and(named("opt")),
4740
getClass().getName() + "$OptAdvice");
@@ -58,26 +51,6 @@ public static void afterInit(@Advice.This Object self, @Advice.Argument(0) final
5851
}
5952
}
6053

61-
public static class GetAdvice {
62-
@Advice.OnMethodExit(suppress = Throwable.class)
63-
@Propagation
64-
public static void afterMethod(@Advice.This Object self, @Advice.Return final Object result) {
65-
boolean isString = result instanceof String;
66-
boolean isJson = !isString && (result instanceof JSONObject || result instanceof JSONArray);
67-
if (!isString && !isJson) {
68-
return;
69-
}
70-
final PropagationModule iastModule = InstrumentationBridge.PROPAGATION;
71-
if (iastModule != null) {
72-
if (isString) {
73-
iastModule.taintStringIfTainted((String) result, self);
74-
} else {
75-
iastModule.taintObjectIfTainted(result, self);
76-
}
77-
}
78-
}
79-
}
80-
8154
public static class OptAdvice {
8255
@Advice.OnMethodExit(suppress = Throwable.class)
8356
@Propagation

‎dd-java-agent/instrumentation/org-json/src/main/java/datadog/trace/instrumentation/json/JSONObjectInstrumentation.java

-27
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,6 @@ public String instrumentedType() {
3333
public void methodAdvice(MethodTransformer transformer) {
3434
transformer.applyAdvice(
3535
isConstructor().and(takesArguments(1)), getClass().getName() + "$ConstructorAdvice");
36-
transformer.applyAdvice(
37-
isMethod()
38-
.and(isPublic())
39-
.and(returns(Object.class))
40-
.and(named("get"))
41-
.and(takesArguments(String.class)),
42-
getClass().getName() + "$GetAdvice");
4336
transformer.applyAdvice(
4437
isMethod()
4538
.and(isPublic())
@@ -60,26 +53,6 @@ public static void afterInit(@Advice.This Object self, @Advice.Argument(0) final
6053
}
6154
}
6255

63-
public static class GetAdvice {
64-
@Advice.OnMethodExit(suppress = Throwable.class)
65-
@Propagation
66-
public static void afterMethod(@Advice.This Object self, @Advice.Return final Object result) {
67-
boolean isString = result instanceof String;
68-
boolean isJson = !isString && (result instanceof JSONObject || result instanceof JSONArray);
69-
if (!isString && !isJson) {
70-
return;
71-
}
72-
final PropagationModule iastModule = InstrumentationBridge.PROPAGATION;
73-
if (iastModule != null) {
74-
if (isString) {
75-
iastModule.taintStringIfTainted((String) result, self);
76-
} else {
77-
iastModule.taintObjectIfTainted(result, self);
78-
}
79-
}
80-
}
81-
}
82-
8356
public static class OptAdvice {
8457
@Advice.OnMethodExit(suppress = Throwable.class)
8558
@Propagation

‎dd-java-agent/instrumentation/org-json/src/test/groovy/JSONArrayInstrumentationTest.groovy

+27-34
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,16 @@ import org.json.JSONTokener
77

88
class JSONArrayInstrumentationTest extends AgentTestRunner {
99

10+
private static json = """{"menu": {
11+
"name": "nameTest",
12+
"value": "File",
13+
"popup": "Popup",
14+
"labels": [
15+
"File",
16+
"Edit"
17+
]
18+
}}"""
19+
1020
@Override
1121
void configurePreAgent() {
1222
injectSysConfig("dd.iast.enabled", "true")
@@ -16,57 +26,40 @@ class JSONArrayInstrumentationTest extends AgentTestRunner {
1626
given:
1727
final module = Mock(PropagationModule)
1828
InstrumentationBridge.registerIastModule(module)
19-
final json = """{"menu": {
20-
"name": "nameTest",
21-
"value": "File",
22-
"popup": "Popup",
23-
"labels": [
24-
"File",
25-
"Edit"
26-
]
27-
}}"""
29+
final jsonObject = new JSONObject(json)
30+
final menuObject = jsonObject.getJSONObject("menu")
2831

2932
when:
30-
final jsonObject = new JSONObject(json)
31-
final name = jsonObject.getJSONObject("menu").getJSONArray("labels").get(0)
33+
final array = menuObject.getJSONArray("labels")
3234

3335
then:
34-
name == "File"
35-
1 * module.taintObjectIfTainted(_ as JSONObject, json)
36-
2 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONTokener)
37-
2 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONObject)
38-
1 * module.taintObjectIfTainted(_ as JSONTokener, json)
39-
2 * module.taintObjectIfTainted(_ as JSONArray, _ as JSONObject)
40-
2 * module.taintStringIfTainted("File", _ as JSONArray)
36+
array.length() == 2
37+
array.get(0) == "File"
38+
array.get(1) == "Edit"
39+
1 * module.taintObjectIfTainted(_ as JSONArray, _ as JSONObject)
4140
0 * _
4241
}
4342

4443
void 'test JSONObject returning an array and calling opt on it'() {
4544
given:
4645
final module = Mock(PropagationModule)
4746
InstrumentationBridge.registerIastModule(module)
48-
final json = """{"menu": {
49-
"name": "nameTest",
50-
"value": "File",
51-
"popup": "Popup",
52-
"labels": [
53-
"File",
54-
"Edit"
55-
]
56-
}}"""
47+
final jsonObject = new JSONObject(json)
48+
final jsonArray =jsonObject.getJSONObject("menu").getJSONArray("labels")
5749

5850
when:
59-
final jsonObject = new JSONObject(json)
60-
final name = jsonObject.getJSONObject("menu").getJSONArray("labels").optString(0, "defaultvalue")
51+
final name = jsonArray.optString(0, "defaultvalue")
6152

6253
then:
6354
name == "File"
64-
1 * module.taintObjectIfTainted(_ as JSONObject, json)
65-
2 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONTokener)
66-
2 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONObject)
67-
1 * module.taintObjectIfTainted(_ as JSONTokener, json)
68-
2 * module.taintObjectIfTainted(_ as JSONArray, _ as JSONObject)
6955
1 * module.taintStringIfTainted("File", _ as JSONArray)
7056
0 * _
57+
58+
where:
59+
method | arguments
60+
"opt" | [0]
61+
"optString" | [0, "defaultvalue"]
62+
"get" | [0]
63+
"getString" | [0, "defaultvalue"]
7164
}
7265
}

‎dd-java-agent/instrumentation/org-json/src/test/groovy/JSONObjectInstrumentationTest.groovy

+26-43
Original file line numberDiff line numberDiff line change
@@ -25,83 +25,66 @@ class JSONObjectInstrumentationTest extends AgentTestRunner {
2525
}}"""
2626

2727
when:
28-
final jsonObject = new JSONObject(json)
29-
final name = jsonObject.getJSONObject("menu").get("name")
28+
new JSONObject(json)
3029

3130
then:
32-
name == "nameTest"
3331
1 * module.taintObjectIfTainted(_ as JSONObject, json)
34-
2 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONTokener)
35-
2 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONObject)
3632
1 * module.taintObjectIfTainted(_ as JSONTokener, json)
37-
2 * module.taintStringIfTainted("nameTest", _ as JSONObject)
3833
0 * _
3934
}
4035

41-
void 'test JSONObject opt'() {
36+
void 'test JSONObject JSonTokenizer constructor'() {
4237
given:
4338
final module = Mock(PropagationModule)
4439
InstrumentationBridge.registerIastModule(module)
45-
final json = """{"menu": {
46-
"name": "nameTest",
47-
"value": "File",
48-
"popup": "Popup",
49-
"labels": [
50-
"File",
51-
"Edit"
52-
]
53-
}}"""
40+
final json = '{"name": "nameTest", "value" : "valueTest"}'
41+
final jsonTokener = new JSONTokener(json)
5442

5543
when:
56-
final jsonObject = new JSONObject(json)
57-
final name = jsonObject.getJSONObject("menu").optString("name")
44+
new JSONObject(jsonTokener)
5845

5946
then:
60-
name == "nameTest"
61-
1 * module.taintObjectIfTainted(_ as JSONObject, json)
62-
2 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONTokener)
63-
2 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONObject)
64-
1 * module.taintObjectIfTainted(_ as JSONTokener, json)
65-
1 * module.taintStringIfTainted("nameTest", _ as JSONObject)
47+
1 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONTokener)
6648
0 * _
6749
}
6850

69-
70-
71-
void 'test JSONObject JSonTokenizer constructor'() {
51+
void 'test JSONObject map constructor'(){
7252
given:
53+
final Map<String, String> map = new HashMap<>()
54+
map.put("name", "nameTest")
55+
map.put("age", "22")
56+
map.put("city", "chicago")
7357
final module = Mock(PropagationModule)
7458
InstrumentationBridge.registerIastModule(module)
75-
final json = '{"name": "nameTest", "value" : "valueTest"}'
7659

7760
when:
78-
final jsonObject = new JSONObject(new JSONTokener(json))
79-
final name = jsonObject.get("name")
61+
new JSONObject(map)
8062

8163
then:
82-
name == "nameTest"
83-
1 * module.taintObjectIfTainted(_ as JSONObject, _ as JSONTokener)
84-
1 * module.taintObjectIfTainted(_ as JSONTokener, json)
85-
2 * module.taintStringIfTainted("nameTest", _ as JSONObject)
64+
1 * module.taintObjectIfTainted(_ as JSONObject, map)
8665
0 * _
8766
}
8867

89-
void 'test JSONObject map constructor'(){
68+
69+
void 'test JSONObject #method'() {
9070
given:
91-
final Map<String, String> map = new HashMap<>()
92-
map.put("name", "nameTest")
93-
map.put("age", "22")
94-
map.put("city", "chicago")
9571
final module = Mock(PropagationModule)
9672
InstrumentationBridge.registerIastModule(module)
73+
final json = """{"menu": {
74+
"name": "nameTest"
75+
}}"""
76+
final jsonObject = new JSONObject(json)
77+
final getObject =jsonObject.getJSONObject("menu")
9778

9879
when:
99-
final jsonObject = new JSONObject(map)
100-
jsonObject.get("name")
80+
final name = getObject."$method"('name')
10181

10282
then:
103-
1 * module.taintObjectIfTainted(_ as JSONObject, map)
104-
2 * module.taintStringIfTainted("nameTest", _ as JSONObject)
83+
name == "nameTest"
84+
1 * module.taintStringIfTainted("nameTest", _ as JSONObject)
10585
0 * _
86+
87+
where:
88+
method << ['get', 'getString', 'opt', 'optString']
10689
}
10790
}

0 commit comments

Comments
 (0)