Skip to content

Commit

Permalink
RASP SQLi: enhance test & activate for Go (#2574)
Browse files Browse the repository at this point in the history
  • Loading branch information
@Hellzy
Hellzy authored Jun 24, 2024
1 parent 8996a42 commit b803a4e
Show file tree
Hide file tree
Showing 9 changed files with 70 additions and 37 deletions.
6 changes: 5 additions & 1 deletion manifests/golang.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -120,7 +120,11 @@ tests/:
rasp/:
test_lfi.py: missing_feature
test_span_tags.py: missing_feature
test_sqli.py: missing_feature
test_sqli.py:
Test_Sqli_BodyJson: v1.66.0-dev
Test_Sqli_BodyUrlEncoded: v1.66.0-dev
Test_Sqli_BodyXml: v1.66.0-dev
Test_Sqli_UrlQuery: v1.66.0-dev
test_ssrf.py:
Test_Ssrf_BodyJson: v1.65.1-rc.1
Test_Ssrf_BodyUrlEncoded: v1.65.1-rc.1
Expand Down
8 changes: 4 additions & 4 deletions tests/appsec/rasp/test_sqli.py
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ def test_sqli_get(self):
self.r,
"rasp-942-100",
{
"resource": {"address": "server.db.statement", "value": "SELECT * FROM table WHERE ? OR ? = ? --;"},
"resource": {"address": "server.db.statement", "value": "SELECT * FROM users WHERE ? OR ? = ? --"},
"params": {"address": "server.request.query", "value": "' OR 1 = 1 --"},
"db_type": {"address": "server.db.system"},
},
Expand All @@ -44,7 +44,7 @@ def test_sqli_post_urlencoded(self):
self.r,
"rasp-942-100",
{
"resource": {"address": "server.db.statement", "value": "SELECT * FROM table WHERE ? OR ? = ? --;"},
"resource": {"address": "server.db.statement", "value": "SELECT * FROM users WHERE ? OR ? = ? --"},
"params": {"address": "server.request.body", "value": "' OR 1 = 1 --"},
"db_type": {"address": "server.db.system"},
},
Expand All @@ -68,7 +68,7 @@ def test_sqli_post_xml(self):
self.r,
"rasp-942-100",
{
"resource": {"address": "server.db.statement", "value": "SELECT * FROM table WHERE ? OR ? = ? --;"},
"resource": {"address": "server.db.statement", "value": "SELECT * FROM users WHERE ? OR ? = ? --"},
"params": {"address": "server.request.body", "value": "' OR 1 = 1 --"},
"db_type": {"address": "server.db.system"},
},
Expand All @@ -92,7 +92,7 @@ def test_sqli_post_json(self):
self.r,
"rasp-942-100",
{
"resource": {"address": "server.db.statement", "value": "SELECT * FROM table WHERE ? OR ? = ? --;"},
"resource": {"address": "server.db.statement", "value": "SELECT * FROM users WHERE ? OR ? = ? --"},
"params": {"address": "server.request.body", "value": "' OR 1 = 1 --"},
"db_type": {"address": "server.db.system"},
},
Expand Down
7 changes: 3 additions & 4 deletions utils/build/docker/golang/app/go.mod
View file
Original file line number Diff line number Diff line change
Expand Up @@ -95,14 +95,13 @@ require (
go.uber.org/atomic v1.11.0 // indirect
golang.org/x/arch v0.4.0 // indirect
golang.org/x/crypto v0.21.0 // indirect
golang.org/x/mod v0.12.0 // indirect
golang.org/x/mod v0.14.0 // indirect
golang.org/x/net v0.23.0 // indirect
golang.org/x/sync v0.4.0 // indirect
golang.org/x/sys v0.20.0 // indirect
golang.org/x/text v0.14.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.12.1-0.20230815132531-74c255bcf846 // indirect
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 // indirect
golang.org/x/tools v0.16.1 // indirect
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
)
15 changes: 7 additions & 8 deletions utils/build/docker/golang/app/go.sum
View file
Original file line number Diff line number Diff line change
Expand Up @@ -272,8 +272,8 @@ golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOM
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.7.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.12.0 h1:rmsUpXtvNzj340zd98LZ4KntptpfRHwpFOHG188oHXc=
golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
Expand All @@ -289,8 +289,7 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.4.0 h1:zxkM55ReGkDlKSM+Fu41A+zmbZuaPVbGMzvvdUPznYQ=
golang.org/x/sync v0.4.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
golang.org/x/sync v0.5.0 h1:60k92dhOjHxJkrqnwsfl8KuaHbn/5dl0lUPUklKo3qE=
golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
Expand Down Expand Up @@ -330,14 +329,14 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
golang.org/x/tools v0.1.1/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk=
golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
golang.org/x/tools v0.4.0/go.mod h1:UE5sM2OK9E/d67R0ANs2xJizIymRP5gJU295PvKXxjQ=
golang.org/x/tools v0.12.1-0.20230815132531-74c255bcf846 h1:Vve/L0v7CXXuxUmaMGIEK/dEeq7uiqb5qBgQrZzIE7E=
golang.org/x/tools v0.12.1-0.20230815132531-74c255bcf846/go.mod h1:Sc0INKfu04TlqNoRA1hgpFZbhYXHPr4V5DzpSBTPqQM=
golang.org/x/tools v0.16.1 h1:TLyB3WofjdOEepBHAU20JdNC1Zbg87elYofWYAY5oZA=
golang.org/x/tools v0.16.1/go.mod h1:kYVVN6I1mBNoB1OX+noeBjbRk4IUEPa7JJ+TJMEooJ0=
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2 h1:H2TDz8ibqkAF6YGhCdN3jS9O0/s90v0rJh3X/OLHEUk=
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2/go.mod h1:K8+ghG5WaK9qNqU5K3HdILfMLy1f3aNYFI/wnl100a8=
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 h1:+cNy6SZtPcJQH3LJVLOSmiC7MMxXNOb3PU/VUEz+EhU=
golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028/go.mod h1:NDW/Ps6MPRej6fsCIbMTohpP40sJ/P/vI1MoTEGwX90=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc h1:XSJ8Vk1SWuNr8S18z1NZSziL0CPIXLCCMDOEFtHBOFc=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:66JfowdXAEgad5O9NnYcsNPLCPZJD++2L9X0PCMODrA=
google.golang.org/grpc v1.57.1 h1:upNTNqv0ES+2ZOOqACwVtS3Il8M12/+Hz41RCPzAjQg=
Expand Down
16 changes: 8 additions & 8 deletions utils/build/docker/golang/app/internal/rasp/rasp.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -4,14 +4,15 @@ import (
"encoding/json"
"encoding/xml"
"errors"
"github.com/mattn/go-sqlite3"
"gopkg.in/DataDog/dd-trace-go.v1/appsec"
"gopkg.in/DataDog/dd-trace-go.v1/appsec/events"
"gopkg.in/DataDog/dd-trace-go.v1/contrib/database/sql"
httptrace "gopkg.in/DataDog/dd-trace-go.v1/contrib/net/http"
"log"
"net/http"
"os"

_ "github.com/mattn/go-sqlite3"
"gopkg.in/DataDog/dd-trace-go.v1/appsec"
"gopkg.in/DataDog/dd-trace-go.v1/appsec/events"
sqltrace "gopkg.in/DataDog/dd-trace-go.v1/contrib/database/sql"
httptrace "gopkg.in/DataDog/dd-trace-go.v1/contrib/net/http"
)

func parseRASPRequest(r *http.Request, key string) string {
Expand Down Expand Up @@ -106,8 +107,7 @@ func SQLi(w http.ResponseWriter, r *http.Request) {
return
}

sql.Register("sqlite3", &sqlite3.SQLiteDriver{})
db, err := sql.Open("sqlite3", ":memory:")
db, err := sqltrace.Open("sqlite3", ":memory:")
if err != nil {
w.WriteHeader(500)
log.Fatalln(err.Error())
Expand All @@ -120,7 +120,7 @@ func SQLi(w http.ResponseWriter, r *http.Request) {
log.Fatalln(err.Error())
}

_, err = db.Exec("SELECT * FROM users WHERE name = '" +sqli+"'")
_, err = db.ExecContext(r.Context(), "SELECT * FROM users WHERE '"+sqli)
if events.IsSecurityError(err) {
return
}
Expand Down
Loading

0 comments on commit b803a4e

Please sign in to comment.