o
    i{U                  	   @   s$  d dl Z d dlZd dlZd dlmZ d dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dl
mZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlm  m  m  mZ d dlmZ d dlmZ d dl m!Z! d dl"m#Z# d dl$m%Z& e!e'Z(da)dZ*dZ+dd Z,dd Z-dee. de/fddZ0de.de/fdd Z1d!d" Z2d#d$ Z3d%ee4e.e.f  de5e.ee.e6e. f f fd&d'Z7d(d) Z8d*d+ Z9d,d- Z:d.d/ Z;d0d1 Z<d2d3 Z=d4d5 Z>d6d7 Z?d8e.ddfd9d:Z@d;ee6e. e.f ddfd<d=ZAd>d?d@d?dAdBdCdDdEZBdHdFdGZCdS )I    N)Iterable)Union_get_asm_contextcall_waf_callback)get_blocked)EXPLOIT_PREVENTION)WAF_ACTIONS)patch)unpatch)_report_rasp_skipped)
try_unwrap)try_wrap_function_wrapper)core)BlockingException)
get_logger)ModuleWatchdog)configFzrasp_os.system
rasp_Popenc                  C   s   t ddd } trd S tddt tddt tddt td	dt td
dt tddt tddt	 tddt
 tddt t  tdt td dad S )N
subprocessc                 S   s.   t   t tt t tt t	d d S )Nz)Patching common modules: subprocess_patch)
subprocess_patchr   add_str_callback_RASP_SYSTEMwrapped_system_5542593D237084A7add_lst_callback_RASP_POPENpopen_FD233052260D8B4Dlogdebug)module r!   Y/home/ubuntu/.local/lib/python3.10/site-packages/ddtrace/appsec/_common_module_patches.py_$   s   zpatch_common_modules.<locals>._urllib3.connectionpool HTTPConnectionPool._make_requestzHTTPConnectionPool.urlopenurllib3._request_methodsRequestMethods.requesturllib3.requestbuiltinsopenpathlib	Path.openurllib.requestOpenerDirector.openhttp.clientHTTPConnection.requestHTTPConnection.getresponsezasm.block.dbapi.executez4Patching common modules: builtins and urllib.requestT)r   after_module_imported_is_patchedr   wrapped_urllib3_make_requestwrapped_urllib3_urlopen wrapped_request_D8CB81E472AF98A2wrapped_open_CFDDB7ABBA9081B6wrapped_path_open_rasp_lfiwrapped_open_ED4CF71136E15EBFwrapped_requestwrapped_responsepatch_stripe_for_appsecr   onexecute_4C9BAC8E228EB347r   r   )r#   r!   r!   r"   patch_common_modules!   s&   

r?   c                   C   s   t sd S tdd tdd tdd tdd tdd	 td
d tdd tdd tdd tdd t  t  tt tt t	
d da d S )Nr$   r%   r&   r'   r(   r)   r*   r+   r,   r-   r.   r/   r0   r1   _iozBytesIO.readzStringIO.readzAUnpatching common modules subprocess, builtins and urllib.requestF)r3   r   unpatch_stripe_for_appsecr   r   del_str_callbackr   del_lst_callbackr   r   r   r!   r!   r!   r"   unpatch_common_modulesB   s$   












rD   actionsreturnc                 C   s   t dd | D S )Nc                 s   s     | ]}|t jt jfv V  qd S N)r
   BLOCK_ACTIONREDIRECT_ACTION).0actionr!   r!   r"   	<genexpr>]   s    z_must_block.<locals>.<genexpr>)any)rE   r!   r!   r"   _must_block\   s   rN   
capabilityc                 C   sR   t jr't jr'ddlm} | sdS ddlm} |jduo&t|jd|  ddS dS )z(Check if the RASP capability is enabled.r   in_asm_contextF)AppSecSpanProcessorNrasp__enabled)	
asm_config_asm_enabled_ep_enabled#ddtrace.appsec._asm_request_contextrQ   ddtrace.appsec._processorrR   	_instancegetattr)rO   rQ   rR   r!   r!   r"   _get_rasp_capability`   s   r\   c                 C   s,  t drnzddlm} ddlm} W n ty"   | |i | Y S w |r)|d n|dd}zt|}W n tyA   d}Y nw |rn| rg|t	j
j|idt	jjd	}|rft|jrftt t	jt	jj|ntt	jjd
 z| |i |W S  ty }	 z|	jjj}
|	|	jd|
|
j|
jd}	~	ww )z(
    wrapper for open file function
    lfir   r   rP   fileN r7   
crop_trace	rule_typeF)r\   rX   r   rQ   ImportErrorgetosfspath	Exceptionr	   ADDRESSLFITYPErN   rE   r   r   BLOCKINGr   __traceback__tb_framef_backwith_traceback	__class__f_lastif_lineno)original_open_callableinstanceargskwargsr   rQ   filename_argfilenamereseprevious_framer!   r!   r"   r7   p   sF   

r7   c           
      C   s  t drbzddlm} ddlm} W n ty"   | |i | Y S w zt|}W n ty5   d}Y nw |rb| r[|tj	j
|idtjj
d}|rZt|jrZtt tjtjj
|nttjj
d z| |i |W S  ty } z|jjj}	||jd	|	|	j|	jd	}~ww )
z0
    wrapper for pathlib.Path.open() method
    r]   r   r   rP   r_   r8   r`   FN)r\   rX   r   rQ   rc   re   rf   rg   r	   rh   ri   rj   rN   rE   r   r   rk   r   rl   rm   rn   ro   rp   rq   rr   )
original_method_callablert   ru   rv   r   rQ   rx   ry   rz   r{   r!   r!   r"   r8      sD   

r8   lstc                 C   sR   i }| D ]"\}}||v r"|| }t |tr||g||< q|| q|||< q|S rG   )
isinstancestrappend)r}   ry   abvr!   r!   r"   _build_headers   s   

r   c                 C   sN  t d}t }tdr|d ur|d urt dd}t|dkr$|d n|dd }t|dkr4|d n|dd }t|d	krD|d	 n|d
i }	tjj|d|d|	i}
|	dd p_|	dd }|ry|dkryz	t	
||
d< W n	 tyx   Y nw t|
dtjjd}| jd7  _t d |rt|jrtt tjtjj|| |i |S )Nfull_urlssrfuse_bodyFr   method   body   headersDOWN_REQ_METHODDOWN_REQ_HEADERSContent-Typecontent-typeapplication/jsonDOWN_REQ_BODYr9   r`      )r   get_itemr   r\   lenrd   r	   rh   SSRFjsonloadsrg   r   rj   SSRF_REQdownstream_requestsdiscard_itemrN   rE   r   r   rk   )original_request_callablert   ru   rv   r   envr   r   r   r   	addressescontent_typery   r!   r!   r"   r:      s2   
   
r:   c                 C   s   | g ||R  }t  }zBtdrC|jjdkrF|d urI| }d|  kr)dk rLn W |S t|t| d}t|t	j
jd W |S W |S W |S W |S W |S  tyX   Y |S w )Nr   HTTPResponse,    DOWN_RES_STATUSDOWN_RES_HEADERSrb   )r   r\   rp   __name__getcoder   r   
getheadersr   r	   rj   SSRF_RESrg   )original_response_callablert   ru   rv   responser   statusr   r!   r!   r"   r;      s0   	
	r;   c                 C   sf   z(| j r#| jdd dkr&| j }|  }t|| _|| _ t|W S W d S W d S  t	y2   Y d S w )Nr   r   )
lengthr   rd   readioBytesIOfpr   r   rg   )r   r   r   r!   r!   r"   _parse_http_response_body   s   r   c                 C   s  t drzddlm} ddlm} W n ty)   ttjjd | |i | Y S w |r0|d n|	dd}|j
jdkr@| }t|toHt|}|r|rt  }r||}	tjd	||	d
 z?| |i |}
|
j
jdkrd|
j  krxdk sn t|
jt|
 d}|	rt|
|d< ||tjjd |
W W  d   S  ty } zB|j
jdkrz|j}W n ty   d}Y nw z	t|j }W n ty   d}Y nw |dus|dur|t||dtjjd  d}~ww 1 sw   Y  n	|rttjjd | |i |S )z'
    wrapper for open url function
    r   r   r   should_analyze_body_responseTfullurlNRequesturl_open_analysisr   r   r   r   r   r   DOWN_RES_BODYr   	HTTPErrorF)r\   rX   r   r   rc   r   r	   rj   r   rd   rp   r   get_full_urlr~   r   boolr   r   context_with_datar   r   r   r   r   rg   coder   items)rs   rt   ru   rv   r   r   url	valid_urlctxr   r   r   rz   status_coderesponse_headersr!   r!   r"   r9   	  sd   $

r9   c                 C   s"   zt | W S  ty   i  Y S w rG   )dictrg   )r   r!   r!   r"   _parse_headers_urllib3A  s
   
r   c                 C   s  t d}t }tdo|d uo|d u}|rt dd}t|dkr&|d n|dd }t|dkr6|d n|dd }	tt|d	krG|d	 n|d
i }
tjj	|d|d|
i}|
dd pc|
dd }|r}|dkr}z	t
|	|d< W n	 ty|   Y nw t|dtjjd}| jd7  _t d |rt|jrtt tjtjj	|| |i |}z4|r|jjdkrd|j  krdk rn W |S t|j|jd}t|tjjd W |S W |S W |S W |S  ty   Y |S w )Nr   r   r   Fr   r   r   r      r   r   r   r   r   r   r   r6   r`   BaseHTTPResponser   r   r   r   )r   r   r   r\   r   rd   r   r	   rh   r   r   r   rg   r   rj   r   r   r   rN   rE   r   r   rk   rp   r   r   r   r   r   )r   rt   ru   rv   r   r   do_raspr   r   r   r   r   r   ry   r   r!   r!   r"   r4   H  sX   
  $
*				r4   c              	   C   sb   t |dkr
|d n|dd }tdd u rtd| z| |i |W td S td w )Nr   r   r   )r   rd   r   r   set_itemr   )rs   rt   ru   rv   r   r!   r!   r"   r5   o  s    r5   c              	   C   s  t drzddlm} ddlm} ddlm} W n ty/   ttjj	d | |i | Y S w t
|dkr:|d n|dd	}t|toHt|}|r|r|  }	r||	}
tjd
||
dT zJ| |i |}|jjdkrd|j  krxdk sn t|jt|jd}|
rz| |d< W n	 ty   Y nw ||tjjd |W W  d	   S  ty    w 1 sw   Y  n	|rttjj	d | |i |S )z_
    wrapper for third party requests.request function
    https://requests.readthedocs.io
    r   r   r   r   r   Tr   r   Nr   r   Responser   r   r   r   r   F)r\   rX   r   r   r   rc   r   r	   rj   r   r   rd   r~   r   r   r   r   rp   r   r   r   r   r   rg   r   )r   rt   ru   rv   r   r   r   r   r   r   r   r   r   r!   r!   r"   r6   y  sH    $r6   commandc                 C   s   t drSzddlm} ddlm} W n ty#   ttjjd Y dS w | rJ|tj	j| idtjjd}|rFt
|jrHtt tjtjj| dS dS ttjjd	 dS dS )
z(
    wrapper for os.system function
    shir   r   rP   TNr   r`   F)r\   rX   r   rQ   rc   r   r	   rj   SHIrh   rN   rE   r   r   rk   )r   r   rQ   ry   r!   r!   r"   r     s*   
r   arg_listc                 C   s   t dr[zddlm} ddlm} W n ty#   ttjjd Y dS w | rR|tj	jt
| tr2| n| gidtjjd}|rNt|jrPtt tjtjj| dS dS ttjjd	 dS dS )
z-
    listener for subprocess.Popen class
    cmdir   r   rP   TNr   r`   F)r\   rX   r   rQ   rc   r   r	   rj   CMDIrh   r~   listrN   rE   r   r   rk   )r   r   rQ   ry   r!   r!   r"   r     s*   r   mariadbmysql
postgresqlodbcsqlsqlitevertica)r   r   postgrespymysqlpyodbcr   r   r   c                 C   s   t drgzddlm} ddlm} W n
 ty   Y dS w | ri|rkt|trmtt	| di ddd}| r^|t
jj|t
jj|id	t
jjd
}|rZt|jr\tt t
jt
jj|dS dS tt
jjd dS dS dS dS dS )z
    listener for dbapi execute and executemany function
    parameters are ignored as they are properly handled by the dbapi without risk of injections
    sqlir   r   rP   N_self_config_dbapi_span_name_prefixr_   r>   r`   F)r\   rX   r   rQ   rc   r~   r   _DB_DIALECTSrd   r[   r	   rh   SQLI	SQLI_TYPErj   rN   rE   r   r   rk   r   )instrument_selfqueryru   rv   r   rQ   db_typery   r!   r!   r"   r>     s2   r>   )rF   N)Dr   r   re   typingr   r   rX   r   r   r   ddtrace.appsec._constantsr	   r
   $ddtrace.appsec._contrib.stripe.patchr   r<   r   rA   ddtrace.appsec._metricsr   ddtrace.appsec._patch_utilsr   r   )ddtrace.contrib.internal.subprocess.patchcontribinternalr   r   ddtrace.internalr   ddtrace.internal._exceptionsr   ddtrace.internal.loggerr   ddtrace.internal.moduler   ddtrace.internal.settings.asmr   rU   r   r   r3   r   r   r?   rD   r   r   rN   r\   r7   r8   tupler   r   r   r:   r;   r   r9   r   r4   r5   r6   r   r   r   r>   r!   r!   r!   r"   <module>   sh    !+2&8'
+