o
    ia                     @   sB  d dl mZ d dlZd dlmZ d dlmZ d dlmZ d dlm	Z	 d dlm
Z
 d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlm Z  d dl!m"Z" d dl#m$Z% dZ&zd dl'm&Z& W n	 e(y   Y nw e"e)Z*dd Z+dd Z,dd Z-dd Z.d d! Z/dTd#e j0d$e1d%dfd&d'Z2d(d) Z3d*ed+e4ed,f d-e5e6ef d%dfd.d/Z7d0d1 Z8d"e8_9d2d3 Z:d4d5 Z;d6d7 Z<d8d9 Z=d:d; Z>d<d= Z?d>d? Z@d@dA ZAdBdC ZBdDdE ZCdFdG ZDdHdI ZEdJdK ZFdLdM ZGdNdO ZHdPdQ ZIdRdS ZJdS )U    )MutableMappingN)Any)IAST)get_iast_stacktrace_reported)is_iast_request_enabled)set_iast_request_endpoint)set_iast_stacktrace_reported)$iast_instrumentation_wrapt_debug_log)!iast_propagation_listener_log_log)$_set_metric_iast_instrumented_source)WrapFunctonsForIAST)
OriginType)origin_to_str)taint_pyobject)is_pyobject_tainted)taint_dictionary)taint_structure)cmdi_sanitizer)core)
get_logger)config)MessageMapContainerc                 C   s|   | |i | t  r<z!t|jttj|jtjd|_t|jttj|jtjd|_W d S  ty;   t	ddd Y d S w d S Npyobjectsource_namesource_valuesource_origin,Unexpected exception while tainting pyobjectTexc_info)
r   r   query_stringr   r   QUERYpathPATH	Exceptionr
   )wrappedinstanceargskwargs r*   R/home/ubuntu/.local/lib/python3.10/site-packages/ddtrace/appsec/_iast/_handlers.py_on_request_init$   s&   r,   c              	   C   s  t jrzt }|ddtttjtj	f |ddtt
tj	d |ddtt
tj	d ttj ttj	 |ddtt
tjd ttj | dkrW|dd	t ttj ttj |dd
tttjtj |ddtttjtj ttj | dk r|ddtt
tjd ttj |  ttj ttj ttj ttj td W dS  ty   tddd Y dS w dS )zsHandle Flask framework patch event.

    Args:
        flask_version: The version tuple of Flask being patched
    zwerkzeug.datastructureszHeaders.itemszEnvironHeaders.__getitem__FzEnvironHeaders.getzImmutableMultiDict.__getitem__)   r   r   zwerkzeug.wrappers.requestRequest.__init__zRequest.get_datazRequest.get_jsonzwerkzeug._internalz_DictAccessorProperty.__get__zPatching flask correctlyz)Unexpected exception while patching FlaskTr   N)
asm_config_iast_enabledr   wrap_function	functoolspartialif_iast_taint_yield_tuple_forr   HEADER_NAMEHEADER!if_iast_taint_returned_object_forr   	PARAMETERr,   r$   r"   r   BODYpatchPATH_PARAMETERCOOKIE_NAMECOOKIEPARAMETER_NAMEr	   r%   )flask_version
iast_funcsr*   r*   r+   _on_flask_patch8   st   










rA   c                 C   sH   | r"t jr"t s
| S i }|  D ]\}}t|||tjd||< q|S | S Nr   )r/   r0   r   itemsr   r   r;   )r)   _kwargskvr*   r*   r+   _iast_on_wrapped_view   s   

rG   c                 C   s@   t  r| t|d tjtjf|dd   i |S | |i |S )Nr      )r   r   r   r5   r6   )r&   	_instancer(   r)   r*   r*   r+   _on_wsgi_environ   s   ,rJ   c               	   C   s   t jrczOt } | ddtttjd | ddt	 | 
  ttj ttj ttj ttj ttj ttj ttj ttj ttj td W d
S  tyb   tddd	 Y d
S w d
S )z$Handle Django framework patch event.zdjango.http.requestzQueryDict.__getitem__Fzdjango.utils.shlexquotezPatching Django correctlyz*Unexpected exception while patching DjangoTr   N)r/   r0   r   r1   r2   r3   r7   r   r8   r   r:   r   r5   r6   r;   r$   r=   r<   r>   r9   r	   r%   r@   r*   r*   r+   _on_django_patch   s0   








rM   Tctx
call_tracereturnc                 K   s8   t jrt sd S | d}|r|f}t||i  d S d S )Nrequest)r/   r0   r   	find_item_taint_django_func_call)rN   rO   r)   rQ   r(   r*   r*   r+   _on_django_middleware   s   
rT   c                 G   sB   t jr| rt| d |rt sd S t| d | | d S d S d S d S )Nr   )r/   r0   
isinstancer   rS   )fn_args	fn_kwargsfirst_arg_expected_type_r*   r*   r+   _on_django_func_wrapped   s
   rZ   http_reqr(   .r)   c                 C   s2  t | dd }|d urt| j|j t| jtjtj| _t | dd d urTt	| j
dkrTtt | dd sTzt| j
ttj| j
tjd| _
W nQ tyS   tjddd Y nBw t | dd d urtt | dd tst	| jdkrtt | dd szt| jttj| jtjd| _W n ty   td	dd Y nw t| jtjtj| _t| jtjtj| _t| jtjtj| _t| jd
| jtjd| _t| jttj| jtjd| _t| j d ttj| jtjd| j d< t| j!tjtj| _!|rz|" D ]\}}t|||tj#d||< qW d S  t$y   tddd Y d S w d S )Nresolver_match_bodyr   r   r   r   z'IAST can't set attribute http_req._bodyTr   bodyz&IAST can't set attribute http_req.bodyr#   	PATH_INFO3Unexpected exception while tainting path parameters)%getattrr   methodrouter   COOKIESr   r<   r=   lenr]   r   r   r   r9   AttributeErrorlogdebugrU   propertyr_   r
   GETr>   r8   POSTheadersr5   r6   r#   r$   	path_infoenvironMETArC   r;   r%   )r[   r(   r)   r\   rE   rF   r*   r*   r+   rS      s|   rS   c                 C   s   t | | |}t|tjrt|tj|tjd}|S td urFt|t	rFt|tr>t
|r>tt|}t || }t| |S t|tjtj}|S rB   )type__saved_getattrrU   r   
TEXT_TYPESr   r   	GRPC_BODYr   r   rf   nextiter_patch_protobuf_classr   )selfnameret	first_key
value_typer*   r*   r+   _custom_protobuf_getattribute  s"   r}   c                 C   sH   t | d}|s	d S t|ds"z	|| _t| _W d S  ty!   Y d S w d S )N__getattribute____datadog_custom)rb   hasattrrr   r}   r~   	TypeError)clsgetattr_methodr*   r*   r+   rw   ,  s   

rw   c                 C   s   t jrt| }t| d S d S )N)r/   r0   rq   rw   )messagemsg_clsr*   r*   r+   _on_grpc_response<  s   r   c           	      c   s    t  r=z(||i |D ]\}}t|||| d d}t|||| d d}||fV  qW d S  ty<   tddd Y d S w ||i |D ]	\}}||fV  qDd S )Nr   r   rH   r   Tr   )r   r   r%   r
   )	originsr&   r'   r(   r)   keyvaluenew_key	new_valuer*   r*   r+   r4   B  s    r4   c                 C   s   ||i |}t  rGz,t|r|r4t|rt|d nd}| tjkr+| dv r+tj} t|||| dW S W |S  t	yF   t
ddd Y |S w |S )Nr   zhttp.request.body)cookiecookiesr   r   Tr   )r   r   rf   strr   r6   lowerr=   r   r%   r
   )originoverride_pyobject_taintedr&   r'   r(   r)   r   ry   r*   r*   r+   r7   R  s   r7   c              	   C   sx   ||i |}t  r:zg }|D ]}t|s!|t|||| d q|| q|W S  ty9   tddd Y |S w |S r   )r   r   appendr   r%   r
   )r   r&   r'   r(   r)   r   reselementr*   r*   r+   &if_iast_taint_starlette_datastructures`  s*   	r   c               	   C   s  zt  } | ddtttjtj ttj ttj | ddtt	tj
d | ddtt	tj
d ttj
 | ddtttj ttj | ddtt	tjd | dd	tt	tjd ttj | dd
tttj ttj | ddt ttj | ddt | ddt | ddtt	tjd | ddtt	tjd | ddtttj |   ttj ttj W d S  ty   tddd Y d S w )Nzstarlette.requestscookie_parserzstarlette.datastructureszQueryParams.__getitem__FzQueryParams.getzQueryParams.keyszHeaders.__getitem__zHeaders.getzHeaders.keyszURL.__init__r.   zRequest.bodyzFormData.__getitem__TzFormData.getzFormData.keysr   r   )r   r1   r2   r3   r   r   r<   r=   r   r7   r8   r   r>   r6   r5   _iast_instrument_starlette_urlr$   "_iast_instrument_starlette_request'_iast_instrument_starlette_request_bodyr9   r:   r;   r%   r
   rL   r*   r*   r+   _on_iast_fastapi_patchw  s   







r   c                 C   s"   | j }t| d|| d d S )Nflask_requestflask_config)span_on_set_request_tags_iastget_item)rN   current_spanr*   r*   r+   _on_pre_tracedrequest_iast  s   r   c                 C   s   t  rHz4| jd urt| j| jj t| jtjtj	dd| _t| j
tjtjdd| _
t| jtjtjdd| _W d S  tyG   tddd Y d S w d S )NTr   z1Unexpected exception while tainting Flask requestr   )r   url_ruler   rc   ruler   r   r   r<   r=   r(   r>   r8   formr%   r
   )rQ   r   r   r*   r*   r+   r     s4   
r   c                 C   s`   |rt  rt r
d S zddlm} |jjddd}|| W d S  ty/   tddd Y d S w 	NrH   iast_check_stacktrace_leakutf-8ignoreerrors1Unexpected exception checking for stacktrace leakTr   )r   r   taint_sinks.stacktrace_leakr   contentdecoder%   r
   )rN   after_request_tagsrQ   responser   r   r*   r*   r+    _on_django_finalize_response_pre  s   r   c                 C   sh   |rt jrt s
d S zddlm} |j}|jjdd}||| W d S  t	y3   t
ddd Y d S w )NrH   )1asm_report_stacktrace_leak_from_django_debug_page__name__ zFUnexpected exception checking for stacktrace leak on 500 response viewTr   )r/   r0   r   r   r   r   tb_frame	f_globalsgetr%   r
   )rQ   r   exc_type	exc_valuetbr   exc_namemoduler*   r*   r+   !_on_django_technical_500_response  s   r   c                 C   sd   | rt  rt r
d S zddlm} | d jddd}|| W d S  ty1   tjddd	 Y d S w )
NrH   r   r   r   r   r   r   Tr   )r   r   r   r   r   r%   rh   ri   )r   rY   r   r   r*   r*   r+   _on_flask_finalize_request_post  s   r   c                 C   sZ   | rt  sd S zddlm} | jddd}|| W d S  ty,   tjddd Y d S w r   )r   r   r   r   r%   rh   ri   )r_   rY   r   r   r*   r*   r+   _on_asgi_finalize_response  s   
r   c                 C   sT   | rt jsd S zddlm} ||  td W d S  ty)   tjddd Y d S w )NrH   r   Tr   r   )r/   r0   r   r   r   r%   rh   ri   )htmlr   r*   r*   r+   !_on_werkzeug_render_debugger_html&  s   
r   c                 C   s&   dd }| |i | t ||j_d S )Nc                    s    fdd}|S )zMThis pattern comes from a Request._receive property, which returns a callablec                     s$      I d H } t| tjtjddS )NTr   )_receiver   r   r9   )r_   rx   r*   r+   wrapped_property_call8  s   zR_iast_instrument_starlette_request.<locals>.receive.<locals>.wrapped_property_callr*   )rx   r   r*   r   r+   receive5  s   z3_iast_instrument_starlette_request.<locals>.receive)rj   	__class__r   )r&   r'   r(   r)   r   r*   r*   r+   r   4  s   
r   c                    s.   | |i |I d H }t |ttj|tjdS Nr^   )r   r   r   r$   r9   )r&   r'   r(   r)   resultr*   r*   r+   r   C  s
   r   c                 C   s   z1t  r)t| d| | dr,| d  D ]\}}t|||tjd| d |< qW d S W d S W d S  tyA   tddd Y d S w )Nrc   path_paramsr^   ra   Tr   )	r   r   r   rC   r   r   r;   r%   r
   )scoperd   rE   rF   r*   r*   r+    _iast_instrument_starlette_scopeK  s   

r   c                 C   s,   dt fdd}t||j_| |i | d S )NrP   c                 S   s    t | jjttj| jjtjdS r   )r   
componentsr#   r   r   r$   r   r*   r*   r+   r#   Y  s   z,_iast_instrument_starlette_url.<locals>.path)r   rj   r   r#   )r&   r'   r(   r)   r#   r*   r*   r+   r   X  s   r   )T)Kcollections.abcr   r2   typingr   ddtrace.appsec._constantsr   /ddtrace.appsec._iast._iast_request_context_baser   r   r   r   ddtrace.appsec._iast._logsr	   r
   ddtrace.appsec._iast._metricsr   #ddtrace.appsec._iast._patch_modulesr   $ddtrace.appsec._iast._taint_trackingr   r   3ddtrace.appsec._iast._taint_tracking._taint_objectsr   8ddtrace.appsec._iast._taint_tracking._taint_objects_baser   !ddtrace.appsec._iast._taint_utilsr   r   ,ddtrace.appsec._iast.secure_marks.sanitizersr   ddtrace.internalr   ddtrace.internal.loggerr   ddtrace.internal.settings.asmr   r/   r   google._upb._messageImportErrorr   rh   r,   rA   rG   rJ   rM   ExecutionContextboolrT   rZ   tupledictr   rS   r}   r   rw   r   r4   r7   r   r   r   r   r   r   r   r   r   r   r   r   r   r*   r*   r*   r+   <module>   sp    P
*
BU