o i@sUddlZddlZddlmZddlmZddlmZddlm Z ee Z ej ddGdd d eZzddlZeje jd d d ZWneyRe d YnwgZeeed<dddZddZdS)N)IAST) Vulnerability) get_logger)configT) unsafe_hashc@seZdZUeed<dS)VulnerabilityFoundInTesttestN)__name__ __module__ __qualname__str__annotations__rrW/home/ubuntu/.local/lib/python3.10/site-packages/ddtrace/appsec/_iast/_pytest_plugin.pyrs r)autousec csdV|dur dS|tj}|dur%|tj}|dur dSt|}|dr_|dD]}tt |j j |d|d|ddq-|j dradd d |dD}td |dSdSdS) z Extract the vulnerabilities discovered in tests. Optionally output the test as failed if vulnerabilities are found. Nvulnerabilitiestypeevidencelocation)rrrrzddtrace-iast-fail-testsz, cSsg|]}|dqS)rr).0vulnrrr 5sz ddtrace_iast..z'There are vulnerabilities in the code: )_get_struct_tagrSTRUCTget_tagJSONjsonloads vuln_dataappendrnodenodeidr getoptionjoinpytestfail)requestddspan dict_datadatarvulnsrrr ddtrace_iasts2      r+zpytest not importedrcCsz9t|d)}|}td||d}tt|||}|||}||fWdWS1s2wYWdStyKtjd|ddYdSw) z3Extracts code snippet around the given line number.rrNzError reading file %sT)exc_info)r)open readlinesmaxminlen Exceptionlogdebug)filepath line_numbercontextfilelinesstartendcoderrrextract_code_snippet?s  ( rAcCsXtjsdSts|jddddd|ddS|jdddddtD]}|jd|jdd|jd}|jd |jd|| d |d |jd d |jdt |jd |jd\}}|r|d|durt ||ddD]%\}}||jdkr|j |dd|dddqt| |dd|qtn |j|ddd|dq"dS)N=zDatadog Code Security ReportT)purpleboldzNo vulnerabilities found.zTest: )rD INJECTIONzVulnerability: )rDredyellowz Location: path:linezCode:r.)r>4dz: )rDrCr) asm_config _iast_enabledr write_sep write_linerrendswithrrA enumeratewrite)terminalreporterentry high_severity code_snippet start_lineirJrrrprint_iast_reportMs:   "  rY)r,) dataclassesrddtrace.appsec._constantsrddtrace.appsec._iast.reporterrddtrace.internal.loggerrddtrace.internal.settings.asmrrLr r7 dataclassrr$fixturerMr+ ImportErrorr8rlistr rArYrrrrs&        !