o
    ilE                     @   s   d dl mZ d dlmZ d dlmZ d dlmZ d dlmZ d dlm	Z	 d dl
mZ d dlmZ d d	lmZ d
ZeeZG dd dZdd ZdddZdd ZG dd dZG dd dZejrfdddZdd ZdS )    )abc)Any)Optional)Union)IAST)taint_pyobject)is_pyobject_tainted)
get_logger)config)zdjango-c                   @   sf   e Zd Z			ddedededeeef de	ee  de	eeef  d	efd
dZ
dd Zdd ZdS )_DeepTaintCommandNFpre
source_keyobjstore_structkeystructis_keyc                 C   s.   || _ || _|| _|| _|| _|| _|| _d S N)r   r   r   r   r   r   r   )selfr   r   r   r   r   r   r    r   U/home/ubuntu/.local/lib/python3.10/site-packages/ddtrace/appsec/_iast/_taint_utils.py__init__   s   

z_DeepTaintCommand.__init__c                 C   s^   t | jtr| j| d S t | jtr%| jr| jd nd }|| j|< d S tdt| j )Nr   zstore_struct of type )
isinstancer   listappenddictr   
ValueErrortype)r   valuer   r   r   r   store+   s   z_DeepTaintCommand.storec                 C   s   |  d| j| j| j| j|S )NF)	__class__r   r   r   r   )r   r   r   r   r   post4      z_DeepTaintCommand.post)NNF)__name__
__module____qualname__boolstrr   r   r   r   r   r   r   r!   r   r   r   r   r      s*    


	r   c                 C   s   | j |j u r|S | j j| j jf}|dkrt|S |dkr-|  i }dd | D |_|S |dkrG|   }| D ]\}}t||| q9|S |dkrP|  |S |dkrY|  |S | S )N)builtinstuple)django.http.requestHttpHeadersc                 S   s   i | ]\}}|  ||fqS r   )lower).0kvr   r   r   
<dictcomp>B   s    z@build_new_tainted_object_from_generic_object.<locals>.<dictcomp>)r*   	QueryDict)z"werkzeug.datastructures.structuresImmutableMultiDict)zwerkzeug.datastructuresr2   )r    r$   r#   r)   items_storer   __setitem__)initial_objectwanted_objectwanted_typeresr.   r/   r   r   r   ,build_new_tainted_object_from_generic_object8   s&   


r:   Fc              
      s  | s| S d}g }zzt d|| |g}|r|   jr͈ js%  j nt jtjrP|s3t jsIt	 j j
 j jr?|n|d} | n  j nt jtjri |  t jtrmt jn j }g }	t|D ]!\}
}g }|	t dt|
|
|dd |	t dt|
|| qx|t|	 n5t jtjrg |   fdd jD }	|t|	 n  j n
 t j j |sW n ty   tjddd Y nw W |r|d	 }|S | }|S |r|d	 }w | }w )
ztaint any structured object
    use a queue like mechanism to avoid recursion
    Best effort: mutate mutable structures and rebuild immutable ones if possible
    NTpyobjectsource_namesource_valuesource_origin)r   c                    s   g | ]
}t d  j|qS )T)r   r   )r-   r/   commandr9   r   r   
<listcomp>   s    z#taint_structure.<locals>.<listcomp>ztaint_structure errorexc_infor   )r   popr   r   r   r   r   
TEXT_TYPESr   r   r   r   r   Mappingr   r!   r   r3   r   r'   extendreversedSequencer:   r   	Exceptionlogdebug)main_objr   r>   override_pyobject_taintedresultmain_resstacknew_objiterabletodor.   r/   	key_storer   r@   r   taint_structureV   sd   "$rW   c                 C   s
   t | dS )N_origins)hasattr)r   r   r   r   _is_tainted_struct      
rZ   c                   @   s4  e Zd ZdZdMddZdd Zd	d
 Zedd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd Zdd  Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Zd+d, Zd-d. Zd/d0 Zd1d2 Zd3d4 Zd5d6 Zd7d8 Zd9d: Zd;d< Z d=d> Z!d?d@ Z"dAdB Z#dCdD Z$dEdF Z%dGdH Z&dIe'fdJdKZ(dLS )NLazyTaintListz
    Encapsulate a list to lazily taint all content on any depth
    It will appear and act as the original list except for some additional private fields
    r   r   F[]c                 C   s4   t |r|jn|| _|| _|d | _|| _|| _d S )N   )rZ   _objrX   _origin_value_override_pyobject_tainted_source_name)r   original_listoriginsrO   r=   r   r   r   r      s
   

zLazyTaintList.__init__c                 C   s   |rkt |tjrAt|r| jr?zt|| j|| jd}W |S  ty.   t	j
d|dd Y |S  ty>   t	j
ddd Y |S w |S t |tjrVt|sVt|| j| jd}|S t |tjrkt|skt|| j| j| jd}|S )Nr;   z)IAST SystemError while tainting value: %sTrC   .IAST Unexpected exception while tainting valuere   rO   re   rO   r=   )r   r   rF   r   rb   r   rc   ra   SystemErrorrL   rM   rK   r   rG   rZ   LazyTaintDictrX   rJ   r\   )r   r   r   r   r   _taint   s@   

zLazyTaintList._taintc                 C   s*   t |r|j}t| j| | j| j| jdS Nrh   )rZ   r`   r\   rX   rb   rc   r   otherr   r   r   __add__   s   zLazyTaintList.__add__c                 C      t S r   )r   r   r   r   r   r          zLazyTaintList.__class__c                 C   
   || j v S r   r`   r   itemr   r   r   __contains__   r[   zLazyTaintList.__contains__c                 C      | j |= d S r   rt   r   r   r   r   r   __delitem__      zLazyTaintList.__delitem__c                 C      t |r|j}| j|kS r   rZ   r`   rm   r   r   r   __eq__      
zLazyTaintList.__eq__c                 C      t |r|j}| j|kS r   r}   rm   r   r   r   __ge__   r   zLazyTaintList.__ge__c                 C   s   |  | j| S r   rk   r`   ry   r   r   r   __getitem__      zLazyTaintList.__getitem__c                 C      t |r|j}| j|kS r   r}   rm   r   r   r   __gt__   r   zLazyTaintList.__gt__c                 C   s    t |r|j}|  j|7  _d S r   r}   rm   r   r   r   __iadd__      zLazyTaintList.__iadd__c                 C   s   |  j |9  _ d S r   rt   rm   r   r   r   __imul__      zLazyTaintList.__imul__c                    s    fddt t jD S )Nc                 3       | ]} | V  qd S r   r   r-   irq   r   r   	<genexpr>       z)LazyTaintList.__iter__.<locals>.<genexpr>)rangelenr`   rq   r   rq   r   __iter__   r"   zLazyTaintList.__iter__c                 C      t |r|j}| j|kS r   r}   rm   r   r   r   __le__   r   zLazyTaintList.__le__c                 C   
   t | jS r   r   r`   rq   r   r   r   __len__   r[   zLazyTaintList.__len__c                 C      t |r|j}| j|k S r   r}   rm   r   r   r   __lt__   r   zLazyTaintList.__lt__c                 C   s   t | j| | j| j| jdS rl   )r\   r`   rX   rb   rc   rm   r   r   r   __mul__     zLazyTaintList.__mul__c                 C      t |r|j}| j|kS r   r}   rm   r   r   r   __ne__	  r   zLazyTaintList.__ne__c                 C   r   r   reprr`   rq   r   r   r   __repr__  r[   zLazyTaintList.__repr__c                    s     fddt tt jD S )Nc                 3   r   r   r   r   rq   r   r   r     r   z-LazyTaintList.__reversed__.<locals>.<genexpr>)rI   r   r   r`   rq   r   rq   r   __reversed__  s    zLazyTaintList.__reversed__c                 C      || j |< d S r   rt   r   r   r   r   r   r   r5        zLazyTaintList.__setitem__c                 C   r   r   r'   r`   rq   r   r   r   __str__  r[   zLazyTaintList.__str__c                 C   s   | j | d S r   )r`   r   ru   r   r   r   r     r   zLazyTaintList.appendc                 C      | j   d S r   r`   clearrq   r   r   r   r        zLazyTaintList.clearc                 C   s   t | j | j| j| jdS rl   )r\   r`   copyrX   rb   rc   rq   r   r   r   r   !  r   zLazyTaintList.copyc                 G      | j j| S r   )r`   countr   argsr   r   r   r   )  r{   zLazyTaintList.countc                 G   r   r   )r`   rH   r   r   r   r   rH   ,  r{   zLazyTaintList.extendc                 G   r   r   )r`   indexr   r   r   r   r   /  r{   zLazyTaintList.indexc                 G   r   r   )r`   insertr   r   r   r   r   2  r{   zLazyTaintList.insertc                 G   s   |  | jj| S r   rk   r`   rE   r   r   r   r   rE   5  r   zLazyTaintList.popc                 G   r   r   r`   remover   r   r   r   r   8  r{   zLazyTaintList.removec                 G   r   r   )r`   reverser   r   r   r   r   ;  r{   zLazyTaintList.reversec                 G   r   r   )r`   sortr   r   r   r   r   >  r{   zLazyTaintList.sortc                 C      | S r   r   )r   protor   r   r   __conform__B     zLazyTaintList.__conform__returnc                 C   s*   dd l m} || j }| |}|S Nr   )psycopg2.extensions
extensionsadaptr`   	getquotedrk   )r   extr   r   r   r   r   E  s   
zLazyTaintList.getquotedN)r]   Fr^   ))r#   r$   r%   __doc__r   rk   ro   propertyr    rw   rz   r~   r   r   r   r   r   r   r   r   r   r   r   r   r   r5   r   r   r   r   r   rH   r   r   rE   r   r   r   r   bytesr   r   r   r   r   r\      sL    


r\   c                   @   sX  e Zd ZdRddZdSddZedd	 Zd
d Zdd Zdd Z	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd Zd d! Zd"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zed0d1 ZdSd2d3Zd4d5 Zd6d7 Zd8d9 Zd:d; Z d<d= Z!d>d? Z"d@dA Z#dBdC Z$dSdDdEZ%dFdG Z&dHdI Z'dSdJdKZ(dLdM Z)dNdO Z*dSdPdQZ+dS )Trj   r]   Fc                 C   sR   ddl m} || _|| _|d r|d n|j| _|d r |d n|j| _|| _d S )Nr   )
OriginTyper_   )	$ddtrace.appsec._iast._taint_trackingr   r`   rX   PARAMETER_NAME_origin_key	PARAMETERra   rb   )r   original_dictre   rO   r   r   r   r   r   N  s   
zLazyTaintDict.__init__Nc                 C   s   |d u r| j }|r^t|tjr5t|r| jr3zt||||d}W |S  ty2   tj	ddd Y |S w |S t|t
jrJt|sJt|| j| jd}|S t|t
jr^t|s^t|| j| j|d}|S )Nr;   rf   TrC   rg   rh   )ra   r   r   rF   r   rb   r   rK   rL   rM   r   rG   rZ   rj   rX   rJ   r\   )r   r   r   originr   r   r   rk   W  s>   

zLazyTaintDict._taintc                 C   rp   r   )r   rq   r   r   r   r    t  rr   zLazyTaintDict.__class__c                 C   rs   r   rt   ru   r   r   r   rw   x  r[   zLazyTaintDict.__contains__c                 C   rx   r   rt   ry   r   r   r   rz   {  r{   zLazyTaintDict.__delitem__c                 C   r|   r   r}   rm   r   r   r   r~   ~  r   zLazyTaintDict.__eq__c                 C   r   r   r}   rm   r   r   r   r     r   zLazyTaintDict.__ge__c                 C   s   |  | j| |S r   r   ry   r   r   r   r     r   zLazyTaintDict.__getitem__c                 C   r   r   r}   rm   r   r   r   r     r   zLazyTaintDict.__gt__c                 C   s    t |r|j}|  j|O  _d S r   r}   rm   r   r   r   __ior__  r   zLazyTaintDict.__ior__c                 C      t |  S r   )iterkeysrq   r   r   r   r     r{   zLazyTaintDict.__iter__c                 C   r   r   r}   rm   r   r   r   r     r   zLazyTaintDict.__le__c                 C   r   r   r   rq   r   r   r   r     r[   zLazyTaintDict.__len__c                 C   r   r   r}   rm   r   r   r   r     r   zLazyTaintDict.__lt__c                 C   r   r   r}   rm   r   r   r   r     r   zLazyTaintDict.__ne__c                 C   s&   t |r|j}t| j|B | j| jdS Nrg   )rZ   r`   rj   rX   rb   rm   r   r   r   __or__  s   zLazyTaintDict.__or__c                 C   r   r   r   rq   r   r   r   r     r[   zLazyTaintDict.__repr__c                 C   r   r   )rI   r   rq   r   r   r   r     r{   zLazyTaintDict.__reversed__c                 C   r   r   rt   r   r   r   r   r5     r   zLazyTaintDict.__setitem__c                 C   r   r   r   rq   r   r   r   r     r[   zLazyTaintDict.__str__c                 C   r   r   r   rq   r   r   r   r     r   zLazyTaintDict.clearc                 C   s   t | j | j| jdS r   )rj   r`   r   rX   rb   rq   r   r   r   r     s
   zLazyTaintDict.copyc                 G   s
   t j| S r   )r   fromkeys)clsr   r   r   r   r     s   
zLazyTaintDict.fromkeysc                 C   s,   t  }| j||}||u r|S | ||S r   )objectr`   getrk   )r   r   defaultobserverr9   r   r   r   r     s
   zLazyTaintDict.getc                 c   s"    |   D ]	}|| | fV  qd S r   )r   r   r.   r   r   r   r3     s   zLazyTaintDict.itemsc                 c   s(    | j  D ]}| ||| jV  qd S r   )r`   r   rk   r   r   r   r   r   r     s   zLazyTaintDict.keysc                 G   s   |  | jj| dS )NrE   r   r   r   r   r   rE        zLazyTaintDict.popc                 C   s&   | j  \}}| ||| ||fS r   )r`   popitemrk   )r   r.   r/   r   r   r   r     s   zLazyTaintDict.popitemc                 G   r   r   r   r   r   r   r   r     r{   zLazyTaintDict.removec                 G   s   |  | jj| |d S r   )rk   r`   
setdefaultr   r   r   r   r        zLazyTaintDict.setdefaultc                 O   s   | j j|i | d S r   )r`   update)r   r   kargsr   r   r   r     s   zLazyTaintDict.updatec                 c   s    |   D ]\}}|V  qd S r   )r3   )r   _r/   r   r   r   values  s   zLazyTaintDict.valuesc                 C      |  | jj||d|S )N)r   )rk   r`   getlist)r   r   r   r   r   r   r     r   zLazyTaintDict.getlistc                 C      | j || d S r   )r`   setlist)r   r   list_r   r   r   r     r   zLazyTaintDict.setlistc                 C   r   r   )r`   
appendlist)r   r   rv   r   r   r   r     r   zLazyTaintDict.appendlistc                 C   r   )N)default_list)rk   r`   setlistdefault)r   r   r   r   r   r   r     r   zLazyTaintDict.setlistdefaultc                 C   s   |  | j | jS r   )rk   r`   listsra   rq   r   r   r   r     r   zLazyTaintDict.listsc                 C   r   r   r   rq   r   r   r   r     r   zLazyTaintDict.dictc                 C   s   |  | jj|d| jS )N)safe)rk   r`   	urlencodera   )r   r   r   r   r   r     r   zLazyTaintDict.urlencode)r]   Fr   ),r#   r$   r%   r   rk   r   r    rw   rz   r~   r   r   r   r   r   r   r   r   r   r   r   r   r5   r   r   r   classmethodr   r   r3   r   rE   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   r   rj   M  sT    

	
	



rj   c                 C   s<   t | tjrt| ||f|S t | tjrt| ||f|S d S r   )r   r   rG   rj   rJ   r\   )rN   
origin_keyorigin_valuerO   r   r   r   rW     s
   c                 C   s   ||i |}t || |ddS )NT)rO   )rW   )r   r   original_funcinstancer   kwargsrP   r   r   r   taint_dictionary  s   r   N)F)collectionsr   typingr   r   r   ddtrace.appsec._constantsr   3ddtrace.appsec._iast._taint_tracking._taint_objectsr   8ddtrace.appsec._iast._taint_tracking._taint_objects_baser   ddtrace.internal.loggerr	   ddtrace.internal.settings.asmr
   
asm_configDBAPI_PREFIXESr#   rL   r   r:   rW   rZ   r\   rj   _iast_lazy_taintr   r   r   r   r   <module>   s,    
= 7 <
