o
    Á¿iG  ã                   @   s  d Z ddlmZ ddlmZ ddlmZ ddlmZ ddlm	Z	 ddlm
Z
 ddlmZ dd	lmZ dd
lmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddlmZ ddl mZ! ddl"m#Z# ddl$m%Z& e#e'ƒZ(dd„ Z)dS )ad  Interactive Application Security Testing (IAST) module.

This module implements IAST functionality by patching security-sensitive functions (sink points)
in various Python modules using wrapt. IAST enables runtime security analysis by instrumenting
code to track tainted data propagation through the application.

The patching mechanism works by:
1. Identifying security-sensitive functions (sinks) in various modules
2. Wrapping these functions using wrapt to enable taint tracking
3. Implementing sanitizers and validators for different types of vulnerabilities
4. Enabling propagation tracking through AST-based instrumentation

Supported vulnerability types include:
- Command Injection
- Code Injection
- SQL Injection
- Cross-Site Scripting (XSS)
- Path Traversal
- Header Injection
- Unvalidated Redirects
- Insecure Cookie
- Server-Side Request Forgery (SSRF)
é    )ÚWrapFunctonsForIAST)Ú_apply_custom_security_controls)Úpatch)Úcmdi_sanitizer)Úpath_traversal_sanitizer)Úsqli_sanitizer)Úheader_injection_sanitizer)Úxss_sanitizer)Úheader_injection_validator)Ússrf_validator)Úunvalidated_redirect_validator)Ú
get_logger)Úconfigc                  C   s  t jrtƒ  tƒ  tƒ  tƒ  tƒ  tƒ  tƒ  t	ƒ  t j
r‚tƒ  tƒ } t| ƒ |  ddt¡ |  ddt¡ |  ddt¡ |  ddt¡ |  d	d
t¡ |  d	dt¡ |  ddt¡ |  ddt¡ |  ddt¡ |  ddt¡ |  ddt¡ |  ddt¡ |  ¡  dS dS )aæ  Patch security-sensitive functions (sink points) for IAST analysis.

    This function implements the core IAST patching mechanism in two phases:

    1. Sink Points Phase (when _DD_IAST_SINK_POINTS_ENABLED):
       - Patches vulnerability detection functions for command injection, XSS,
         code injection, header injection, insecure cookies, and unvalidated redirects

    2. Propagation Phase (when _DD_IAST_PROPAGATION_ENABLED):
       - Enables JSON tainting for data flow tracking
       - Configures sanitizers for input validation (SQL injection, XSS, path traversal)
       - Sets up validators for security checks (SSRF, header injection, unvalidated redirects)
       - Applies custom security controls and taint tracking
    ÚshlexÚquotezmysql.connector.conversionzMySQLConverter.escapezpymysql.connectionszConnection.escape_stringzpymysql.convertersÚescape_stringzwerkzeug.utilsÚ_str_header_valueÚsecure_filenamezdjango.http.responsez#ResponseHeaders._convert_to_charsetz$HttpResponseBase._convert_to_charsetzdjango.utils.httpÚurl_has_allowed_host_and_schemezurllib.parseÚurlparseÚhtmlÚescapeN)Ú
asm_configÚ_iast_sink_points_enabledÚcode_injection_patchÚheader_injection_patchÚinsecure_cookie_patchÚunstrusted_serialization_patchÚunvalidated_redirect_patchÚweak_cipher_patchÚweak_hash_patchÚ	xss_patchÚ_iast_propagation_enabledÚjson_tainting_patchr   r   Úwrap_functionr   r   r   r   r
   r   r   r	   r   )Ú
iast_funcs© r&   úM/home/ubuntu/.local/lib/python3.10/site-packages/ddtrace/appsec/_iast/main.pyÚ
patch_iast3   s>   ÿÿÏr(   N)*Ú__doc__Ú#ddtrace.appsec._iast._patch_modulesr   r   Ú+ddtrace.appsec._iast._patches.json_taintingr   r#   Ú!ddtrace.appsec._iast.secure_marksr   r   r   Ú,ddtrace.appsec._iast.secure_marks.sanitizersr   r	   Ú,ddtrace.appsec._iast.secure_marks.validatorsr
   r   r   Ú/ddtrace.appsec._iast.taint_sinks.code_injectionr   Ú1ddtrace.appsec._iast.taint_sinks.header_injectionr   Ú0ddtrace.appsec._iast.taint_sinks.insecure_cookier   Ú8ddtrace.appsec._iast.taint_sinks.untrusted_serializationr   Ú5ddtrace.appsec._iast.taint_sinks.unvalidated_redirectr   Ú,ddtrace.appsec._iast.taint_sinks.weak_cipherr   Ú*ddtrace.appsec._iast.taint_sinks.weak_hashr    Ú$ddtrace.appsec._iast.taint_sinks.xssr!   Úddtrace.internal.loggerr   Úddtrace.internal.settings.asmr   r   Ú__name__Úlogr(   r&   r&   r&   r'   Ú<module>   s0    