o
    i$                     @   s  d dl mZ d dlmZ d dlmZ d dlmZ d dlmZ d dl	m
Z
 d dl	mZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ eeZG dd deZdefddZ da!dd Z"dd Z#dd Z$defddZ%dS )     )Text)IAST)IAST_SPAN_TAGS)is_iast_request_enabled)%iast_propagation_sink_point_debug_log)_set_metric_iast_executed_sink)"_set_metric_iast_instrumented_sink)WrapFunctonsForIAST)increment_iast_span_metric)VulnerabilityType)VULN_XSS)VulnerabilityBase)
get_logger)ModuleWatchdog)configc                   @   s   e Zd ZeZejZdS )XSSN)__name__
__module____qualname__r   vulnerability_typer   r   secure_mark r   r   X/home/ubuntu/.local/lib/python3.10/site-packages/ddtrace/appsec/_iast/taint_sinks/xss.pyr      s    
r   returnc                   C   s   dS )N r   r   r   r   r   get_version   s   r   Fc                  C   s   t rtjsd S tjsd S da t } | ddt | ddt | ddt | ddt |   t	t
 tdd	d
 }d S )NTzdjango.utils.safestring	mark_safezdjango.template.defaultfilterszjinja2.filtersdo_mark_safeflaskrender_template_stringc              	   S   s@   zddl m} ddl m} ||d< W d S  ttfy   Y d S w )Nr   )FILTERS)r   safe)jinja2.filtersr    r   ImportErrorKeyError)moduler    r   r   r   r   _K   s   zpatch.<locals>._)_IS_PATCHED
asm_config_iast_is_testing_iast_enabledr	   wrap_function_iast_django_xss_iast_jinja2_xsspatchr   r   r   after_module_imported)
iast_funcsr&   r   r   r   r.   "   s<   
r.   c                 C   *   |rt |dkrt|d  | |i |S N   r   len_iast_report_xsswrappedinstanceargskwargsr   r   r   r,   V      r,   c                 C   r1   r2   r4   r7   r   r   r   r-   \   r<   r-   code_stringc              
   C   s   z*t  r(t| tjrt rt| rtj| d tt	j
tj ttj W d S W d S  tyD } ztd|  W Y d }~d S d }~ww )N)evidence_valuez4propagation::sink_point::Error in _iast_report_xss. )r   
isinstancer   
TEXT_TYPESr   	has_quotais_tainted_pyobjectreportr
   r   TELEMETRY_EXECUTED_SINKr   r   	Exceptionr   )r=   er   r   r   r6   b   s   r6   N)&typingr   ddtrace.appsec._constantsr   r   /ddtrace.appsec._iast._iast_request_context_baser   ddtrace.appsec._iast._logsr   ddtrace.appsec._iast._metricsr   r   #ddtrace.appsec._iast._patch_modulesr	   "ddtrace.appsec._iast._span_metricsr
   $ddtrace.appsec._iast._taint_trackingr   ddtrace.appsec._iast.constantsr   &ddtrace.appsec._iast.taint_sinks._baser   ddtrace.internal.loggerr   ddtrace.internal.moduler   ddtrace.internal.settings.asmr   r(   r   logr   r   r'   r.   r,   r-   r6   r   r   r   r   <module>   s.    4