Skip to content

Commit cff741f

Browse files
committed
Fix CI test failures for file_write RASP event
- Add FILE_WRITTEN_ID to InstrumentationGateway callback-wrapping switch so exceptions in fileWritten() callbacks are properly caught (fixes InstrumentationGatewayTest#testThrowableBlocking) - Change rasp-930-101 smoke test rule from lfi_detector to match_regex operator, since lfi_detector only supports server.io.fs.file as resource address; match_regex on server.io.fs.file_write with path-traversal regex correctly detects ../../../etc/passwd patterns
1 parent 5070900 commit cff741f

2 files changed

Lines changed: 6 additions & 3 deletions

File tree

dd-smoke-tests/appsec/springboot/src/test/groovy/datadog/smoketest/appsec/SpringBootSmokeTest.groovy

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -434,10 +434,11 @@ class SpringBootSmokeTest extends AbstractAppSecServerSmokeTest {
434434
conditions : [
435435
[
436436
parameters: [
437-
resource: [[address: 'server.io.fs.file_write']],
438-
params : [[address: 'server.request.query']],
437+
inputs : [[address: 'server.io.fs.file_write']],
438+
regex : '(?:^|[/\\\\])\\.\\.[/\\\\]',
439+
options: [case_sensitive: true, min_length: 4],
439440
],
440-
operator : 'lfi_detector',
441+
operator : 'match_regex',
441442
],
442443
],
443444
transformers: [],

internal-api/src/main/java/datadog/trace/api/gateway/InstrumentationGateway.java

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44
import static datadog.trace.api.gateway.Events.DATABASE_SQL_QUERY_ID;
55
import static datadog.trace.api.gateway.Events.EXEC_CMD_ID;
66
import static datadog.trace.api.gateway.Events.FILE_LOADED_ID;
7+
import static datadog.trace.api.gateway.Events.FILE_WRITTEN_ID;
78
import static datadog.trace.api.gateway.Events.GRAPHQL_SERVER_REQUEST_MESSAGE_ID;
89
import static datadog.trace.api.gateway.Events.GRPC_SERVER_METHOD_ID;
910
import static datadog.trace.api.gateway.Events.GRPC_SERVER_REQUEST_MESSAGE_ID;
@@ -447,6 +448,7 @@ public Flow<Void> apply(RequestContext ctx, String arg) {
447448
};
448449
case DATABASE_SQL_QUERY_ID:
449450
case FILE_LOADED_ID:
451+
case FILE_WRITTEN_ID:
450452
case SHELL_CMD_ID:
451453
return (C)
452454
new BiFunction<RequestContext, String, Flow<Void>>() {

0 commit comments

Comments
 (0)