dd-trace 4.34.0 → 4.36.0

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-base-analyzer.js

@@ -0,0 +1,70 @@
+'use strict'
+
+const Analyzer = require('./vulnerability-analyzer')
+const { getRelativePath } = require('../path-line')
+
+class HardcodedBaseAnalyzer extends Analyzer {
+  constructor (type, allRules = [], valueOnlyRules = []) {
+    super(type)
+
+    this.allRules = allRules
+    this.valueOnlyRules = valueOnlyRules
+  }
+
+  onConfigure () {
+    this.addSub('datadog:secrets:result', (secrets) => { this.analyze(secrets) })
+  }
+
+  analyze (secrets) {
+    if (!secrets?.file || !secrets.literals) return
+
+    const { allRules, valueOnlyRules } = this
+
+    const matches = []
+    for (const literal of secrets.literals) {
+      const { value, locations } = literal
+      if (!value || !locations) continue
+
+      for (const location of locations) {
+        let match
+        if (location.ident) {
+          const fullValue = `${location.ident}=${value}`
+          match = allRules.find(rule => fullValue.match(rule.regex))
+        } else {
+          match = valueOnlyRules.find(rule => value.match(rule.regex))
+        }
+
+        if (match) {
+          matches.push({ location, ruleId: match.id })
+        }
+      }
+    }
+
+    if (matches.length) {
+      const file = getRelativePath(secrets.file)
+
+      matches
+        .forEach(match => this._report({
+          file,
+          line: match.location.line,
+          column: match.location.column,
+          data: match.ruleId
+        }))
+    }
+  }
+
+  _getEvidence (value) {
+    return { value: `${value.data}` }
+  }
+
+  _getLocation (value) {
+    return {
+      path: value.file,
+      line: value.line,
+      column: value.column,
+      isInternal: false
+    }
+  }
+}
+
+module.exports = HardcodedBaseAnalyzer

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-password-analyzer.js

@@ -0,0 +1,14 @@
+'use strict'
+
+const { HARDCODED_PASSWORD } = require('../vulnerabilities')
+const HardcodedBaseAnalyzer = require('./hardcoded-base-analyzer')
+
+const allRules = require('./hardcoded-password-rules')
+
+class HardcodedPasswordAnalyzer extends HardcodedBaseAnalyzer {
+  constructor () {
+    super(HARDCODED_PASSWORD, allRules)
+  }
+}
+
+module.exports = new HardcodedPasswordAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-password-rules.js

@@ -0,0 +1,12 @@
+/* eslint-disable max-len */
+'use strict'
+
+const { NameAndValue } = require('./hardcoded-rule-type')
+
+module.exports = [
+  {
+    id: 'hardcoded-password',
+    regex: /(?:pwd|pswd|pass|secret)(?:[0-9a-z\-_\t.]{0,20})(?:[\s|']|[\s|""]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|""|\s|=|\x60){0,5}([0-9a-z\-_.=]{10,150})(?:['"\s\x60;]|$)/i,
+    type: NameAndValue
+  }
+]

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-rule-type.js

@@ -0,0 +1,6 @@
+'use strict'
+
+module.exports = {
+  ValueOnly: 'ValueOnly',
+  NameAndValue: 'NameAndValue'
+}

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-secret-analyzer.js

@@ -1,59 +1,14 @@
 'use strict'
 
-const Analyzer = require('./vulnerability-analyzer')
 const { HARDCODED_SECRET } = require('../vulnerabilities')
-const { getRelativePath } = require('../path-line')
+const HardcodedBaseAnalyzer = require('./hardcoded-base-analyzer')
+const { ValueOnly } = require('./hardcoded-rule-type')
 
-const secretRules = require('./hardcoded-secrets-rules')
+const allRules = require('./hardcoded-secret-rules')
 
-class HardcodedSecretAnalyzer extends Analyzer {
+class HardcodedSecretAnalyzer extends HardcodedBaseAnalyzer {
   constructor () {
-    super(HARDCODED_SECRET)
-  }
-
-  onConfigure () {
-    this.addSub('datadog:secrets:result', (secrets) => { this.analyze(secrets) })
-  }
-
-  analyze (secrets) {
-    if (!secrets?.file || !secrets.literals) return
-
-    const matches = secrets.literals
-      .filter(literal => literal.value && literal.locations?.length)
-      .map(literal => {
-        const match = secretRules.find(rule => literal.value.match(rule.regex))
-
-        return match ? { locations: literal.locations, ruleId: match.id } : undefined
-      })
-      .filter(match => !!match)
-
-    if (matches.length) {
-      const file = getRelativePath(secrets.file)
-
-      matches.forEach(match => {
-        match.locations
-          .filter(location => location.line)
-          .forEach(location => this._report({
-            file,
-            line: location.line,
-            column: location.column,
-            data: match.ruleId
-          }))
-      })
-    }
-  }
-
-  _getEvidence (value) {
-    return { value: `${value.data}` }
-  }
-
-  _getLocation (value) {
-    return {
-      path: value.file,
-      line: value.line,
-      column: value.column,
-      isInternal: false
-    }
+    super(HARDCODED_SECRET, allRules, allRules.filter(rule => rule.type === ValueOnly))
   }
 }