DongTai icon indicating copy to clipboard operation
DongTai copied to clipboard

dubbo远程方法调用检测场景下存在污点丢失问题

Open Maskhe opened this issue 3 years ago • 0 comments

Preflight Checklist

  • [X] I agree to follow the Code of Conduct that this project adheres to.
  • [X] I have searched the issue tracker for an issue that matches the one I want to file, without success.
  • [X] I am not looking for support or already pursued the available support channels without success.

Version

1.3.0

Installation Type

Other (specify below)

Service Name

DongTai-agent-java

Describe the details of the bug and the steps to reproduce it

dubbo的provider端代码如下,其中,参数word是用户可控的内容,但是此处没有被检出 image

原因:

因为上述示例污点经过了字符串拼接后才流入sink点,而字符串拼接是一个propagator节点,目前agent进入propagator的处理逻辑要求已经离开了souce节点(sourceLevel==0),但是agent在进入dubbo的monitor.invoke()方法时对souceLevel进行了+1操作,而在污点流到propagator之前没有执行souceLevel-1操作,导致后续的所有propagator节点都会被忽略,对应的污点也就丢失了

Additional Information

No response

Logs

No response

Maskhe avatar Mar 10 '22 09:03 Maskhe