DongTai
DongTai copied to clipboard
dubbo远程方法调用检测场景下存在污点丢失问题
Preflight Checklist
- [X] I agree to follow the Code of Conduct that this project adheres to.
- [X] I have searched the issue tracker for an issue that matches the one I want to file, without success.
- [X] I am not looking for support or already pursued the available support channels without success.
Version
1.3.0
Installation Type
Other (specify below)
Service Name
DongTai-agent-java
Describe the details of the bug and the steps to reproduce it
dubbo的provider端代码如下,其中,参数word是用户可控的内容,但是此处没有被检出

原因:
因为上述示例污点经过了字符串拼接后才流入sink点,而字符串拼接是一个propagator节点,目前agent进入propagator的处理逻辑要求已经离开了souce节点(sourceLevel==0),但是agent在进入dubbo的monitor.invoke()方法时对souceLevel进行了+1操作,而在污点流到propagator之前没有执行souceLevel-1操作,导致后续的所有propagator节点都会被忽略,对应的污点也就丢失了
Additional Information
No response
Logs
No response