-
Notifications
You must be signed in to change notification settings - Fork 309
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Support url.parse, url.URL.parse and new url.URL for IAST taint track…
…ing (#4836) * Support url.parse, url.URL.parse and new url.URL for taint tracking * Address PR comments * Use shimmer.wrap instead of doing it manually
- Loading branch information
Showing
7 changed files
with
343 additions
and
2 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| 'use strict' | ||
|
|
||
| const { addHook, channel } = require('./helpers/instrument') | ||
| const shimmer = require('../../datadog-shimmer') | ||
| const names = ['url', 'node:url'] | ||
|
|
||
| const parseFinishedChannel = channel('datadog:url:parse:finish') | ||
| const urlGetterChannel = channel('datadog:url:getter:finish') | ||
| const instrumentedGetters = ['host', 'origin', 'hostname'] | ||
|
|
||
| addHook({ name: names }, function (url) { | ||
| shimmer.wrap(url, 'parse', (parse) => { | ||
| return function wrappedParse (input) { | ||
| const parsedValue = parse.apply(this, arguments) | ||
| if (!parseFinishedChannel.hasSubscribers) return parsedValue | ||
|
|
||
| parseFinishedChannel.publish({ | ||
| input, | ||
| parsed: parsedValue, | ||
| isURL: false | ||
| }) | ||
|
|
||
| return parsedValue | ||
| } | ||
| }) | ||
|
|
||
| const URLPrototype = url.URL.prototype.constructor.prototype | ||
| instrumentedGetters.forEach(property => { | ||
| const originalDescriptor = Object.getOwnPropertyDescriptor(URLPrototype, property) | ||
|
|
||
| if (originalDescriptor?.get) { | ||
| const newDescriptor = shimmer.wrap(originalDescriptor, 'get', function (originalGet) { | ||
| return function get () { | ||
| const result = originalGet.apply(this, arguments) | ||
| if (!urlGetterChannel.hasSubscribers) return result | ||
|
|
||
| const context = { urlObject: this, result, property } | ||
| urlGetterChannel.publish(context) | ||
|
|
||
| return context.result | ||
| } | ||
| }) | ||
|
|
||
| Object.defineProperty(URLPrototype, property, newDescriptor) | ||
| } | ||
| }) | ||
|
|
||
| shimmer.wrap(url, 'URL', (URL) => { | ||
| return class extends URL { | ||
| constructor (input, base) { | ||
| super(...arguments) | ||
|
|
||
| if (!parseFinishedChannel.hasSubscribers) return | ||
|
|
||
| parseFinishedChannel.publish({ | ||
| input, | ||
| base, | ||
| parsed: this, | ||
| isURL: true | ||
| }) | ||
| } | ||
| } | ||
| }) | ||
|
|
||
| if (url.URL.parse) { | ||
| shimmer.wrap(url.URL, 'parse', (parse) => { | ||
| return function wrappedParse (input, base) { | ||
| const parsedValue = parse.apply(this, arguments) | ||
| if (!parseFinishedChannel.hasSubscribers) return parsedValue | ||
|
|
||
| parseFinishedChannel.publish({ | ||
| input, | ||
| base, | ||
| parsed: parsedValue, | ||
| isURL: true | ||
| }) | ||
|
|
||
| return parsedValue | ||
| } | ||
| }) | ||
| } | ||
|
|
||
| return url | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,114 @@ | ||
| 'use strict' | ||
|
|
||
| const agent = require('../../dd-trace/test/plugins/agent') | ||
| const { channel } = require('../src/helpers/instrument') | ||
| const names = ['url', 'node:url'] | ||
|
|
||
| names.forEach(name => { | ||
| describe(name, () => { | ||
| const url = require(name) | ||
| const parseFinishedChannel = channel('datadog:url:parse:finish') | ||
| const urlGetterChannel = channel('datadog:url:getter:finish') | ||
| let parseFinishedChannelCb, urlGetterChannelCb | ||
|
|
||
| before(async () => { | ||
| await agent.load('url') | ||
| }) | ||
|
|
||
| after(() => { | ||
| return agent.close() | ||
| }) | ||
|
|
||
| beforeEach(() => { | ||
| parseFinishedChannelCb = sinon.stub() | ||
| urlGetterChannelCb = sinon.stub() | ||
| parseFinishedChannel.subscribe(parseFinishedChannelCb) | ||
| urlGetterChannel.subscribe(urlGetterChannelCb) | ||
| }) | ||
|
|
||
| afterEach(() => { | ||
| parseFinishedChannel.unsubscribe(parseFinishedChannelCb) | ||
| urlGetterChannel.unsubscribe(urlGetterChannelCb) | ||
| }) | ||
|
|
||
| describe('url.parse', () => { | ||
| it('should publish', () => { | ||
| // eslint-disable-next-line n/no-deprecated-api | ||
| const result = url.parse('https://www.datadoghq.com') | ||
|
|
||
| sinon.assert.calledOnceWithExactly(parseFinishedChannelCb, { | ||
| input: 'https://www.datadoghq.com', | ||
| parsed: result, | ||
| isURL: false | ||
| }, sinon.match.any) | ||
| }) | ||
| }) | ||
|
|
||
| describe('url.URL', () => { | ||
| describe('new URL', () => { | ||
| it('should publish with input', () => { | ||
| const result = new url.URL('https://www.datadoghq.com') | ||
|
|
||
| sinon.assert.calledOnceWithExactly(parseFinishedChannelCb, { | ||
| input: 'https://www.datadoghq.com', | ||
| base: undefined, | ||
| parsed: result, | ||
| isURL: true | ||
| }, sinon.match.any) | ||
| }) | ||
|
|
||
| it('should publish with base and input', () => { | ||
| const result = new url.URL('/path', 'https://www.datadoghq.com') | ||
|
|
||
| sinon.assert.calledOnceWithExactly(parseFinishedChannelCb, { | ||
| base: 'https://www.datadoghq.com', | ||
| input: '/path', | ||
| parsed: result, | ||
| isURL: true | ||
| }, sinon.match.any) | ||
| }) | ||
|
|
||
| ;['host', 'origin', 'hostname'].forEach(property => { | ||
| it(`should publish on get ${property}`, () => { | ||
| const urlObject = new url.URL('/path', 'https://www.datadoghq.com') | ||
|
|
||
| const result = urlObject[property] | ||
|
|
||
| sinon.assert.calledWithExactly(urlGetterChannelCb, { | ||
| urlObject, | ||
| result, | ||
| property | ||
| }, sinon.match.any) | ||
| }) | ||
| }) | ||
| }) | ||
| }) | ||
|
|
||
| if (url.URL.parse) { // added in v22.1.0 | ||
| describe('url.URL.parse', () => { | ||
| it('should publish with input', () => { | ||
| const input = 'https://www.datadoghq.com' | ||
| const parsed = url.URL.parse(input) | ||
|
|
||
| sinon.assert.calledOnceWithExactly(parseFinishedChannelCb, { | ||
| input, | ||
| parsed, | ||
| base: undefined, | ||
| isURL: true | ||
| }, sinon.match.any) | ||
| }) | ||
|
|
||
| it('should publish with base and input', () => { | ||
| const result = new url.URL('/path', 'https://www.datadoghq.com') | ||
|
|
||
| sinon.assert.calledOnceWithExactly(parseFinishedChannelCb, { | ||
| base: 'https://www.datadoghq.com', | ||
| input: '/path', | ||
| parsed: result, | ||
| isURL: true | ||
| }, sinon.match.any) | ||
| }) | ||
| }) | ||
| } | ||
| }) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.