Merge pull request #351 from lostsnow/fix/stack-depth

fixes stack depth to correct caller
HXSecurity · Sep 14, 2022 · b07b8e4 · b07b8e4
2 parents 60568b5 + a0e189e
commit b07b8e4
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 5 deletions.
diff --git a/.../src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java b/.../src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java
@@ -38,7 +38,7 @@ public static void solvePropagator(MethodEvent event, AtomicInteger invokeIdSequ
 
     private static void addPropagator(MethodEvent event, AtomicInteger invokeIdSequencer) {
         event.source = false;
-        event.setCallStacks(StackUtils.createCallStack(STACK_DEPTH));
+        event.setCallStacks(StackUtils.createCallStack(6));
         int invokeId = invokeIdSequencer.getAndIncrement();
         event.setInvokeId(invokeId);
         EngineManager.TRACK_MAP.get().put(invokeId, event);

diff --git a/...core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/SourceImpl.java b/...core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/SourceImpl.java
@@ -35,7 +35,7 @@ public static void solveSource(MethodEvent event, AtomicInteger invokeIdSequence
         }
 
         event.source = true;
-        event.setCallStacks(StackUtils.createCallStack(9));
+        event.setCallStacks(StackUtils.createCallStack(4));
 
         int invokeId = invokeIdSequencer.getAndIncrement();
         event.setInvokeId(invokeId);

diff --git a/...re/src/main/java/io/dongtai/iast/core/handler/hookpoint/framework/dubbo/DubboHandler.java b/...re/src/main/java/io/dongtai/iast/core/handler/hookpoint/framework/dubbo/DubboHandler.java
@@ -97,7 +97,7 @@ public static void solveDubbo(MethodEvent event, AtomicInteger invokeIdSequencer
             if (!validArguments.isEmpty()) {
                 Object[] verifiedArguments = validArguments.toArray();
                 event.source = true;
-                event.setCallStacks(StackUtils.createCallStack(9));
+                event.setCallStacks(StackUtils.createCallStack(5));
 
                 int invokeId = invokeIdSequencer.getAndIncrement();
                 event.setInvokeId(invokeId);

diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/MethodEvent.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/MethodEvent.java
@@ -306,7 +306,7 @@ public MethodEvent changeParameter(final int index,
 
     public void setCallStacks(StackTraceElement[] callStacks) {
         this.callStacks = callStacks;
-        this.setCallStack(callStacks[0]);
+        this.setCallStack(callStacks[1]);
     }
 
     public Object getObject() {

diff --git a/...java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java b/...java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java
@@ -69,7 +69,7 @@ public void scan(IastSinkModel sink, MethodEvent event) {
         }
 
         if (sinkSourceHitTaintPool(event, sink)) {
-            event.setCallStacks(StackUtils.createCallStack(11));
+            event.setCallStacks(StackUtils.createCallStack(5));
             int invokeId = SpyDispatcherImpl.INVOKE_ID_SEQUENCER.getAndIncrement();
             event.setInvokeId(invokeId);
             EngineManager.TRACK_MAP.addTrackMethod(invokeId, event);