From a0e189e428080dadbfd72a90447115bc2f46ed28 Mon Sep 17 00:00:00 2001 From: lostsnow Date: Wed, 14 Sep 2022 11:05:59 +0800 Subject: [PATCH] fixes stack depth to correct caller --- .../core/handler/hookpoint/controller/impl/PropagatorImpl.java | 2 +- .../iast/core/handler/hookpoint/controller/impl/SourceImpl.java | 2 +- .../core/handler/hookpoint/framework/dubbo/DubboHandler.java | 2 +- .../dongtai/iast/core/handler/hookpoint/models/MethodEvent.java | 2 +- .../hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java index 8443cddb8..c93ed8a36 100644 --- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java +++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java @@ -38,7 +38,7 @@ public static void solvePropagator(MethodEvent event, AtomicInteger invokeIdSequ private static void addPropagator(MethodEvent event, AtomicInteger invokeIdSequencer) { event.source = false; - event.setCallStacks(StackUtils.createCallStack(STACK_DEPTH)); + event.setCallStacks(StackUtils.createCallStack(6)); int invokeId = invokeIdSequencer.getAndIncrement(); event.setInvokeId(invokeId); EngineManager.TRACK_MAP.get().put(invokeId, event); diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/SourceImpl.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/SourceImpl.java index 328985645..8e3b3aba1 100644 --- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/SourceImpl.java +++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/SourceImpl.java @@ -35,7 +35,7 @@ public static void solveSource(MethodEvent event, AtomicInteger invokeIdSequence } event.source = true; - event.setCallStacks(StackUtils.createCallStack(9)); + event.setCallStacks(StackUtils.createCallStack(4)); int invokeId = invokeIdSequencer.getAndIncrement(); event.setInvokeId(invokeId); diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/framework/dubbo/DubboHandler.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/framework/dubbo/DubboHandler.java index fd091da43..54381ad36 100644 --- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/framework/dubbo/DubboHandler.java +++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/framework/dubbo/DubboHandler.java @@ -97,7 +97,7 @@ public static void solveDubbo(MethodEvent event, AtomicInteger invokeIdSequencer if (!validArguments.isEmpty()) { Object[] verifiedArguments = validArguments.toArray(); event.source = true; - event.setCallStacks(StackUtils.createCallStack(9)); + event.setCallStacks(StackUtils.createCallStack(5)); int invokeId = invokeIdSequencer.getAndIncrement(); event.setInvokeId(invokeId); diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/MethodEvent.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/MethodEvent.java index 4dbe27919..3ea31b6b8 100644 --- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/MethodEvent.java +++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/MethodEvent.java @@ -306,7 +306,7 @@ public MethodEvent changeParameter(final int index, public void setCallStacks(StackTraceElement[] callStacks) { this.callStacks = callStacks; - this.setCallStack(callStacks[0]); + this.setCallStack(callStacks[1]); } public Object getObject() { diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java index d65d57e56..c2d303264 100644 --- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java +++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/DynamicPropagatorScanner.java @@ -69,7 +69,7 @@ public void scan(IastSinkModel sink, MethodEvent event) { } if (sinkSourceHitTaintPool(event, sink)) { - event.setCallStacks(StackUtils.createCallStack(11)); + event.setCallStacks(StackUtils.createCallStack(5)); int invokeId = SpyDispatcherImpl.INVOKE_ID_SEQUENCER.getAndIncrement(); event.setInvokeId(invokeId); EngineManager.TRACK_MAP.addTrackMethod(invokeId, event);