diff --git a/iast-agent/pom.xml b/iast-agent/pom.xml index 2440f618b..09b5cfc05 100755 --- a/iast-agent/pom.xml +++ b/iast-agent/pom.xml @@ -1,7 +1,7 @@ + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" + xmlns="http://maven.apache.org/POM/4.0.0"> 4.0.0 @@ -53,6 +53,12 @@ commons-io ${commons-io.version} + + + com.secnium.iast + iast-log + 1.2.0 + diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/Agent.java b/iast-agent/src/main/java/com/secnium/iast/agent/Agent.java index 6112d6b7f..7c4ad637c 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/Agent.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/Agent.java @@ -7,7 +7,7 @@ import java.net.URL; import java.net.URLClassLoader; -import com.secnium.iast.agent.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; import org.apache.commons.cli.CommandLine; import org.apache.commons.cli.CommandLineParser; import org.apache.commons.cli.DefaultParser; @@ -47,16 +47,16 @@ public static void main(String[] args) { String jdkVersion = getJdkVersion(); if ("1".equals(jdkVersion) && appendToolsPath()) { AttachLauncher.attach(pid, attachArgs); - LogUtils.info("engine " + attachArgs + " successfully. pid: " + pid); + DongTaiLog.info("engine " + attachArgs + " successfully. pid: " + pid); } else { AttachLauncher.attach(pid, attachArgs); - LogUtils.info("engine " + attachArgs + " successfully. pid: " + pid); + DongTaiLog.info("engine " + attachArgs + " successfully. pid: " + pid); } } else { formatter.printHelp("java -jar agent.jar", attachOptions, true); } } catch (Throwable t) { - LogUtils.error("Start DongTai Agent failed, exception stack trace: "); + DongTaiLog.error("Start DongTai Agent failed, exception stack trace: "); t.printStackTrace(); System.exit(-1); } @@ -69,7 +69,7 @@ public static void main(String[] args) { */ public static String getJdkVersion() { String jdkVersion = System.getProperty("java.version", "1.8"); - LogUtils.info("current jdk version is : " + jdkVersion); + DongTaiLog.info("current jdk version is : " + jdkVersion); String[] jdkVersionItem = jdkVersion.split("\\."); boolean isHighJdk = true; if (jdkVersionItem.length > 1 && ("6".equals(jdkVersionItem[1]) || "7".equals(jdkVersionItem[1]) || "8" diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/AgentLauncher.java b/iast-agent/src/main/java/com/secnium/iast/agent/AgentLauncher.java index a5ee5762d..ac70454d4 100755 --- a/iast-agent/src/main/java/com/secnium/iast/agent/AgentLauncher.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/AgentLauncher.java @@ -4,8 +4,10 @@ import com.secnium.iast.agent.monitor.EngineMonitor; import com.secnium.iast.agent.monitor.MonitorDaemonThread; import com.secnium.iast.agent.report.AgentRegisterReport; -import com.secnium.iast.agent.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; + import java.lang.instrument.Instrumentation; +import java.util.concurrent.TimeUnit; /** * @author dongzhiyong@huoxian.cn @@ -40,7 +42,7 @@ public static void premain(String args, Instrumentation inst) { */ public static void agentmain(String featureString, Instrumentation inst) { if ("uninstall".equals(featureString)) { - LogUtils.info("Engine is about to be uninstalled"); + DongTaiLog.info("Engine is about to be uninstalled"); uninstall(); } else { LAUNCH_MODE = LAUNCH_MODE_ATTACH; @@ -72,17 +74,17 @@ private static void install(final Instrumentation inst) { IastProperties iastProperties = IastProperties.getInstance(); Boolean send = AgentRegisterReport.send(); if (send) { - LogUtils.info("Agent has successfully registered with " + iastProperties.getBaseUrl()); + DongTaiLog.info("Agent has successfully registered with " + iastProperties.getBaseUrl()); Boolean agentStat = AgentRegisterReport.agentStat(); if (!agentStat) { EngineMonitor.isCoreRegisterStart = false; - LogUtils.info("The agent was not audited. Disable enabling."); + DongTaiLog.info("The agent was not audited. Disable enabling."); } else { EngineMonitor.isCoreRegisterStart = true; } loadEngine(inst); } else { - LogUtils.error("Agent register failed. Start without DongTai IAST."); + DongTaiLog.error("Agent register failed. Start without DongTai IAST."); } } diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/AttachLauncher.java b/iast-agent/src/main/java/com/secnium/iast/agent/AttachLauncher.java index fe861bc13..f3a5c3250 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/AttachLauncher.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/AttachLauncher.java @@ -1,9 +1,10 @@ package com.secnium.iast.agent; import com.secnium.iast.agent.util.JavaVersionUtils; -import com.secnium.iast.agent.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; import com.sun.tools.attach.AttachNotSupportedException; import com.sun.tools.attach.VirtualMachine; + import java.io.IOException; import java.util.Properties; @@ -17,17 +18,17 @@ public class AttachLauncher { public static void attach(String pid, String args) throws Exception { VirtualMachine vmObj = null; try { - LogUtils.info("trying attach to process " + pid + ", agent address is " + AGENT_PATH); + DongTaiLog.info("trying attach to process " + pid + ", agent address is " + AGENT_PATH); vmObj = VirtualMachine.attach(pid); Properties targetSystemProperties = vmObj.getSystemProperties(); String targetJavaVersion = JavaVersionUtils.javaVersionStr(targetSystemProperties); String currentJavaVersion = JavaVersionUtils.javaVersionStr(); if (targetJavaVersion != null && currentJavaVersion != null) { if (!targetJavaVersion.equals(currentJavaVersion)) { - LogUtils.error( + DongTaiLog.error( "Current VM java version: " + currentJavaVersion + " do not match target VM java version: " + targetJavaVersion + ", attach may fail."); - LogUtils.error( + DongTaiLog.error( "Target VM JAVA_HOME is " + targetSystemProperties.getProperty("java.home") + ", DongTai-Agent JAVA_HOME is " + System.getProperty("java.home") + ", try to set the same JAVA_HOME."); @@ -35,7 +36,7 @@ public static void attach(String pid, String args) throws Exception { } vmObj.loadAgent(AGENT_PATH, args); - LogUtils.info("attach to process " + pid + " success."); + DongTaiLog.info("attach to process " + pid + " success."); } finally { if (null != vmObj) { vmObj.detach(); diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/IastProperties.java b/iast-agent/src/main/java/com/secnium/iast/agent/IastProperties.java index 3fa6a2388..da8119127 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/IastProperties.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/IastProperties.java @@ -1,6 +1,7 @@ package com.secnium.iast.agent; -import com.secnium.iast.agent.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; + import java.io.ByteArrayInputStream; import java.io.File; import java.io.FileOutputStream; @@ -87,7 +88,7 @@ public void init(String path) throws ClassNotFoundException { ByteArrayInputStream inputStream = new ByteArrayInputStream(data); cfg.load(inputStream); - LogUtils.info( + DongTaiLog.info( "The engine configuration file is initialized successfully. file is " + propertiesFile.toString()); } catch (IOException e) { e.printStackTrace(); diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/ShutdownThread.java b/iast-agent/src/main/java/com/secnium/iast/agent/ShutdownThread.java index 654e04dcd..af83726c6 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/ShutdownThread.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/ShutdownThread.java @@ -1,15 +1,15 @@ package com.secnium.iast.agent; import com.secnium.iast.agent.monitor.MonitorDaemonThread; -import com.secnium.iast.agent.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; public class ShutdownThread extends Thread { @Override public void run() { - LogUtils.info("enter shutdown thread"); + DongTaiLog.info("enter shutdown thread"); MonitorDaemonThread.isExit = true; - LogUtils.info("exit shutdown thread"); + DongTaiLog.info("exit shutdown thread"); } } diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/manager/EngineManager.java b/iast-agent/src/main/java/com/secnium/iast/agent/manager/EngineManager.java index fb05f4507..d299b5c1b 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/manager/EngineManager.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/manager/EngineManager.java @@ -2,8 +2,8 @@ import com.secnium.iast.agent.*; import com.secnium.iast.agent.report.AgentRegisterReport; -import com.secnium.iast.agent.util.LogUtils; import com.secnium.iast.agent.util.http.HttpClientUtils; +import com.secnium.iast.log.DongTaiLog; import java.io.BufferedInputStream; import java.io.File; @@ -134,7 +134,7 @@ private boolean downloadJarPackageToCacheFromUrl(String fileUrl, String fileName final File classPath = new File(new File(fileName).getParent()); if (!classPath.mkdirs() && !classPath.exists()) { - LogUtils.info("Check or create local file cache path, path is " + classPath); + DongTaiLog.info("Check or create local file cache path, path is " + classPath); } FileOutputStream fileOutputStream = new FileOutputStream(fileName); byte[] dataBuffer = new byte[1024]; @@ -142,10 +142,10 @@ private boolean downloadJarPackageToCacheFromUrl(String fileUrl, String fileName while ((bytesRead = in.read(dataBuffer, 0, 1024)) != -1) { fileOutputStream.write(dataBuffer, 0, bytesRead); } - LogUtils.info("The remote file " + fileUrl + " was successfully written to the local cache."); + DongTaiLog.info("The remote file " + fileUrl + " was successfully written to the local cache."); status = true; } catch (Exception ignore) { - LogUtils.error("The remote file " + fileUrl + " download failure, please check the iast-token."); + DongTaiLog.error("The remote file " + fileUrl + " download failure, please check the iast-token."); } return status; } @@ -164,7 +164,7 @@ public boolean updateEnginePackage() { public boolean downloadEnginePackage() { if (engineNotExist(getInjectPackageCachePath()) || engineNotExist(getEnginePackageCachePath())) { - LogUtils.info("Engine does not exist in local cache, the engine will be downloaded."); + DongTaiLog.info("Engine does not exist in local cache, the engine will be downloaded."); return updateEnginePackage(); } else { return true; @@ -184,11 +184,11 @@ public boolean install() { .invoke(null, launchMode, this.properties.getPropertiesFilePath(), AgentRegisterReport.getAgentFlag(), inst, agentPath); return true; } catch (IOException e) { - LogUtils.error("DongTai engine start failed, please contact staff for help."); + DongTaiLog.error("DongTai engine start failed, please contact staff for help."); } catch (ClassNotFoundException e) { - LogUtils.error(" DongTai engine start failed, please contact staff for help."); + DongTaiLog.error(" DongTai engine start failed, please contact staff for help."); } catch (Throwable throwable) { - LogUtils.error("DongTai engine start failed, please contact staff for help."); + DongTaiLog.error("DongTai engine start failed, please contact staff for help."); throwable.printStackTrace(); } return false; @@ -202,18 +202,18 @@ public boolean start() { try { if (classOfEngine != null) { classOfEngine.getMethod("start").invoke(null); - LogUtils.info("DongTai engine start successfully."); + DongTaiLog.info("DongTai engine start successfully."); return true; } return false; } catch (InvocationTargetException e) { - LogUtils.error("DongTai engine start failed, please contact staff for help."); + DongTaiLog.error("DongTai engine start failed, please contact staff for help."); } catch (NoSuchMethodException e) { - LogUtils.error("DongTai engine start failed, please contact staff for help."); + DongTaiLog.error("DongTai engine start failed, please contact staff for help."); } catch (IllegalAccessException e) { - LogUtils.error("DongTai engine start failed, please contact staff for help."); + DongTaiLog.error("DongTai engine start failed, please contact staff for help."); } catch (Throwable throwable) { - LogUtils.error("DongTai engine start failed, please contact staff for help."); + DongTaiLog.error("DongTai engine start failed, please contact staff for help."); throwable.printStackTrace(); } return false; @@ -229,23 +229,23 @@ public boolean stop() { try { if (classOfEngine != null) { classOfEngine.getMethod("stop").invoke(null); - LogUtils.info("DongTai engine stop successfully."); + DongTaiLog.info("DongTai engine stop successfully."); return true; } return false; } catch (InvocationTargetException e) { - LogUtils.error("DongTai engine stop failed, please contact staff for help."); + DongTaiLog.error("DongTai engine stop failed, please contact staff for help."); StringWriter sw = new StringWriter(); PrintWriter pw = new PrintWriter(sw); e.printStackTrace(pw); - LogUtils.error(sw.toString()); + DongTaiLog.error(sw.toString()); } catch (NoSuchMethodException e) { - LogUtils.error("DongTai engine stop failed, please contact staff for help."); + DongTaiLog.error("DongTai engine stop failed, please contact staff for help."); } catch (IllegalAccessException e) { - LogUtils.error("DongTai engine stop failed, please contact staff for help."); + DongTaiLog.error("DongTai engine stop failed, please contact staff for help."); e.printStackTrace(); } catch (Throwable throwable) { - LogUtils.error("DongTai engine stop failed, please contact staff for help."); + DongTaiLog.error("DongTai engine stop failed, please contact staff for help."); throwable.printStackTrace(); } return false; @@ -329,10 +329,10 @@ private static synchronized ClassLoader loadOrDefineClassLoader(final String cor * @return true-引擎不存在；false-引擎存在 */ private boolean engineNotExist(final String jarPath) { - LogUtils.info("Check if the engine[" + jarPath + "] needs to be updated"); + DongTaiLog.info("Check if the engine[" + jarPath + "] needs to be updated"); if (properties.isDebug()) { - LogUtils.info("current mode: debug, load engine from " + jarPath); + DongTaiLog.info("current mode: debug, load engine from " + jarPath); File tempFile = new File(jarPath); return !tempFile.exists(); } else { diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/monitor/EngineMonitor.java b/iast-agent/src/main/java/com/secnium/iast/agent/monitor/EngineMonitor.java index 8c92efe4d..5d23afab1 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/monitor/EngineMonitor.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/monitor/EngineMonitor.java @@ -3,8 +3,8 @@ import com.secnium.iast.agent.*; import com.secnium.iast.agent.manager.EngineManager; import com.secnium.iast.agent.report.AgentRegisterReport; -import com.secnium.iast.agent.util.LogUtils; import com.secnium.iast.agent.util.http.HttpClientUtils; +import com.secnium.iast.log.DongTaiLog; import org.json.JSONObject; /** @@ -31,10 +31,10 @@ public void check() { isCoreRegisterStart = true; startEngine(); }else if ("coreStop".equals(status) && isCoreRegisterStart) { - LogUtils.info("engine stop"); + DongTaiLog.info("engine stop"); engineManager.stop(); } else if ("coreStart".equals(status) && isCoreRegisterStart) { - LogUtils.info("engine start"); + DongTaiLog.info("engine start"); engineManager.start(); } } @@ -57,7 +57,7 @@ public void startEngine() { status = status && engineManager.install(); status = status && engineManager.start(); if (!status) { - LogUtils.info("DongTai IAST started failure"); + DongTaiLog.info("DongTai IAST started failure"); } } } diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/monitor/MonitorDaemonThread.java b/iast-agent/src/main/java/com/secnium/iast/agent/monitor/MonitorDaemonThread.java index 0c8ff9be2..3a838e20f 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/monitor/MonitorDaemonThread.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/monitor/MonitorDaemonThread.java @@ -1,7 +1,8 @@ package com.secnium.iast.agent.monitor; import com.secnium.iast.agent.manager.EngineManager; -import com.secnium.iast.agent.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; + import java.util.ArrayList; /** @@ -22,10 +23,10 @@ public MonitorDaemonThread(EngineManager engineManager) { this.engineManager = engineManager; try { delayTime = Integer.parseInt(System.getProperty("iast.engine.delay.time", "0")); - LogUtils.info("engine delay time is " + delayTime + " s"); + DongTaiLog.info("engine delay time is " + delayTime + " s"); delayTime = delayTime * 1000; } catch (Exception e) { - LogUtils.error("engine delay time must be int,eg: 10、20"); + DongTaiLog.error("engine delay time must be int,eg: 10、20"); delayTime = 0; } } @@ -65,7 +66,7 @@ public void startEngine() { status = status && engineManager.install(); status = status && engineManager.start(); if (!status) { - LogUtils.info("DongTai IAST started failure"); + DongTaiLog.info("DongTai IAST started failure"); } } } diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/monitor/PerformanceMonitor.java b/iast-agent/src/main/java/com/secnium/iast/agent/monitor/PerformanceMonitor.java index f71055fde..b8ed4cc65 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/monitor/PerformanceMonitor.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/monitor/PerformanceMonitor.java @@ -1,9 +1,9 @@ package com.secnium.iast.agent.monitor; -import com.secnium.iast.agent.util.LogUtils; import com.secnium.iast.agent.IastProperties; import com.secnium.iast.agent.manager.EngineManager; import com.secnium.iast.agent.report.AgentRegisterReport; +import com.secnium.iast.log.DongTaiLog; import org.json.JSONArray; import org.json.JSONObject; import oshi.SystemInfo; @@ -43,7 +43,7 @@ public double memUsedRate() { return free / max; } - public static Integer getCpuUsage(){ + public static Integer getCpuUsage() { return CPU_USAGE; } @@ -65,7 +65,7 @@ public Integer cpuUsedRate() { long iowait = ticks[CentralProcessor.TickType.IOWAIT.getIndex()] - prevTicks[CentralProcessor.TickType.IOWAIT.getIndex()]; long idle = ticks[CentralProcessor.TickType.IDLE.getIndex()] - prevTicks[CentralProcessor.TickType.IDLE.getIndex()]; long totalCpu = user + nice + cSys + idle + iowait + irq + softirq + steal; - CPU_USAGE = (int)((1.0 - (idle * 1.0 / totalCpu)) * 100); + CPU_USAGE = (int) ((1.0 - (idle * 1.0 / totalCpu)) * 100); return CPU_USAGE; } @@ -120,11 +120,11 @@ public void check() { if (isStart(UsedRate, preStatus)) { this.engineManager.start(); this.engineManager.setRunningStatus(0); - LogUtils.info("The current CPU usage is " + UsedRate + "%, lower than the threshold " + AGENT_THRESHOLD_VALUE + "%，and the detection engine is starting"); + DongTaiLog.info("The current CPU usage is " + UsedRate + "%, lower than the threshold " + AGENT_THRESHOLD_VALUE + "%，and the detection engine is starting"); } else if (isStop(UsedRate, preStatus)) { this.engineManager.stop(); this.engineManager.setRunningStatus(1); - LogUtils.info("The current CPU usage is " + UsedRate + "%, higher than the threshold " + AGENT_THRESHOLD_VALUE + "%，and the detection engine is stopping"); + DongTaiLog.info("The current CPU usage is " + UsedRate + "%, higher than the threshold " + AGENT_THRESHOLD_VALUE + "%，and the detection engine is stopping"); } } diff --git a/iast-agent/src/main/java/com/secnium/iast/agent/report/AgentRegisterReport.java b/iast-agent/src/main/java/com/secnium/iast/agent/report/AgentRegisterReport.java index 3009d13ca..9b43854f0 100644 --- a/iast-agent/src/main/java/com/secnium/iast/agent/report/AgentRegisterReport.java +++ b/iast-agent/src/main/java/com/secnium/iast/agent/report/AgentRegisterReport.java @@ -5,15 +5,17 @@ import com.secnium.iast.agent.manager.EngineManager; import com.secnium.iast.agent.middlewarerecognition.IServer; import com.secnium.iast.agent.middlewarerecognition.ServerDetect; -import com.secnium.iast.agent.util.LogUtils; import com.secnium.iast.agent.util.base64.Base64Encoder; import com.secnium.iast.agent.util.http.HttpClientUtils; + import java.net.Inet6Address; import java.net.InetAddress; import java.net.NetworkInterface; import java.net.SocketException; import java.net.UnknownHostException; import java.util.Enumeration; + +import com.secnium.iast.log.DongTaiLog; import org.json.JSONObject; /** @@ -194,7 +196,7 @@ private String readIpInfo() { public void register() { try { String msg = generateAgentRegisterMsg(); - LogUtils.info("register agent"); + DongTaiLog.info("register agent"); StringBuilder responseRaw = HttpClientUtils.sendPost(Constant.API_AGENT_REGISTER, msg); if (!isRegistered()) { setAgentData(responseRaw); diff --git a/iast-agent/src/test/java/com/secnium/iast/agent/monitor/EngineMonitor.java b/iast-agent/src/test/java/com/secnium/iast/agent/monitor/EngineMonitor.java index fd1f410d1..14bfba1bf 100644 --- a/iast-agent/src/test/java/com/secnium/iast/agent/monitor/EngineMonitor.java +++ b/iast-agent/src/test/java/com/secnium/iast/agent/monitor/EngineMonitor.java @@ -5,6 +5,7 @@ import com.secnium.iast.agent.report.AgentRegisterReport; import com.secnium.iast.agent.util.LogUtils; import com.secnium.iast.agent.util.http.HttpClientUtils; +import com.secnium.iast.log.DongTaiLog; import org.json.JSONObject; /** @@ -29,13 +30,13 @@ public void check() { } else if (status.equals(this.currentStatus)) { return; } else if ("coreStop".equals(status)) { - LogUtils.info("engine stop"); + DongTaiLog.info("engine stop"); engineManager.stop(); - if (currentStatus == null){ + if (currentStatus == null) { return; } } else if ("coreStart".equals(status)) { - LogUtils.info("engine start"); + DongTaiLog.info("engine start"); engineManager.start(); } this.currentStatus = status; diff --git a/iast-core/pom.xml b/iast-core/pom.xml index 2d529f176..f4b5f0c41 100755 --- a/iast-core/pom.xml +++ b/iast-core/pom.xml @@ -1,7 +1,7 @@ + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" + xmlns="http://maven.apache.org/POM/4.0.0"> 4.0.0 @@ -148,18 +148,6 @@ provided - - - org.slf4j - slf4j-api - ${slf4j-api.version} - - - ch.qos.logback - logback-classic - ${logback-classic.version} - - org.apache.commons commons-lang3 @@ -218,6 +206,11 @@ ${apache-httpclient.version} provided + + com.secnium.iast + iast-log + 1.2.0 + diff --git a/iast-core/src/main/java/com/secnium/iast/core/AbstractThread.java b/iast-core/src/main/java/com/secnium/iast/core/AbstractThread.java index 00269c66d..8a62ed3ad 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/AbstractThread.java +++ b/iast-core/src/main/java/com/secnium/iast/core/AbstractThread.java @@ -1,8 +1,7 @@ package com.secnium.iast.core; -import com.secnium.iast.core.util.LogUtils; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; import java.io.IOException; @@ -12,7 +11,6 @@ * @author dongzhiyong@huoxian.cn */ public abstract class AbstractThread extends Thread { - private final Logger logger = LogUtils.getLogger(getClass()); @Override public void run() { @@ -23,9 +21,9 @@ public void run() { try { send(); } catch (IOException e) { - logger.error("report error reason: ", e); + DongTaiLog.error("report error reason: {}", e); } catch (Exception e) { - logger.error("report error, reason: ", e); + DongTaiLog.error("report error, reason: {}", e); } if (isRunning) { EngineManager.turnOnLingzhi(); diff --git a/iast-core/src/main/java/com/secnium/iast/core/AgentEngine.java b/iast-core/src/main/java/com/secnium/iast/core/AgentEngine.java index ded45dd43..79f3c4a8b 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/AgentEngine.java +++ b/iast-core/src/main/java/com/secnium/iast/core/AgentEngine.java @@ -7,18 +7,18 @@ import com.secnium.iast.core.engines.impl.SpyEngine; import com.secnium.iast.core.engines.impl.TransformEngine; import com.secnium.iast.core.report.StartUpTimeReport; -import com.secnium.iast.core.util.LogUtils; + import java.lang.instrument.Instrumentation; import java.util.ArrayList; import java.util.ListIterator; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class AgentEngine { - private static final Logger logger = LogUtils.getLogger(AgentEngine.class); private static AgentEngine instance; public long getStartUpTime() { @@ -49,13 +49,13 @@ public AgentEngine() { public static void install(String mode, String propertiesFilePath, Integer agentId, Instrumentation inst, - String agentFile) { + String agentFile) { long start = System.currentTimeMillis(); if ("true".equals(System.getProperty("DongTai.IAST.Status"))) { - logger.info("DongTai IAST has Installed."); + DongTaiLog.info("DongTai IAST has Installed."); return; } - logger.info("DongTai Engine is about to be installed, the installation mode is {}", mode); + DongTaiLog.info("DongTai Engine is about to be installed, the installation mode is {}", mode); PropertyUtils propertiesUtils = PropertyUtils.getInstance(propertiesFilePath); EngineManager.setAgentPath(agentFile); EngineManager.setAgentId(agentId); @@ -68,28 +68,28 @@ public static void install(String mode, String propertiesFilePath, Integer agent StartUpTimeReport.sendReport(EngineManager.getAgentId(), startupTime); EngineManager.agentStarted(); System.setProperty("DongTai.IAST.Status", "true"); - logger.info("DongTai Engine is successfully installed to the JVM, and it takes {} s", + DongTaiLog.info("DongTai Engine is successfully installed to the JVM, and it takes {} s", agentEngine.getStartUpTime() / 1000); } public static void start() { - logger.info("Turn on the engine"); + DongTaiLog.info("Turn on the engine"); EngineManager.turnOnEngine(); - logger.info("Engine opened successfully"); + DongTaiLog.info("Engine opened successfully"); } public static void stop() { - logger.info("Turn off the engine"); + DongTaiLog.info("Turn off the engine"); EngineManager.turnOffEngine(); - logger.info("Engine shut down successfully"); + DongTaiLog.info("Engine shut down successfully"); } public static void destroy(String mode, String propertiesFilePath, Instrumentation inst) { - logger.info("Uninstall engine"); + DongTaiLog.info("Uninstall engine"); AgentEngine agentEngine = AgentEngine.getInstance(); assert agentEngine != null; agentEngine.destroy(); - logger.info("Engine uninstallation succeeded"); + DongTaiLog.info("Engine uninstallation succeeded"); } diff --git a/iast-core/src/main/java/com/secnium/iast/core/EngineManager.java b/iast-core/src/main/java/com/secnium/iast/core/EngineManager.java index 93a02a6c2..d9628a23f 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/EngineManager.java +++ b/iast-core/src/main/java/com/secnium/iast/core/EngineManager.java @@ -11,7 +11,7 @@ import com.secnium.iast.core.threadlocalpool.IastTaintPool; import com.secnium.iast.core.threadlocalpool.IastTrackMap; import com.secnium.iast.core.threadlocalpool.RequestContext; -import com.secnium.iast.core.util.LogUtils; + import java.io.File; import java.lang.reflect.Method; import java.net.URL; @@ -19,7 +19,6 @@ import java.util.HashSet; import java.util.Map; import java.util.concurrent.ArrayBlockingQueue; -import org.slf4j.Logger; /** * 存储全局信息 @@ -91,7 +90,9 @@ public static void setInstance() { instance = null; } + private EngineManager(final PropertyUtils cfg) { + this.cfg = cfg; } diff --git a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/ConfigEngine.java b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/ConfigEngine.java index 14fe4d272..5eb9eb2fb 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/ConfigEngine.java +++ b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/ConfigEngine.java @@ -3,16 +3,16 @@ import com.secnium.iast.core.PropertyUtils; import com.secnium.iast.core.engines.IEngine; import com.secnium.iast.core.handler.models.IastHookRuleModel; -import com.secnium.iast.core.util.LogUtils; + import java.lang.instrument.Instrumentation; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class ConfigEngine implements IEngine { - private final Logger logger = LogUtils.getLogger(ConfigEngine.class); @Override public void init(PropertyUtils cfg, Instrumentation inst) { @@ -20,9 +20,9 @@ public void init(PropertyUtils cfg, Instrumentation inst) { @Override public void start() { - logger.info("Initialize the core configuration of the engine"); + DongTaiLog.info("Initialize the core configuration of the engine"); IastHookRuleModel.buildModel(); - logger.info("The engine's core configuration is initialized successfully."); + DongTaiLog.info("The engine's core configuration is initialized successfully."); } @Override diff --git a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/SandboxEngine.java b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/SandboxEngine.java index e6051ebfc..dc83a4db0 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/SandboxEngine.java +++ b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/SandboxEngine.java @@ -3,16 +3,14 @@ import com.secnium.iast.core.EngineManager; import com.secnium.iast.core.PropertyUtils; import com.secnium.iast.core.engines.IEngine; -import com.secnium.iast.core.util.LogUtils; + +import com.secnium.iast.log.DongTaiLog; import java.lang.instrument.Instrumentation; -import org.slf4j.Logger; /** * @author dongzhiyong@huoxian.cn */ public class SandboxEngine implements IEngine { - - private final Logger logger = LogUtils.getLogger(getClass()); private PropertyUtils cfg; @Override @@ -22,12 +20,12 @@ public void init(PropertyUtils cfg, Instrumentation inst) { @Override public void start() { - if (logger.isDebugEnabled()) { - logger.debug("initing global control instance"); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("initing global control instance"); } EngineManager.getInstance(cfg); - if (logger.isDebugEnabled()) { - logger.debug("inited global control instance"); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("inited global control instance"); } } @@ -40,9 +38,9 @@ public void stop() { @Override public void destroy() { - logger.info("destroy engine instance"); + DongTaiLog.info("destroy engine instance"); EngineManager.setInstance(); - logger.info("destroy engine instance"); + DongTaiLog.info("destroy engine instance"); } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/ServiceEngine.java b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/ServiceEngine.java index b013cc4a8..2da8a2e39 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/ServiceEngine.java +++ b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/ServiceEngine.java @@ -3,16 +3,16 @@ import com.secnium.iast.core.PropertyUtils; import com.secnium.iast.core.ServiceFactory; import com.secnium.iast.core.engines.IEngine; -import com.secnium.iast.core.util.LogUtils; + import java.lang.instrument.Instrumentation; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class ServiceEngine implements IEngine { - private final Logger logger = LogUtils.getLogger(getClass()); private ServiceFactory serviceFactory; @Override @@ -23,9 +23,9 @@ public void init(PropertyUtils cfg, Instrumentation inst) { @Override public void start() { - logger.info("Start the data reporting submodule"); + DongTaiLog.info("Start the data reporting submodule"); serviceFactory.start(); - logger.info("The data reporting submodule started successfully"); + DongTaiLog.info("The data reporting submodule started successfully"); } @Override @@ -35,8 +35,8 @@ public void stop() { @Override public void destroy() { - logger.info("Destroy the data reporting submodule"); + DongTaiLog.info("Destroy the data reporting submodule"); serviceFactory.destory(); - logger.info("The data reporting submodule is destroyed successfully"); + DongTaiLog.info("The data reporting submodule is destroyed successfully"); } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/SpyEngine.java b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/SpyEngine.java index 05041bc20..e7f7bbf0e 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/SpyEngine.java +++ b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/SpyEngine.java @@ -3,16 +3,16 @@ import com.secnium.iast.core.PropertyUtils; import com.secnium.iast.core.engines.IEngine; import com.secnium.iast.core.enhance.asm.SpyUtils; -import com.secnium.iast.core.util.LogUtils; + import java.lang.instrument.Instrumentation; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class SpyEngine implements IEngine { - private final Logger logger = LogUtils.getLogger(getClass()); private PropertyUtils cfg; @Override @@ -22,9 +22,9 @@ public void init(PropertyUtils cfg, Instrumentation inst) { @Override public void start() { - logger.info("Register spy submodule"); + DongTaiLog.info("Register spy submodule"); SpyUtils.init(cfg.getNamespace()); - logger.info("Spy sub-module registered successfully"); + DongTaiLog.info("Spy sub-module registered successfully"); } @Override @@ -34,8 +34,8 @@ public void stop() { @Override public void destroy() { - logger.info("Uninstall the spy submodule"); + DongTaiLog.info("Uninstall the spy submodule"); SpyUtils.clean(cfg.getNamespace()); - logger.info("Spy submodule uninstalled successfully"); + DongTaiLog.info("Spy submodule uninstalled successfully"); } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/TransformEngine.java b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/TransformEngine.java index 532dc6987..c697e6cf3 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/engines/impl/TransformEngine.java +++ b/iast-core/src/main/java/com/secnium/iast/core/engines/impl/TransformEngine.java @@ -4,16 +4,16 @@ import com.secnium.iast.core.engines.IEngine; import com.secnium.iast.core.enhance.IastClassFileTransformer; import com.secnium.iast.core.report.ErrorLogReport; -import com.secnium.iast.core.util.LogUtils; + import java.lang.instrument.Instrumentation; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class TransformEngine implements IEngine { - private final Logger logger = LogUtils.getLogger(getClass()); private Instrumentation inst; @Override @@ -24,11 +24,11 @@ public void init(PropertyUtils cfg, Instrumentation inst) { @Override public void start() { try { - logger.info("Install data acquisition and analysis sub-modules"); + DongTaiLog.info("Install data acquisition and analysis sub-modules"); IastClassFileTransformer.init(inst); - logger.info("The sub-module of data acquisition and analysis is successfully installed"); + DongTaiLog.info("The sub-module of data acquisition and analysis is successfully installed"); } catch (Throwable cause) { - logger.error("Failed to install the sub-module of data collection and analysis"); + DongTaiLog.error("Failed to install the sub-module of data collection and analysis"); ErrorLogReport.sendErrorLog(cause); } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java index c928cab20..4fad5490d 100755 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassFileTransformer.java @@ -11,8 +11,8 @@ import com.secnium.iast.core.enhance.sca.ScaScanner; import com.secnium.iast.core.report.ErrorLogReport; import com.secnium.iast.core.util.AsmUtils; -import com.secnium.iast.core.util.LogUtils; import com.secnium.iast.core.util.matcher.ConfigMatcher; + import java.io.File; import java.io.IOException; import java.lang.instrument.ClassFileTransformer; @@ -22,11 +22,12 @@ import java.security.ProtectionDomain; import java.util.HashSet; import java.util.List; + import org.apache.commons.lang3.time.StopWatch; import org.objectweb.asm.ClassReader; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.ClassWriter; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn @@ -35,7 +36,6 @@ public class IastClassFileTransformer implements ClassFileTransformer { private final IastClassAncestorQuery COMMON_UTILS = IastClassAncestorQuery.getInstance(); - private final Logger logger; private final boolean isDumpClass; private final Instrumentation inst; private final String namespace; @@ -44,7 +44,6 @@ public class IastClassFileTransformer implements ClassFileTransformer { IastClassFileTransformer(Instrumentation inst) { - this.logger = LogUtils.getLogger(getClass()); this.inst = inst; this.namespace = EngineManager.getNamespace(); this.isDumpClass = EngineManager.isEnableDumpClass(); @@ -72,14 +71,13 @@ public byte[] transform(final ClassLoader loader, if (internalClassName == null) { return null; } - boolean isRunning = EngineManager.isLingzhiRunning(); if (isRunning) { EngineManager.turnOffLingzhi(); } StopWatch clock = null; - if (logger.isDebugEnabled()) { + if (DongTaiLog.isDebugEnabled()) { clock = new StopWatch(); clock.start(); } @@ -114,17 +112,17 @@ public byte[] transform(final ClassLoader loader, cr.accept(cv, ClassReader.EXPAND_FRAMES); AbstractClassVisitor dumpClassVisitor = (AbstractClassVisitor) cv; if (dumpClassVisitor.hasTransformed()) { - if (logger.isDebugEnabled() && null != clock) { + if (DongTaiLog.isDebugEnabled() && null != clock) { clock.stop(); - logger.debug("conversion class {} is successful, and it takes {}ms.", internalClassName, + DongTaiLog.debug("conversion class {} is successful, and it takes {}ms.", internalClassName, clock.getTime()); } return dumpClassIfNecessary(cr.getClassName(), cw.toByteArray(), srcByteCodeArray); } } else { - if (logger.isDebugEnabled() && null != clock) { + if (DongTaiLog.isDebugEnabled() && null != clock) { clock.stop(); - logger.debug("failed to convert the class {}, and it takes {} ms", internalClassName, + DongTaiLog.debug("failed to convert the class {}, and it takes {} ms", internalClassName, clock.getTime()); } } @@ -147,7 +145,7 @@ public byte[] transform(final ClassLoader loader, * @return ClassWriter */ private ClassWriter createClassWriter(final ClassLoader targetClassLoader, - final ClassReader cr) { + final ClassReader cr) { return new ClassWriter(cr, COMPUTE_FRAMES | COMPUTE_MAXS) { /* @@ -189,17 +187,17 @@ private byte[] dumpClassIfNecessary(String className, byte[] data, byte[] origin final File classPath = new File(enhancedClass.getParent()); if (!classPath.mkdirs() && !classPath.exists()) { - logger.warn("create dump classpath={} failed.", classPath); + DongTaiLog.warn("create dump classpath={} failed.", classPath); return data; } writeByteArrayToFile(enhancedClass, data); writeByteArrayToFile(originalClass, originalData); - if (logger.isDebugEnabled()) { - logger.debug("dump class {} to {} success.", className, enhancedClass); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("dump class {} to {} success.", className, enhancedClass); } } catch (IOException e) { - logger.error("dump class {} failed. reason: {}", className, e); + DongTaiLog.error("dump class {} failed. reason: {}", className, e); } return data; @@ -238,8 +236,8 @@ private void retransform() { try { inst.retransformClasses(waitingReTransformClass); - if (logger.isDebugEnabled()) { - logger.debug("reTransform class {} success, index={};total={};", waitingReTransformClass, index - 1, + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("reTransform class {} success, index={};total={};", waitingReTransformClass, index - 1, total); } } catch (Throwable t) { diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassHookPointMatcher.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassHookPointMatcher.java index b47e26353..0ff86623e 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassHookPointMatcher.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/IastClassHookPointMatcher.java @@ -1,12 +1,13 @@ package com.secnium.iast.core.enhance; -import com.secnium.iast.core.util.LogUtils; import com.secnium.iast.core.util.matcher.ConfigMatcher; + import java.lang.instrument.Instrumentation; import java.util.ArrayList; import java.util.Iterator; import java.util.List; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * 判断类 是否允许hook @@ -15,7 +16,6 @@ */ public class IastClassHookPointMatcher { - private final Logger logger = LogUtils.getLogger(getClass()); private final Instrumentation inst; public IastClassHookPointMatcher(Instrumentation inst) { @@ -67,8 +67,8 @@ public static List> findForRetransform(Instrumentation inst, boolean is final Class clazz = itForLoaded.next(); if (isRemoveUnsupported && !inst.isModifiableClass(clazz)) { - if (classHookManager.logger.isDebugEnabled()) { - classHookManager.logger.debug("remove from findForReTransform, because class:" + clazz.getName() + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("remove from findForReTransform, because class:" + clazz.getName() + " is unModifiable"); } continue; @@ -79,12 +79,12 @@ public static List> findForRetransform(Instrumentation inst, boolean is ClassLoader loader = clazz.getClassLoader(); if (ConfigMatcher.isHookPoint(className, loader)) { classes.add(clazz); - if (classHookManager.logger.isDebugEnabled()) { - classHookManager.logger.debug("findForReTransform: class " + clazz.getName() + " is added"); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("findForReTransform: class " + clazz.getName() + " is added"); } } else { - if (classHookManager.logger.isDebugEnabled()) { - classHookManager.logger.debug("findForReTransform: class " + clazz.getName() + " is ignored"); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("findForReTransform: class " + clazz.getName() + " is ignored"); } } } catch (Throwable cause) { @@ -93,10 +93,9 @@ public static List> findForRetransform(Instrumentation inst, boolean is // 所以当尝试获取这个类更多详细信息的时候会引起关联类的ClassNotFoundException等未知的错误（取决于底层ClassLoader的实现） // 这里没有办法穷举出所有的异常情况，所以catch Throwable来完成异常容灾处理 // 当解析类出现异常的时候，直接简单粗暴的认为根本没有这个类就好了 - if (classHookManager.logger.isDebugEnabled()) { - classHookManager.logger - .debug("remove from findForReTransform, because loading class:" + clazz.getName() - + " occur an exception", cause); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("remove from findForReTransform, because loading class:" + clazz.getName() + + " occur an exception", cause); } } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/cookie/BaseType.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/cookie/BaseType.java index 3ed7decba..90a695175 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/cookie/BaseType.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/cookie/BaseType.java @@ -4,10 +4,9 @@ import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor; import com.secnium.iast.core.enhance.plugins.core.adapter.PropagateAdviceAdapter; import com.secnium.iast.core.util.AsmUtils; -import com.secnium.iast.core.util.LogUtils; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; import java.util.List; @@ -18,8 +17,6 @@ * @author dongzhiyong@huoxian.cn */ public class BaseType extends AbstractClassVisitor { - private final Logger logger = LogUtils.getLogger(getClass()); - private final List hookMethods; public BaseType(ClassVisitor classVisitor, IastContext context, List methods) { @@ -36,8 +33,8 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri String framework = "refType"; mv = new PropagateAdviceAdapter(mv, access, name, desc, context, framework, iastMethodSignature); transformed = true; - if (logger.isDebugEnabled()) { - logger.debug("rewrite method {} for listener[match={},class={}]", iastMethodSignature, context.getMatchClassName(), context.getClassName()); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("rewrite method {} for listener[match={},class={}]", iastMethodSignature, context.getMatchClassName(), context.getClassName()); } } return mv; diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/cookie/DispatchCookie.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/cookie/DispatchCookie.java index fbb084dd7..ad3f84cc5 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/cookie/DispatchCookie.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/cookie/DispatchCookie.java @@ -2,10 +2,11 @@ import com.secnium.iast.core.enhance.IastContext; import com.secnium.iast.core.enhance.plugins.DispatchPlugin; -import com.secnium.iast.core.util.LogUtils; + import java.util.Set; + import org.objectweb.asm.ClassVisitor; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn @@ -25,8 +26,8 @@ public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) { classname = context.getClassName(); String matchClassname = isMatch(); if (null != matchClassname) { - if (logger.isDebugEnabled()) { - logger.debug("Cookie match class for {} from {}", classname, matchClassname); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("Cookie match class for {} from {}", classname, matchClassname); } context.setMatchClassName(matchClassname); classVisitor = new CookieAdapter(classVisitor, context); @@ -60,5 +61,4 @@ static boolean isHookMethod(String name) { } - private final Logger logger = LogUtils.getLogger(getClass()); } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/core/DispatchClassPlugin.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/core/DispatchClassPlugin.java index 18b04b9e9..dbaa24b0c 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/core/DispatchClassPlugin.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/core/DispatchClassPlugin.java @@ -13,15 +13,16 @@ import com.secnium.iast.core.handler.models.IastSinkModel; import com.secnium.iast.core.handler.vulscan.VulnType; import com.secnium.iast.core.util.AsmUtils; -import com.secnium.iast.core.util.LogUtils; import com.secnium.iast.core.util.matcher.Method; + import java.lang.reflect.Modifier; import java.util.Arrays; import java.util.Set; + import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; import org.objectweb.asm.commons.JSRInlinerAdapter; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn @@ -30,14 +31,12 @@ public class DispatchClassPlugin implements DispatchPlugin { private final static EngineManager JVM_SANDBOX = EngineManager.getInstance(); private final static PropertyUtils PROPERTIES_UTILS = JVM_SANDBOX.getCfg(); - private final Logger logger; private final boolean enableAllHook; private Set ancestors; private String className; public DispatchClassPlugin() { this.enableAllHook = PROPERTIES_UTILS.isEnableAllHook(); - this.logger = LogUtils.getLogger(getClass()); } @Override @@ -48,8 +47,8 @@ public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) { String matchClassName = isMatch(); if (null != matchClassName) { - if (logger.isDebugEnabled()) { - logger.debug("class {} hit rule {}, class diagrams: {}", className, matchClassName, + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("class {} hit rule {}, class diagrams: {}", className, matchClassName, Arrays.toString(ancestors.toArray())); } context.setMatchClassName(matchClassName); @@ -95,7 +94,7 @@ public boolean hasTransformed() { @Override public MethodVisitor visitMethod(final int access, final String name, final String desc, final String signature, - final String[] exceptions) { + final String[] exceptions) { MethodVisitor mv = super.visitMethod(access, name, desc, signature, exceptions); if (!Modifier.isInterface(access) && !Modifier.isAbstract(access) && !"".equals(name)) { @@ -110,8 +109,8 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri mv = new JSRInlinerAdapter(mv, access, name, desc, signature, exceptions); } - if (transformed && logger.isDebugEnabled() && null != framework) { - logger.debug("rewrite method {} for listener[framework={},class={}]", iastMethodSignature, + if (transformed && DongTaiLog.isDebugEnabled() && null != framework) { + DongTaiLog.debug("rewrite method {} for listener[framework={},class={}]", iastMethodSignature, framework, context.getClassName()); } } @@ -120,7 +119,7 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri @Override public void visit(int version, int access, String name, String signature, String superName, - String[] interfaces) { + String[] interfaces) { this.classVersion = version; super.visit(version, access, name, signature, superName, interfaces); } @@ -137,7 +136,7 @@ public void visit(int version, int access, String name, String signature, String * @return 修改后的方法访问器 */ private MethodVisitor greedyAop(MethodVisitor mv, int access, String name, String desc, String framework, - String signature) { + String signature) { if (null != framework) { mv = new PropagateAdviceAdapter(mv, access, name, desc, context, framework, signature); } else if (isAppClass && Method.hook(access, name, desc, signature)) { @@ -159,7 +158,7 @@ private MethodVisitor greedyAop(MethodVisitor mv, int access, String name, Strin * @return 修改后的方法访问器 */ private MethodVisitor lazyAop(MethodVisitor mv, int access, String name, String desc, String framework, - String signature) { + String signature) { int hookValue = IastHookRuleModel.getRuleTypeValueByFramework(framework); if (HookType.PROPAGATOR.equals(hookValue)) { mv = new PropagateAdviceAdapter(mv, access, name, desc, context, framework, signature); @@ -172,7 +171,7 @@ private MethodVisitor lazyAop(MethodVisitor mv, int access, String name, String mv = new SinkAdviceAdapter(mv, access, name, desc, context, framework, signature, isOverPower); transformed = true; } else { - logger.error("framework[{}], method[{}] doesn't find sink model", framework, name); + DongTaiLog.error("framework[{}], method[{}] doesn't find sink model", framework, name); } } else if (HookType.SOURCE.equals(hookValue)) { mv = new SourceAdviceAdapter(mv, access, name, desc, context, framework, signature); diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/dubbo/DubboAdapter.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/dubbo/DubboAdapter.java index a6b2f7d1f..d45c4810d 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/dubbo/DubboAdapter.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/dubbo/DubboAdapter.java @@ -3,16 +3,14 @@ import com.secnium.iast.core.enhance.IastContext; import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor; import com.secnium.iast.core.util.AsmUtils; -import com.secnium.iast.core.util.LogUtils; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class DubboAdapter extends AbstractClassVisitor { - private final Logger logger = LogUtils.getLogger(getClass()); public DubboAdapter(ClassVisitor classVisitor, IastContext context) { super(classVisitor, context); @@ -28,14 +26,14 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri MethodVisitor mv = super.visitMethod(access, name, desc, signature, exceptions); String signCode = AsmUtils.buildSignature(context.getClassName(), name, desc); if ("invoke".equals(name)) { - if (logger.isDebugEnabled()) { - logger.debug("Adding Dubbo Source tracking for type {}", context.getClassName()); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("Adding Dubbo Source tracking for type {}", context.getClassName()); } mv = new DubboAdviceAdapter(mv, access, name, desc, signCode, context); transformed = true; - if (logger.isDebugEnabled()) { - logger.debug("rewrite method {}.{} for listener[match={}]", context.getClassName(), name, context.getMatchClassName()); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("rewrite method {}.{} for listener[match={}]", context.getClassName(), name, context.getMatchClassName()); } } return mv; diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/dispatch/DispatchJ2ee.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/dispatch/DispatchJ2ee.java index ba6142a21..a35ecd427 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/dispatch/DispatchJ2ee.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/dispatch/DispatchJ2ee.java @@ -2,18 +2,18 @@ import com.secnium.iast.core.enhance.IastContext; import com.secnium.iast.core.enhance.plugins.DispatchPlugin; -import com.secnium.iast.core.util.LogUtils; + import java.lang.reflect.Modifier; import java.util.Set; + import org.objectweb.asm.ClassVisitor; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class DispatchJ2ee implements DispatchPlugin { - private final Logger logger = LogUtils.getLogger(getClass()); private final String FILTER = " javax.servlet.Filter".substring(1); private final String FILTER_CHAIN = " javax.servlet.FilterChain".substring(1); private final String HTTP_SERVLET = " javax.servlet.http.HttpServlet".substring(1); @@ -27,7 +27,7 @@ public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) { Set ancestors = context.getAncestors(); if (Modifier.isInterface(context.getFlags())) { - logger.trace("Ignoring interface " + className); + DongTaiLog.trace("Ignoring interface " + className); } else if (isServletDispatch(className, ancestors) || isJakartaServlet(className)) { classVisitor = new ServletDispatcherAdapter(classVisitor, context); } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/dispatch/ServletDispatcherAdapter.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/dispatch/ServletDispatcherAdapter.java index 0f04ab74e..dbe98ed2c 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/dispatch/ServletDispatcherAdapter.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/dispatch/ServletDispatcherAdapter.java @@ -3,18 +3,16 @@ import com.secnium.iast.core.enhance.IastContext; import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor; import com.secnium.iast.core.util.AsmUtils; -import com.secnium.iast.core.util.LogUtils; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; import org.objectweb.asm.Type; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class ServletDispatcherAdapter extends AbstractClassVisitor { - private final Logger logger = LogUtils.getLogger(getClass()); private final String HTTP_SERVLET_REQUEST = " javax.servlet.http.HttpServletRequest".substring(1); private final String HTTP_SERVLET_RESPONSE = " javax.servlet.http.HttpServletResponse".substring(1); private final String SERVLET_REQUEST = " javax.servlet.ServletRequest".substring(1); @@ -47,16 +45,16 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri (this.isJakarta && isJakartaArgs(typeOfArgs)) || (this.isFaces && isFacesArgs(typeOfArgs)) ) { - if (logger.isDebugEnabled()) { - logger.debug("Adding HTTP tracking for type {}", context.getClassName()); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("Adding HTTP tracking for type {}", context.getClassName()); } mv = new ServletDispatcherAdviceAdapter(mv, access, name, desc, signCode, context, isJakarta); transformed = true; } if (transformed) { - if (logger.isDebugEnabled()) { - logger.debug("rewrite method {}.{} for listener[match={}]", context.getClassName(), name, context.getMatchClassName()); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("rewrite method {}.{} for listener[match={}]", context.getClassName(), name, context.getMatchClassName()); } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/jsp/DispatchJsp.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/jsp/DispatchJsp.java index f314c9328..dc0de8783 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/jsp/DispatchJsp.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/jsp/DispatchJsp.java @@ -2,10 +2,11 @@ import com.secnium.iast.core.enhance.IastContext; import com.secnium.iast.core.enhance.plugins.DispatchPlugin; -import com.secnium.iast.core.util.LogUtils; + import java.util.Set; + import org.objectweb.asm.ClassVisitor; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * 处理jsp include方法的文件包含 @@ -17,7 +18,6 @@ public class DispatchJsp implements DispatchPlugin { private static final String JSP_PAGE = " javax.servlet.jsp.JspPage".substring(1); private static final String JSP_BASE = " org.apache.jasper.runtime.HttpJspBase".substring(1); private Set ancestors; - private final Logger logger = LogUtils.getLogger(getClass()); @Override public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) { @@ -25,8 +25,8 @@ public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) { String matchClassname = isMatch(); if (null != matchClassname) { - if (logger.isDebugEnabled()) { - logger.debug("JspPage match class for {} from {}", context.getClassName(), matchClassname); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("JspPage match class for {} from {}", context.getClassName(), matchClassname); } context.setMatchClassName(matchClassname); // JspPageAdapter diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/jsp/JspPageAdapter.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/jsp/JspPageAdapter.java index 61a69891d..8e9bac733 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/jsp/JspPageAdapter.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/j2ee/jsp/JspPageAdapter.java @@ -4,11 +4,10 @@ import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor; import com.secnium.iast.core.enhance.plugins.framework.j2ee.dispatch.ServletDispatcherAdviceAdapter; import com.secnium.iast.core.util.AsmUtils; -import com.secnium.iast.core.util.LogUtils; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; import org.objectweb.asm.Type; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** @@ -16,7 +15,6 @@ */ public class JspPageAdapter extends AbstractClassVisitor { - private final Logger logger = LogUtils.getLogger(getClass()); JspPageAdapter(ClassVisitor classVisitor, IastContext context) { super(classVisitor, context); @@ -47,8 +45,8 @@ private class JspAdviceAdapter extends ServletDispatcherAdviceAdapter { @Override public void visitMethodInsn(int opc, String owner, String name, String desc, boolean isInterface) { if (owner.endsWith("JspRuntimeLibrary") && "include".equals(name)) { - if (logger.isDebugEnabled()) { - logger.debug("[com.secnium.iast] enter include method" + owner + "." + name); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("[com.secnium.iast] enter include method" + owner + "." + name); } int j = newLocal(Type.getType(Object.class)); diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/ByteChunkVisitor.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/ByteChunkVisitor.java index 871d25937..f81d99965 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/ByteChunkVisitor.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/ByteChunkVisitor.java @@ -4,8 +4,7 @@ import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; -import org.slf4j.Logger; -import com.secnium.iast.core.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; import java.lang.reflect.Modifier; @@ -30,8 +29,8 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri int bool = (!Modifier.isNative(access) && !Modifier.isAbstract(access)) ? 1 : 0; if (1 == bool && "recycle".equals(name)) { - if (logger.isDebugEnabled()) { - logger.debug("Instrumenting Tomcat's ByteChunk recycle() method"); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("Instrumenting Tomcat's ByteChunk recycle() method"); } mv = new ByteChunkAdapter(mv, access, name, desc, context); transformed = true; @@ -39,5 +38,4 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri return mv; } - private final Logger logger = LogUtils.getLogger(getClass()); } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/CharChunkVisitor.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/CharChunkVisitor.java index 5883ba3fd..10b85adab 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/CharChunkVisitor.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/CharChunkVisitor.java @@ -4,8 +4,7 @@ import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; -import org.slf4j.Logger; -import com.secnium.iast.core.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; import java.lang.reflect.Modifier; @@ -32,8 +31,8 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri int bool = (!Modifier.isNative(access) && !Modifier.isAbstract(access)) ? 1 : 0; if (1 == bool && "recycle".equals(name)) { - if (logger.isDebugEnabled()) { - logger.debug("Instrumenting Tomcat's ByteChunk recycle() method"); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("Instrumenting Tomcat's ByteChunk recycle() method"); } mv = new CharChunkAdapter(mv, access, name, desc, IastContext); transformed = true; @@ -41,5 +40,4 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri return mv; } - private final Logger logger = LogUtils.getLogger(getClass()); } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/RequestVisitor.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/RequestVisitor.java index 6dab9f010..779ab6314 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/RequestVisitor.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/framework/tomcat/RequestVisitor.java @@ -4,8 +4,7 @@ import com.secnium.iast.core.enhance.plugins.AbstractClassVisitor; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; -import org.slf4j.Logger; -import com.secnium.iast.core.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; import java.lang.reflect.Modifier; @@ -29,8 +28,8 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri int bool = (!Modifier.isNative(access) && !Modifier.isAbstract(access)) ? 1 : 0; if (1 == bool && "recycle".equals(name)) { - if (logger.isDebugEnabled()) { - logger.debug("Instrumenting Tomcat's ByteChunk recycle() method"); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("Instrumenting Tomcat's ByteChunk recycle() method"); } mv = new RequestAdapter(mv, access, name, desc, context); @@ -39,5 +38,4 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri return mv; } - private final Logger logger = LogUtils.getLogger(getClass()); } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/hardcoded/DispatchHardcodedPlugin.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/hardcoded/DispatchHardcodedPlugin.java index c12428de0..50dabe52d 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/hardcoded/DispatchHardcodedPlugin.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/hardcoded/DispatchHardcodedPlugin.java @@ -7,15 +7,15 @@ import com.secnium.iast.core.handler.vulscan.ReportConstant; import com.secnium.iast.core.report.ReportThread; import com.secnium.iast.core.util.Constants; -import com.secnium.iast.core.util.LogUtils; import com.secnium.iast.core.util.base64.Base64Encoder; import com.secnium.iast.core.util.commonUtils; + import java.lang.reflect.Modifier; import java.util.regex.Pattern; + import org.json.JSONObject; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.FieldVisitor; -import org.slf4j.Logger; /** * 检测字节码中使用硬编码的转换类 @@ -24,7 +24,6 @@ */ public class DispatchHardcodedPlugin implements DispatchPlugin { - private final Logger logger = LogUtils.getLogger(getClass()); @Override public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) { @@ -119,7 +118,7 @@ public boolean hasTransformed() { } private void sendVulReport(String fileName, String className, boolean isJDKClass, String fieldName, - String value) { + String value) { JSONObject report = new JSONObject(); JSONObject detail = new JSONObject(); report.put(ReportConstant.REPORT_KEY, ReportConstant.REPORT_VUL_HARDCORD); diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/technology/DispatchTechnologyPlugin.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/technology/DispatchTechnologyPlugin.java index a122c7ed8..2e517e629 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/technology/DispatchTechnologyPlugin.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/plugins/technology/DispatchTechnologyPlugin.java @@ -5,8 +5,7 @@ import com.secnium.iast.core.enhance.plugins.DispatchPlugin; import org.objectweb.asm.ClassVisitor; import org.objectweb.asm.MethodVisitor; -import org.slf4j.Logger; -import com.secnium.iast.core.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; import java.util.HashMap; import java.util.Map; @@ -20,7 +19,6 @@ final public class DispatchTechnologyPlugin implements DispatchPlugin { private final Map> technologyMap; private String classname; - private final Logger logger = LogUtils.getLogger(DispatchTechnologyPlugin.class); public DispatchTechnologyPlugin() { this.technologyMap = new HashMap>(); @@ -72,7 +70,7 @@ public ClassVisitor dispatch(ClassVisitor classVisitor, IastContext context) { classname = context.getClassName(); String matchClassName = isMatch(); if (matchClassName != null) { - logger.debug("current class {} hit rule \"Technology\"", classname); + DongTaiLog.debug("current class {} hit rule \"Technology\"", classname); context.setMatchClassName(matchClassName); classVisitor = new ClassVisit(classVisitor, context, this.technologyMap.get(matchClassName)); } @@ -88,7 +86,6 @@ public String isMatch() { } public static class ClassVisit extends AbstractClassVisitor { - private final Logger logger = LogUtils.getLogger(getClass()); private final Map technologyMapDetail; ClassVisit(ClassVisitor classVisitor, IastContext context, Map technologyMapDetail) { @@ -107,7 +104,7 @@ public MethodVisitor visitMethod(final int access, final String name, final Stri String technologyName = this.technologyMapDetail.get(name); if (technologyName != null) { // todo: 后续增加应用保存和发送回服务器 - logger.debug("discover {} technology", technologyName); + DongTaiLog.debug("discover {} technology", technologyName); } return mv; } diff --git a/iast-core/src/main/java/com/secnium/iast/core/enhance/sca/SignatureAlgorithm.java b/iast-core/src/main/java/com/secnium/iast/core/enhance/sca/SignatureAlgorithm.java index 90cdbccc1..725971e23 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/enhance/sca/SignatureAlgorithm.java +++ b/iast-core/src/main/java/com/secnium/iast/core/enhance/sca/SignatureAlgorithm.java @@ -1,7 +1,6 @@ package com.secnium.iast.core.enhance.sca; -import com.secnium.iast.core.util.LogUtils; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; import java.io.File; import java.io.FileInputStream; @@ -17,7 +16,6 @@ * @author dongzhiyong@huoxian.cn */ public class SignatureAlgorithm { - private static final Logger logger = LogUtils.getLogger(SignatureAlgorithm.class); public static String getSignature(InputStream is, String algorithm) { String signature = null; @@ -31,9 +29,9 @@ public static String getSignature(InputStream is, String algorithm) { } signature = new BigInteger(1, digest.digest()).toString(16); } catch (IOException e) { - logger.error("calc jar signature error[IOException], msg: %s", e); + DongTaiLog.error("calc jar signature error[IOException], msg: %s{}", e); } catch (NoSuchAlgorithmException e) { - logger.error("calc jar signature error[NoSuchAlgorithmException], msg: %s", e); + DongTaiLog.error("calc jar signature error[NoSuchAlgorithmException], msg: %s{}", e); } return signature; } @@ -48,14 +46,14 @@ public static String getSignature(File file, String algorithm) { in = new FileInputStream(file); signature = getSignature(in, algorithm); } catch (IOException e) { - logger.error("calc jar signature error[IOException], msg: %s", e); + DongTaiLog.error("calc jar signature error[IOException], msg: %s{}", e); } finally { try { if (in != null) { in.close(); } } catch (IOException e) { - logger.error("calc jar signature error[IOException], msg: %s", e); + DongTaiLog.error("calc jar signature error[IOException], msg: %s{}", e); } } return signature; diff --git a/iast-core/src/main/java/com/secnium/iast/core/handler/controller/impl/HttpImpl.java b/iast-core/src/main/java/com/secnium/iast/core/handler/controller/impl/HttpImpl.java index 83db4d437..ea1cbd7cb 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/handler/controller/impl/HttpImpl.java +++ b/iast-core/src/main/java/com/secnium/iast/core/handler/controller/impl/HttpImpl.java @@ -5,8 +5,8 @@ import com.secnium.iast.core.handler.IastClassLoader; import com.secnium.iast.core.handler.models.MethodEvent; import com.secnium.iast.core.util.HttpClientUtils; -import com.secnium.iast.core.util.LogUtils; import com.secnium.iast.core.util.matcher.ConfigMatcher; + import java.io.File; import java.io.IOException; import java.lang.reflect.InvocationTargetException; @@ -14,7 +14,8 @@ import java.net.MalformedURLException; import java.net.URL; import java.util.Map; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * Http方法处理入口 @@ -151,8 +152,8 @@ public static Map getResponseMeta(Object response) */ public static void solveHttp(MethodEvent event) throws InvocationTargetException, IllegalAccessException, NoSuchMethodException { - if (logger.isDebugEnabled()) { - logger.debug(EngineManager.SCOPE_TRACKER.get().toString()); + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug(EngineManager.SCOPE_TRACKER.get().toString()); } Map requestMeta = getRequestMeta(event.argumentArray[0]); @@ -160,18 +161,17 @@ public static void solveHttp(MethodEvent event) if (ConfigMatcher.disableExtension((String) requestMeta.get("requestURI"))) { return; } - if (ConfigMatcher.getBlackUrl( requestMeta)) { + if (ConfigMatcher.getBlackUrl(requestMeta)) { return; } // todo: add custom header escape EngineManager.enterHttpEntry(requestMeta); - if (logger.isDebugEnabled()) { - logger.debug("HTTP Request:{} {} from: {}", requestMeta.get("method"), requestMeta.get("requestURI"), + if (DongTaiLog.isDebugEnabled()) { + DongTaiLog.debug("HTTP Request:{} {} from: {}", requestMeta.get("method"), requestMeta.get("requestURI"), event.signature); } } - private static final Logger logger = LogUtils.getLogger(HttpImpl.class); } diff --git a/iast-core/src/main/java/com/secnium/iast/core/handler/graphy/GraphBuilder.java b/iast-core/src/main/java/com/secnium/iast/core/handler/graphy/GraphBuilder.java index 41eaad2e0..ddd7d41a0 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/handler/graphy/GraphBuilder.java +++ b/iast-core/src/main/java/com/secnium/iast/core/handler/graphy/GraphBuilder.java @@ -9,15 +9,15 @@ import com.secnium.iast.core.handler.vulscan.normal.AbstractNormalVulScan; import com.secnium.iast.core.report.ReportThread; import com.secnium.iast.core.util.Constants; -import com.secnium.iast.core.util.LogUtils; import com.secnium.iast.core.util.base64.Base64Encoder; + import java.lang.reflect.InvocationTargetException; import java.util.ArrayList; import java.util.List; import java.util.Map; + import org.json.JSONArray; import org.json.JSONObject; -import org.slf4j.Logger; /** * @author dongzhiyong@huoxian.cn @@ -122,6 +122,4 @@ public static String convertToReport(List nodeList, Object response) return report.toString(); } - - private static final Logger logger = LogUtils.getLogger(GraphBuilder.class); } diff --git a/iast-core/src/main/java/com/secnium/iast/core/handler/vulscan/dynamic/DynamicPropagatorScanner.java b/iast-core/src/main/java/com/secnium/iast/core/handler/vulscan/dynamic/DynamicPropagatorScanner.java index 594b46cf3..3f1bba0dc 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/handler/vulscan/dynamic/DynamicPropagatorScanner.java +++ b/iast-core/src/main/java/com/secnium/iast/core/handler/vulscan/dynamic/DynamicPropagatorScanner.java @@ -3,17 +3,17 @@ import com.secnium.iast.core.EngineManager; import com.secnium.iast.core.context.ContextManager; import com.secnium.iast.core.handler.EventListenerHandlers; -import com.secnium.iast.core.handler.controller.impl.SinkImpl; import com.secnium.iast.core.handler.models.IastSinkModel; import com.secnium.iast.core.handler.models.MethodEvent; import com.secnium.iast.core.handler.vulscan.IVulScan; -import com.secnium.iast.core.util.LogUtils; import com.secnium.iast.core.util.StackUtils; import com.secnium.iast.core.util.TaintPoolUtils; + import java.lang.reflect.Method; import java.util.Arrays; import java.util.HashSet; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn @@ -34,8 +34,6 @@ public class DynamicPropagatorScanner implements IVulScan { private static String HTTP_CLIENT_4 = " org.apache.commons.httpclient.HttpClient.executeMethod(org.apache.commons.httpclient.HostConfiguration,org.apache.commons.httpclient.HttpMethod,org.apache.commons.httpclient.HttpState)" .substring(1); - private final Logger logger = LogUtils.getLogger(SinkImpl.class); - @Override public void scan(IastSinkModel sink, MethodEvent event) { // todo: 判断是否为 ssrf，如果是，增加 header 头 @@ -89,7 +87,7 @@ private boolean sinkSourceHitTaintPool(MethodEvent event, IastSinkModel sink) { boolean hitTaintPool = false; if (isRedirectVul(sink.getType(), event.signature)) { String attribute = String.valueOf(event.argumentArray[0]); - logger.debug("add Header method, attribute name is {} ", attribute); + DongTaiLog.debug("add Header method, attribute name is {} ", attribute); if (attributeIsLocation(attribute)) { Object attributeValue = event.argumentArray[1]; hitTaintPool = TaintPoolUtils.poolContains(attributeValue, event); diff --git a/iast-core/src/main/java/com/secnium/iast/core/report/AgentQueueReport.java b/iast-core/src/main/java/com/secnium/iast/core/report/AgentQueueReport.java index 1c1c824d0..bec544438 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/report/AgentQueueReport.java +++ b/iast-core/src/main/java/com/secnium/iast/core/report/AgentQueueReport.java @@ -6,9 +6,8 @@ import com.secnium.iast.core.replay.HttpRequestReplay; import com.secnium.iast.core.util.Constants; import com.secnium.iast.core.util.HttpClientUtils; -import com.secnium.iast.core.util.LogUtils; import org.json.JSONObject; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * 上报agent队列与请求数量 @@ -17,8 +16,6 @@ */ public class AgentQueueReport extends AbstractThread { - private final Logger logger = LogUtils.getLogger(getClass()); - public static String generateHeartBeatMsg() { JSONObject report = new JSONObject(); JSONObject detail = new JSONObject(); @@ -45,7 +42,7 @@ protected void send() throws Exception { StringBuilder response = HttpClientUtils.sendPost(Constants.API_REPORT_UPLOAD, generateHeartBeatMsg()); HttpRequestReplay.sendReplayRequest(response); } catch (Exception e) { - logger.error("agent queue reported failed. reason: ", e); + DongTaiLog.error("agent queue reported failed. reason: {}", e); } } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/report/ReportThread.java b/iast-core/src/main/java/com/secnium/iast/core/report/ReportThread.java index 15c2c1c1e..1a4dddcfe 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/report/ReportThread.java +++ b/iast-core/src/main/java/com/secnium/iast/core/report/ReportThread.java @@ -2,15 +2,13 @@ import com.secnium.iast.core.EngineManager; import com.secnium.iast.core.util.HttpClientUtils; -import com.secnium.iast.core.util.LogUtils; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * @author owefsad */ public class ReportThread extends Thread { - private final Logger logger = LogUtils.getLogger(ReportThread.class); private final String report; private final String uri; @@ -40,7 +38,7 @@ public void run() { try { HttpClientUtils.sendPost(uri, report); } catch (Exception e) { - logger.error("report error, reason: ", e); + DongTaiLog.error("report error, reason: {}", e); } if (isRunning) { EngineManager.turnOnLingzhi(); diff --git a/iast-core/src/main/java/com/secnium/iast/core/util/ConfigUtils.java b/iast-core/src/main/java/com/secnium/iast/core/util/ConfigUtils.java index 5ba5a94a5..4b63dd6a9 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/util/ConfigUtils.java +++ b/iast-core/src/main/java/com/secnium/iast/core/util/ConfigUtils.java @@ -1,20 +1,20 @@ package com.secnium.iast.core.util; import com.secnium.iast.core.report.ErrorLogReport; + import java.io.IOException; import java.io.InputStream; import java.util.HashSet; + import org.apache.commons.io.IOUtils; import org.apache.commons.io.LineIterator; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn */ public class ConfigUtils { - private final static Logger logger = LogUtils.getLogger(ConfigUtils.class); - /** * 通过文件名从资源加载器中加载资源 * @@ -46,7 +46,7 @@ public static HashSet[] loadConfigFromFile(String filename) { } } } catch (IOException e) { - logger.error("读取配置文件：{} 失败，错误信息：{}", filename, e); + DongTaiLog.error("读取配置文件：{} 失败，错误信息：{}", filename, e); ErrorLogReport.sendErrorLog(e); } return new HashSet[]{container, startWith, endWith}; @@ -63,7 +63,7 @@ public static String[] loadExtConfigFromFile(String filename) { extStringArray = exts.split(","); } } catch (IOException e) { - logger.error("读取后缀配置文件：{} 失败，错误信息：{}", filename, e); + DongTaiLog.error("读取后缀配置文件：{} 失败，错误信息：{}", filename, e); ErrorLogReport.sendErrorLog(e); } return extStringArray; @@ -80,7 +80,7 @@ public static HashSet loadConfigFromFileByLine(String filename) { container.add(line); } } catch (IOException e) { - logger.error("读取配置文件：{} 失败，错误信息：{}", filename, e); + DongTaiLog.error("读取配置文件：{} 失败，错误信息：{}", filename, e); ErrorLogReport.sendErrorLog(ThrowableUtils.getStackTrace(e)); } return container; diff --git a/iast-core/src/main/java/com/secnium/iast/core/util/HttpClientUtils.java b/iast-core/src/main/java/com/secnium/iast/core/util/HttpClientUtils.java index 1f97a8fa4..77314fd9c 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/util/HttpClientUtils.java +++ b/iast-core/src/main/java/com/secnium/iast/core/util/HttpClientUtils.java @@ -2,6 +2,7 @@ import com.secnium.iast.core.PropertyUtils; import com.secnium.iast.core.report.ErrorLogReport; + import java.io.BufferedInputStream; import java.io.BufferedReader; import java.io.File; @@ -20,7 +21,8 @@ import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLContext; import javax.net.ssl.TrustManager; -import org.slf4j.Logger; + +import com.secnium.iast.log.DongTaiLog; /** * @author dongzhiyong@huoxian.cn @@ -39,8 +41,6 @@ public class HttpClientUtils { private final static PropertyUtils PROPERTIES = PropertyUtils.getInstance(); private final static Proxy PROXY = loadProxy(); - private static final Logger logger = LogUtils.getLogger(HttpClientUtils.class); - public static StringBuilder sendGet(String uri, String arg, String value) { try { if (arg != null && value != null) { @@ -58,14 +58,14 @@ public static StringBuilder sendPost(String uri, String value) throws Exception StringBuilder response; response = sendRequest(HttpMethods.POST, PROPERTIES.getBaseUrl(), uri, value, null, PROXY); if (PROPERTIES.isDebug()) { - logger.debug("cn.huoxian.iast url is {}, resp is {}", uri, response.toString()); + DongTaiLog.debug("cn.huoxian.iast url is {}, resp is {}", uri, response.toString()); } return response; } private static StringBuilder sendRequest(HttpMethods method, String baseUrl, String urlStr, String data, - HashMap headers, Proxy proxy) throws Exception { + HashMap headers, Proxy proxy) throws Exception { HttpURLConnection connection = null; StringBuilder response = new StringBuilder(); try { @@ -149,7 +149,7 @@ public static void downloadRemoteJar(String fileURI, String fileName) { final File classPath = new File(new File(fileName).getParent()); if (!classPath.mkdirs() && !classPath.exists()) { - logger.info("Check or create local file cache path, path is {}", classPath); + DongTaiLog.info("Check or create local file cache path, path is {}", classPath); } FileOutputStream fileOutputStream = new FileOutputStream(fileName); byte[] dataBuffer = new byte[1024]; @@ -157,9 +157,9 @@ public static void downloadRemoteJar(String fileURI, String fileName) { while ((bytesRead = in.read(dataBuffer, 0, 1024)) != -1) { fileOutputStream.write(dataBuffer, 0, bytesRead); } - logger.info("The remote file {} was successfully written to the local cache", fileURI); + DongTaiLog.info("The remote file {} was successfully written to the local cache", fileURI); } catch (Exception ignore) { - logger.error("The remote file {} download failure, please check the iast-token", fileURI); + DongTaiLog.error("The remote file {} download failure, please check the iast-token", fileURI); } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/util/LogUtils.java b/iast-core/src/main/java/com/secnium/iast/core/util/LogUtils.java deleted file mode 100644 index 6ef7a2ef5..000000000 --- a/iast-core/src/main/java/com/secnium/iast/core/util/LogUtils.java +++ /dev/null @@ -1,57 +0,0 @@ -package com.secnium.iast.core.util; - -import ch.qos.logback.classic.LoggerContext; -import ch.qos.logback.classic.joran.JoranConfigurator; -import ch.qos.logback.core.joran.spi.JoranException; -import org.slf4j.ILoggerFactory; -import org.slf4j.Logger; - -import java.io.IOException; -import java.io.InputStream; - -/** - * @author WuHaoyuan - */ -public class LogUtils implements ILoggerFactory { - - private final LoggerContext loggerContext; - - private static LogUtils logUtils; - - /** - * 读取默认的logback配置文件 - */ - private LogUtils() { - this.loggerContext = new LoggerContext(); - JoranConfigurator configurator = new JoranConfigurator(); - configurator.setContext(loggerContext); - InputStream configStream = null; - try { - NamespaceConvert.initNamespaceConvert("DongTai"); - configStream = LogUtils.class.getClassLoader().getResourceAsStream("logback-dongtai.xml"); - configurator.doConfigure(configStream); - } catch (JoranException e) { - e.printStackTrace(); - } finally { - if (configStream != null) { - try { - configStream.close(); - } catch (IOException e) { - e.printStackTrace(); - } - } - } - } - - @Override - public Logger getLogger(String s) { - return this.loggerContext.getLogger(s); - } - - public static Logger getLogger(Class clazz) { - if (logUtils == null) { - logUtils = new LogUtils(); - } - return logUtils.getLogger(clazz.getName()); - } -} diff --git a/iast-core/src/main/java/com/secnium/iast/core/util/NamespaceConvert.java b/iast-core/src/main/java/com/secnium/iast/core/util/NamespaceConvert.java deleted file mode 100644 index e1aa5b9c7..000000000 --- a/iast-core/src/main/java/com/secnium/iast/core/util/NamespaceConvert.java +++ /dev/null @@ -1,33 +0,0 @@ -package com.secnium.iast.core.util; - -import ch.qos.logback.classic.PatternLayout; -import ch.qos.logback.classic.pattern.ClassicConverter; -import ch.qos.logback.classic.spi.ILoggingEvent; - -/** - * Sandbox的命名空间注册到logback - * - * @author dongzhiyong@huoxian.cn - */ -public class NamespaceConvert extends ClassicConverter { - - private static volatile String namespace; - - @Override - public String convert(ILoggingEvent event) { - return null == namespace - ? "NULL" - : namespace; - } - - /** - * 注册命名空间到Logback - * - * @param namespace 命名空间 - */ - public static void initNamespaceConvert(final String namespace) { - NamespaceConvert.namespace = namespace; - PatternLayout.defaultConverterMap.put("NAMESPACE", NamespaceConvert.class.getName()); - } - -} diff --git a/iast-core/src/main/java/com/secnium/iast/core/util/matcher/ConfigMatcher.java b/iast-core/src/main/java/com/secnium/iast/core/util/matcher/ConfigMatcher.java index 589a0da5c..07d7e5239 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/util/matcher/ConfigMatcher.java +++ b/iast-core/src/main/java/com/secnium/iast/core/util/matcher/ConfigMatcher.java @@ -3,14 +3,14 @@ import com.secnium.iast.core.PropertyUtils; import com.secnium.iast.core.report.ErrorLogReport; import com.secnium.iast.core.util.ConfigUtils; -import com.secnium.iast.core.util.LogUtils; + import com.secnium.iast.core.util.ThrowableUtils; import java.util.HashMap; import java.util.HashSet; import java.util.Map; import java.util.Set; import org.apache.commons.lang3.StringUtils; -import org.slf4j.Logger; +import com.secnium.iast.log.DongTaiLog; /** * 各种匹配方法（通过配置文件匹配） @@ -19,8 +19,6 @@ */ public class ConfigMatcher { - private final static Logger logger = LogUtils.getLogger(ConfigMatcher.class); - private final static Set BLACKS; private final static String[] START_WITH_BLACKS; private final static String[] END_WITH_BLACKS; @@ -71,7 +69,7 @@ public static boolean getBlackUrl(Map request) { } } } catch (Exception e) { - logger.info("dongtai getBalckurl error"); + DongTaiLog.info("dongtai getBalckurl error"); ErrorLogReport.sendErrorLog(ThrowableUtils.getStackTrace(e)); } return false; @@ -102,34 +100,34 @@ public static PropagatorType blackFunc(final String signature) { */ public static boolean isHookPoint(String className, ClassLoader loader) { if (ConfigMatcher.inHookBlacklist(className)) { - logger.trace("ignore transform {} in loader={}. reason: class is in blacklist", className, loader); + DongTaiLog.trace("ignore transform {} in loader={}. Reason: classname is startswith com/secnium/iast/", + className, loader); return false; } if (className.contains("CGLIB$$")) { - logger.trace("ignore transform {} in loader={}. Reason: classname is a aop class by CGLIB", className, + DongTaiLog.trace("ignore transform {} in loader={}. Reason: classname is a aop class by CGLIB", className, loader); return false; } if (className.contains("$$Lambda$")) { - logger.trace("ignore transform {} in loader={}. Reason: classname is a aop class by Lambda", className, + DongTaiLog.trace("ignore transform {} in loader={}. Reason: classname is a aop class by Lambda", className, loader); return false; } if (className.contains("_$$_jvst")) { - logger.trace("ignore transform {} in loader={}. Reason: classname is a aop class", className, loader); + DongTaiLog.trace("ignore transform {} in loader={}. Reason: classname is a aop class", className, loader); return false; } - + // todo: 计算startsWith、contains与正则匹配的时间损耗 if (className.startsWith("com/secnium/iast/") || className.startsWith("java/lang/iast/") || className.startsWith("cn/huoxian/iast/") ) { - logger.trace("ignore transform {} in loader={}. Reason: classname is startswith com/secnium/iast/", - className, loader); + DongTaiLog.trace("ignore transform {} in loader={}. Reason: class is in blacklist", className, loader); return false; } diff --git a/iast-core/src/main/java/com/secnium/iast/core/util/matcher/structure/ClassStructureFactory.java b/iast-core/src/main/java/com/secnium/iast/core/util/matcher/structure/ClassStructureFactory.java index 6dccdb6d7..2c43e43ae 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/util/matcher/structure/ClassStructureFactory.java +++ b/iast-core/src/main/java/com/secnium/iast/core/util/matcher/structure/ClassStructureFactory.java @@ -1,8 +1,7 @@ package com.secnium.iast.core.util.matcher.structure; -import org.slf4j.Logger; -import com.secnium.iast.core.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; import java.io.IOException; import java.io.InputStream; @@ -17,8 +16,6 @@ */ public class ClassStructureFactory { - private static final Logger logger = LogUtils.getLogger(ClassStructureFactory.class); - /** * 通过Class类字节流来构造类结构 * @@ -31,7 +28,7 @@ public static ClassStructure createClassStructure(final InputStream classInputSt try { return new ClassStructureImplByAsm(classInputStream, loader); } catch (IOException cause) { - logger.warn("create class structure failed by using ASM, return null. loader=" + loader + ";", cause); + DongTaiLog.warn("create class structure failed by using ASM, return null. loader=" + loader + ";", cause); return null; } } diff --git a/iast-core/src/main/java/com/secnium/iast/core/util/matcher/structure/ClassStructureImplByAsm.java b/iast-core/src/main/java/com/secnium/iast/core/util/matcher/structure/ClassStructureImplByAsm.java index 6d2241317..007b2ebf5 100644 --- a/iast-core/src/main/java/com/secnium/iast/core/util/matcher/structure/ClassStructureImplByAsm.java +++ b/iast-core/src/main/java/com/secnium/iast/core/util/matcher/structure/ClassStructureImplByAsm.java @@ -11,8 +11,7 @@ import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.StringUtils; import org.objectweb.asm.*; -import org.slf4j.Logger; -import com.secnium.iast.core.util.LogUtils; +import com.secnium.iast.log.DongTaiLog; import java.io.IOException; import java.io.InputStream; @@ -231,7 +230,6 @@ public String getJavaClassName() { */ public class ClassStructureImplByAsm extends FamilyClassStructure { - private final Logger logger = LogUtils.getLogger(getClass()); private final ClassReader classReader; private final ClassLoader loader; private final Access access; @@ -322,7 +320,7 @@ private ClassStructure newInstance(final String javaClassName) { return classStructure; } catch (Throwable cause) { // ignore - logger.warn("new instance class structure by using ASM failed, will return null. class=" + javaClassName + ";loader=" + loader + ";", + DongTaiLog.warn("new instance class structure by using ASM failed, will return null. class=" + javaClassName + ";loader=" + loader + ";", cause); classStructureCache.put(pair, null); } finally { diff --git a/iast-core/src/test/java/com/secnium/iast/core/util/matcher/ConfigMatcherTest.java b/iast-core/src/test/java/com/secnium/iast/core/util/matcher/ConfigMatcherTest.java index 094b4131c..f0252f5b6 100644 --- a/iast-core/src/test/java/com/secnium/iast/core/util/matcher/ConfigMatcherTest.java +++ b/iast-core/src/test/java/com/secnium/iast/core/util/matcher/ConfigMatcherTest.java @@ -9,19 +9,19 @@ public class ConfigMatcherTest { * // CGLIB$$的类不hook * if (hook && className.contains("CGLIB$$")) { * hook = false; - * logger.debug("ignore transform {} in loader={}. Reason: classname is a aop class by CGLIB", className, loader); + * DongTaiLog.debug("ignore transform {} in loader={}. Reason: classname is a aop class by CGLIB", className, loader); * } *

* //$$Lambda$ * if (hook && className.contains("$$Lambda$")) { * hook = false; - * logger.debug("ignore transform {} in loader={}. Reason: classname is a aop class by Lambda", className, loader); + * DongTaiLog.debug("ignore transform {} in loader={}. Reason: classname is a aop class by Lambda", className, loader); * } *

* //$$Lambda$ * if (hook && className.contains("_$$_jvst")) { * hook = false; - * logger.debug("ignore transform {} in loader={}. Reason: classname is a aop class", className, loader); + * DongTaiLog.debug("ignore transform {} in loader={}. Reason: classname is a aop class", className, loader); * } *

* 执行时长：46329000 纳秒. diff --git a/iast-log/pom.xml b/iast-log/pom.xml new file mode 100644 index 000000000..c2a9995ac --- /dev/null +++ b/iast-log/pom.xml @@ -0,0 +1,68 @@ + + + + iast + com.secnium.iast + 1.2.0 + + 4.0.0 + + iast-log + + + 8 + 8 + + + + dongtai-spring-api + + + org.apache.maven.plugins + maven-shade-plugin + 2.4 + + + package + + shade + + + + + + + maven-antrun-plugin + + + copy-lib-src-webapps + package + + + + + + + + + + + run + + + + + + org.apache.maven.plugins + maven-compiler-plugin + + 8 + 8 + + + + + + \ No newline at end of file diff --git a/iast-log/src/main/java/com/secnium/iast/log/DongTaiLog.java b/iast-log/src/main/java/com/secnium/iast/log/DongTaiLog.java new file mode 100644 index 000000000..bf6ef80e7 --- /dev/null +++ b/iast-log/src/main/java/com/secnium/iast/log/DongTaiLog.java @@ -0,0 +1,269 @@ +package com.secnium.iast.log; + +import java.io.File; +import java.io.FileOutputStream; +import java.io.IOException; +import java.text.SimpleDateFormat; +import java.util.Date; +import java.util.TimeZone; +import java.util.logging.Level; +import java.util.regex.Matcher; + +/** + * @author niuerzhuang@huoxian.cn + */ +public class DongTaiLog { + + static boolean enableWriteToFile; + static String filePath; + static boolean enableColor; + private static final IastProperties iastProperties; + public static java.util.logging.Level LEVEL = java.util.logging.Level.CONFIG; + + private static final String RESET = "\033[0m"; + private static final int RED = 31; + private static final int GREEN = 32; + private static final int YELLOW = 33; + private static final int BLUE = 34; + + private static final String TITTLE = "[io.dongtai.iast.agent] "; + private static final String TITTLE_COLOR_PREFIX = "[" + colorStr("io.dongtai.iast.agent", BLUE) + "] "; + + private static final String TRACE_PREFIX = "[TRACE] "; + private static final String TRACE_COLOR_PREFIX = "[" + colorStr("TRACE", GREEN) + "] "; + + private static final String DEBUG_PREFIX = "[DEBUG] "; + private static final String DEBUG_COLOR_PREFIX = "[" + colorStr("DEBUG", GREEN) + "] "; + + private static final String INFO_PREFIX = "[INFO] "; + private static final String INFO_COLOR_PREFIX = "[" + colorStr("INFO", GREEN) + "] "; + + private static final String WARN_PREFIX = "[WARN] "; + private static final String WARN_COLOR_PREFIX = "[" + colorStr("WARN", YELLOW) + "] "; + + private static final String ERROR_PREFIX = "[ERROR] "; + private static final String ERROR_COLOR_PREFIX = "[" + colorStr("ERROR", RED) + "] "; + + static { + if (System.console() != null && !System.getProperty("os.name").toLowerCase().contains("windows")) { + enableColor = true; + } + } + + /** + * set logger Level + * + * @param level + * @return + * @see java.util.logging.Level + */ + public static Level level(Level level) { + Level old = LEVEL; + LEVEL = level; + return old; + } + + private static String colorStr(String msg, int colorCode) { + return "\033[" + colorCode + "m" + msg + RESET; + } + + public static void trace(String msg) { + if (canLog(Level.FINEST)) { + if (enableColor) { + System.out.println(getTime() + TITTLE_COLOR_PREFIX + TRACE_COLOR_PREFIX + msg); + } else { + System.out.println(getTime() + TITTLE + TRACE_PREFIX + msg); + } + msg = getTime() + TITTLE + TRACE_PREFIX + msg; + if (enableWriteToFile) { + writeLogToFile(msg); + } + } + } + + public static void trace(String format, Object... arguments) { + if (canLog(Level.FINEST)) { + trace(format(format, arguments)); + } + } + + public static void trace(Throwable t) { + if (canLog(Level.FINEST)) { + t.printStackTrace(System.out); + } + } + + public static void debug(String msg) { + if (canLog(Level.FINER)) { + if (enableColor) { + System.out.println(getTime() + TITTLE_COLOR_PREFIX + DEBUG_COLOR_PREFIX + msg); + } else { + System.out.println(getTime() + TITTLE + DEBUG_PREFIX + msg); + } + msg = getTime() + TITTLE + DEBUG_PREFIX + msg; + if (enableWriteToFile) { + writeLogToFile(msg); + } + } + } + + public static void debug(String format, Object... arguments) { + if (canLog(Level.FINER)) { + debug(format(format, arguments)); + } + } + + public static void debug(Throwable t) { + if (canLog(Level.FINER)) { + t.printStackTrace(System.out); + } + } + + public static void info(String msg) { + if (canLog(Level.CONFIG)) { + if (enableColor) { + System.out.println(getTime() + TITTLE_COLOR_PREFIX + INFO_COLOR_PREFIX + msg); + } else { + System.out.println(getTime() + TITTLE + INFO_PREFIX + msg); + } + msg = getTime() + TITTLE + INFO_PREFIX + msg; + if (enableWriteToFile) { + writeLogToFile(msg); + } + } + } + + public static void info(String format, Object... arguments) { + if (canLog(Level.CONFIG)) { + info(format(format, arguments)); + } + } + + public static void info(Throwable t) { + if (canLog(Level.CONFIG)) { + t.printStackTrace(System.out); + } + } + + public static void warn(String msg) { + if (canLog(Level.WARNING)) { + if (enableColor) { + System.out.println(getTime() + TITTLE_COLOR_PREFIX + WARN_COLOR_PREFIX + msg); + } else { + System.out.println(getTime() + TITTLE + WARN_PREFIX + msg); + } + msg = getTime() + TITTLE + WARN_PREFIX + msg; + if (enableWriteToFile) { + writeLogToFile(msg); + } + } + } + + public static void warn(String format, Object... arguments) { + if (canLog(Level.WARNING)) { + warn(format(format, arguments)); + } + } + + public static void warn(Throwable t) { + if (canLog(Level.WARNING)) { + t.printStackTrace(System.out); + } + } + + public static void error(String msg) { + if (canLog(Level.SEVERE)) { + if (enableColor) { + System.out.println(getTime() + TITTLE_COLOR_PREFIX + ERROR_COLOR_PREFIX + msg); + } else { + System.out.println(getTime() + TITTLE + ERROR_PREFIX + msg); + } + msg = getTime() + TITTLE + ERROR_PREFIX + msg; + if (enableWriteToFile) { + writeLogToFile(msg); + } + } + } + + public static void error(String format, Object... arguments) { + if (canLog(Level.SEVERE)) { + error(format(format, arguments)); + } + } + + public static void error(Throwable t) { + if (canLog(Level.SEVERE)) { + t.printStackTrace(System.out); + } + } + + private static String format(String from, Object... arguments) { + if (from != null) { + String computed = from; + if (arguments != null && arguments.length != 0) { + for (Object argument : arguments) { + computed = computed.replaceFirst("\\{\\}", Matcher.quoteReplacement(argument.toString())); + } + } + return computed; + } + return null; + } + + private static boolean canLog(Level level) { + return level.intValue() >= LEVEL.intValue(); + } + + public static boolean isDebugEnabled() { + if ("debug".equals(iastProperties.getLogLevel())) { + level(Level.ALL); + return true; + } else { + return false; + } + } + + private static String getTime() { + SimpleDateFormat simpleDateFormat = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"); + simpleDateFormat.setTimeZone(TimeZone.getTimeZone("Asia/Shanghai")); + return simpleDateFormat.format(new Date()) + " "; + } + + private static void writeLogToFile(String msg) { + FileOutputStream o = null; + try { + File file = new File(filePath + "/dongtai.log"); + o = new FileOutputStream(file, true); + o.write(msg.getBytes()); + o.write(System.getProperty("line.separator").getBytes()); + o.flush(); + o.close(); + } catch (Exception e) { + e.printStackTrace(); + } + } + + static { + iastProperties = IastProperties.getInstance(); + if ("true".equals(iastProperties.enableLogFile())) { + enableWriteToFile = true; + } else if ("false".equals(iastProperties.enableLogFile())) { + enableWriteToFile = false; + } + filePath = iastProperties.getLogPath(); + if (enableWriteToFile) { + File f = new File(filePath); + if (!f.exists()) { + f.mkdirs(); + } + File file = new File(filePath, "/dongtai.log"); + if (!file.exists()) { + try { + file.createNewFile(); + } catch (IOException e) { + e.printStackTrace(); + } + } + } + } +} diff --git a/iast-log/src/main/java/com/secnium/iast/log/IastProperties.java b/iast-log/src/main/java/com/secnium/iast/log/IastProperties.java new file mode 100644 index 000000000..bc3c0ab54 --- /dev/null +++ b/iast-log/src/main/java/com/secnium/iast/log/IastProperties.java @@ -0,0 +1,93 @@ +package com.secnium.iast.log; + +import java.io.*; +import java.net.URLDecoder; +import java.util.Properties; + +/** + * @author dongzhiyong@huoxian.cn + */ +public class IastProperties { + + private static IastProperties instance; + public Properties cfg = new Properties(); + + private String propertiesFilePath; + + public static IastProperties getInstance() { + if (null == instance) { + instance = new IastProperties(null); + } + return instance; + } + + private IastProperties(String path) { + try { + init(path); + } catch (ClassNotFoundException ignored) { + } + } + + public void init(String path) throws ClassNotFoundException { + String basePath = null; + File agentFile; + File propertiesFile; + try { + if (path != null) { + propertiesFilePath = path; + } else { + agentFile = new File( + IastProperties.class.getProtectionDomain().getCodeSource().getLocation().getFile()); + basePath = agentFile.getParentFile().getPath(); + propertiesFilePath = basePath + File.separator + "config" + File.separator + "iast.properties"; + propertiesFilePath = URLDecoder.decode(propertiesFilePath, "utf-8"); + } + + propertiesFile = new File(propertiesFilePath); + + if (!propertiesFile.exists()) { + if (!propertiesFile.getParentFile().exists()) { + if (!propertiesFile.getParentFile().mkdirs()) { + throw new NullPointerException("配置文件创建失败"); + } + } + propertiesFile.createNewFile(); + } + + InputStream is = IastProperties.class.getClassLoader().getResourceAsStream("iast.properties"); + FileOutputStream fos = new FileOutputStream(propertiesFile); + byte[] data = new byte[1024]; + while (true) { + assert is != null; + int length = is.read(data); + if (length < 1024) { + fos.write(data, 0, length); + break; + } + fos.write(data); + } + + is.close(); + fos.close(); + + ByteArrayInputStream inputStream = new ByteArrayInputStream(data); + cfg.load(inputStream); + } catch (IOException e) { + e.printStackTrace(); + } + } + + + public String enableLogFile() { + return System.getProperty("dongtai.log", cfg.getProperty("dongtai.log", "true")); + } + + public String getLogPath() { + return System.getProperty("dongtai.log.path", cfg.getProperty("dongtai.log.path", "logs")); + } + + public String getLogLevel() { + return System.getProperty("dongtai.log.level", cfg.getProperty("dongtai.log.level", "info")); + } + +} diff --git a/pom.xml b/pom.xml index 46753e3f0..4eb3b400e 100644 --- a/pom.xml +++ b/pom.xml @@ -1,6 +1,6 @@ + xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> 4.0.0 @@ -101,6 +101,7 @@ dongtai-jakarta-api dongtai-servlet-api dongtai-spring-api + iast-log