Populate ddbb before test

DataDog · May 29, 2024 · 0b71a3e · 0b71a3e
1 parent a27358b
commit 0b71a3e
Show file tree

Hide file tree

Showing 14 changed files with 46 additions and 10 deletions.
diff --git a/tracer/test/Datadog.Trace.Security.IntegrationTests/RASP/AspNetCore2Rasp.cs b/tracer/test/Datadog.Trace.Security.IntegrationTests/RASP/AspNetCore2Rasp.cs
@@ -102,8 +102,9 @@ public async Task TestRaspRequestBody(string url, string exploit, string body =
  IncludeAllHttpSpans = true;
  await TryStartApp();
  var agent = Fixture.Agent;
+ _ = await SendRequestsAsync(agent, "/Iast/PopulateDDBB", null, 1, 1, string.Empty, "application/json", null);
  var spans = await SendRequestsAsync(agent, url, body, 1, 1, string.Empty, "application/json", null);
- var spansFiltered = spans.Where(x => x.Type == SpanTypes.Web).ToList();
+ var spansFiltered = spans.Where(x => x.Type == SpanTypes.Web && !x.Resource.Contains("/Iast/PopulateDDBB")).ToList();
  var settings = VerifyHelper.GetSpanVerifierSettings();
  settings.UseParameters(url, exploit, body);
  settings.AddIastScrubbing();

diff --git a/tracer/test/Datadog.Trace.Security.IntegrationTests/RASP/AspNetCore5Rasp.cs b/tracer/test/Datadog.Trace.Security.IntegrationTests/RASP/AspNetCore5Rasp.cs
@@ -103,8 +103,9 @@ public async Task TestRaspRequestBody(string url, string exploit, string body =
  IncludeAllHttpSpans = true;
  await TryStartApp();
  var agent = Fixture.Agent;
+ _ = await SendRequestsAsync(agent, "/Iast/PopulateDDBB", null, 1, 1, string.Empty, "application/json", null);
  var spans = await SendRequestsAsync(agent, url, body, 1, 1, string.Empty, "application/json", null);
- var spansFiltered = spans.Where(x => x.Type == SpanTypes.Web).ToList();
+ var spansFiltered = spans.Where(x => x.Type == SpanTypes.Web && !x.Resource.Contains("/Iast/PopulateDDBB")).ToList();
  var settings = VerifyHelper.GetSpanVerifierSettings();
  settings.UseParameters(url, exploit, body);
  settings.AddIastScrubbing();

diff --git a/tracer/test/Datadog.Trace.Security.IntegrationTests/RASP/AspNetMvc5Rasp.cs b/tracer/test/Datadog.Trace.Security.IntegrationTests/RASP/AspNetMvc5Rasp.cs
@@ -116,6 +116,10 @@ public async Task TestRaspRequestBody(string url, string exploit, string body =
  settings.UseParameters(url, exploit, body);
  settings.AddIastScrubbing();
  var dateTime = DateTime.UtcNow;
+ var answer = await SubmitRequest("/Iast/PopulateDDBB", null, string.Empty);
+ _iisFixture.Agent.SpanFilters.Add(s => !s.Resource.Contains("/Iast/PopulateDDBB"));
+ agent.WaitForSpans(2, minDateTime: dateTime);
+ dateTime = DateTime.UtcNow;
  var testName = _enableIast ? "RaspIast.AspNetMvc5" : "Rasp.AspNetMvc5";
  testName += _classicMode ? ".Classic" : ".Integrated";
  await SubmitRequest(url, body, "application/json");

diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt
@@ -56,7 +56,7 @@
  _dd.appsec.enabled: 1.0,
  _dd.appsec.rasp.duration: 0.0,
  _dd.appsec.rasp.duration_ext: 0.0,
- _dd.appsec.rasp.rule.eval: 17.0,
+ _dd.appsec.rasp.rule.eval: 1.0,
  _dd.appsec.waf.duration: 0.0,
  _dd.appsec.waf.duration_ext: 0.0,
  _dd.top_level: 1.0,

diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt
@@ -57,7 +57,7 @@
  _dd.appsec.enabled: 1.0,
  _dd.appsec.rasp.duration: 0.0,
  _dd.appsec.rasp.duration_ext: 0.0,
- _dd.appsec.rasp.rule.eval: 17.0,
+ _dd.appsec.rasp.rule.eval: 1.0,
  _dd.appsec.waf.duration: 0.0,
  _dd.appsec.waf.duration_ext: 0.0,
  _dd.top_level: 1.0,

diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt
@@ -33,7 +33,7 @@
  _dd.appsec.enabled: 1.0,
  _dd.appsec.rasp.duration: 0.0,
  _dd.appsec.rasp.duration_ext: 0.0,
- _dd.appsec.rasp.rule.eval: 17.0,
+ _dd.appsec.rasp.rule.eval: 1.0,
  _dd.appsec.waf.duration: 0.0,
  _dd.appsec.waf.duration_ext: 0.0,
  _dd.top_level: 1.0,

diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt
@@ -34,7 +34,7 @@
  _dd.appsec.enabled: 1.0,
  _dd.appsec.rasp.duration: 0.0,
  _dd.appsec.rasp.duration_ext: 0.0,
- _dd.appsec.rasp.rule.eval: 17.0,
+ _dd.appsec.rasp.rule.eval: 1.0,
  _dd.appsec.waf.duration: 0.0,
  _dd.appsec.waf.duration_ext: 0.0,
  _dd.top_level: 1.0,

diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt
@@ -92,7 +92,7 @@
  _dd.appsec.enabled: 1.0,
  _dd.appsec.rasp.duration: 0.0,
  _dd.appsec.rasp.duration_ext: 0.0,
- _dd.appsec.rasp.rule.eval: 17.0,
+ _dd.appsec.rasp.rule.eval: 1.0,
  _dd.appsec.waf.duration: 0.0,
  _dd.appsec.waf.duration_ext: 0.0,
  _dd.top_level: 1.0,

diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt
@@ -93,7 +93,7 @@
  _dd.appsec.enabled: 1.0,
  _dd.appsec.rasp.duration: 0.0,
  _dd.appsec.rasp.duration_ext: 0.0,
- _dd.appsec.rasp.rule.eval: 17.0,
+ _dd.appsec.rasp.rule.eval: 1.0,
  _dd.appsec.waf.duration: 0.0,
  _dd.appsec.waf.duration_ext: 0.0,
  _dd.top_level: 1.0,

diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt
@@ -69,7 +69,7 @@
  _dd.appsec.enabled: 1.0,
  _dd.appsec.rasp.duration: 0.0,
  _dd.appsec.rasp.duration_ext: 0.0,
- _dd.appsec.rasp.rule.eval: 17.0,
+ _dd.appsec.rasp.rule.eval: 1.0,
  _dd.appsec.waf.duration: 0.0,
  _dd.appsec.waf.duration_ext: 0.0,
  _dd.top_level: 1.0,

diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '2'='2-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '2'='2-}.verified.txt
@@ -0,0 +1 @@
+
diff --git a/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt b/...-ExecuteQueryFromBodyQueryData_exploit=SqlI_body={-UserName-- -' or '1'='1-}.verified.txt
@@ -82,7 +82,7 @@
  _dd.appsec.enabled: 1.0,
  _dd.appsec.rasp.duration: 0.0,
  _dd.appsec.rasp.duration_ext: 0.0,
- _dd.appsec.rasp.rule.eval: 17.0,
+ _dd.appsec.rasp.rule.eval: 1.0,
  _dd.appsec.waf.duration: 0.0,
  _dd.appsec.waf.duration_ext: 0.0,
  _dd.top_level: 1.0,

diff --git a/...est/test-applications/security/Samples.Security.AspNetCore5/Controllers/IastController.cs b/...est/test-applications/security/Samples.Security.AspNetCore5/Controllers/IastController.cs
@@ -115,6 +115,21 @@ public IActionResult WeakHashing(int delay1 = 0, int delay2 = 0)
 #pragma warning restore SYSLIB0021 // Type or member is obsolete
  }
 
+ [HttpGet("PopulateDDBB")]
+ [Route("PopulateDDBB")]
+ public IActionResult PopulateDDBB()
+ {
+ try
+ {
+ dbConnection ??= IastControllerHelper.CreateDatabase();
+ return Content("OK");
+ }
+ catch (SQLiteException ex)
+ {
+ return StatusCode(500, IastControllerHelper.ToFormattedString(ex));
+ }
+ }
+
  [HttpGet("SqlQuery")]
  [Route("SqlQuery")]
  public IActionResult SqlQuery(string username, string query)

diff --git a/...st-applications/security/aspnet/Samples.Security.AspNetMvc5/Controllers/IastController.cs b/...st-applications/security/aspnet/Samples.Security.AspNetMvc5/Controllers/IastController.cs
@@ -70,6 +70,20 @@ public ActionResult WeakHashing(int delay1 = 0, int delay2 = 0)
 #pragma warning restore SYSLIB0021 // Type or member is obsolete
  }
 
+ [Route("PopulateDDBB")]
+ public ActionResult PopulateDDBB()
+ {
+ try
+ {
+ dbConnection = dbConnection ?? IastControllerHelper.CreateDatabase();
+ return Content("OK");
+ }
+ catch (SQLiteException ex)
+ {
+ return Content(IastControllerHelper.ToFormattedString(ex));
+ }
+ }
+
  [Route("SqlQuery")]
  public ActionResult SqlQuery(string username, string query)
  {