add conditional listener registration helpers

Signed-off-by: Eliott Bouhana <[email protected]>

internal/appsec/dyngo/operation.go

@@ -32,7 +32,7 @@ import (
 // This is required because we really want to be able to log errors from dyngo
 // but the log package depend on too much packages that we want to instrument.
 // So we need to do this to avoid dependency cycles.
-var LogError func(string, ...any)
+var LogError = func(string, ...any) {}
 
 // Operation interface type allowing to register event listeners to the
 // operation. The event listeners will be automatically removed from the
@@ -321,7 +321,7 @@ func (b *dataBroadcaster) clear() {
 
 func emitData[T any](b *dataBroadcaster, v T) {
  defer func() {
- if r := recover(); r != nil && LogError != nil {
+ if r := recover(); r != nil {
  LogError("appsec: recovered from an unexpected panic from an event listener: %+v", r)
  }
  }()
@@ -352,7 +352,7 @@ func (r *eventRegister) clear() {
 
 func emitEvent[O Operation, T any](r *eventRegister, op O, v T) {
  defer func() {
- if r := recover(); r != nil && LogError != nil {
+ if r := recover(); r != nil {
  LogError("appsec: recovered from an unexpected panic from an event listener: %+v", r)
  }
  }()

internal/appsec/listener/grpcsec/grpc.go

@@ -117,11 +117,11 @@ func (l *wafEventListener) onEvent(op *types.HandlerOperation, handlerArgs types
  return
  }
 
- if l.isSecAddressListened(httpsec.ServerIoNetURLAddr) {
+ if httpsec.SSRFAddressesPresent(l.addresses) {
  httpsec.RegisterRoundTripperListener(op, &op.SecurityEventsHolder, wafCtx, l.limiter)
  }
 
- if l.isSecAddressListened(ossec.ServerIOFSFileAddr) {
+ if ossec.OSAddressesPresent(l.addresses) {
  ossec.RegisterOpenListener(op, &op.SecurityEventsHolder, wafCtx, l.limiter)
  }
 

internal/appsec/listener/httpsec/http.go

@@ -113,13 +113,13 @@ func (l *wafEventListener) onEvent(op *types.Operation, args types.HandlerOperat
  return
  }
 
- if _, ok := l.addresses[ServerIoNetURLAddr]; ok {
+ if SSRFAddressesPresent(l.addresses) {
  dyngo.On(op, shared.MakeWAFRunListener(&op.SecurityEventsHolder, wafCtx, l.limiter, func(args types.RoundTripOperationArgs) waf.RunAddressData {
  return waf.RunAddressData{Ephemeral: map[string]any{ServerIoNetURLAddr: args.URL}}
  }))
  }
 
- if _, ok := l.addresses[ossec.ServerIOFSFileAddr]; ok {
+ if ossec.OSAddressesPresent(l.addresses) {
  ossec.RegisterOpenListener(op, &op.SecurityEventsHolder, wafCtx, l.limiter)
  }
 

internal/appsec/listener/httpsec/roundtripper.go

@@ -8,6 +8,7 @@ package httpsec
 import (
  "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/dyngo"
  "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/emitter/httpsec/types"
+ "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/listener"
  "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/listener/sharedsec"
  "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/trace"
 
@@ -21,3 +22,8 @@ func RegisterRoundTripperListener(op dyngo.Operation, events *trace.SecurityEven
  return waf.RunAddressData{Ephemeral: map[string]any{ServerIoNetURLAddr: args.URL}}
  }))
 }
+
+func SSRFAddressesPresent(addresses listener.AddressSet) bool {
+ _, urlAddr := addresses[ServerIoNetURLAddr]
+ return urlAddr
+}

internal/appsec/listener/ossec/lfi.go

@@ -6,14 +6,13 @@
 package ossec
 
 import (
- "os"
-
  "github.com/DataDog/appsec-internal-go/limiter"
  waf "github.com/DataDog/go-libddwaf/v3"
 
  "gopkg.in/DataDog/dd-trace-go.v1/appsec/events"
  "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/dyngo"
  "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/emitter/ossec"
+ "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/listener"
  "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/listener/sharedsec"
  "gopkg.in/DataDog/dd-trace-go.v1/internal/appsec/trace"
 )
@@ -28,21 +27,18 @@ func RegisterOpenListener(op dyngo.Operation, eventsHolder *trace.SecurityEvents
  })
 
  dyngo.On(op, func(op *ossec.OpenOperation, args ossec.OpenOperationArgs) {
- // We only care about read operations. We don't want to scan for write operations
- // os.O_RDONLY is not a flag it's simply 0, so we can't do a simple bit mask
- // If os.O_CREATE is set, we also want to monitor the operation because the file must not exist
- if (args.Flags&os.O_RDWR == 0 && args.Flags != os.O_RDONLY) || args.Flags&os.O_CREATE != 0 {
- return
- }
-
  dyngo.OnData(op, func(e *events.BlockingSecurityEvent) {
  dyngo.OnFinish(op, func(op *ossec.OpenOperation, res ossec.OpenOperationRes) {
  if res.Err != nil {
  *res.Err = e
  }
  })
  })
-
  runWAF(op, args)
  })
 }
+
+func OSAddressesPresent(addresses listener.AddressSet) bool {
+ _, fileAddr := addresses[ServerIOFSFileAddr]
+ return fileAddr
+}