fix(iast): partial matches on function names should not be patched [backport 2.11]

ddtrace/appsec/_iast/_ast/visitor.py

@@ -261,7 +261,7 @@ def _should_replace_with_taint_sink(self, call_node: ast.Call, is_function: bool
  if function_name in self._taint_sink_replace_disabled:
  return False
 
- return any(allowed in function_name for allowed in self._taint_sink_replace_any)
+ return function_name in self._taint_sink_replace_any
 
  def _add_original_function_as_arg(self, call_node: ast.Call, is_function: bool) -> Any:
  """

releasenotes/notes/iast-aspects-partial-matches-f43dc04584ca6788.yaml

@@ -0,0 +1,3 @@
+fixes:
+ - |
+ Code security: This fix resolves an issue where partial matches on function names we aimed to patch were being patched instead of full matches on them.

tests/appsec/iast/_ast/test_ast_patching.py

@@ -155,3 +155,18 @@ def test_module_path_none(caplog):
  with caplog.at_level(logging.DEBUG), mock.patch("ddtrace.internal.module.Path.resolve", side_effect=AttributeError):
  assert ("", "") == astpatch_module(__import__("tests.appsec.iast.fixtures.ast.str.class_str", fromlist=[None]))
  assert "astpatch_source couldn't find the module: tests.appsec.iast.fixtures.ast.str.class_str" in caplog.text
+
+
+@pytest.mark.parametrize(
+ "module_name",
+ [
+ ("tests.appsec.iast.fixtures.ast.other.globals_builtin"),
+ ],
+)
+def test_astpatch_globals_module_unchanged(module_name):
+ module_path, new_source = astpatch_module(__import__(module_name, fromlist=[None]))
+ assert ("", "") == (module_path, new_source)
+ if ("", "") != (module_path, new_source):
+ new_code = astunparse.unparse(new_source)
+ assert not new_code.startswith("\nimport ddtrace.appsec._iast")
+ assert "ddtrace_taint_sinks.ast_function(globals, 0)" not in new_code

tests/appsec/iast/fixtures/ast/other/globals_builtin.py

@@ -0,0 +1,3 @@
+#!/usr/bin/env python3
+
+_globals = globals()