fix：修复jackson规则影响后续规则的问题，添加新的跳过规则

HXSecurity · Oct 18, 2023 · c44ce84 · c44ce84
1 parent c0b7f6e
commit c44ce84
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/.../src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java b/.../src/main/java/io/dongtai/iast/core/handler/hookpoint/controller/impl/PropagatorImpl.java
@@ -30,7 +30,8 @@ public class PropagatorImpl {
             "java.net.URL.<init>(java.net.URL,java.lang.String,java.net.URLStreamHandler)",
             "java.net.URL.<init>(java.lang.String,java.lang.String,java.lang.String)", // indirect
             "java.net.URL.<init>(java.lang.String,java.lang.String,int,java.lang.String)", // indirect
-            "java.net.URL.<init>(java.lang.String,java.lang.String,int,java.lang.String,java.net.URLStreamHandler)"
+            "java.net.URL.<init>(java.lang.String,java.lang.String,int,java.lang.String,java.net.URLStreamHandler)",
+            "com.fasterxml.jackson.databind.ObjectMapper.readValue(java.io.InputStream,com.fasterxml.jackson.databind.JavaType)"
     ));
 
     public static void solvePropagator(MethodEvent event, PropagatorNode propagatorNode, AtomicInteger invokeIdSequencer) {

diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/utils/TaintPoolUtils.java b/dongtai-core/src/main/java/io/dongtai/iast/core/utils/TaintPoolUtils.java
@@ -153,7 +153,7 @@ public static void trackObject(MethodEvent event, PolicyNode policyNode, Object
                 hash = System.identityHashCode(obj);
                 identityHash = hash;
             }
-            if (EngineManager.TAINT_HASH_CODES.contains(hash) && !isMicroservice) {
+            if (EngineManager.TAINT_HASH_CODES.contains(hash)) {
                 return;
             }
         }