feat(appsec): extend RASP callsite coverage to File-argument constructors of FileOutputStream and FileInputStream

buildSrc/call-site-instrumentation-plugin/src/main/java/datadog/trace/plugin/csi/impl/AdviceGeneratorImpl.java

@@ -58,6 +58,7 @@
 import java.io.File;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Comparator;
 import java.util.List;
 import java.util.stream.Collectors;
 import javax.annotation.Nonnull;
@@ -266,7 +267,7 @@ private static void writeStackOperations(final AdviceSpecification advice, final
       final List<Expression> parameterIndicesValues =
           advice
               .getArguments()
-              .sorted()
+              .sorted(Comparator.comparingInt(argSpec -> argSpec.getIndex()))
               .map(argSpec -> intLiteral(argSpec.getIndex()))
               .collect(Collectors.toList());
       final VariableDeclarator parameterIndices =

dd-java-agent/instrumentation/java/java-io-1.8/build.gradle

@@ -8,8 +8,20 @@ apply from: "$rootDir/gradle/java.gradle"
 apply plugin: 'dd-trace-java.call-site-instrumentation'
 
 addTestSuiteForDir('latestDepTest', 'test')
+addTestSuiteForDir('java11Test', 'java11Test')
+
+// java11Test only runs on JDK 11+; the testJvmConstraints plugin reads this property by convention
+ext.java11TestMinJavaVersionForTests = JavaVersion.VERSION_11
+
+tasks.named("compileJava11TestJava", JavaCompile) {
+  configureCompiler(it, 11)
+}
+tasks.named("compileJava11TestGroovy", GroovyCompile) {
+  configureCompiler(it, 11)
+}
 
 dependencies {
   testRuntimeOnly project(':dd-java-agent:instrumentation:datadog:asm:iast-instrumenter')
   testImplementation group: 'org.apache.tomcat', name: 'tomcat-catalina', version: '9.0.56'
+  java11TestImplementation sourceSets.test.output
 }

dd-java-agent/instrumentation/java/java-io-1.8/src/java11Test/groovy/datadog/trace/instrumentation/java/io/FileReaderCharsetCallSiteTest.groovy

@@ -0,0 +1,35 @@
+package datadog.trace.instrumentation.java.io
+
+import datadog.trace.instrumentation.java.lang.FileIORaspHelper
+import foo.bar.TestFileReaderCharsetSuite
+
+import java.nio.charset.Charset
+
+class FileReaderCharsetCallSiteTest extends BaseIoRaspCallSiteTest {
+
+  void 'test RASP new FileReader with String path and Charset'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final file = newFile('test_rasp_fr_str_cs.txt')
+
+    when:
+    TestFileReaderCharsetSuite.newFileReader(file.path, Charset.defaultCharset()).close()
+
+    then:
+    1 * helper.beforeFileLoaded(file.path)
+  }
+
+  void 'test RASP new FileReader with File and Charset'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final file = newFile('test_rasp_fr_file_cs.txt')
+
+    when:
+    TestFileReaderCharsetSuite.newFileReader(file, Charset.defaultCharset()).close()
+
+    then:
+    1 * helper.beforeFileLoaded(file.path)
+  }
+}

dd-java-agent/instrumentation/java/java-io-1.8/src/java11Test/groovy/datadog/trace/instrumentation/java/io/FileWriterCharsetCallSiteTest.groovy

@@ -0,0 +1,61 @@
+package datadog.trace.instrumentation.java.io
+
+import datadog.trace.instrumentation.java.lang.FileIORaspHelper
+import foo.bar.TestFileWriterCharsetSuite
+
+import java.nio.charset.Charset
+
+class FileWriterCharsetCallSiteTest extends BaseIoRaspCallSiteTest {
+
+  void 'test RASP new FileWriter with String path and Charset'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final file = newFile('test_rasp_fw_str_cs.txt')
+
+    when:
+    TestFileWriterCharsetSuite.newFileWriter(file.path, Charset.defaultCharset()).close()
+
+    then:
+    1 * helper.beforeFileWritten(file.path)
+  }
+
+  void 'test RASP new FileWriter with String path, Charset, and append flag'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final file = newFile('test_rasp_fw_str_cs_append.txt')
+
+    when:
+    TestFileWriterCharsetSuite.newFileWriter(file.path, Charset.defaultCharset(), false).close()
+
+    then:
+    1 * helper.beforeFileWritten(file.path)
+  }
+
+  void 'test RASP new FileWriter with File and Charset'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final file = newFile('test_rasp_fw_file_cs.txt')
+
+    when:
+    TestFileWriterCharsetSuite.newFileWriter(file, Charset.defaultCharset()).close()
+
+    then:
+    1 * helper.beforeFileWritten(file.path)
+  }
+
+  void 'test RASP new FileWriter with File, Charset, and append flag'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final file = newFile('test_rasp_fw_file_cs_append.txt')
+
+    when:
+    TestFileWriterCharsetSuite.newFileWriter(file, Charset.defaultCharset(), false).close()
+
+    then:
+    1 * helper.beforeFileWritten(file.path)
+  }
+}

dd-java-agent/instrumentation/java/java-io-1.8/src/java11Test/groovy/datadog/trace/instrumentation/java/io/FilesJava11CallSiteTest.groovy

@@ -0,0 +1,61 @@
+package datadog.trace.instrumentation.java.io
+
+import datadog.trace.instrumentation.java.lang.FileIORaspHelper
+import foo.bar.TestFilesJava11Suite
+
+import java.nio.charset.StandardCharsets
+
+class FilesJava11CallSiteTest extends BaseIoRaspCallSiteTest {
+
+  void 'test RASP Files.writeString without charset'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final path = temporaryFolder.resolve('test_rasp_writestring.txt')
+
+    when:
+    TestFilesJava11Suite.writeString(path, 'hello')
+
+    then:
+    1 * helper.beforeFileWritten(path.toString())
+  }
+
+  void 'test RASP Files.writeString with charset'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final path = temporaryFolder.resolve('test_rasp_writestring_cs.txt')
+
+    when:
+    TestFilesJava11Suite.writeString(path, 'hello', StandardCharsets.UTF_8)
+
+    then:
+    1 * helper.beforeFileWritten(path.toString())
+  }
+
+  void 'test RASP Files.readString without charset'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final path = newFile('test_rasp_readstring.txt').toPath()
+
+    when:
+    TestFilesJava11Suite.readString(path)
+
+    then:
+    1 * helper.beforeFileLoaded(path.toString())
+  }
+
+  void 'test RASP Files.readString with charset'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final path = newFile('test_rasp_readstring_cs.txt').toPath()
+
+    when:
+    TestFilesJava11Suite.readString(path, StandardCharsets.UTF_8)
+
+    then:
+    1 * helper.beforeFileLoaded(path.toString())
+  }
+}

dd-java-agent/instrumentation/java/java-io-1.8/src/java11Test/groovy/datadog/trace/instrumentation/java/io/PathOfCallSiteTest.groovy

@@ -0,0 +1,37 @@
+package datadog.trace.instrumentation.java.io
+
+import datadog.trace.instrumentation.java.lang.FileIORaspHelper
+import foo.bar.TestPathOfSuite
+
+class PathOfCallSiteTest extends BaseIoRaspCallSiteTest {
+
+  void 'test RASP Path.of from strings'(final String first, final String... more) {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+
+    when:
+    TestPathOfSuite.of(first, more)
+
+    then:
+    1 * helper.beforeFileLoaded(first, more)
+
+    where:
+    first      | more
+    'test.txt' | [] as String[]
+    '/tmp'     | ['log', 'test.txt'] as String[]
+  }
+
+  void 'test RASP Path.of from URI'() {
+    setup:
+    final helper = Mock(FileIORaspHelper)
+    FileIORaspHelper.INSTANCE = helper
+    final uri = new URI('file:/test.txt')
+
+    when:
+    TestPathOfSuite.of(uri)
+
+    then:
+    1 * helper.beforeFileLoaded(uri)
+  }
+}

dd-java-agent/instrumentation/java/java-io-1.8/src/java11Test/java/foo/bar/TestFileReaderCharsetSuite.java

@@ -0,0 +1,19 @@
+package foo.bar;
+
+import java.io.File;
+import java.io.FileReader;
+import java.io.IOException;
+import java.nio.charset.Charset;
+
+public class TestFileReaderCharsetSuite {
+
+  public static FileReader newFileReader(final String path, final Charset charset)
+      throws IOException {
+    return new FileReader(path, charset);
+  }
+
+  public static FileReader newFileReader(final File file, final Charset charset)
+      throws IOException {
+    return new FileReader(file, charset);
+  }
+}

dd-java-agent/instrumentation/java/java-io-1.8/src/java11Test/java/foo/bar/TestFileWriterCharsetSuite.java

@@ -0,0 +1,29 @@
+package foo.bar;
+
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.nio.charset.Charset;
+
+public class TestFileWriterCharsetSuite {
+
+  public static FileWriter newFileWriter(final String path, final Charset charset)
+      throws IOException {
+    return new FileWriter(path, charset);
+  }
+
+  public static FileWriter newFileWriter(
+      final String path, final Charset charset, final boolean append) throws IOException {
+    return new FileWriter(path, charset, append);
+  }
+
+  public static FileWriter newFileWriter(final File file, final Charset charset)
+      throws IOException {
+    return new FileWriter(file, charset);
+  }
+
+  public static FileWriter newFileWriter(
+      final File file, final Charset charset, final boolean append) throws IOException {
+    return new FileWriter(file, charset, append);
+  }
+}

dd-java-agent/instrumentation/java/java-io-1.8/src/java11Test/java/foo/bar/TestFilesJava11Suite.java

@@ -0,0 +1,32 @@
+package foo.bar;
+
+import java.io.IOException;
+import java.nio.charset.Charset;
+import java.nio.file.Files;
+import java.nio.file.OpenOption;
+import java.nio.file.Path;
+
+public class TestFilesJava11Suite {
+
+  public static Path writeString(
+      final Path path, final CharSequence content, final OpenOption... options) throws IOException {
+    return Files.writeString(path, content, options);
+  }
+
+  public static Path writeString(
+      final Path path,
+      final CharSequence content,
+      final Charset charset,
+      final OpenOption... options)
+      throws IOException {
+    return Files.writeString(path, content, charset, options);
+  }
+
+  public static String readString(final Path path) throws IOException {
+    return Files.readString(path);
+  }
+
+  public static String readString(final Path path, final Charset charset) throws IOException {
+    return Files.readString(path, charset);
+  }
+}

dd-java-agent/instrumentation/java/java-io-1.8/src/java11Test/java/foo/bar/TestPathOfSuite.java

@@ -0,0 +1,15 @@
+package foo.bar;
+
+import java.net.URI;
+import java.nio.file.Path;
+
+public class TestPathOfSuite {
+
+  public static Path of(final String first, final String... more) {
+    return Path.of(first, more);
+  }
+
+  public static Path of(final URI uri) {
+    return Path.of(uri);
+  }
+}