Add propagation to URI#toURL method

Author: manuel-alvarez-alvarez

dd-java-agent/instrumentation/java-net/src/main/java/datadog/trace/instrumentation/java/net/URICallSite.java

@@ -9,6 +9,7 @@
 import datadog.trace.api.iast.propagation.CodecModule;
 import datadog.trace.api.iast.propagation.PropagationModule;
 import java.net.URI;
+import java.net.URL;
 import javax.annotation.Nonnull;
 import javax.annotation.Nullable;
 
@@ -105,4 +106,19 @@ public static URI afterNormalize(
     }
     return result;
   }
+
+  @Propagation
+  @CallSite.After("java.net.URL java.net.URI.toURL()")
+  public static URL afterToURL(@CallSite.This final URI uri, @CallSite.Return final URL result) {
+    final PropagationModule module = InstrumentationBridge.PROPAGATION;
+    if (module != null && result != null) {
+      try {
+        boolean keepRanges = uri.toString().equals(result.toString());
+        module.taintObjectIfTainted(result, uri, keepRanges, NOT_MARKED);
+      } catch (final Throwable e) {
+        module.onUnexpectedException("After toURL threw", e);
+      }
+    }
+    return result;
+  }
 }

dd-java-agent/instrumentation/java-net/src/test/groovy/datadog/trace/instrumentation/java/net/URICallSIteTest.groovy

@@ -69,5 +69,6 @@ class URICallSIteTest extends AgentTestRunner {
     'toASCIIString' | 'String' | [new URI('http://test.com/index?name=value#fragment')]         | true
     'toASCIIString' | 'String' | [new URI('http://test.com/漢/index?name=value#fragment')]      | false
     'toString'      | 'String' | [new URI('http://test.com/index?name=value#fragment')]         | true
+    'toURL'         | 'Object' | [new URI('http://test.com/index?name=value#fragment')]         | true
   }
 }

dd-java-agent/instrumentation/java-net/src/test/java/foo/bar/TestURICallSiteSuite.java

@@ -1,7 +1,9 @@
 package foo.bar;
 
+import java.net.MalformedURLException;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.net.URL;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -105,4 +107,11 @@ public static String toASCIIString(final URI uri) {
     LOGGER.debug("After toAsciiString {}", result);
     return result;
   }
+
+  public static URL toURL(final URI uri) throws MalformedURLException {
+    LOGGER.debug("Before toURL {}", uri);
+    final URL result = uri.toURL();
+    LOGGER.debug("After toURL {}", result);
+    return result;
+  }
 }

dd-smoke-tests/iast-util/src/main/java/datadog/smoketest/springboot/controller/SsrfController.java

@@ -3,6 +3,7 @@
 import com.squareup.okhttp.OkHttpClient;
 import com.squareup.okhttp.Request;
 import java.net.HttpURLConnection;
+import java.net.URI;
 import java.net.URL;
 import org.apache.commons.httpclient.HttpClient;
 import org.apache.commons.httpclient.HttpMethod;
@@ -39,6 +40,21 @@ public String ssrf(
     return "ok";
   }
 
+  @PostMapping("/uri")
+  public String uri(
+      @RequestParam(value = "url", required = false) final String url,
+      @RequestParam(value = "host", required = false) final String host) {
+    try {
+      final URI uri =
+          url != null ? new URI(url) : new URI("https", null, host, 443, "/test", null, null);
+      final URL target = uri.toURL();
+      final HttpURLConnection conn = (HttpURLConnection) target.openConnection();
+      conn.disconnect();
+    } catch (final Exception e) {
+    }
+    return "ok";
+  }
+
   @PostMapping("/apache-httpclient4")
   public String apacheHttpClient4(
       @RequestParam(value = "url", required = false) final String url,

dd-smoke-tests/iast-util/src/testFixtures/groovy/datadog/smoketest/AbstractIastSpringBootTest.groovy

@@ -688,7 +688,7 @@ abstract class AbstractIastSpringBootTest extends AbstractIastServerSmokeTest {
 
   void 'ssrf is present'() {
     setup:
-    final url = "http://localhost:${httpPort}/ssrf"
+    final url = "http://localhost:${httpPort}/ssrf${path}"
     final body = new FormBody.Builder().add(parameter, value).build()
     final request = new Request.Builder().url(url).post(body).build()
 
@@ -715,9 +715,11 @@ abstract class AbstractIastSpringBootTest extends AbstractIastServerSmokeTest {
     }
 
     where:
-    parameter | value
-    'url'     | 'https://dd.datad0g.com/'
-    'host'    | 'dd.datad0g.com'
+    path   | parameter | value
+    ''     | 'url'     | 'https://dd.datad0g.com/'
+    ''     | 'host'    | 'dd.datad0g.com'
+    '/uri' | 'url'     | 'https://dd.datad0g.com/'
+    '/uri' | 'host'    | 'dd.datad0g.com'
   }
 
   void 'ssrf is present (#path) (#parameter)'() {