v.1.3.0 proposal (#55)

* Add SetMaxTransacion function. (#54)

* Add static casting in order to prevent compilation errors in older g++ versions. (#56)

* Update version to 1.3.0

Author: hoolioh

index.d.ts

@@ -30,6 +30,7 @@ declare module 'datadog-iast-taint-tracking' {
         getMetrics(transactionId: string, telemetryVerbosity: number): Metrics;
         getRanges(transactionId: string, original: string): NativeTaintedRange[];
         removeTransaction(transactionId: string): void;
+        setMaxTransactions(maxTransactions: number): void;
         concat(transactionId: string, result: string, op1: string, op2: string): string;
         trim(transactionId: string, result: string, thisArg: string): string;
         trimEnd(transactionId: string, result: string, thisArg: string): string;

index.js

@@ -27,6 +27,8 @@ try {
     },
     removeTransaction () {
     },
+    setMaxTransactions () {
+    },
     replace (transactionId, result) {
       return result
     },
@@ -58,6 +60,7 @@ const iastNativeMethods = {
   getRanges: addon.getRanges,
   createTransaction: addon.createTransaction,
   removeTransaction: addon.removeTransaction,
+  setMaxTransactions: addon.setMaxTransactions,
   replace: require('./replace.js')(addon),
   concat: addon.concat,
   trim: addon.trim,

package-lock.json

@@ -2,7 +2,7 @@
   "name": "@datadog/native-iast-taint-tracking",
   "home": "https://github.com/DataDog/dd-native-iast-taint-tracking-js/blob/main/README.md",
   "repository": "[email protected]:DataDog/dd-native-iast-taint-tracking-js.git",
-  "version": "1.2.1",
+  "version": "1.3.0",
   "description": "Datadog IAST tant tracking support for NodeJS",
   "main": "index.js",
   "scripts": {

package.json

@@ -185,12 +185,31 @@ void DeleteTransaction(const FunctionCallbackInfo<Value>& args) {
     RemoveTransaction(transactionId);
 }
 
+void SetMaxTransactions(const FunctionCallbackInfo<Value>& args) {
+    Isolate* isolate = args.GetIsolate();
+    if (args.Length() != 1) {
+        // Throw an Error that is passed back to JavaScript
+        isolate->ThrowException(Exception::TypeError(
+            String::NewFromUtf8(isolate,
+                "Wrong number of arguments",
+                NewStringType::kNormal).ToLocalChecked()));
+        return;
+    }
+
+    if (!args[0]->IsNumber()) {
+        return;
+    }
+
+    iast::SetMaxTransactions(args[0]->IntegerValue(isolate->GetCurrentContext()).FromJust());
+}
+
 void StringMethods::Init(Local<Object> exports) {
     NODE_SET_METHOD(exports, "createTransaction", CreateTransaction);
     NODE_SET_METHOD(exports, "newTaintedString", NewTaintedString);
     NODE_SET_METHOD(exports, "isTainted", IsTainted);  // TODO(julio): support several objects.
     NODE_SET_METHOD(exports, "getRanges", GetRanges);
     NODE_SET_METHOD(exports, "removeTransaction", DeleteTransaction);
+    NODE_SET_METHOD(exports, "setMaxTransactions", SetMaxTransactions);
 }
 }  // namespace api
 }  // namespace iast

src/api/string_methods.cc

@@ -4,6 +4,7 @@
 **/
 
 #include <node.h>
+#include <cstddef>
 #include "iast.h"
 #include "gc/gc.h"
 #include "container/singleton.h"
@@ -17,25 +18,29 @@
 #include "api/replace.h"
 #include "api/metrics.h"
 
-using transactionManger = iast::container::Singleton<iast::TransactionManager<iast::tainted::Transaction,
+using transactionManager = iast::container::Singleton<iast::TransactionManager<iast::tainted::Transaction,
       iast::tainted::transaction_key_t>>;
 
 namespace iast {
 
 void RehashAllTransactions(void) {
-    transactionManger::GetInstance().RehashAll();
+    transactionManager::GetInstance().RehashAll();
 }
 
 void RemoveTransaction(transaction_key_t id) {
-    transactionManger::GetInstance().Remove(id);
+    transactionManager::GetInstance().Remove(id);
 }
 
 Transaction* GetTransaction(transaction_key_t id) {
-    return transactionManger::GetInstance().Get(id);
+    return transactionManager::GetInstance().Get(id);
 }
 
 Transaction* NewTransaction(transaction_key_t id) {
-    return transactionManger::GetInstance().New(id);
+    return transactionManager::GetInstance().New(id);
+}
+
+void SetMaxTransactions(size_t maxItems) {
+    transactionManager::GetInstance().setMaxItems(maxItems);
 }
 
 void Init(v8::Local<v8::Object> exports) {

src/iast.cc

@@ -23,6 +23,7 @@ void RehashAllTransactions(void);
 void RemoveTransaction(transaction_key_t id);
 Transaction* GetTransaction(transaction_key_t id);
 Transaction* NewTransaction(transaction_key_t id);
+void SetMaxTransactions(size_t maxItems);
 
 }  // namespace iast
 

src/iast.h

@@ -122,3 +122,26 @@ TEST(TransactionManager, insert_beyond_limit)
     iastManager.Remove(key1);
     iastManager.Remove(key2);
 }
+
+TEST(TransactionManager, create_beyond_limit)
+{
+    int elems = 0;
+    TransactionManager<FakeTransaction, transaction_key_t> iastManager;
+    elems = iastManager.getMaxItems();
+    CHECK_EQUAL(2, elems);
+
+    iastManager.New(1);
+    CHECK_EQUAL(1, iastManager.Size());
+
+    iastManager.New(2);
+    CHECK_EQUAL(2, iastManager.Size());
+
+    CHECK_EQUAL(static_cast<FakeTransaction*>(nullptr), iastManager.New(3));
+
+    iastManager.setMaxItems(3);
+    iastManager.New(3);
+    CHECK_EQUAL(3, iastManager.Size());
+
+    iastManager.Clear();
+    CHECK_EQUAL(0, iastManager.Size());
+}

test/cpputest/transaction_manager.cc

@@ -6,7 +6,7 @@ const { TaintedUtils, taintFormattedString, formatTaintedValue } = require('./ut
 const assert = require('assert')
 
 describe('Plus operator', function () {
-  const id = '1'
+  const id = TaintedUtils.createTransaction('1')
 
   afterEach(function () {
     TaintedUtils.removeTransaction(id)
@@ -139,7 +139,7 @@ describe('Plus operator', function () {
 })
 
 describe('concat method', () => {
-  const id = '1'
+  const id = TaintedUtils.createTransaction('1')
 
   afterEach(function () {
     TaintedUtils.removeTransaction(id)

test/js/concat.spec.js

@@ -10,6 +10,10 @@ describe('Addon loading', function () {
     assert(TaintedUtils, 'Undefined module')
     assert(TaintedUtils.newTaintedString, 'Undefined')
     assert(TaintedUtils.isTainted, 'Undefined')
+    assert(TaintedUtils.getRanges, 'Undefined')
+    assert(TaintedUtils.createTransaction, 'Undefined')
+    assert(TaintedUtils.removeTransaction, 'Undefined')
+    assert(TaintedUtils.setMaxTransactions, 'Undefined')
     assert(TaintedUtils.concat, 'Undefined')
     assert(TaintedUtils.trim, 'Undefined')
     assert(TaintedUtils.trimEnd, 'Undefined')