Clean instrumentation

dd-java-agent/agent-bootstrap/src/main/java/datadog/trace/bootstrap/instrumentation/iast/NamedContext.java

@@ -19,8 +19,6 @@ public abstract class NamedContext {
 
   public abstract void taintName(@Nullable String name);
 
-  public abstract void setCurrentName(@Nullable final String name);
-
   @Nonnull
   public static <E> NamedContext getOrCreate(
       @Nonnull final ContextStore<E, NamedContext> store, @Nonnull final E target) {
@@ -49,9 +47,6 @@ public void taintValue(@Nullable final String value) {}
 
     @Override
     public void taintName(@Nullable final String name) {}
-
-    @Override
-    public void setCurrentName(@Nullable final String name) {}
   }
 
   private static class NamedContextImpl extends NamedContext {
@@ -83,11 +78,6 @@ public void taintName(@Nullable final String name) {
       }
     }
 
-    @Override
-    public void setCurrentName(@Nullable final String name) {
-      currentName = name;
-    }
-
     private IastContext iastCtx() {
       if (!fetched) {
         fetched = true;

dd-java-agent/instrumentation/iast-instrumenter/src/main/resources/datadog/trace/instrumentation/iastinstrumenter/iast_exclusion.trie

@@ -125,8 +125,6 @@
 1 graphql.*
 1 ibm.security.*
 1 io.dropwizard.*
-2 io.ebean.*
-2 io.ebeaninternal.*
 1 io.github.lukehutch.fastclasspathscanner.*
 1 io.grpc.*
 1 io.leangen.geantyref.*

dd-java-agent/instrumentation/jackson-core/src/main/java/datadog/trace/instrumentation/jackson/core/Json2ParserInstrumentation.java

@@ -10,8 +10,6 @@
 
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonToken;
-import com.fasterxml.jackson.core.json.Json2ParserHelper;
-import com.fasterxml.jackson.core.json.UTF8StreamJsonParser;
 import com.google.auto.service.AutoService;
 import datadog.trace.agent.tooling.Instrumenter;
 import datadog.trace.agent.tooling.InstrumenterModule;
@@ -70,14 +68,6 @@ public Map<String, String> contextStore() {
     return singletonMap(TARGET_TYPE, "datadog.trace.bootstrap.instrumentation.iast.NamedContext");
   }
 
-  @Override
-  public String[] helperClassNames() {
-    return new String[] {
-      "com.fasterxml.jackson.core.json" + ".Json2ParserHelper",
-      "com.fasterxml.jackson.core.sym" + ".ByteQuadsCanonicalizerHelper",
-    };
-  }
-
   public static class TextAdvice {
 
     @Advice.OnMethodExit(suppress = Throwable.class)
@@ -115,11 +105,6 @@ public static void onExit(@Advice.This JsonParser jsonParser, @Advice.Return Str
         final ContextStore<JsonParser, NamedContext> store =
             InstrumentationContext.get(JsonParser.class, NamedContext.class);
         final NamedContext context = NamedContext.getOrCreate(store, jsonParser);
-        if (jsonParser instanceof UTF8StreamJsonParser
-            && Json2ParserHelper.fetchInterned((UTF8StreamJsonParser) jsonParser)) {
-          context.setCurrentName(result);
-          return;
-        }
         context.taintName(result);
       }
     }

dd-java-agent/instrumentation/jackson-core/src/test/groovy/Json2ParserInstrumentationTest.groovy

@@ -42,32 +42,7 @@ class Json2ParserInstrumentationTest extends AgentTestRunner {
     0 * _
 
     where:
-    target << [JSON_STRING]
-  }
-
-  void 'test json parsing (tainted but field names)'() {
-    given:
-    final source = new SourceImpl(origin: SourceTypes.REQUEST_BODY, name: 'body', value: JSON_STRING)
-    final module = Mock(PropagationModule)
-    InstrumentationBridge.registerIastModule(module)
-
-    and:
-    final reader = new ObjectMapper().readerFor(Map)
-
-    when:
-    final taintedResult = reader.readValue(target) as Map
-
-    then:
-    JsonOutput.toJson(taintedResult) == JSON_STRING
-    _ * module.taintObjectIfTainted(_, _)
-    _ * module.findSource(_) >> source
-    1 * module.taintString(_, 'root_value', source.origin, 'root', JSON_STRING)
-    1 * module.taintString(_, 'array_0', source.origin, 'nested_array', JSON_STRING)
-    1 * module.taintString(_, 'array_1', source.origin, 'nested_array', JSON_STRING)
-    0 * _
-
-    where:
-    target << [new ByteArrayInputStream(JSON_STRING.getBytes(Charset.defaultCharset()))]
+    target << testSuite()
   }
 
   void 'test json parsing (not tainted)'() {

dd-java-agent/instrumentation/kafka-clients-0.11/src/iastLatestDepTest3/groovy/iast/KafkaIastDeserializerTest.groovy

@@ -124,6 +124,10 @@ class KafkaIastDeserializerTest extends IastAgentTestRunner {
       value(instanceOf(TestBean))
       range(0, Integer.MAX_VALUE, source(origin as byte))
     }
+    to.hasTaintedObject {
+      value('name')
+      range(0, 4, source(origin as byte, 'name', 'name'))
+    }
     to.hasTaintedObject {
       value('Mr Bean')
       range(0, 7, source(origin as byte, 'name', 'Mr Bean'))

dd-java-agent/instrumentation/kafka-clients-0.11/src/test/groovy/iast/KafkaIastDeserializerForkedTest.groovy

@@ -122,6 +122,10 @@ class KafkaIastDeserializerForkedTest extends IastAgentTestRunner {
       value(instanceOf(TestBean))
       range(0, Integer.MAX_VALUE, source(origin as byte))
     }
+    to.hasTaintedObject {
+      value('name')
+      range(0, 4, source(origin as byte, 'name', 'name'))
+    }
     to.hasTaintedObject {
       value('Mr Bean')
       range(0, 7, source(origin as byte, 'name', 'Mr Bean'))

dd-java-agent/instrumentation/spring-webflux-5/src/iastTest/groovy/datadog/trace/instrumentation/springwebflux/server/IastWebFluxTest.groovy

@@ -275,6 +275,14 @@ class IastWebFluxTest extends IastRequestTestRunner {
 
     then:
     // source values take the value of the current object as the body is never converted to a CharSequence
+    toc.hasTaintedObject {
+      value 'var1'
+      range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1',  'var1')
+    }
+    toc.hasTaintedObject {
+      value 'var2'
+      range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2',  'var2')
+    }
     toc.hasTaintedObject {
       value 'foo'
       range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1',  'foo')

dd-java-agent/instrumentation/spring-webflux-6/src/iastTest/groovy/datadog/trace/instrumentation/springwebflux6/server/IastWebFluxTest.groovy

@@ -278,6 +278,14 @@ class IastWebFluxTest extends IastRequestTestRunner {
 
     then:
     // source values take the value of the current object as the body is never converted to a CharSequence
+    toc.hasTaintedObject {
+      value 'var1'
+      range 0, 4, source(SourceTypes.REQUEST_BODY, 'var1',  'var1')
+    }
+    toc.hasTaintedObject {
+      value 'var2'
+      range 0, 4, source(SourceTypes.REQUEST_BODY, 'var2',  'var2')
+    }
     toc.hasTaintedObject {
       value 'foo'
       range 0, 3, source(SourceTypes.REQUEST_BODY, 'var1',  'foo')

dd-smoke-tests/iast-util/src/testFixtures/groovy/datadog/smoketest/AbstractIastVertxSmokeTest.groovy

@@ -166,6 +166,9 @@ abstract class AbstractIastVertxSmokeTest extends AbstractIastServerSmokeTest {
     client.newCall(request).execute()
 
     then:
+    hasTainted { tainted ->
+      tainted.value == 'my_key' && tainted.ranges[0].source.origin == 'http.request.body'
+    }
     hasTainted { tainted ->
       tainted.value == 'my_value' && tainted.ranges[0].source.origin == 'http.request.body'
     }