HXSecurity · lostsnow · Jan 17, 2022 · Jan 12, 2022 · Jan 12, 2022
diff --git a/dongtai_agent_python/policy/tracking.py b/dongtai_agent_python/policy/tracking.py
@@ -4,6 +4,8 @@
 import traceback
 
 from pkg_resources import parse_version
+# from regexploit import redos
+# from regexploit.ast.sre import SreOpParser
 
 from dongtai_agent_python import CONTEXT_TRACKER
 from dongtai_agent_python.setting import const
@@ -101,6 +103,10 @@ def apply(self, args, kwargs, target):
             elif len(list(set(self.context.taint_ids) & set(source_ids))) == 0:
                 return
 
+        if self.signature.startswith('re.'):
+            if re_is_safe(self.context.taint_ids, args, kwargs):
+                return
+
         self.get_caller(-4)
         if self.ignore_tracking:
             return
@@ -169,6 +175,14 @@ def processing_invoke_args(signature=None, come_args=None, come_kwargs=None):
         'Cryptodome.Cipher._mode_ecb.EcbMode.encrypt': {'args': [0, 1], 'kwargs': ['plaintext']},
         'Cryptodome.Cipher._mode_ofb.OfbMode.encrypt': {'args': [0, 1], 'kwargs': ['plaintext']},
         'Cryptodome.Cipher._mode_openpgp.OpenPgpMode.encrypt': {'args': [0, 1], 'kwargs': ['plaintext']},
+        're.match': {'args': [0, 1], 'kwargs': ['pattern', 'string']},
+        're.fullmatch': {'args': [0, 1], 'kwargs': ['pattern', 'string']},
+        're.search': {'args': [0, 1], 'kwargs': ['pattern', 'string']},
+        're.sub': {'args': [0, 2], 'kwargs': ['pattern', 'string']},
+        're.subn': {'args': [0, 2], 'kwargs': ['pattern', 'string']},
+        're.split': {'args': [0, 1], 'kwargs': ['pattern', 'string']},
+        're.findall': {'args': [0, 1], 'kwargs': ['pattern', 'string']},
+        're.finditer': {'args': [0, 1], 'kwargs': ['pattern', 'string']},
     }
 
     context = CONTEXT_TRACKER.current()
@@ -209,6 +223,7 @@ def processing_invoke_args(signature=None, come_args=None, come_kwargs=None):
     return invoke_args
 
 
+@scope.with_scope(scope.SCOPE_AGENT)
 def yaml_load_is_safe(args, kwargs=None):
     if kwargs is None:
         kwargs = {}
@@ -230,6 +245,44 @@ def yaml_load_is_safe(args, kwargs=None):
     return True
 
 
+@scope.with_scope(scope.SCOPE_AGENT)
+def re_is_safe(taint_ids, args, kwargs=None):
+    if args is None:
+        args = ()
+    if kwargs is None:
+        kwargs = {}
+
+    if len(args) > 0:
+        pattern = args[0]
+    elif 'pattern' in kwargs:
+        pattern = kwargs['pattern']
+    else:
+        return True
+
+    if not pattern:
+        return True
+
+    if utils.get_hash(pattern) in taint_ids:
+        return False
+
+    # @TODO: static analysis
+    """
+    if isinstance(pattern, const.EMPTY_PATTERN):
+        pattern = pattern.pattern
+
+    try:
+        parsed = SreOpParser().parse_sre(pattern)
+    except re.error:
+        return True
+
+    for rd in redos.find(parsed):
+        if rd.starriness > 2:
+            return False
+    """
+
+    return True
+
+
 @scope.with_scope(scope.SCOPE_AGENT)
 def recurse_tracking(obj, node_type, hash_ids=None):
     if obj is None:

diff --git a/dongtai_agent_python/policy_api.json b/dongtai_agent_python/policy_api.json
@@ -401,6 +401,69 @@
         }
       ]
     },
+    {
+      "type": 4,
+      "enable": 1,
+      "value": "redos",
+      "details": [
+        {
+          "source": "P1,2,pattern,string",
+          "track": "true",
+          "target": "",
+          "value": "re.match",
+          "inherit": "false"
+        },
+        {
+          "source": "P1,2,pattern,string",
+          "track": "true",
+          "target": "",
+          "value": "re.fullmatch",
+          "inherit": "false"
+        },
+        {
+          "source": "P1,2,pattern,string",
+          "track": "true",
+          "target": "",
+          "value": "re.search",
+          "inherit": "false"
+        },
+        {
+          "source": "P1,3,pattern,string",
+          "track": "true",
+          "target": "",
+          "value": "re.sub",
+          "inherit": "false"
+        },
+        {
+          "source": "P1,3,pattern,string",
+          "track": "true",
+          "target": "",
+          "value": "re.subn",
+          "inherit": "false"
+        },
+        {
+          "source": "P1,2,pattern,string",
+          "track": "true",
+          "target": "",
+          "value": "re.split",
+          "inherit": "false"
+        },
+        {
+          "source": "P1,2,pattern,string",
+          "track": "true",
+          "target": "",
+          "value": "re.findall",
+          "inherit": "false"
+        },
+        {
+          "source": "P1,2,pattern,string",
+          "track": "true",
+          "target": "",
+          "value": "re.finditer",
+          "inherit": "false"
+        }
+      ]
+    },
     {
       "type": 2,
       "enable": 1,
@@ -895,6 +958,13 @@
           "target": "R",
           "value": "ldap3.utils.conv.escape_filter_chars",
           "inherit": "false"
+        },
+        {
+          "source": "P1,pattern",
+          "track": "true",
+          "target": "R",
+          "value": "re.escape",
+          "inherit": "false"
         }
       ]
     }

diff --git a/dongtai_agent_python/setting/const.py b/dongtai_agent_python/setting/const.py
@@ -1,3 +1,5 @@
+import re
+
 CONTAINER_DJANGO = 'Django'
 CONTAINER_FLASK = 'Flask'
 
@@ -16,6 +18,8 @@
 TAINT_SOURCE = 1
 TAINT_TARGET = 2
 
+EMPTY_PATTERN = type(re.compile(''))
+
 C_API_PATCHES = [
     'builtins.str.fstring',
     'builtins.str.cformat',

diff --git a/setup.cfg b/setup.cfg
@@ -29,3 +29,4 @@ install_requires =
     psutil >= 5.8.0
     requests >= 2.25.1
     pip >= 19.2.3
+;    regexploit >= 1.0.0