diff --git a/agent/java/engine/src/main/java/com/baidu/openrasp/config/Config.java b/agent/java/engine/src/main/java/com/baidu/openrasp/config/Config.java index f0ce76b80..a557fd962 100755 --- a/agent/java/engine/src/main/java/com/baidu/openrasp/config/Config.java +++ b/agent/java/engine/src/main/java/com/baidu/openrasp/config/Config.java @@ -27,6 +27,7 @@ import com.baidu.openrasp.plugin.checker.local.ConfigurableChecker; import com.baidu.openrasp.tool.FileUtil; import com.baidu.openrasp.tool.LRUCache; +import com.baidu.openrasp.tool.Reflection; import com.baidu.openrasp.tool.cpumonitor.CpuMonitorManager; import com.baidu.openrasp.tool.filemonitor.FileScanListener; import com.baidu.openrasp.tool.filemonitor.FileScanMonitor; @@ -88,7 +89,9 @@ public enum Item { CPU_USAGE_PERCENT("cpu.usage.percent", "90"), CPU_USAGE_ENABLE("cpu.usage.enable", "false"), CPU_USAGE_INTERVAL("cpu.usage.interval", "5"), - HTTPS_VERIFY_SSL("openrasp.ssl_verifypeer", "false"); + HTTPS_VERIFY_SSL("openrasp.ssl_verifypeer", "false"), + LRU_COMPARE_ENABLE("lru.compare_enable", "false"), + LRU_COMPARE_LIMIT("lru.compare_limit", "10240"); Item(String key, String defaultValue) { @@ -166,6 +169,8 @@ public String toString() { private boolean isHttpsVerifyPeer; private String raspId; private HashSet sqlErrorCodes = new HashSet(); + private boolean lruCompareEnable; + private int lruCompareLimit; static { @@ -475,7 +480,7 @@ public long getPluginTimeout() { public synchronized void setPluginTimeout(String pluginTimeout) { long value = Long.parseLong(pluginTimeout); if (value <= 0) { - throw new ConfigLoadException(Item.PLUGIN_TIMEOUT_MILLIS.name() + " must be greater than 0"); + throw new ConfigLoadException(Item.PLUGIN_TIMEOUT_MILLIS.toString() + " must be greater than 0"); } this.pluginTimeout = value; } @@ -519,7 +524,7 @@ public int getBodyMaxBytes() { public synchronized void setBodyMaxBytes(String bodyMaxBytes) { int value = Integer.parseInt(bodyMaxBytes); if (value <= 0) { - throw new ConfigLoadException(Item.BODY_MAX_BYTES.name() + " must be greater than 0"); + throw new ConfigLoadException(Item.BODY_MAX_BYTES.toString() + " must be greater than 0"); } this.bodyMaxBytes = value; } @@ -531,7 +536,7 @@ public int getSqlSlowQueryMinCount() { public synchronized void setSqlSlowQueryMinCount(String sqlSlowQueryMinCount) { int value = Integer.parseInt(sqlSlowQueryMinCount); if (value < 0) { - throw new ConfigLoadException(Item.SQL_SLOW_QUERY_MIN_ROWS.name() + " can not be less than 0"); + throw new ConfigLoadException(Item.SQL_SLOW_QUERY_MIN_ROWS.toString() + " can not be less than 0"); } this.sqlSlowQueryMinCount = value; } @@ -571,7 +576,7 @@ public int getPluginMaxStack() { public synchronized void setPluginMaxStack(String pluginMaxStack) { int value = Integer.parseInt(pluginMaxStack); if (value < 0) { - throw new ConfigLoadException(Item.PLUGIN_MAX_STACK.name() + " can not be less than 0"); + throw new ConfigLoadException(Item.PLUGIN_MAX_STACK.toString() + " can not be less than 0"); } this.pluginMaxStack = value; } @@ -647,7 +652,7 @@ public int getOgnlMinLength() { public synchronized void setOgnlMinLength(String ognlMinLength) { int value = Integer.parseInt(ognlMinLength); if (value <= 0) { - throw new ConfigLoadException(Item.OGNL_EXPRESSION_MIN_LENGTH.name() + " must be greater than 0"); + throw new ConfigLoadException(Item.OGNL_EXPRESSION_MIN_LENGTH.toString() + " must be greater than 0"); } this.ognlMinLength = value; } @@ -669,7 +674,7 @@ public int getBlockStatusCode() { public synchronized void setBlockStatusCode(String blockStatusCode) { int value = Integer.parseInt(blockStatusCode); if (value < 100 || value > 999) { - throw new ConfigLoadException(Item.BLOCK_STATUS_CODE.name() + " must be between [100,999]"); + throw new ConfigLoadException(Item.BLOCK_STATUS_CODE.toString() + " must be between [100,999]"); } this.blockStatusCode = value; } @@ -684,6 +689,53 @@ public int getDebugLevel() { return debugLevel; } + /** + * 设置 LRU 内容匹配开关 + * + * @param lruCompareEnable lru 匹配开关 + */ + public synchronized void setLruCompareEnable(String lruCompareEnable) { + boolean value = Boolean.parseBoolean(lruCompareEnable); + if (value != this.lruCompareEnable) { + this.lruCompareEnable = value; + commonLRUCache.clear(); + } + } + + /** + * 获取 LRU 内容匹配开关 + * + * @return LRU 内容匹配开关 + */ + public boolean getLruCompareEnable() { + return lruCompareEnable; + } + + /** + * 设置 LRU 匹配最长字节 + * + * @param lruCompareLimit LRU 匹配最长字节 + */ + public synchronized void setLruCompareLimit(String lruCompareLimit) { + int value = Integer.parseInt(lruCompareLimit); + if (value <= 0 || value > 102400) { + throw new ConfigLoadException(Item.LRU_COMPARE_LIMIT.toString() + " must be between [1,102400]"); + } + if (value < this.lruCompareLimit) { + commonLRUCache.clear(); + } + this.lruCompareLimit = value; + } + + /** + * 获取 LRU 匹配最长字节 + * + * @return LRU 匹配最长字节 + */ + public int getLruCompareLimit() { + return lruCompareLimit; + } + /** * 是否开启调试 * @@ -900,7 +952,7 @@ public int getSqlCacheCapacity() { public synchronized void setSqlCacheCapacity(String sqlCacheCapacity) { int value = Integer.parseInt(sqlCacheCapacity); if (value < 0) { - throw new ConfigLoadException(Item.SQL_CACHE_CAPACITY.name() + " can not be less than 0"); + throw new ConfigLoadException(Item.SQL_CACHE_CAPACITY.toString() + " can not be less than 0"); } this.sqlCacheCapacity = value; if (Config.commonLRUCache == null || Config.commonLRUCache.maxSize() != this.sqlCacheCapacity) { @@ -984,7 +1036,7 @@ public int getSyslogFacility() { public synchronized void setSyslogFacility(String syslogFacility) { int value = Integer.parseInt(syslogFacility); if (!(value >= 0 && value <= 23)) { - throw new ConfigLoadException(Item.SYSLOG_FACILITY.name() + " must be between [0,23]"); + throw new ConfigLoadException(Item.SYSLOG_FACILITY.toString() + " must be between [0,23]"); } this.syslogFacility = value; } @@ -1006,7 +1058,7 @@ public int getSyslogReconnectInterval() { public synchronized void setSyslogReconnectInterval(String syslogReconnectInterval) { int value = Integer.parseInt(syslogReconnectInterval); if (value <= 0) { - throw new ConfigLoadException(Item.SYSLOG_RECONNECT_INTERVAL.name() + " must be greater than 0"); + throw new ConfigLoadException(Item.SYSLOG_RECONNECT_INTERVAL.toString() + " must be greater than 0"); } this.syslogReconnectInterval = value; } @@ -1028,7 +1080,7 @@ public int getLogMaxBurst() { public synchronized void setLogMaxBurst(String logMaxBurst) { int value = Integer.parseInt(logMaxBurst); if (value < 0) { - throw new ConfigLoadException(Item.LOG_MAXBURST.name() + " can not be less than 0"); + throw new ConfigLoadException(Item.LOG_MAXBURST.toString() + " can not be less than 0"); } this.logMaxBurst = value; } @@ -1158,7 +1210,7 @@ public int getHeartbeatInterval() { public synchronized void setHeartbeatInterval(String heartbeatInterval) { int value = Integer.parseInt(heartbeatInterval); if (!(value >= 10 && value <= 1800)) { - throw new ConfigLoadException(Item.HEARTBEAT_INTERVAL.name() + " must be between [10,1800]"); + throw new ConfigLoadException(Item.HEARTBEAT_INTERVAL.toString() + " must be between [10,1800]"); } this.heartbeatInterval = value; } @@ -1196,6 +1248,28 @@ public Map getResponseHeaders() { * @param responseHeaders 待设置response header数组 */ public synchronized void setResponseHeaders(Map responseHeaders) { + for (Map.Entry entry : responseHeaders.entrySet()) { + Object k = entry.getKey(); + Object v = entry.getValue(); + if (k == null || v == null) { + throw new ConfigLoadException("the value of " + Item.RESPONSE_HEADERS.toString() + + "'s key and value can not be null"); + } + if (!Reflection.isPrimitiveType(v) && !(v instanceof String)) { + throw new ConfigLoadException("the type of " + Item.RESPONSE_HEADERS.toString() + + "'s value must be primitive type or String, can not be " + v.getClass().getName()); + } + String key = v.toString(); + String value = v.toString(); + if (key.length() == 0 || key.length() > 200) { + throw new ConfigLoadException("the length of " + Item.RESPONSE_HEADERS.toString() + + "'s key must be between [1,200]"); + } + if (value.length() == 0 || value.length() > 200) { + throw new ConfigLoadException("the length of " + Item.RESPONSE_HEADERS.toString() + + "'s value must be between [1,200]"); + } + } this.responseHeaders = responseHeaders; LOGGER.info(RESPONSE_HEADERS + ": " + responseHeaders); } @@ -1222,7 +1296,7 @@ public int getLogMaxBackUp() { public synchronized void setLogMaxBackUp(String logMaxBackUp) { int value = Integer.parseInt(logMaxBackUp) + 1; if (value <= 0) { - throw new ConfigLoadException(Item.LOG_MAX_BACKUP.name() + " can not be less than 0"); + throw new ConfigLoadException(Item.LOG_MAX_BACKUP.toString() + " can not be less than 0"); } this.logMaxBackUp = value; } @@ -1289,7 +1363,7 @@ public int getCpuUsagePercent() { public void setCpuUsagePercent(String cpuUsagePercent) { int value = Integer.parseInt(cpuUsagePercent); if (!(value >= 30 && value <= 100)) { - throw new ConfigLoadException(Item.CPU_USAGE_PERCENT.name() + " must be between [30,100]"); + throw new ConfigLoadException(Item.CPU_USAGE_PERCENT.toString() + " must be between [30,100]"); } this.cpuUsagePercent = value; } @@ -1437,6 +1511,12 @@ public boolean setConfig(String key, String value, boolean isInit) throws Except } else if (Item.CPU_USAGE_INTERVAL.key.equals(key)) { setCpuUsageCheckInterval(value); currentValue = getCpuUsageCheckInterval(); + } else if (Item.LRU_COMPARE_ENABLE.key.equals(key)) { + setLruCompareEnable(value); + currentValue = getLruCompareEnable(); + } else if (Item.LRU_COMPARE_LIMIT.key.equals(key)) { + setLruCompareLimit(value); + currentValue = getLruCompareLimit(); } else { isHit = false; } diff --git a/agent/java/engine/src/main/java/com/baidu/openrasp/plugin/js/Context.java b/agent/java/engine/src/main/java/com/baidu/openrasp/plugin/js/Context.java index 157363b33..a568fd4c8 100644 --- a/agent/java/engine/src/main/java/com/baidu/openrasp/plugin/js/Context.java +++ b/agent/java/engine/src/main/java/com/baidu/openrasp/plugin/js/Context.java @@ -25,6 +25,7 @@ import com.baidu.openrasp.v8.ByteArrayOutputStream; import com.jsoniter.output.JsonStream; +import java.io.UnsupportedEncodingException; import java.util.Enumeration; import java.util.HashMap; import java.util.List; @@ -164,7 +165,7 @@ public String getRequestId() { // TODO: update openrasp-v8, accept string body public byte[] getBody() { try { - return request.getStringBody().getBytes("UTF-8"); + return escape(request.getStringBody()); } catch (Exception e) { return null; } @@ -182,6 +183,21 @@ public byte[] getJson() { } } + public byte[] escape(String src) throws UnsupportedEncodingException { + char j; + StringBuilder tmp = new StringBuilder(); + for (int i = 0; i < src.length(); i++) { + j = src.charAt(i); + if (j < 256) + tmp.append(j); + else { + tmp.append("\\u"); + tmp.append(Integer.toString(j, 16)); + } + } + return tmp.toString().getBytes("UTF-8"); + } + public byte[] getHeader() { try { Enumeration headerNames = request.getHeaderNames(); diff --git a/agent/java/engine/src/main/java/com/baidu/openrasp/plugin/js/JS.java b/agent/java/engine/src/main/java/com/baidu/openrasp/plugin/js/JS.java index 0b2a1ce0a..3a939f7ae 100644 --- a/agent/java/engine/src/main/java/com/baidu/openrasp/plugin/js/JS.java +++ b/agent/java/engine/src/main/java/com/baidu/openrasp/plugin/js/JS.java @@ -106,12 +106,15 @@ public static List Check(CheckParameter checkParameter) { ByteArrayOutputStream params = new ByteArrayOutputStream(); JsonStream.serialize(checkParameter.getParams(), params); - int hashcode = 0; + Object hashData = null; if (type == Type.DIRECTORY || type == Type.READFILE || type == Type.WRITEFILE || type == Type.SQL || type == Type.SSRF) { - hashcode = ByteBuffer.wrap(params.getByteArray()).hashCode(); - } - if (hashcode != 0) { - if (Config.commonLRUCache.isContainsKey(hashcode)) { + byte[] paramData = params.getByteArray(); + if (!Config.getConfig().getLruCompareEnable()) { + hashData = ByteBuffer.wrap(paramData).hashCode(); + } else if (paramData.length <= Config.getConfig().getLruCompareLimit()) { + hashData = ByteBuffer.wrap(paramData); + } + if (Config.commonLRUCache.isContainsKey(hashData)) { return null; } } @@ -126,8 +129,8 @@ public static List Check(CheckParameter checkParameter) { } if (results == null) { - if (hashcode != 0 && Config.commonLRUCache.maxSize() != 0) { - Config.commonLRUCache.put(hashcode, null); + if (hashData != null && Config.commonLRUCache.maxSize() != 0) { + Config.commonLRUCache.put(hashData, null); } return null; } diff --git a/agent/java/engine/src/main/java/com/baidu/openrasp/tool/Reflection.java b/agent/java/engine/src/main/java/com/baidu/openrasp/tool/Reflection.java index d3d7f868c..dedee40f2 100755 --- a/agent/java/engine/src/main/java/com/baidu/openrasp/tool/Reflection.java +++ b/agent/java/engine/src/main/java/com/baidu/openrasp/tool/Reflection.java @@ -125,4 +125,13 @@ public static Object invokeMethod(Object object, Class clazz, String methodName, return null; } } + + public static boolean isPrimitiveType(Object object) { + try { + return ((Class) object.getClass().getField("TYPE").get(null)).isPrimitive(); + } catch (Exception e) { + return false; + } + } + } diff --git a/agent/php5/openrasp_config_block.cc b/agent/php5/openrasp_config_block.cc index 4c5a55ff8..e9e2ff55e 100644 --- a/agent/php5/openrasp_config_block.cc +++ b/agent/php5/openrasp_config_block.cc @@ -114,10 +114,13 @@ void InjectBlock::update(BaseReader *reader) headers.clear(); for (const auto &key : custom_headers_keys) { - if (!key.empty()) + if (!key.empty() && key.length() <= 200) { - const auto &value = reader->fetch_string({"inject.custom_headers", key}); - headers.emplace_back(key + ": " + value); + const std::string value = reader->fetch_string({"inject.custom_headers", key}); + if (!value.empty() && value.length() <= 200) + { + headers.emplace_back(key + ": " + value); + } } } }; diff --git a/agent/php5/utils/json_reader.cc b/agent/php5/utils/json_reader.cc index cbebb1f7e..7d221a6ea 100644 --- a/agent/php5/utils/json_reader.cc +++ b/agent/php5/utils/json_reader.cc @@ -15,6 +15,7 @@ */ #include +#include #include "json_reader.h" #include "utils/json.h" @@ -52,12 +53,19 @@ std::string JsonReader::fetch_string(const std::vector &keys, const json::json_pointer ptr = json::json_pointer(to_json_pointer(keys)); try { - return j.at(ptr); + if (j.at(ptr).is_string()) + { + return j.at(ptr).get(); + } + else if (j.at(ptr).is_number()) + { + return std::to_string(j.at(ptr).get()); + } } catch (...) { - return default_value; } + return default_value; } int64_t JsonReader::fetch_int64(const std::vector &keys, const int64_t &default_value) @@ -65,12 +73,19 @@ int64_t JsonReader::fetch_int64(const std::vector &keys, const int6 json::json_pointer ptr = json::json_pointer(to_json_pointer(keys)); try { - return j.at(ptr); + if (j.at(ptr).is_number()) + { + return j.at(ptr).get(); + } + else if (j.at(ptr).is_string()) + { + return atoi(j.at(ptr).get().c_str()); + } } catch (...) { - return default_value; } + return default_value; } bool JsonReader::fetch_bool(const std::vector &keys, const bool &default_value) @@ -78,12 +93,15 @@ bool JsonReader::fetch_bool(const std::vector &keys, const bool &de json::json_pointer ptr = json::json_pointer(to_json_pointer(keys)); try { - return j.at(ptr); + if (j.at(ptr).is_boolean()) + { + return j.at(ptr); + } } catch (...) { - return default_value; } + return default_value; } void JsonReader::erase(const std::vector &keys) @@ -99,9 +117,12 @@ std::vector JsonReader::fetch_object_keys(const std::vector JsonReader::fetch_strings(const std::vector &keys, bool pretty) @@ -133,8 +157,8 @@ std::string JsonReader::dump(const std::vector &keys, bool pretty) } catch (...) { - return ""; } + return ""; } std::string JsonReader::dump(bool pretty) diff --git a/agent/php5/utils/yaml_reader.cc b/agent/php5/utils/yaml_reader.cc index e3025f4b8..af51731ff 100644 --- a/agent/php5/utils/yaml_reader.cc +++ b/agent/php5/utils/yaml_reader.cc @@ -54,14 +54,17 @@ std::string YamlReader::fetch_string(const std::vector &keys, const { node = &(*node)[key]; } - std::string rst; - *node >> rst; - return rst; + if (node->Type() == YAML::NodeType::Scalar) + { + std::string rst; + *node >> rst; + return rst; + } } catch (...) { - return default_value; } + return default_value; } int64_t YamlReader::fetch_int64(const std::vector &keys, const int64_t &default_value) { @@ -72,14 +75,17 @@ int64_t YamlReader::fetch_int64(const std::vector &keys, const int6 { node = &(*node)[key]; } - int64_t rst; - *node >> rst; - return rst; + if (node->Type() == YAML::NodeType::Scalar) + { + int64_t rst; + *node >> rst; + return rst; + } } catch (...) { - return default_value; } + return default_value; } bool YamlReader::fetch_bool(const std::vector &keys, const bool &default_value) { @@ -90,14 +96,17 @@ bool YamlReader::fetch_bool(const std::vector &keys, const bool &de { node = &(*node)[key]; } - bool rst = false; - *node >> rst; - return rst; + if (node->Type() == YAML::NodeType::Scalar) + { + bool rst = false; + *node >> rst; + return rst; + } } catch (...) { - return default_value; } + return default_value; } std::vector YamlReader::fetch_object_keys(const std::vector &keys) { @@ -122,8 +131,8 @@ std::vector YamlReader::fetch_object_keys(const std::vector YamlReader::fetch_strings(const std::vector &keys, const std::vector &default_value) { @@ -148,8 +157,8 @@ std::vector YamlReader::fetch_strings(const std::vector &keys, bool pretty) @@ -170,8 +179,8 @@ std::string YamlReader::dump(const std::vector &keys, bool pretty) } catch (...) { - return result; } + return result; } std::string YamlReader::dump(bool pretty) diff --git a/agent/php7/openrasp_config_block.cc b/agent/php7/openrasp_config_block.cc index 59a1f1309..fd99b2f8d 100644 --- a/agent/php7/openrasp_config_block.cc +++ b/agent/php7/openrasp_config_block.cc @@ -114,10 +114,13 @@ void InjectBlock::update(BaseReader *reader) headers.clear(); for (const auto &key : custom_headers_keys) { - if (!key.empty()) + if (!key.empty() && key.length() <= 200) { - const auto &value = reader->fetch_string({"inject.custom_headers", key}); - headers.emplace_back(key + ": " + value); + const std::string value = reader->fetch_string({"inject.custom_headers", key}); + if (!value.empty() && value.length() <= 200) + { + headers.emplace_back(key + ": " + value); + } } } }; diff --git a/agent/php7/utils/json_reader.cc b/agent/php7/utils/json_reader.cc index cbebb1f7e..7d221a6ea 100644 --- a/agent/php7/utils/json_reader.cc +++ b/agent/php7/utils/json_reader.cc @@ -15,6 +15,7 @@ */ #include +#include #include "json_reader.h" #include "utils/json.h" @@ -52,12 +53,19 @@ std::string JsonReader::fetch_string(const std::vector &keys, const json::json_pointer ptr = json::json_pointer(to_json_pointer(keys)); try { - return j.at(ptr); + if (j.at(ptr).is_string()) + { + return j.at(ptr).get(); + } + else if (j.at(ptr).is_number()) + { + return std::to_string(j.at(ptr).get()); + } } catch (...) { - return default_value; } + return default_value; } int64_t JsonReader::fetch_int64(const std::vector &keys, const int64_t &default_value) @@ -65,12 +73,19 @@ int64_t JsonReader::fetch_int64(const std::vector &keys, const int6 json::json_pointer ptr = json::json_pointer(to_json_pointer(keys)); try { - return j.at(ptr); + if (j.at(ptr).is_number()) + { + return j.at(ptr).get(); + } + else if (j.at(ptr).is_string()) + { + return atoi(j.at(ptr).get().c_str()); + } } catch (...) { - return default_value; } + return default_value; } bool JsonReader::fetch_bool(const std::vector &keys, const bool &default_value) @@ -78,12 +93,15 @@ bool JsonReader::fetch_bool(const std::vector &keys, const bool &de json::json_pointer ptr = json::json_pointer(to_json_pointer(keys)); try { - return j.at(ptr); + if (j.at(ptr).is_boolean()) + { + return j.at(ptr); + } } catch (...) { - return default_value; } + return default_value; } void JsonReader::erase(const std::vector &keys) @@ -99,9 +117,12 @@ std::vector JsonReader::fetch_object_keys(const std::vector JsonReader::fetch_strings(const std::vector &keys, bool pretty) @@ -133,8 +157,8 @@ std::string JsonReader::dump(const std::vector &keys, bool pretty) } catch (...) { - return ""; } + return ""; } std::string JsonReader::dump(bool pretty) diff --git a/agent/php7/utils/yaml_reader.cc b/agent/php7/utils/yaml_reader.cc index e3025f4b8..af51731ff 100644 --- a/agent/php7/utils/yaml_reader.cc +++ b/agent/php7/utils/yaml_reader.cc @@ -54,14 +54,17 @@ std::string YamlReader::fetch_string(const std::vector &keys, const { node = &(*node)[key]; } - std::string rst; - *node >> rst; - return rst; + if (node->Type() == YAML::NodeType::Scalar) + { + std::string rst; + *node >> rst; + return rst; + } } catch (...) { - return default_value; } + return default_value; } int64_t YamlReader::fetch_int64(const std::vector &keys, const int64_t &default_value) { @@ -72,14 +75,17 @@ int64_t YamlReader::fetch_int64(const std::vector &keys, const int6 { node = &(*node)[key]; } - int64_t rst; - *node >> rst; - return rst; + if (node->Type() == YAML::NodeType::Scalar) + { + int64_t rst; + *node >> rst; + return rst; + } } catch (...) { - return default_value; } + return default_value; } bool YamlReader::fetch_bool(const std::vector &keys, const bool &default_value) { @@ -90,14 +96,17 @@ bool YamlReader::fetch_bool(const std::vector &keys, const bool &de { node = &(*node)[key]; } - bool rst = false; - *node >> rst; - return rst; + if (node->Type() == YAML::NodeType::Scalar) + { + bool rst = false; + *node >> rst; + return rst; + } } catch (...) { - return default_value; } + return default_value; } std::vector YamlReader::fetch_object_keys(const std::vector &keys) { @@ -122,8 +131,8 @@ std::vector YamlReader::fetch_object_keys(const std::vector YamlReader::fetch_strings(const std::vector &keys, const std::vector &default_value) { @@ -148,8 +157,8 @@ std::vector YamlReader::fetch_strings(const std::vector &keys, bool pretty) @@ -170,8 +179,8 @@ std::string YamlReader::dump(const std::vector &keys, bool pretty) } catch (...) { - return result; } + return result; } std::string YamlReader::dump(bool pretty) diff --git a/cloud/src/rasp-cloud/controllers/api/app.go b/cloud/src/rasp-cloud/controllers/api/app.go index 864444a12..487cf3665 100644 --- a/cloud/src/rasp-cloud/controllers/api/app.go +++ b/cloud/src/rasp-cloud/controllers/api/app.go @@ -492,9 +492,26 @@ func (o *AppController) validateAppConfig(config map[string]interface{}) { "the length of config key '"+key+"' must be less than 512") } if v, ok := value.(string); ok { - if len(v) >= 2048 { + if len(v) >= 4096 { o.ServeError(http.StatusBadRequest, - "the value's length of config item '"+key+"' must be less than 2048") + "the value's length of config item '"+key+"' must be less than 4096") + } + } + if key == "inject.custom_headers" { + for hk, hv := range value.(map[string]interface{}) { + if len(hk) >= 200 { + o.ServeError(http.StatusBadRequest, + "the value's length of config item '"+hk+"' must be less than 200") + } + if hv, ok := hv.(string); ok { + if len(hv) >= 200 { + o.ServeError(http.StatusBadRequest, + "the value's length of config item '"+hv+"' must be less than 200") + } + } else { + o.ServeError(http.StatusBadRequest, + "the inject.custom_headers's value cannot convert to type string") + } } } if v, ok := value.(float64); ok { diff --git a/rasp-install/java/src/main/resources/openrasp.yml b/rasp-install/java/src/main/resources/openrasp.yml index eb490706e..2f6e2712d 100644 --- a/rasp-install/java/src/main/resources/openrasp.yml +++ b/rasp-install/java/src/main/resources/openrasp.yml @@ -11,6 +11,8 @@ # ognl.expression.minlength: 30 # clientip.header: ClientIP # lru.max_size: 100 +# lru.compare_enable: false +# lru.compare_limit: 10240 # inject.urlprefix: # log.maxburst: 100 # log.maxbackup: 30 diff --git a/rasp-vue/src/components/pages/settings/general.vue b/rasp-vue/src/components/pages/settings/general.vue index 3074f5037..969afcc87 100644 --- a/rasp-vue/src/components/pages/settings/general.vue +++ b/rasp-vue/src/components/pages/settings/general.vue @@ -15,7 +15,7 @@ [帮助文档] - +
-
+ +
+ + +

@@ -149,6 +155,14 @@ +
+
diff --git a/rasp-vue/src/components/pages/settings/hardening.vue b/rasp-vue/src/components/pages/settings/hardening.vue index e7063ea32..ddf909da8 100644 --- a/rasp-vue/src/components/pages/settings/hardening.vue +++ b/rasp-vue/src/components/pages/settings/hardening.vue @@ -39,7 +39,7 @@ [帮助文档] - +