Skip to content

Commit 9292dbd

Browse files
authored
chore(iast): fix header injection attr (#13624)
Fix validation introduced in #13546 APPSEC-57163 ## Checklist - [x] PR author has checked that all the criteria below are met - The PR description includes an overview of the change - The PR description articulates the motivation for the change - The change includes tests OR the PR description describes a testing strategy - The PR description notes risks associated with the change, if any - Newly-added code is easy to change - The change follows the [library release note guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html) - The change includes or references documentation updates if necessary - Backport labels are set (if [applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)) ## Reviewer Checklist - [x] Reviewer has checked that all the criteria below are met - Title is accurate - All changes are related to the pull request's stated goal - Avoids breaking [API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces) changes - Testing strategy adequately addresses listed risks - Newly-added code is easy to change - Release note makes sense to a user of the library - If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment - Backport labels are set in a manner that is consistent with the [release branch maintenance policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)
1 parent 9fbf472 commit 9292dbd

File tree

2 files changed

+3
-5
lines changed

2 files changed

+3
-5
lines changed

ddtrace/appsec/_iast/_logs.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,4 +49,4 @@ def iast_error(msg, default_prefix="iast::"):
4949
stack = inspect.stack()
5050
frame_info = "\n".join("%s %s" % (frame_info.filename, frame_info.lineno) for frame_info in stack[:7])
5151
log.debug("%s%s:\n%s", default_prefix, msg, frame_info)
52-
_set_iast_error_metric(f"{default_prefix}. {msg}")
52+
_set_iast_error_metric(f"{default_prefix}{msg}")

ddtrace/appsec/_iast/taint_sinks/header_injection.py

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -207,12 +207,10 @@ class HeaderInjection(VulnerabilityBase):
207207

208208
def _iast_django_response(wrapped, instance, args, kwargs):
209209
try:
210-
from django import VERSION as DJANGO_VERSION
211-
212210
wrapped.__func__(instance, *args, **kwargs)
213-
if DJANGO_VERSION < (3, 2, 0):
211+
if hasattr(instance, "_headers"):
214212
instance._headers = HeaderInjectionDict(instance._headers)
215-
else:
213+
elif hasattr(instance, "_store"):
216214
instance._store = HeaderInjectionDict(instance._store)
217215
except Exception as e:
218216
iast_error(f"propagation::sink_point::Error in _iast_django_response. {e}")

0 commit comments

Comments
 (0)