Ignore header vulnerabilities in cors headers (#3962)

--------- Co-authored-by: Igor Unanua <igor.unanua@datadoghq.com>
DataDog · Jan 15, 2024 · e678f30 · e678f30
1 parent a0abbbc
commit e678f30
Show file tree

Hide file tree

Showing 2 changed files with 34 additions and 3 deletions.
diff --git a/packages/dd-trace/src/appsec/iast/analyzers/header-injection-analyzer.js b/packages/dd-trace/src/appsec/iast/analyzers/header-injection-analyzer.js
@@ -48,7 +48,7 @@ class HeaderInjectionAnalyzer extends InjectionAnalyzer {
     if (ranges?.length > 0) {
       return !(this.isCookieExclusion(lowerCasedHeaderName, ranges) ||
         this.isSameHeaderExclusion(lowerCasedHeaderName, ranges) ||
-        this.isAccessControlAllowOriginExclusion(lowerCasedHeaderName, ranges))
+        this.isAccessControlAllowExclusion(lowerCasedHeaderName, ranges))
     }
 
     return false
@@ -84,8 +84,8 @@ class HeaderInjectionAnalyzer extends InjectionAnalyzer {
     return false
   }
 
-  isAccessControlAllowOriginExclusion (name, ranges) {
-    if (name === 'access-control-allow-origin') {
+  isAccessControlAllowExclusion (name, ranges) {
+    if (name?.startsWith('access-control-allow-')) {
       return ranges
         .every(range => range.iinfo.type === HTTP_REQUEST_HEADER_VALUE)
     }

diff --git a/packages/dd-trace/test/appsec/iast/analyzers/header-injection.express.plugin.spec.js b/packages/dd-trace/test/appsec/iast/analyzers/header-injection.express.plugin.spec.js
@@ -239,6 +239,37 @@ describe('Header injection vulnerability', () => {
             }).catch(done)
           }
         })
+
+        testThatRequestHasNoVulnerability({
+          fn: (req, res) => {
+            setHeaderFunction('Access-Control-Allow-Origin', req.headers['origin'], res)
+            setHeaderFunction('Access-Control-Allow-Headers', req.headers['access-control-request-headers'], res)
+            setHeaderFunction('Access-Control-Allow-Methods', req.headers['access-control-request-methods'], res)
+          },
+          testDescription: 'Should not have vulnerability with CORS headers',
+          vulnerability: 'HEADER_INJECTION',
+          occurrencesAndLocation: {
+            occurrences: 1,
+            location: {
+              path: setHeaderFunctionFilename,
+              line: 4
+            }
+          },
+          cb: (headerInjectionVulnerabilities) => {
+            const evidenceString = headerInjectionVulnerabilities[0].evidence.valueParts
+              .map(part => part.value).join('')
+            expect(evidenceString).to.be.equal('custom: value')
+          },
+          makeRequest: (done, config) => {
+            return axios.options(`http://localhost:${config.port}/`, {
+              headers: {
+                'origin': 'http://custom-origin',
+                'Access-Control-Request-Headers': 'TestHeader',
+                'Access-Control-Request-Methods': 'GET'
+              }
+            }).catch(done)
+          }
+        })
       })
   })
 })