tests

DataDog · sezen-datadog · Feb 5, 2025 · Jan 15, 2025 · Jan 15, 2025 · Jan 15, 2025
commit 457e9f648e0b25c706129abf3e90dee8024b9c8d
@@ -13,6 +13,7 @@ addTestSuiteForDir('latestDepTest', 'test')
 
 dependencies {
   testRuntimeOnly project(':dd-java-agent:instrumentation:iast-instrumenter')
+  compileOnly 'jakarta.activation:jakarta.activation-api:2.0.1'
   testImplementation 'jakarta.activation:jakarta.activation-api:2.0.1'
   compileOnly 'jakarta.mail:jakarta.mail-api:2.0.1'
   testImplementation 'jakarta.mail:jakarta.mail-api:2.0.1'

@@ -4,6 +4,7 @@
 import com.google.gson.JsonParser;
 import datadog.communication.util.IOUtils;
 import datadog.smoketest.springboot.TestBean;
+import datadog.smoketest.springboot.controller.mock.JakartaMockTransport;
 import datadog.smoketest.springboot.controller.mock.MockTransport;
 import ddtest.client.sources.Hasher;
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
@@ -344,22 +345,21 @@ public String handleFileUpload(
   }
 
   @PostMapping("/mailHtmlVulnerability")
-  public String mailHtmlVulnerability(
-      @RequestParam("messageText") String messageText,
-      @RequestParam("messageContent") String messageContent,
-      @RequestParam("sanitize") String sanitize)
-      throws MessagingException {
+  public String mailHtmlVulnerability(HttpServletRequest request) throws MessagingException {
     Session session = Session.getDefaultInstance(new Properties());
     Provider provider =
         new Provider(
             Provider.Type.TRANSPORT, "smtp", MockTransport.class.getName(), "MockTransport", "1.0");
     session.setProvider(provider);
     MimeMessage message = new MimeMessage(session);
-    if (messageText != null) {
+    boolean sanitize =
+        StringUtils.isNotEmpty(request.getParameter("sanitize"))
+            && request.getParameter("sanitize").equalsIgnoreCase("true");
+    if (request.getParameter("messageText") != null) {
       message.setText(
-          StringUtils.isNotEmpty(sanitize) && sanitize.equalsIgnoreCase("true")
-              ? StringEscapeUtils.escapeHtml4(messageText)
-              : messageText,
+          sanitize
+              ? StringEscapeUtils.escapeHtml4(request.getParameter("messageText"))
+              : request.getParameter("messageText"),
           "utf-8",
           "html");
     } else {
@@ -368,9 +368,9 @@ public String mailHtmlVulnerability(
       content
           .getBodyPart(0)
           .setContent(
-              StringUtils.isNotEmpty(sanitize) && sanitize.equalsIgnoreCase("true")
-                  ? StringEscapeUtils.escapeHtml4(messageContent)
-                  : messageContent,
+              sanitize
+                  ? StringEscapeUtils.escapeHtml4(request.getParameter("messageContent"))
+                  : request.getParameter("messageContent"),
               "text/html");
       message.setContent(content, "multipart/*");
     }
@@ -379,26 +379,26 @@ public String mailHtmlVulnerability(
   }
 
   @PostMapping("/jakartaMailHtmlVulnerability")
-  public String jakartaMailHtmlVulnerability(
-      @RequestParam("messageText") String messageText,
-      @RequestParam("messageContent") String messageContent,
-      @RequestParam("sanitize") String sanitize)
+  public String jakartaMailHtmlVulnerability(HttpServletRequest request)
       throws jakarta.mail.MessagingException {
     jakarta.mail.Session session = jakarta.mail.Session.getDefaultInstance(new Properties());
     jakarta.mail.Provider provider =
         new jakarta.mail.Provider(
             jakarta.mail.Provider.Type.TRANSPORT,
             "smtp",
-            MockTransport.class.getName(),
+            JakartaMockTransport.class.getName(),
             "MockTransport",
             "1.0");
     session.setProvider(provider);
+    boolean sanitize =
+        StringUtils.isNotEmpty(request.getParameter("sanitize"))
+            && request.getParameter("sanitize").equalsIgnoreCase("true");
     jakarta.mail.internet.MimeMessage message = new jakarta.mail.internet.MimeMessage(session);
-    if (messageText != null) {
+    if (request.getParameter("messageText") != null) {
       message.setText(
-          StringUtils.isNotEmpty(sanitize) && sanitize.equalsIgnoreCase("true")
-              ? StringEscapeUtils.escapeHtml4(messageText)
-              : messageText,
+          sanitize
+              ? StringEscapeUtils.escapeHtml4(request.getParameter("messageText"))
+              : request.getParameter("messageText"),
           "utf-8",
           "html");
     } else {
@@ -407,9 +407,9 @@ public String jakartaMailHtmlVulnerability(
       content
           .getBodyPart(0)
           .setContent(
-              StringUtils.isNotEmpty(sanitize) && sanitize.equalsIgnoreCase("true")
-                  ? StringEscapeUtils.escapeHtml4(messageContent)
-                  : messageContent,
+              sanitize
+                  ? StringEscapeUtils.escapeHtml4(request.getParameter("messageContent"))
+                  : request.getParameter("messageContent"),
               "text/html");
       message.setContent(content, "multipart/*");
     }

@@ -0,0 +1,42 @@
+package datadog.smoketest.springboot.controller.mock;
+
+import jakarta.mail.Address;
+import jakarta.mail.Message;
+import jakarta.mail.MessagingException;
+import jakarta.mail.Session;
+import jakarta.mail.Transport;
+import jakarta.mail.URLName;
+import java.util.Properties;
+
+public class JakartaMockTransport extends Transport {
+  public JakartaMockTransport(Session session, URLName urlname) {
+    super(session, urlname);
+  }
+
+  public JakartaMockTransport() {
+    this(Session.getInstance(new Properties()), null);
+  }
+
+  public JakartaMockTransport(Session session) {
+    this(session, null);
+  }
+
+  public static Transport newInstance(Session session) {
+    return new JakartaMockTransport(session, null);
+  }
+
+  public void sendMessage(Message msg, Address[] addresses) throws MessagingException {
+    for (Address a : addresses) {
+      this.notifyTransportListeners(1, addresses, new Address[0], new Address[0], msg);
+    }
+  }
+
+  @Override
+  public void connect() {
+    this.setConnected(true);
+    this.notifyConnectionListeners(1);
+  }
+
+  public synchronized void connect(String host, int port, String user, String password)
+      throws MessagingException {}
+}
@@ -48,12 +48,13 @@ dependencies {
   testImplementation project(':dd-smoke-tests')
   implementation project(':dd-smoke-tests:iast-util')
   testImplementation(testFixtures(project(":dd-smoke-tests:iast-util")))
+
   implementation 'javax.mail:javax.mail-api:1.4.4'
   implementation 'jakarta.mail:jakarta.mail-api:2.0.1'
   implementation 'com.sun.mail:javax.mail:1.4.4'
   implementation 'javax.activation:activation:1.1.1'
-  implementation 'jakarta.activation:jakarta.activation-api:2.0.1'
   implementation 'com.sun.mail:jakarta.mail:2.0.1'
+  implementation 'jakarta.activation:jakarta.activation-api:2.0.1'
   // text sanitization
   implementation group: 'org.apache.commons', name: 'commons-text', version: '1.0'
 }