IAST: support Spring Webflux

[cataphract]

No description provided.

[manuel-alvarez-alvarez]

We taint by reference so the local variable lc might defeat the purpose of the tainted map, we should only taint the original string instances.

In any case, I think in here it's more suitable a wrapped Map/MultiValueMap instance that taints on demand (for example, the keys from the dictionary are rarely used by the app as they are often hard coded constants). Maybe we can come back to it for the next iteration?

[cataphract]

yes, the tainting of the transformed key makes no sense, I've fixed it.

re: the second point, this advice is precisely for when the user injects a full map (or multimap) of headers, so I think it makes sense to taint it all. If he was interested in only one or two headers, he'd likely inject only those specific ones into string variables.

[manuel-alvarez-alvarez]

The interface Taintable can be used for non bootclasspath classes (where we can add fields) and it also marks an object as tainted (maybe we should deal with this abstraction inside the TaintedObjects?)

[cataphract]

The current version now checks first if the object is taintable:

  @Override
  public boolean isTainted(@Nullable Object obj) {
    if (obj instanceof Taintable) {
      return ((Taintable) obj).$DD$isTainted();
    }

    // ...
  }

I think doing it in TaintedObjects is too late; by then we've already fetched the context and traversed a few pointers, which is not needed.

This is done in https://github.com/DataDog/dd-trace-java/pull/4996/files

[smola]

Can xchg possibly be null? If there's the slightest chance of it, I will check it first and do early return. But I guess it would not be the case for onExit...