Do not taint empty strings

DataDog · Sep 21, 2023 · 9f0d0cb · 9f0d0cb
1 parent 3e732e5
commit 9f0d0cb
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/src/api/string_methods.cc b/src/api/string_methods.cc
@@ -71,7 +71,10 @@ void NewTaintedString(const FunctionCallbackInfo<Value>& args) {
 
     // if string length < 10 then make a new one in order to avoid cache issues.
     int len =  v8::Local<v8::String>::Cast(args[1])->Length();
-    if (len == 1) {
+    if (len == 0) {
+        args.GetReturnValue().Set(args[1]);
+        return;
+    } else if (len == 1) {
         parameterValue = tainted::NewExternalString(isolate, args[1]);
     } else if (len < 10) {
         v8::String::Utf8Value param1(isolate, args[1]);

diff --git a/test/js/new_tainted_string.spec.js b/test/js/new_tainted_string.spec.js
@@ -108,6 +108,16 @@ describe('Taint strings', function () {
     assert.strictEqual(ret, false, 'Unexpected value')
   })
 
+  it('Do not taint empty string', function () {
+    let ret
+    const value = ''
+
+    ret = TaintedUtils.newTaintedString(id, value, 'param', 'REQUEST')
+    assert.strictEqual(ret, '', 'Unexpected value')
+    ret = TaintedUtils.isTainted(id, ret)
+    assert.strictEqual(ret, false, 'Unexpected value')
+  })
+
   it('Max values', function () {
     let ret
     const values = new Array(MAX_TAINTED_OBJECTS).fill('value')