[GOLANG] Enable IAST features in net-http-orchestrion variant

.github/workflows/system-tests.yml

@@ -184,6 +184,9 @@ jobs:
       - compute_parameters
     if: ${{ needs.compute_parameters.outputs.endtoend_defs_parallel_enable == 'true' && needs.compute_parameters.outputs.endtoend_defs_parallel_weblogs != '[]'}}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     strategy:
       matrix:
         weblog: ${{ fromJson(needs.compute_parameters.outputs.endtoend_defs_parallel_weblogs) }}
@@ -213,26 +216,48 @@ jobs:
       - name: Log binaries contents
         if : ${{ needs.compute_parameters.outputs.binaries_artifact != '' }}
         run: ls -la binaries/
-      - name: Export github token to a file
-        run: echo "${{ secrets.GITHUB_TOKEN }}" > "$RUNNER_TEMP/github_token.txt"
       - name: Build weblog base images
         if: matrix.weblog.build_base_image
         run: |
           source venv/bin/activate
           ./utils/script/build_base_image.py ${{ inputs.library }} ${{ matrix.weblog.name }}
+      # TODO: Remove this token exchange after dd-iast-go becomes public.
+      - name: Get temporary dd-iast-go read token
+        id: dd_iast_go_token
+        if: >-
+          github.event_name == 'pull_request'
+          && github.event.pull_request.number == 7342
+          && inputs.library == 'golang'
+          && matrix.weblog.name == 'net-http-orchestrion'
+        uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
+        with:
+          scope: DataDog/dd-iast-go
+          policy: system-tests.github.read-contents.pr-7342
       - name: Build weblog
         id: build
-        run: SYSTEM_TEST_BUILD_ATTEMPTS=3 ./build.sh ${{ inputs.library }} -i weblog -w ${{ matrix.weblog.name }} -s --github-token-file "$RUNNER_TEMP/github_token.txt"
-      - name: Remove secrets
-        if: always()
+        env:
+          GITHUB_TOKEN: ${{ steps.dd_iast_go_token.outputs.token || secrets.GITHUB_TOKEN }}
         run: |
           TOKEN_FILE="$RUNNER_TEMP/github_token.txt"
-          if [ -f "$TOKEN_FILE" ]; then
-            echo "Removing token file at $TOKEN_FILE"
-            rm -f "$TOKEN_FILE"
-          else
-            echo "Token file not found — nothing to clean up"
-          fi
+
+          cleanup() {
+            rm -f -- "$TOKEN_FILE"
+          }
+
+          trap cleanup EXIT
+          trap 'exit 129' HUP
+          trap 'exit 130' INT
+          trap 'exit 143' TERM
+
+          umask 077
+          printf '%s' "$GITHUB_TOKEN" > "$TOKEN_FILE"
+
+          SYSTEM_TEST_BUILD_ATTEMPTS=3 ./build.sh \
+            ${{ inputs.library }} \
+            -i weblog \
+            -w ${{ matrix.weblog.name }} \
+            -s \
+            --github-token-file "$TOKEN_FILE"
       - name: Upload artifact
         uses: ./.github/actions/upload_artifact
         with:

docs/understand/weblogs/end-to-end_weblog.md

@@ -370,6 +370,14 @@ This endpoint should set a cookie with the name and value coming from the reques
 
 This endpoint should set a cookie with empty cookie value without Secure flag, INSECURE_COOKIE vulnerability shouldn't be detected.
 
+### GET /iast/insecure_cipher/test_insecure_algorithm
+
+Parameterless endpoint. This endpoint performs an encryption operation using a weak cipher algorithm.
+
+### GET /iast/insecure_cipher/test_secure_algorithm
+
+Parameterless endpoint. This endpoint performs an encryption operation using a secure cipher algorithm.
+
 ### GET /iast/insecure_hashing/deduplicate
 
 Parameterless endpoint. This endpoint contains a vulnerable source code line (weak hash) in a loop with at least two iterations.

manifests/golang.yml

@@ -182,12 +182,23 @@ manifest:
   tests/appsec/iast/sink/test_unvalidated_redirect_forward.py::TestUnvalidatedForward: missing_feature
   tests/appsec/iast/sink/test_unvalidated_redirect_forward.py::TestUnvalidatedForward_ExtendedLocation: missing_feature
   tests/appsec/iast/sink/test_unvalidated_redirect_forward.py::TestUnvalidatedForward_StackTrace: missing_feature
-  tests/appsec/iast/sink/test_weak_cipher.py::TestWeakCipher: missing_feature
-  tests/appsec/iast/sink/test_weak_cipher.py::TestWeakCipher_ExtendedLocation: missing_feature
+  tests/appsec/iast/sink/test_weak_cipher.py::TestWeakCipher:
+    - weblog_declaration:
+        "*": missing_feature
+        net-http-orchestrion: v2.11.0-dev
+  tests/appsec/iast/sink/test_weak_cipher.py::TestWeakCipher_ExtendedLocation:
+    - weblog_declaration:
+        "*": missing_feature
+        net-http-orchestrion: v2.11.0-dev
   tests/appsec/iast/sink/test_weak_cipher.py::TestWeakCipher_StackTrace: missing_feature
-  tests/appsec/iast/sink/test_weak_hash.py::TestDeduplication: missing_feature
-  tests/appsec/iast/sink/test_weak_hash.py::TestWeakHash: missing_feature
-  tests/appsec/iast/sink/test_weak_hash.py::TestWeakHash_ExtendedLocation: missing_feature
+  tests/appsec/iast/sink/test_weak_hash.py:
+    - weblog_declaration:
+        "*": missing_feature
+        net-http-orchestrion: v2.11.0-dev
+  tests/appsec/iast/sink/test_weak_hash.py::TestDeduplication:
+    - weblog_declaration:
+        "*": missing_feature
+        net-http-orchestrion: v2.11.0-dev
   tests/appsec/iast/sink/test_weak_hash.py::TestWeakHash_StackTrace: missing_feature
   tests/appsec/iast/sink/test_weak_randomness.py::TestWeakRandomness: missing_feature
   tests/appsec/iast/sink/test_weak_randomness.py::TestWeakRandomness_ExtendedLocation: missing_feature

tests/appsec/iast/sink/test_weak_hash.py

@@ -12,6 +12,9 @@
 
 
 def _expected_location() -> str | None:
+    if context.library.name == "golang":
+        return f"/app/{context.weblog_variant}/main.go"
+
     if context.library.name == "java":
         return "com.datadoghq.system_tests.iast.utils.CryptoExamples"
 
@@ -33,7 +36,7 @@ def _expected_location() -> str | None:
 
 
 def _expected_evidence() -> str:
-    if context.library.name == "dotnet":
+    if context.library.name in {"dotnet", "golang"}:
         return "MD5"
     else:
         return "md5"

tests/appsec/iast/utils.py

@@ -323,7 +323,7 @@ def validate_extended_location_data(
         # If there is no stacktrace, just check for the presence of basic attributes.
         assert all(field in location for field in ["path", "line"])
 
-        if context.library.name not in ("python", "nodejs"):
+        if context.library.name not in ("python", "nodejs", "golang"):
             assert all(field in location for field in ["class", "method"])
     else:
         assert "vulnerability" in span["meta_struct"]["_dd.stack"], "'vulnerability' not found in '_dd.stack'"