Repository: hxsecurity/dongtai-agent-java
Issue: [Bug]: POST出现服务器端请求伪造漏洞,位置:HEADER

### Preflight Checklist

- [X] I agree to follow the [Code of Conduct](https://github.com/HXSecurity/DongTai/blob/main/.github/CODE_OF_CONDUCT.md) that this project adheres to.
- [X] I have searched the [issue tracker](https://www.github.com/HXSecurity/DongTai/issues) for an issue that matches the one I want to file, without success.
- [X] I am not looking for support or already pursued the available [support channels](https://github.com/HXSecurity/DongTai/issues/new/choose) without success.

### Version

1.12.0

### Installation Type

Official Kubernetes

### Service Name

DongTai-Web

### Describe the details of the bug and the steps to reproduce it


![image](https://github.com/HXSecurity/DongTai/assets/28825226/b9918e2a-0816-4b39-9b9b-452509b8c1c4)
根据调用链显示x-forwarded-for参数存在ssrf的注入点，我将洞态上的请求复制到burp上重新发从，发现将x-forwarded-for这个参数删除之后仍然可以得到响应结果，这个是不是误报？
![image](https://github.com/HXSecurity/DongTai/assets/28825226/3d4e2780-8d32-417b-b7d4-7c72681e94d8)
![image](https://github.com/HXSecurity/DongTai/assets/28825226/f53fe931-acb6-48b2-84f2-38a075361fd6)


### Additional Information

_No response_

### Logs

_No response_

Changed files:
dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommandRunner.java
dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommand.java
dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintRangesBuilder.java

diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommand.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommand.java
index a269fb53..f131b262 100644
--- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommand.java
+++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommand.java
@@ -13,6 +13,7 @@ public enum TaintCommand {
     REMOVE,
     REPLACE,
     CONCAT,
+    OVERWRITE,
     TRIM,
     TRIM_RIGHT,
     TRIM_LEFT,
diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommandRunner.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommandRunner.java
index 97b5dd20..ae5c85e5 100644
--- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommandRunner.java
+++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintCommandRunner.java
@@ -133,6 +133,8 @@ public class TaintCommandRunner {
                 case CONCAT:
                     this.builder.concat(tr, target, oldTaintRanges, source, srcTaintRanges, params);
                     break;
+                case OVERWRITE:
+                    this.builder.overwrite(tr, oldTaintRanges, source, srcTaintRanges, p1, this.paramsCount);
                 case TRIM:
                 case TRIM_LEFT:
                 case TRIM_RIGHT:
diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintRangesBuilder.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintRangesBuilder.java
index 6a6be60e..f78d114f 100644
--- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintRangesBuilder.java
+++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/models/taint/range/TaintRangesBuilder.java
@@ -144,6 +144,16 @@ public class TaintRangesBuilder {
         taintRanges.merge();
     }
 
+    public void overwrite(TaintRanges taintRanges, TaintRanges oldTagRanges, Object source, TaintRanges srcTagRanges, int p1, int argC) {
+        if (argC == 1) {
+            int length = getLength(source);
+            srcTagRanges.shift(p1);
+            oldTagRanges.clear(p1, length + p1);
+            taintRanges.addAll(oldTagRanges);
+            taintRanges.addAll(srcTagRanges);
+        }
+    }
+
     public void trim(TaintCommand command, TaintRanges taintRanges, Object source, TaintRanges srcTaintRanges, int argC) {
         if (argC > 0) {
             return;