[ASM] Taint request body #4080

NachoEchevarria · 2023-04-25T12:37:59Z

Summary of changes

This PR implements a way to taint the values coming from the requests body in order to check if they are used in a vulnerable call.

Reason for change

It is a required feature for this quarter.

Implementation details

In ASM, the request body was already been analyzed, so we will use the same mechanisms for IAST, In IAST, we will only consider the string values received.

ASM has an instrumentation point, in (DefaultModelBindingContext_SetResult_Integration.cs), that we will use for IAST.

Test coverage

Some integration tests have been added.

Other details

datadog-ddstaging · 2023-04-25T13:12:29Z

Datadog Report

Branch report: nacho/taintRequestBody
Commit report: 0e2ee35

✅ dd-trace-dotnet: 0 Failed, 0 New Flaky, 313369 Passed, 1329 Skipped, 27m 26.74s Wall Time

tracer/src/Datadog.Trace/IAST/IastRequestContext.cs

datadog-ddstaging · 2023-05-05T09:31:02Z

Datadog Report

Branch report: nacho/taintRequestBody
Commit report: e4001cd

❌ dd-trace-dotnet: 28 Failed (0 Known Flaky), 0 New Flaky, 339006 Passed, 1324 Skipped, 30m 38.54s Wall Time

❌ Failed Tests (28)

This report shows up to 5 failed tests.

TestIastSqlInjectionRequest - Datadog.Trace.Security.IntegrationTests.Iast.AspNetCore5IastTestsFullSamplingIastDisabled - Details

Expand for error

 Results do not match.
 Differences:
 Received: Iast.SqlInjection.AspNetCore5.IastDisabled.received.txt
 Verified: Iast.SqlInjection.AspNetCore5.IastDisabled.verified.txt
 Received Content:
 [
   {
     TraceId: Id_1,
     SpanId: Id_2,
     Name: aspnet_core.request,
 ...

TestIastSqlInjectionRequest - Datadog.Trace.Security.IntegrationTests.Iast.AspNetCore5IastTestsFullSamplingIastDisabled - Details

Expand for error

 Results do not match.
 Differences:
 Received: Iast.SqlInjection.AspNetCore5.IastDisabled.received.txt
 Verified: Iast.SqlInjection.AspNetCore5.IastDisabled.verified.txt
 Received Content:
 [
   {
     TraceId: Id_1,
     SpanId: Id_2,
     Name: aspnet_core.request,
 ...

TestIastSqlInjectionRequest - Datadog.Trace.Security.IntegrationTests.Iast.AspNetCore5IastTestsFullSamplingIastDisabled - Details

Expand for error

 Results do not match.
 Differences:
 Received: Iast.SqlInjection.AspNetCore5.IastDisabled.received.txt
 Verified: Iast.SqlInjection.AspNetCore5.IastDisabled.verified.txt
 Received Content:
 [
   {
     TraceId: Id_1,
     SpanId: Id_2,
     Name: aspnet_core.request,
 ...

TestIastSqlInjectionRequest - Datadog.Trace.Security.IntegrationTests.Iast.AspNetCore5IastTestsFullSamplingIastEnabled - Details

Expand for error

 Results do not match.
 Differences:
 Received: Iast.SqlInjection.AspNetCore5.IastEnabled.received.txt
 Verified: Iast.SqlInjection.AspNetCore5.IastEnabled.verified.txt
 Received Content:
 [
   {
     TraceId: Id_1,
     SpanId: Id_2,
     Name: aspnet_core.request,
 ...

TestIastSqlInjectionRequest - Datadog.Trace.Security.IntegrationTests.Iast.AspNetCore5IastTestsFullSamplingIastEnabled - Details

Expand for error

 Results do not match.
 Differences:
 Received: Iast.SqlInjection.AspNetCore5.IastEnabled.received.txt
 Verified: Iast.SqlInjection.AspNetCore5.IastEnabled.verified.txt
 Received Content:
 [
   {
     TraceId: Id_1,
     SpanId: Id_2,
     Name: aspnet_core.request,
 ...

tracer/src/Datadog.Trace/IAST/IastRequestContext.cs

robertpi

Made a suggestion for optimization, but seems good otherwise.

This reverts commit f5681dd.

andrewlock · 2023-05-12T13:35:52Z

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing the following branches/commits:

Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:

Welch test with statistical test for significance of 5%
Only results indicating a difference greater than 5% and 5 ms are considered.

Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.

Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).

gantt
    title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (4080) - mean (3,005ms)  : 2894, 3117
     .   : milestone, 3005,
    master - mean (3,004ms)  : 2867, 3141
     .   : milestone, 3004,

    section CallTarget+Inlining+NGEN
    This PR (4080) - mean (3,774ms)  : 3704, 3843
     .   : milestone, 3774,
    master - mean (3,765ms)  : 3677, 3852
     .   : milestone, 3765,

gantt
    title Execution time (ms) FakeDbCommand (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (4080) - mean (3,129ms)  : 3026, 3231
     .   : milestone, 3129,
    master - mean (3,143ms)  : 3033, 3254
     .   : milestone, 3143,

    section CallTarget+Inlining+NGEN
    This PR (4080) - mean (3,580ms)  : 3492, 3667
     .   : milestone, 3580,
    master - mean (3,578ms)  : 3477, 3679
     .   : milestone, 3578,

gantt
    title Execution time (ms) FakeDbCommand (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (4080) - mean (3,113ms)  : 2975, 3251
     .   : milestone, 3113,
    master - mean (3,101ms)  : 2958, 3244
     .   : milestone, 3101,

    section CallTarget+Inlining+NGEN
    This PR (4080) - mean (3,537ms)  : 3435, 3639
     .   : milestone, 3537,
    master - mean (3,537ms)  : 3437, 3637
     .   : milestone, 3537,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (4080) - mean (194ms)  : 189, 199
     .   : milestone, 194,
    master - mean (185ms)  : 176, 193
     .   : milestone, 185,

    section CallTarget+Inlining+NGEN
    This PR (4080) - mean (1,027ms)  : 992, 1062
     .   : milestone, 1027,
    master - mean (1,004ms)  : 982, 1026
     .   : milestone, 1004,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (4080) - mean (364ms)  : 360, 367
     .   : milestone, 364,
    master - mean (364ms)  : 357, 371
     .   : milestone, 364,

    section CallTarget+Inlining+NGEN
    This PR (4080) - mean (1,106ms)  : 1085, 1128
     .   : milestone, 1106,
    master - mean (1,103ms)  : 1079, 1126
     .   : milestone, 1103,

gantt
    title Execution time (ms) HttpMessageHandler (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (4080) - mean (352ms)  : 347, 358
     .   : milestone, 352,
    master - mean (351ms)  : 346, 357
     .   : milestone, 351,

    section CallTarget+Inlining+NGEN
    This PR (4080) - mean (1,055ms)  : 1031, 1079
     .   : milestone, 1055,
    master - mean (1,052ms)  : 1027, 1078
     .   : milestone, 1052,

andrewlock · 2023-05-12T13:36:03Z

Benchmarks Report 🐌

Benchmarks for #4080 compared to master:

All benchmarks have the same speed
All benchmarks have the same allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	604μs	116ns	450ns	0	2.62 KB
master	`WriteAndFlushEnrichedTraces`	net472	816μs	355ns	1.28μs	0.411	3.22 KB
#4080	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	616μs	259ns	1μs	0	2.62 KB
#4080	`WriteAndFlushEnrichedTraces`	net472	815μs	196ns	708ns	0.408	3.22 KB

Benchmarks.Trace.AppSecBodyBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`AllCycleSimpleBody`	netcoreapp3.1	40.3μs	45.6ns	177ns	0.0201	0	1.63 KB
master	`AllCycleSimpleBody`	net472	41.2μs	52.1ns	202ns	0.264	0	1.69 KB
master	`AllCycleMoreComplexBody`	netcoreapp3.1	228μs	208ns	780ns	0.112	0	9.12 KB
master	`AllCycleMoreComplexBody`	net472	235μs	161ns	602ns	1.41	0	9.28 KB
master	`ObjectExtractorSimpleBody`	netcoreapp3.1	183ns	0.117ns	0.454ns	0.00367	0	272 B
master	`ObjectExtractorSimpleBody`	net472	142ns	0.424ns	1.64ns	0.0446	0	281 B
master	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	4.12μs	3.6ns	14ns	0.0513	0	3.78 KB
master	`ObjectExtractorMoreComplexBody`	net472	4.04μs	6.78ns	24.5ns	0.618	0.00604	3.89 KB
#4080	`AllCycleSimpleBody`	netcoreapp3.1	40.6μs	72.9ns	282ns	0.0203	0	1.63 KB
#4080	`AllCycleSimpleBody`	net472	41.5μs	42.8ns	166ns	0.264	0	1.69 KB
#4080	`AllCycleMoreComplexBody`	netcoreapp3.1	227μs	285ns	1.1μs	0.113	0	9.12 KB
#4080	`AllCycleMoreComplexBody`	net472	237μs	256ns	990ns	1.41	0	9.28 KB
#4080	`ObjectExtractorSimpleBody`	netcoreapp3.1	173ns	0.21ns	0.786ns	0.00367	0	272 B
#4080	`ObjectExtractorSimpleBody`	net472	146ns	0.199ns	0.77ns	0.0446	0	281 B
#4080	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	4.01μs	2.34ns	8.45ns	0.0518	0	3.78 KB
#4080	`ObjectExtractorMoreComplexBody`	net472	4μs	2.93ns	11.4ns	0.618	0.00604	3.89 KB

Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendRequest`	netcoreapp3.1	182μs	197ns	761ns	0.181	20.02 KB
master	`SendRequest`	net472	4.62E‑05ns	4.62E‑05ns	0.000167ns	0	0 b
#4080	`SendRequest`	netcoreapp3.1	181μs	159ns	617ns	0.18	20.02 KB
#4080	`SendRequest`	net472	0.000245ns	0.000185ns	0.000665ns	0	0 b

Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	601μs	987ns	3.42μs	0.302	0	0	41.56 KB
master	`WriteAndFlushEnrichedTraces`	net472	782μs	3.82μs	16.2μs	8.38	2.67	0.381	53.23 KB
#4080	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	616μs	1.8μs	6.95μs	0.302	0	0	41.64 KB
#4080	`WriteAndFlushEnrichedTraces`	net472	781μs	3.88μs	16.5μs	8.1	2.31	0.386	53.21 KB

Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`ExecuteNonQuery`	netcoreapp3.1	1.14μs	0.371ns	1.39ns	0.00974	728 B
master	`ExecuteNonQuery`	net472	1.38μs	0.972ns	3.76ns	0.109	690 B
#4080	`ExecuteNonQuery`	netcoreapp3.1	1.13μs	1.04ns	4.04ns	0.0101	728 B
#4080	`ExecuteNonQuery`	net472	1.45μs	1.37ns	5.29ns	0.11	690 B

Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`CallElasticsearch`	netcoreapp3.1	1.22μs	1.3ns	4.7ns	0.0104	0	752 B
master	`CallElasticsearch`	net472	1.91μs	0.688ns	2.67ns	0.121	0.000957	762 B
master	`CallElasticsearchAsync`	netcoreapp3.1	1.31μs	0.914ns	3.54ns	0.0118	0	872 B
master	`CallElasticsearchAsync`	net472	2.16μs	1.29ns	4.82ns	0.142	0	899 B
#4080	`CallElasticsearch`	netcoreapp3.1	1.23μs	0.587ns	2.27ns	0.0104	0	752 B
#4080	`CallElasticsearch`	net472	1.97μs	3.81ns	14.7ns	0.121	0.00096	762 B
#4080	`CallElasticsearchAsync`	netcoreapp3.1	1.27μs	0.554ns	2.07ns	0.0115	0	872 B
#4080	`CallElasticsearchAsync`	net472	2.15μs	0.654ns	2.53ns	0.142	0.00107	899 B

Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`ExecuteAsync`	netcoreapp3.1	1.35μs	0.554ns	2.14ns	0.0135	0	992 B
master	`ExecuteAsync`	net472	1.56μs	0.336ns	1.26ns	0.153	0.000776	963 B
#4080	`ExecuteAsync`	netcoreapp3.1	1.38μs	0.418ns	1.56ns	0.0131	0	992 B
#4080	`ExecuteAsync`	net472	1.61μs	0.917ns	3.55ns	0.153	0.000804	963 B

Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendAsync`	netcoreapp3.1	4.16μs	1.56ns	5.82ns	0.0313	2.36 KB
master	`SendAsync`	net472	6.72μs	1.84ns	6.64ns	0.463	2.92 KB
#4080	`SendAsync`	netcoreapp3.1	4.24μs	1.1ns	4.1ns	0.0304	2.36 KB
#4080	`SendAsync`	net472	6.75μs	1.4ns	5.24ns	0.461	2.92 KB

Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	netcoreapp3.1	2.04μs	0.605ns	2.26ns	0.0236	1.72 KB
master	`EnrichedLog`	net472	2.49μs	0.596ns	2.23ns	0.284	1.8 KB
#4080	`EnrichedLog`	netcoreapp3.1	1.96μs	0.474ns	1.71ns	0.0233	1.72 KB
#4080	`EnrichedLog`	net472	2.47μs	0.929ns	3.6ns	0.285	1.8 KB

Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EnrichedLog`	netcoreapp3.1	118μs	326ns	1.26μs	0.0588	0	4.3 KB
master	`EnrichedLog`	net472	148μs	335ns	1.3μs	0.671	0.224	4.64 KB
#4080	`EnrichedLog`	netcoreapp3.1	118μs	271ns	1.05μs	0	0	4.3 KB
#4080	`EnrichedLog`	net472	147μs	209ns	811ns	0.728	0.218	4.64 KB

Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EnrichedLog`	netcoreapp3.1	3.84μs	1.15ns	4.31ns	0.052	0	3.78 KB
master	`EnrichedLog`	net472	4.95μs	0.875ns	3.39ns	0.566	0.00247	3.57 KB
#4080	`EnrichedLog`	netcoreapp3.1	3.91μs	6.07ns	22.7ns	0.052	0	3.78 KB
#4080	`EnrichedLog`	net472	4.88μs	1.73ns	6.48ns	0.567	0.00244	3.57 KB

Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendReceive`	netcoreapp3.1	1.55μs	0.529ns	1.91ns	0.0139	1.01 KB
master	`SendReceive`	net472	1.76μs	1.08ns	4.2ns	0.16	1.01 KB
#4080	`SendReceive`	netcoreapp3.1	1.46μs	0.489ns	1.83ns	0.0138	1.01 KB
#4080	`SendReceive`	net472	1.64μs	2.43ns	9.09ns	0.16	1.01 KB

Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	netcoreapp3.1	3.65μs	1.48ns	5.53ns	0.0219	1.67 KB
master	`EnrichedLog`	net472	4.43μs	2.49ns	9.33ns	0.351	2.22 KB
#4080	`EnrichedLog`	netcoreapp3.1	3.75μs	1.26ns	4.55ns	0.0227	1.67 KB
#4080	`EnrichedLog`	net472	4.31μs	1.38ns	5.35ns	0.351	2.22 KB

Benchmarks.Trace.SpanBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`StartFinishSpan`	netcoreapp3.1	540ns	0.262ns	1.01ns	0.0073	544 B
master	`StartFinishSpan`	net472	587ns	0.203ns	0.732ns	0.0866	546 B
master	`StartFinishScope`	netcoreapp3.1	713ns	0.13ns	0.468ns	0.00902	664 B
master	`StartFinishScope`	net472	880ns	0.258ns	0.929ns	0.0994	626 B
#4080	`StartFinishSpan`	netcoreapp3.1	553ns	0.969ns	3.63ns	0.00743	544 B
#4080	`StartFinishSpan`	net472	596ns	0.179ns	0.67ns	0.0865	546 B
#4080	`StartFinishScope`	netcoreapp3.1	780ns	0.323ns	1.25ns	0.00895	664 B
#4080	`StartFinishScope`	net472	836ns	0.354ns	1.28ns	0.0993	626 B

Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunOnMethodBegin`	netcoreapp3.1	828ns	0.922ns	3.57ns	0.00901	664 B
master	`RunOnMethodBegin`	net472	980ns	0.282ns	1.02ns	0.099	626 B
#4080	`RunOnMethodBegin`	netcoreapp3.1	800ns	0.27ns	1.01ns	0.00894	664 B
#4080	`RunOnMethodBegin`	net472	983ns	0.21ns	0.759ns	0.099	626 B

andrewlock · 2023-05-12T13:49:42Z

Throughput/Crank Report:zap:

Throughput results for AspNetCoreSimpleController comparing the following branches/commits:

Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red.

Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards!

gantt
    title Throughput Linux x64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (4080) (10.998M)   : 0, 10998114
    master (11.316M)   : 0, 11315615
    benchmarks/2.30.0 (11.327M)   : 0, 11326709
    benchmarks/2.9.0 (11.162M)   : 0, 11161538

    section Automatic
    This PR (4080) (7.857M)   : 0, 7857344
    master (7.955M)   : 0, 7954979
    benchmarks/2.30.0 (7.858M)   : 0, 7857987
    benchmarks/2.9.0 (8.099M)   : 0, 8099075

    section Trace stats
    master (7.958M)   : 0, 7957963
    benchmarks/2.30.0 (7.824M)   : 0, 7824267

    section Manual
    This PR (4080) (9.701M)   : 0, 9700584
    master (9.977M)   : 0, 9977251
    benchmarks/2.30.0 (10.102M)   : 0, 10101646

    section Manual + Automatic
    This PR (4080) (7.435M)   : 0, 7435013
    master (7.656M)   : 0, 7655837
    benchmarks/2.30.0 (7.554M)   : 0, 7553853

    section Version Conflict
    master (6.909M)   : 0, 6908693
    benchmarks/2.30.0 (6.855M)   : 0, 6855103

gantt
    title Throughput Linux arm64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (4080) (9.473M)   : 0, 9472865
    master (9.677M)   : 0, 9676680
    benchmarks/2.30.0 (9.576M)   : 0, 9575959
    benchmarks/2.9.0 (9.705M)   : 0, 9704781

    section Automatic
    This PR (4080) (6.775M)   : 0, 6775122
    master (6.912M)   : 0, 6911855
    benchmarks/2.30.0 (6.907M)   : 0, 6906859

    section Trace stats
    master (6.815M)   : 0, 6815156
    benchmarks/2.30.0 (6.852M)   : 0, 6852240

    section Manual
    This PR (4080) (8.516M)   : 0, 8516253
    master (8.405M)   : 0, 8404707
    benchmarks/2.30.0 (8.238M)   : 0, 8238091

    section Manual + Automatic
    This PR (4080) (6.636M)   : 0, 6636140
    master (6.343M)   : 0, 6343365
    benchmarks/2.30.0 (6.616M)   : 0, 6615730

    section Version Conflict
    master (6.033M)   : 0, 6032976
    benchmarks/2.30.0 (6.030M)   : 0, 6030374

gantt
    title Throughput Windows x64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (4080) (10.037M)   : 0, 10036541
    master (9.908M)   : 0, 9907712
    benchmarks/2.30.0 (10.356M)   : 0, 10355657
    benchmarks/2.9.0 (9.827M)   : 0, 9827121

    section Automatic
    This PR (4080) (7.174M)   : crit ,0, 7174211
    master (7.628M)   : 0, 7628164
    benchmarks/2.30.0 (7.232M)   : 0, 7231961
    benchmarks/2.9.0 (7.246M)   : 0, 7246397

    section Trace stats
    master (7.404M)   : 0, 7403510
    benchmarks/2.30.0 (7.389M)   : 0, 7389346

    section Manual
    This PR (4080) (8.888M)   : crit ,0, 8888175
    master (9.534M)   : 0, 9534015
    benchmarks/2.30.0 (9.091M)   : 0, 9091062

    section Manual + Automatic
    This PR (4080) (7.083M)   : 0, 7083272
    master (7.400M)   : 0, 7400474
    benchmarks/2.30.0 (6.850M)   : 0, 6849618

    section Version Conflict
    master (6.735M)   : 0, 6735450
    benchmarks/2.30.0 (6.115M)   : 0, 6115255

gantt
    title Throughput Linux x64 (ASM) (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (4080) (7.498M)   : 0, 7498119
    master (7.421M)   : 0, 7421296
    benchmarks/2.30.0 (7.197M)   : 0, 7197004
    benchmarks/2.9.0 (7.748M)   : 0, 7748029

    section No attack
    This PR (4080) (2.384M)   : 0, 2384133
    master (2.403M)   : 0, 2403011
    benchmarks/2.30.0 (2.367M)   : 0, 2366569
    benchmarks/2.9.0 (3.274M)   : 0, 3273699

    section Attack
    This PR (4080) (2.025M)   : 0, 2024685
    master (2.033M)   : 0, 2032674
    benchmarks/2.30.0 (1.983M)   : 0, 1982525
    benchmarks/2.9.0 (2.598M)   : 0, 2597950

    section Blocking
    This PR (4080) (4.042M)   : 0, 4042052
    master (4.078M)   : 0, 4078429
    benchmarks/2.30.0 (3.949M)   : 0, 3948532

NachoEchevarria · 2023-05-12T14:14:28Z

Thank you for your time and feedback!!!

github-actions bot added the area:asm label Apr 25, 2023

This comment has been minimized.

Sign in to view

NachoEchevarria marked this pull request as ready for review April 26, 2023 15:08

NachoEchevarria requested review from a team as code owners April 26, 2023 15:08

This comment has been minimized.

Sign in to view

NachoEchevarria added the area:asm-iast label Apr 26, 2023

manuel-alvarez-alvarez reviewed Apr 27, 2023

View reviewed changes

tracer/src/Datadog.Trace/IAST/IastRequestContext.cs Outdated Show resolved Hide resolved

manuel-alvarez-alvarez reviewed Apr 27, 2023

View reviewed changes

tracer/src/Datadog.Trace/IAST/IastRequestContext.cs Outdated Show resolved Hide resolved

NachoEchevarria marked this pull request as draft April 27, 2023 10:30

NachoEchevarria marked this pull request as ready for review April 27, 2023 15:25

This comment has been minimized.

Sign in to view

NachoEchevarria force-pushed the nacho/taintRequestBody branch from 0e2ee35 to 423835b Compare May 5, 2023 09:07

This comment has been minimized.

Sign in to view

robertpi reviewed May 5, 2023

View reviewed changes

tracer/src/Datadog.Trace/IAST/IastRequestContext.cs Outdated Show resolved Hide resolved

robertpi approved these changes May 5, 2023

View reviewed changes

This comment has been minimized.

Sign in to view

NachoEchevarria force-pushed the nacho/taintRequestBody branch from 4dfbf1c to 8046d56 Compare May 8, 2023 09:53

This comment has been minimized.

Sign in to view

NachoEchevarria added 16 commits May 12, 2023 12:10

add net5 tests

5338e74

add more integration tests

5edd9aa

fix

628fc20

Add support for complex json data.

5e76b17

small performance improvement

998cdaa

Performance improvements

50ca253

Added some unit tests for property tainting

1eaf7d1

fix codeowners case sensitive line

0a75962

Simplify unit tests

29e8e42

fix naming

dc3e807

Erase AnrUsupported invalid statements

3d2f2b5

Add a body test with both security and iast enabled

ecf3263

Revert "Add a body test with both security and iast enabled"

c1168ec

This reverts commit f5681dd.

Add securityAndIast body test

64866e8

Add IastAsm test

89afdfb

Remove comment

a10e7b7

NachoEchevarria force-pushed the nacho/taintRequestBody branch from 94addbd to a10e7b7 Compare May 12, 2023 10:28

NachoEchevarria added 2 commits May 12, 2023 12:28

merge fixes

aa2c090

Merge fixes2

d1fe441

This comment has been minimized.

Sign in to view

Fix body tests: redaction

2d7b211

NachoEchevarria merged commit c0a6ea7 into master May 12, 2023

NachoEchevarria deleted the nacho/taintRequestBody branch May 12, 2023 14:14

github-actions bot added this to the vNext milestone May 12, 2023

[ASM] Taint request body #4080

[ASM] Taint request body #4080

Uh oh!

Conversation

NachoEchevarria commented Apr 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary of changes

Reason for change

Implementation details

Test coverage

Other details

Uh oh!

datadog-ddstaging bot commented Apr 25, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Datadog Report

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

datadog-ddstaging bot commented May 5, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Datadog Report

❌ Failed Tests (28)

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

Uh oh!

robertpi left a comment

Choose a reason for hiding this comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

andrewlock commented May 12, 2023

Execution-Time Benchmarks Report ⏱️

Uh oh!

andrewlock commented May 12, 2023

Benchmarks Report 🐌

Benchmark details

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Uh oh!

andrewlock commented May 12, 2023

Throughput/Crank Report:zap:

Uh oh!

NachoEchevarria commented May 12, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

NachoEchevarria commented Apr 25, 2023 •

edited

Loading

datadog-ddstaging bot commented Apr 25, 2023 •

edited

Loading

datadog-ddstaging bot commented May 5, 2023 •

edited

Loading