Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: add IAST propagation for string' split, rsplit and splitlines #9113

Merged

Conversation

juanjux
Copy link
Collaborator

@juanjux juanjux commented Apr 28, 2024

Description

Add propagation for the split/rsplit/splitlines methods.

Checklist

  • Change(s) are motivated and described in the PR description
  • Testing strategy is described if automated tests are not included in the PR
  • Risks are described (performance impact, potential for breakage, maintainability)
  • Change is maintainable (easy to change, telemetry, documentation)
  • Library release note guidelines are followed or label changelog/no-changelog is set
  • Documentation is included (in-code, generated user docs, public corp docs)
  • Backport labels are set (if applicable)
  • If this PR changes the public interface, I've notified @DataDog/apm-tees.

Reviewer Checklist

  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Description motivates each change
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Change is maintainable (easy to change, telemetry, documentation)
  • Release note makes sense to a user of the library
  • Author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

juanjux and others added 14 commits April 25, 2024 19:32
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
@juanjux juanjux added changelog/no-changelog A changelog entry is not required for this PR. ASM Application Security Monitoring labels Apr 28, 2024
@juanjux juanjux self-assigned this Apr 28, 2024
@juanjux juanjux requested review from a team as code owners April 28, 2024 19:25
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
@juanjux juanjux removed request for a team and erikayasuda April 28, 2024 19:56
@datadog-dd-trace-py-rkomorn
Copy link

datadog-dd-trace-py-rkomorn bot commented Apr 28, 2024

Datadog Report

Branch report: juanjux/APPSEC-9608-string-split-rsplit-splitlines-progatation
Commit report: 4a3dc16
Test service: dd-trace-py

✅ 0 Failed, 108767 Passed, 3520 Skipped, 6m 29.82s Total duration (36m 23.12s time saved)

Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
@pr-commenter
Copy link

pr-commenter bot commented Apr 28, 2024

Benchmarks

Benchmark execution time: 2024-04-28 21:33:57

Comparing candidate commit bd69a86 in PR branch juanjux/APPSEC-9608-string-split-rsplit-splitlines-progatation with baseline commit bf42804 in branch main.

Found 6 performance improvements and 5 performance regressions! Performance is the same for 190 metrics, 9 unstable metrics.

scenario:httppropagationextract-invalid_span_id_header

  • 🟩 max_rss_usage [-715.603KB; -432.915KB] or [-3.387%; -2.049%]

scenario:sethttpmeta-collectipvariant_exists

  • 🟥 max_rss_usage [+767.817KB; +842.320KB] or [+3.679%; +4.036%]

scenario:sethttpmeta-no-collectipvariant

  • 🟥 max_rss_usage [+728.965KB; +802.119KB] or [+3.493%; +3.844%]

scenario:sethttpmeta-obfuscation-disabled

  • 🟩 max_rss_usage [-778.538KB; -696.022KB] or [-3.592%; -3.211%]

scenario:sethttpmeta-obfuscation-no-query

  • 🟥 max_rss_usage [+718.531KB; +792.074KB] or [+3.442%; +3.794%]

scenario:sethttpmeta-obfuscation-regular-case-explicit-query

  • 🟩 max_rss_usage [-969.914KB; -891.718KB] or [-4.440%; -4.082%]

scenario:sethttpmeta-obfuscation-regular-case-implicit-query

  • 🟩 max_rss_usage [-947.993KB; -873.498KB] or [-4.344%; -4.003%]

scenario:sethttpmeta-useragentvariant_exists_2

  • 🟩 max_rss_usage [-778.795KB; -704.776KB] or [-3.597%; -3.255%]

scenario:sethttpmeta-useragentvariant_exists_3

  • 🟩 max_rss_usage [-767.178KB; -691.407KB] or [-3.545%; -3.195%]

scenario:sethttpmeta-useragentvariant_not_exists_2

  • 🟥 max_rss_usage [+526.272KB; +600.537KB] or [+2.502%; +2.855%]

scenario:tracer-medium

  • 🟥 max_rss_usage [+922.317KB; +991.335KB] or [+4.539%; +4.878%]

@avara1986 avara1986 enabled auto-merge (squash) April 29, 2024 14:29
@codecov-commenter
Copy link

Codecov Report

Attention: Patch coverage is 0% with 203 lines in your changes are missing coverage. Please review.

Project coverage is 6.61%. Comparing base (704aac0) to head (4a3dc16).
Report is 24 commits behind head on main.

Files Patch % Lines
tests/appsec/iast/aspects/test_split_aspect.py 0.00% 117 Missing ⚠️
ddtrace/appsec/_iast/_taint_tracking/aspects.py 0.00% 38 Missing ⚠️
tests/appsec/iast/aspects/test_str_aspect.py 0.00% 28 Missing ⚠️
tests/appsec/iast/fixtures/aspects/str_methods.py 0.00% 15 Missing ⚠️
ddtrace/appsec/_iast/_taint_tracking/__init__.py 0.00% 3 Missing ⚠️
tests/appsec/iast/aspects/test_aspect_helpers.py 0.00% 2 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             main    #9113       +/-   ##
===========================================
- Coverage   78.64%    6.61%   -72.04%     
===========================================
  Files        1254     1233       -21     
  Lines      117809   117223      -586     
===========================================
- Hits        92653     7755    -84898     
- Misses      25156   109468    +84312     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@avara1986 avara1986 merged commit 33bd59f into main Apr 29, 2024
83 of 84 checks passed
@avara1986 avara1986 deleted the juanjux/APPSEC-9608-string-split-rsplit-splitlines-progatation branch April 29, 2024 14:37
juanjux added a commit that referenced this pull request Apr 29, 2024
Note: this branches from #9113 so it will be easier to review once that
PR has been merged.

## Description

Implements the aspects for all functions in the `os.path` module that
split a string into parts (plus `normpath` because it's trivial):

- os.path.split
- os.path.splitext
- os.path.basename
- os.path.dirname
- os.path.normcase
- os.path.splitdrive
- os.path.splitroot

## Checklist

- [x] Change(s) are motivated and described in the PR description
- [x] Testing strategy is described if automated tests are not included
in the PR
- [x] Risks are described (performance impact, potential for breakage,
maintainability)
- [x] Change is maintainable (easy to change, telemetry, documentation)
- [x] [Library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
are followed or label `changelog/no-changelog` is set
- [x] Documentation is included (in-code, generated user docs, [public
corp docs](https://github.com/DataDog/documentation/))
- [x] Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))
- [x] If this PR changes the public interface, I've notified
`@DataDog/apm-tees`.

## Reviewer Checklist

- [x] Title is accurate
- [x] All changes are related to the pull request's stated goal
- [x] Description motivates each change
- [x] Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- [x] Testing strategy adequately addresses listed risks
- [x] Change is maintainable (easy to change, telemetry, documentation)
- [x] Release note makes sense to a user of the library
- [x] Author has acknowledged and discussed the performance implications
of this PR as reported in the benchmarks PR comment
- [x] Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Co-authored-by: Alberto Vara <alberto.vara@datadoghq.com>
erikayasuda added a commit that referenced this pull request May 10, 2024
@erikayasuda erikayasuda mentioned this pull request May 10, 2024
17 tasks
brettlangdon pushed a commit that referenced this pull request May 10, 2024
Reverting the following IAST PRs: #9113, #9114, #9085

They will be re-introduced in 2.10 after some investigation, but
reverting for now to un-block the 2.9.0 release pipeline.

## Checklist

- [x] Change(s) are motivated and described in the PR description
- [x] Testing strategy is described if automated tests are not included
in the PR
- [x] Risks are described (performance impact, potential for breakage,
maintainability)
- [x] Change is maintainable (easy to change, telemetry, documentation)
- [x] [Library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
are followed or label `changelog/no-changelog` is set
- [x] Documentation is included (in-code, generated user docs, [public
corp docs](https://github.com/DataDog/documentation/))
- [x] Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))
- [x] If this PR changes the public interface, I've notified
`@DataDog/apm-tees`.

## Reviewer Checklist

- [x] Title is accurate
- [x] All changes are related to the pull request's stated goal
- [x] Description motivates each change
- [x] Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- [x] Testing strategy adequately addresses listed risks
- [x] Change is maintainable (easy to change, telemetry, documentation)
- [x] Release note makes sense to a user of the library
- [x] Author has acknowledged and discussed the performance implications
of this PR as reported in the benchmarks PR comment
- [x] Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)
juanjux added a commit that referenced this pull request May 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ASM Application Security Monitoring changelog/no-changelog A changelog entry is not required for this PR.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants