[ASM] RASP shell injection vulnerability #5871

NachoEchevarria · 2024-08-09T16:18:48Z

Summary of changes

This PR contains the implementation of the RASP shell injection vulnerability. This vulnerability is defined in this RFC

This vulnerability is only launched when a process is executed from a shell. That includes both processes with the useShellExecute flag set to true in the ProcessStartInfo class.

It can also be a case where a command does not have that flag but calls a shell executable, but this case is not yet supported but it is expected to be supported in next WAF releases.

Reason for change

Is required for RASP during this quarter.

Implementation details

Test coverage

Other details

…/dd-trace-dotnet into nacho/RASPShellInjection

datadog-ddstaging · 2024-08-09T16:55:12Z

Datadog Report

Branch report: nacho/RASPShellInjection
Commit report: 1fd06b2
Test service: dd-trace-dotnet

✅ 0 Failed, 305337 Passed, 1637 Skipped, 12h 48m 21.79s Total Time

andrewlock · 2024-08-12T09:52:39Z

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing the following branches/commits:

Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:

Welch test with statistical test for significance of 5%
Only results indicating a difference greater than 5% and 5 ms are considered.

Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.

Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).

andrewlock · 2024-08-12T10:22:05Z

Benchmarks Report for appsec 🐌

Benchmarks for #5871 compared to master:

1 benchmarks are slower, with geometric mean 1.229
1 benchmarks have fewer allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.Asm.AppSecBodyBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #5871

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody‑netcoreapp3.1	1.229	197.53	242.71	bimodal

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`AllCycleSimpleBody`	net6.0	72.8μs	81.5ns	305ns	0.0722	0	6.01 KB
master	`AllCycleSimpleBody`	netcoreapp3.1	62.3μs	80.7ns	313ns	0.0938	0	6.95 KB
master	`AllCycleSimpleBody`	net472	48.5μs	94.1ns	364ns	1.32	0	8.34 KB
master	`AllCycleMoreComplexBody`	net6.0	79.4μs	221ns	858ns	0.118	0	9.51 KB
master	`AllCycleMoreComplexBody`	netcoreapp3.1	70.2μs	103ns	398ns	0.14	0	10.36 KB
master	`AllCycleMoreComplexBody`	net472	56.2μs	50.7ns	196ns	1.86	0.0281	11.85 KB
master	`ObjectExtractorSimpleBody`	net6.0	145ns	0.132ns	0.493ns	0.00398	0	280 B
master	`ObjectExtractorSimpleBody`	netcoreapp3.1	202ns	1.1ns	6.24ns	0.00376	0	272 B
master	`ObjectExtractorSimpleBody`	net472	176ns	0.399ns	1.54ns	0.0446	0	281 B
master	`ObjectExtractorMoreComplexBody`	net6.0	3.09μs	1.79ns	6.71ns	0.0525	0	3.78 KB
master	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	3.99μs	1.44ns	5.58ns	0.0498	0	3.69 KB
master	`ObjectExtractorMoreComplexBody`	net472	3.79μs	2.85ns	11ns	0.603	0.00567	3.8 KB
#5871	`AllCycleSimpleBody`	net6.0	72.8μs	112ns	432ns	0.0726	0	6 KB
#5871	`AllCycleSimpleBody`	netcoreapp3.1	62.3μs	89.1ns	345ns	0.0938	0	6.95 KB
#5871	`AllCycleSimpleBody`	net472	48.8μs	30.1ns	113ns	1.3	0	8.34 KB
#5871	`AllCycleMoreComplexBody`	net6.0	80.5μs	230ns	890ns	0.119	0	9.51 KB
#5871	`AllCycleMoreComplexBody`	netcoreapp3.1	70.6μs	77ns	288ns	0.141	0	10.36 KB
#5871	`AllCycleMoreComplexBody`	net472	56.4μs	29ns	104ns	1.86	0.0282	11.85 KB
#5871	`ObjectExtractorSimpleBody`	net6.0	142ns	0.148ns	0.552ns	0.00392	0	280 B
#5871	`ObjectExtractorSimpleBody`	netcoreapp3.1	243ns	0.204ns	0.763ns	0.00366	0	272 B
#5871	`ObjectExtractorSimpleBody`	net472	167ns	0.188ns	0.729ns	0.0446	0	281 B
#5871	`ObjectExtractorMoreComplexBody`	net6.0	3.14μs	1.14ns	4.28ns	0.0536	0	3.78 KB
#5871	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	4.06μs	1.55ns	5.82ns	0.0506	0	3.69 KB
#5871	`ObjectExtractorMoreComplexBody`	net472	3.79μs	2ns	7.5ns	0.603	0.00569	3.8 KB

Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EncodeArgs`	net6.0	36.8μs	16.8ns	65.1ns	0.442	0	32.4 KB
master	`EncodeArgs`	netcoreapp3.1	54.3μs	22ns	85.2ns	0.433	0	32.4 KB
master	`EncodeArgs`	net472	66.2μs	23.9ns	92.6ns	5.14	0.0663	32.5 KB
master	`EncodeLegacyArgs`	net6.0	79.2μs	15.7ns	60.9ns	0	0	2.14 KB
master	`EncodeLegacyArgs`	netcoreapp3.1	105μs	89.6ns	347ns	0	0	2.15 KB
master	`EncodeLegacyArgs`	net472	152μs	71ns	275ns	0.305	0	2.15 KB
#5871	`EncodeArgs`	net6.0	36.6μs	20.5ns	76.7ns	0.456	0	32.4 KB
#5871	`EncodeArgs`	netcoreapp3.1	54.5μs	23.6ns	85.2ns	0.436	0	32.4 KB
#5871	`EncodeArgs`	net472	65.2μs	42.1ns	163ns	5.15	0.0651	32.5 KB
#5871	`EncodeLegacyArgs`	net6.0	72.4μs	29.3ns	110ns	0	0	2.14 KB
#5871	`EncodeLegacyArgs`	netcoreapp3.1	108μs	132ns	495ns	0	0	2.15 KB
#5871	`EncodeLegacyArgs`	net472	152μs	90.6ns	339ns	0.303	0	2.15 KB

Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunWafRealisticBenchmark`	net6.0	183μs	147ns	529ns	0	2.42 KB
master	`RunWafRealisticBenchmark`	netcoreapp3.1	197μs	346ns	1.34μs	0	2.37 KB
master	`RunWafRealisticBenchmark`	net472	208μs	62.3ns	233ns	0.311	2.43 KB
master	`RunWafRealisticBenchmarkWithAttack`	net6.0	123μs	40ns	155ns	0	1.46 KB
master	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	131μs	133ns	497ns	0	1.45 KB
master	`RunWafRealisticBenchmarkWithAttack`	net472	139μs	47.2ns	183ns	0.209	1.48 KB
#5871	`RunWafRealisticBenchmark`	net6.0	184μs	114ns	441ns	0	2.42 KB
#5871	`RunWafRealisticBenchmark`	netcoreapp3.1	198μs	137ns	512ns	0	2.37 KB
#5871	`RunWafRealisticBenchmark`	net472	208μs	101ns	392ns	0.312	2.43 KB
#5871	`RunWafRealisticBenchmarkWithAttack`	net6.0	122μs	60.6ns	227ns	0	1.46 KB
#5871	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	130μs	85.3ns	307ns	0	1.45 KB
#5871	`RunWafRealisticBenchmarkWithAttack`	net472	139μs	36ns	139ns	0.208	1.48 KB

Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ Fewer allocations 🎉

Fewer allocations 🎉 in #5871

Benchmark	Base Allocated	Diff Allocated	Change	Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1	262.32 KB	252.85 KB	-9.47 KB	-3.61%

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Allocated
master	`StringConcatBenchmark`	net6.0	58.2μs	644ns	6.28μs	43.44 KB
master	`StringConcatBenchmark`	netcoreapp3.1	52.8μs	238ns	923ns	42.64 KB
master	`StringConcatBenchmark`	net472	37.5μs	184ns	759ns	57.59 KB
master	`StringConcatAspectBenchmark`	net6.0	307μs	1.74μs	13.1μs	254.55 KB
master	`StringConcatAspectBenchmark`	netcoreapp3.1	342μs	1.93μs	12.9μs	262.32 KB
master	`StringConcatAspectBenchmark`	net472	290μs	6.81μs	67.1μs	278.53 KB
#5871	`StringConcatBenchmark`	net6.0	59μs	717ns	7.17μs	43.44 KB
#5871	`StringConcatBenchmark`	netcoreapp3.1	57.1μs	658ns	6.48μs	42.64 KB
#5871	`StringConcatBenchmark`	net472	37.2μs	162ns	919ns	57.69 KB
#5871	`StringConcatAspectBenchmark`	net6.0	312μs	1.77μs	13μs	254.78 KB
#5871	`StringConcatAspectBenchmark`	netcoreapp3.1	330μs	1.63μs	7.11μs	252.85 KB
#5871	`StringConcatAspectBenchmark`	net472	292μs	6.53μs	64.6μs	278.53 KB

andrewlock · 2024-08-13T00:31:11Z

Benchmarks Report for tracer 🐌

Benchmarks for #5871 compared to master:

1 benchmarks are faster, with geometric mean 1.116
1 benchmarks are slower, with geometric mean 1.133
All benchmarks have the same allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`StartStopWithChild`	net6.0	7.69μs	44ns	317ns	0.0151	0.00754	0	5.42 KB
master	`StartStopWithChild`	netcoreapp3.1	9.99μs	53.8ns	284ns	0.0248	0.00991	0	5.62 KB
master	`StartStopWithChild`	net472	15.9μs	48.3ns	181ns	1.02	0.302	0.0952	6.07 KB
#5871	`StartStopWithChild`	net6.0	7.78μs	43.4ns	285ns	0.0223	0.00744	0	5.42 KB
#5871	`StartStopWithChild`	netcoreapp3.1	10.2μs	57.2ns	401ns	0.0202	0.0101	0	5.62 KB
#5871	`StartStopWithChild`	net472	16μs	63.1ns	244ns	1.01	0.284	0.0867	6.06 KB

Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	470μs	261ns	1.01μs	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	651μs	275ns	1.03μs	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	net472	838μs	644ns	2.49μs	0.419	3.3 KB
#5871	`WriteAndFlushEnrichedTraces`	net6.0	452μs	176ns	657ns	0	2.7 KB
#5871	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	642μs	205ns	767ns	0	2.7 KB
#5871	`WriteAndFlushEnrichedTraces`	net472	838μs	476ns	1.72μs	0.419	3.3 KB

Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendRequest`	net6.0	189μs	1.06μs	6.78μs	0.188	18.45 KB
master	`SendRequest`	netcoreapp3.1	210μs	1E+03ns	5.66μs	0.21	20.61 KB
master	`SendRequest`	net472	0.000126ns	0.000126ns	0.000454ns	0	0 b
#5871	`SendRequest`	net6.0	186μs	924ns	3.92μs	0.182	18.45 KB
#5871	`SendRequest`	netcoreapp3.1	210μs	1.19μs	8.27μs	0.199	20.61 KB
#5871	`SendRequest`	net472	0.000597ns	0.000334ns	0.00125ns	0	0 b

Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	555μs	1.06μs	3.67μs	0.566	0	0	41.6 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	672μs	3.19μs	12.4μs	0.327	0	0	41.83 KB
master	`WriteAndFlushEnrichedTraces`	net472	890μs	3.36μs	13μs	8.13	2.57	0.428	53.34 KB
#5871	`WriteAndFlushEnrichedTraces`	net6.0	566μs	2.63μs	9.85μs	0.539	0	0	41.65 KB
#5871	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	659μs	3.09μs	12μs	0.331	0	0	41.97 KB
#5871	`WriteAndFlushEnrichedTraces`	net472	885μs	4.13μs	16.5μs	8.42	2.66	0.443	53.3 KB

Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`ExecuteNonQuery`	net6.0	1.25μs	1.18ns	4.57ns	0.0142	1.02 KB
master	`ExecuteNonQuery`	netcoreapp3.1	1.72μs	1.1ns	4.26ns	0.0137	1.02 KB
master	`ExecuteNonQuery`	net472	2.1μs	1.69ns	6.32ns	0.157	987 B
#5871	`ExecuteNonQuery`	net6.0	1.3μs	0.925ns	3.58ns	0.0143	1.02 KB
#5871	`ExecuteNonQuery`	netcoreapp3.1	1.64μs	1.48ns	5.35ns	0.0136	1.02 KB
#5871	`ExecuteNonQuery`	net472	1.97μs	1.66ns	6.44ns	0.156	987 B

Benchmarks.Trace.ElasticsearchBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #5871

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch‑netcoreapp3.1	1.133	1,459.70	1,653.54

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`CallElasticsearch`	net6.0	1.24μs	0.842ns	3.15ns	0.0135	0	976 B
master	`CallElasticsearch`	netcoreapp3.1	1.46μs	0.942ns	3.53ns	0.0134	0	976 B
master	`CallElasticsearch`	net472	2.37μs	1.87ns	7.24ns	0.158	0.00119	995 B
master	`CallElasticsearchAsync`	net6.0	1.26μs	0.695ns	2.51ns	0.0132	0	952 B
master	`CallElasticsearchAsync`	netcoreapp3.1	1.7μs	0.858ns	3.21ns	0.0136	0	1.02 KB
master	`CallElasticsearchAsync`	net472	2.62μs	2.13ns	8.25ns	0.167	0.00131	1.05 KB
#5871	`CallElasticsearch`	net6.0	1.13μs	1.09ns	4.1ns	0.0135	0	976 B
#5871	`CallElasticsearch`	netcoreapp3.1	1.65μs	0.646ns	2.5ns	0.0132	0	976 B
#5871	`CallElasticsearch`	net472	2.37μs	1.21ns	4.52ns	0.158	0	995 B
#5871	`CallElasticsearchAsync`	net6.0	1.36μs	2.24ns	8.68ns	0.0137	0	952 B
#5871	`CallElasticsearchAsync`	netcoreapp3.1	1.61μs	1.26ns	4.88ns	0.0136	0	1.02 KB
#5871	`CallElasticsearchAsync`	net472	2.67μs	2.04ns	7.89ns	0.167	0.00132	1.05 KB

Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`ExecuteAsync`	net6.0	1.27μs	0.881ns	3.41ns	0.0134	0	952 B
master	`ExecuteAsync`	netcoreapp3.1	1.66μs	0.531ns	2.06ns	0.0124	0	952 B
master	`ExecuteAsync`	net472	1.79μs	0.888ns	3.44ns	0.145	0	915 B
#5871	`ExecuteAsync`	net6.0	1.3μs	0.998ns	3.86ns	0.013	0	952 B
#5871	`ExecuteAsync`	netcoreapp3.1	1.65μs	2.41ns	9.03ns	0.013	0	952 B
#5871	`ExecuteAsync`	net472	1.71μs	0.78ns	3.02ns	0.145	0.000852	915 B

Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendAsync`	net6.0	4.05μs	1.36ns	5.08ns	0.0308	2.22 KB
master	`SendAsync`	netcoreapp3.1	5.08μs	2.25ns	8.73ns	0.0356	2.76 KB
master	`SendAsync`	net472	8.09μs	1.89ns	7.3ns	0.499	3.15 KB
#5871	`SendAsync`	net6.0	4.22μs	2ns	7.75ns	0.0315	2.22 KB
#5871	`SendAsync`	netcoreapp3.1	4.99μs	1.57ns	6.07ns	0.0374	2.76 KB
#5871	`SendAsync`	net472	7.79μs	1.81ns	6.26ns	0.499	3.15 KB

Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	1.64μs	5.49ns	21.3ns	0.0226	1.64 KB
master	`EnrichedLog`	netcoreapp3.1	2.28μs	1.76ns	6.57ns	0.022	1.64 KB
master	`EnrichedLog`	net472	2.74μs	2.65ns	9.9ns	0.249	1.57 KB
#5871	`EnrichedLog`	net6.0	1.59μs	1.11ns	4.28ns	0.0231	1.64 KB
#5871	`EnrichedLog`	netcoreapp3.1	2.4μs	1.97ns	7.39ns	0.0219	1.64 KB
#5871	`EnrichedLog`	net472	2.67μs	1.06ns	3.96ns	0.249	1.57 KB

Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EnrichedLog`	net6.0	117μs	254ns	984ns	0.0584	0	4.28 KB
master	`EnrichedLog`	netcoreapp3.1	121μs	198ns	766ns	0	0	4.28 KB
master	`EnrichedLog`	net472	149μs	424ns	1.64μs	0.666	0.222	4.46 KB
#5871	`EnrichedLog`	net6.0	117μs	262ns	1.01μs	0	0	4.28 KB
#5871	`EnrichedLog`	netcoreapp3.1	123μs	263ns	1.02μs	0	0	4.28 KB
#5871	`EnrichedLog`	net472	150μs	242ns	936ns	0.669	0.223	4.46 KB

Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	3μs	3.36ns	13ns	0.0302	2.2 KB
master	`EnrichedLog`	netcoreapp3.1	4.33μs	4.36ns	16.3ns	0.0282	2.2 KB
master	`EnrichedLog`	net472	4.87μs	2.62ns	10.2ns	0.319	2.02 KB
#5871	`EnrichedLog`	net6.0	3.04μs	0.762ns	2.95ns	0.0304	2.2 KB
#5871	`EnrichedLog`	netcoreapp3.1	4.15μs	2.69ns	10.4ns	0.0291	2.2 KB
#5871	`EnrichedLog`	net472	4.87μs	1.28ns	4.96ns	0.319	2.02 KB

Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`SendReceive`	net6.0	1.37μs	0.77ns	2.98ns	0.0158	0	1.14 KB
master	`SendReceive`	netcoreapp3.1	1.82μs	2.19ns	7.9ns	0.0155	0	1.14 KB
master	`SendReceive`	net472	2.21μs	1.7ns	6.58ns	0.183	0	1.16 KB
#5871	`SendReceive`	net6.0	1.26μs	0.376ns	1.36ns	0.0158	0	1.14 KB
#5871	`SendReceive`	netcoreapp3.1	1.73μs	4.72ns	17.6ns	0.0152	0	1.14 KB
#5871	`SendReceive`	net472	2.14μs	1.72ns	6.66ns	0.184	0.00107	1.16 KB

Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	2.7μs	0.749ns	2.9ns	0.023	1.6 KB
master	`EnrichedLog`	netcoreapp3.1	3.9μs	2.57ns	9.63ns	0.0214	1.65 KB
master	`EnrichedLog`	net472	4.38μs	3.36ns	13ns	0.324	2.04 KB
#5871	`EnrichedLog`	net6.0	2.72μs	1ns	3.87ns	0.0218	1.6 KB
#5871	`EnrichedLog`	netcoreapp3.1	3.93μs	1.69ns	6.34ns	0.0217	1.65 KB
#5871	`EnrichedLog`	net472	4.36μs	7.6ns	29.4ns	0.322	2.04 KB

Benchmarks.Trace.SpanBenchmark - Faster 🎉 Same allocations ✔️

Faster 🎉 in #5871

Benchmark	base/diff	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.SpanBenchmark.StartFinishScope‑net472	1.116	939.28	841.37

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`StartFinishSpan`	net6.0	397ns	0.195ns	0.755ns	0.0081	576 B
master	`StartFinishSpan`	netcoreapp3.1	596ns	0.379ns	1.47ns	0.00785	576 B
master	`StartFinishSpan`	net472	624ns	0.719ns	2.78ns	0.0917	578 B
master	`StartFinishScope`	net6.0	512ns	0.19ns	0.734ns	0.00974	696 B
master	`StartFinishScope`	netcoreapp3.1	695ns	0.547ns	2.12ns	0.00935	696 B
master	`StartFinishScope`	net472	939ns	1.39ns	5.38ns	0.104	658 B
#5871	`StartFinishSpan`	net6.0	397ns	0.545ns	2.11ns	0.00805	576 B
#5871	`StartFinishSpan`	netcoreapp3.1	653ns	0.806ns	3.12ns	0.00797	576 B
#5871	`StartFinishSpan`	net472	601ns	0.648ns	2.51ns	0.0917	578 B
#5871	`StartFinishScope`	net6.0	472ns	0.267ns	0.998ns	0.0097	696 B
#5871	`StartFinishScope`	netcoreapp3.1	702ns	0.738ns	2.86ns	0.00939	696 B
#5871	`StartFinishScope`	net472	840ns	1.09ns	4.22ns	0.104	658 B

Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunOnMethodBegin`	net6.0	648ns	0.316ns	1.22ns	0.00974	696 B
master	`RunOnMethodBegin`	netcoreapp3.1	984ns	1.46ns	5.65ns	0.00932	696 B
master	`RunOnMethodBegin`	net472	1.09μs	1.21ns	4.68ns	0.105	658 B
#5871	`RunOnMethodBegin`	net6.0	588ns	0.362ns	1.4ns	0.00965	696 B
#5871	`RunOnMethodBegin`	netcoreapp3.1	887ns	0.78ns	3.02ns	0.00929	696 B
#5871	`RunOnMethodBegin`	net472	1.05μs	0.955ns	3.7ns	0.104	658 B

andrewlock · 2024-08-13T08:44:50Z

tracer/src/Datadog.Trace/AppSec/Rasp/RaspModule.cs

@@ -177,4 +179,26 @@ private static void SendStack(Span rootSpan, string id)
            rootSpan.Context.TraceContext.AddStackTraceElement(stack, Security.Instance.Settings.MaxStackTraces);
        }
    }
+
+    internal static void OnCommandInjection(string fileName, string argumentLine, Collection<string>? argumentList, bool useShellExecute)


FYI, this code (or wherever is safest) needs to call the ProcessHelpers.ShouldTraceProcessStart() method. We invoke processes during startup to e.g. read info about the environment, so we have to make sure not to invoke any code that could cause things to initialize, i.e. calling Security.Instance or Tracer.Instance, otherwise we end up recursively initializing which causes "issues" 😅

Yes, we check that on ProcessStartIntegration.cs, which is actually calling the vulnerabilityManager, which calls the RaspModule.

andrewlock · 2024-08-26T10:15:46Z

Throughput/Crank Report ⚡

Throughput results for AspNetCoreSimpleController comparing the following branches/commits:

Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red.

Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards!

gantt
    title Throughput Linux x64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (5871) (11.943M)   : 0, 11942904
    master (11.426M)   : 0, 11426024
    benchmarks/2.9.0 (11.724M)   : 0, 11723598

    section Automatic
    This PR (5871) (7.650M)   : 0, 7650024
    master (7.538M)   : 0, 7538141
    benchmarks/2.9.0 (8.457M)   : 0, 8457362

    section Trace stats
    master (7.957M)   : 0, 7957385

    section Manual
    master (11.226M)   : 0, 11226205

    section Manual + Automatic
    This PR (5871) (7.173M)   : 0, 7173176
    master (7.080M)   : 0, 7079680

    section DD_TRACE_ENABLED=0
    master (10.508M)   : 0, 10507826

gantt
    title Throughput Linux arm64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (5871) (9.502M)   : 0, 9501935

    section Automatic
    This PR (5871) (6.520M)   : 0, 6520314

    section Manual + Automatic
    This PR (5871) (6.105M)   : 0, 6104687

gantt
    title Throughput Windows x64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (5871) (10.166M)   : 0, 10166495
    master (10.277M)   : 0, 10276521
    benchmarks/2.9.0 (10.150M)   : 0, 10149589

    section Automatic
    This PR (5871) (6.924M)   : 0, 6924096
    master (6.916M)   : 0, 6916225
    benchmarks/2.9.0 (7.559M)   : 0, 7558859

    section Trace stats
    master (7.400M)   : 0, 7399689

    section Manual
    master (10.055M)   : 0, 10055069

    section Manual + Automatic
    This PR (5871) (6.415M)   : 0, 6415007
    master (6.342M)   : 0, 6342009

    section DD_TRACE_ENABLED=0
    master (9.471M)   : 0, 9471248

daniel-romano-DD

LGTM

NachoEchevarria · 2024-08-28T16:12:02Z

Thank you for your reviews!

NachoEchevarria added 7 commits August 8, 2024 17:18

ShellI implementation

01ddb1b

shellI unit test and example code

3263e85

ShellI implementation

99d6845

shellI unit test and example code

6c91dcd

Merge branch 'nacho/RASPShellInjection' of https://github.com/DataDog…

de1dd97

…/dd-trace-dotnet into nacho/RASPShellInjection

Integration tests

b4ed038

Add try/catch

a77e765

NachoEchevarria added 2 commits August 12, 2024 11:04

Fix compilation error

c33132d

Refactor

82ef2f9

NachoEchevarria changed the title ~~Nacho/rasp shell injection~~ [ASM] RASP shell injection vulnerability Aug 12, 2024

NachoEchevarria added the area:asm label Aug 12, 2024

NachoEchevarria and others added 2 commits August 12, 2024 12:45

Remove shell invocation case.

acde96b

Merge branch 'master' into nacho/RASPShellInjection

606d9f2

NachoEchevarria marked this pull request as ready for review August 12, 2024 15:51

NachoEchevarria requested review from a team as code owners August 12, 2024 15:51

andrewlock reviewed Aug 13, 2024

View reviewed changes

NachoEchevarria added 2 commits August 13, 2024 13:38

Merge branch 'master' into nacho/RASPShellInjection

93b921a

Merge branch 'master' into nacho/RASPShellInjection

1fd06b2

daniel-romano-DD approved these changes Aug 28, 2024

View reviewed changes

lucaspimentel approved these changes Aug 28, 2024

View reviewed changes

NachoEchevarria merged commit d453b52 into master Aug 28, 2024
72 of 73 checks passed

NachoEchevarria deleted the nacho/RASPShellInjection branch August 28, 2024 16:12

github-actions bot added this to the vNext-v3 milestone Aug 28, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ASM] RASP shell injection vulnerability #5871

[ASM] RASP shell injection vulnerability #5871

NachoEchevarria commented Aug 9, 2024 •

edited

Loading

datadog-ddstaging bot commented Aug 9, 2024 •

edited

Loading

andrewlock commented Aug 12, 2024 •

edited

Loading

andrewlock commented Aug 12, 2024 •

edited

Loading

Slower ⚠️ in #5871

Raw results

Raw results

Raw results

Fewer allocations 🎉 in #5871

Raw results

andrewlock commented Aug 13, 2024 •

edited

Loading

Raw results

Raw results

Raw results

Raw results

Raw results

Slower ⚠️ in #5871

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Faster 🎉 in #5871

Raw results

Raw results

andrewlock Aug 13, 2024

NachoEchevarria Aug 13, 2024

andrewlock commented Aug 26, 2024

daniel-romano-DD left a comment

NachoEchevarria commented Aug 28, 2024

[ASM] RASP shell injection vulnerability #5871

[ASM] RASP shell injection vulnerability #5871

Conversation

NachoEchevarria commented Aug 9, 2024 • edited Loading

Summary of changes

Reason for change

Implementation details

Test coverage

Other details

datadog-ddstaging bot commented Aug 9, 2024 • edited Loading

Datadog Report

andrewlock commented Aug 12, 2024 • edited Loading

Execution-Time Benchmarks Report ⏱️

andrewlock commented Aug 12, 2024 • edited Loading

Benchmarks Report for appsec 🐌

Benchmark details

Slower ⚠️ in #5871

Raw results

Raw results

Raw results

Fewer allocations 🎉 in #5871

Raw results

andrewlock commented Aug 13, 2024 • edited Loading

Benchmarks Report for tracer 🐌

Benchmark details

Raw results

Raw results

Raw results

Raw results

Raw results

Slower ⚠️ in #5871

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Faster 🎉 in #5871

Raw results

Raw results

andrewlock Aug 13, 2024

Choose a reason for hiding this comment

NachoEchevarria Aug 13, 2024

Choose a reason for hiding this comment

andrewlock commented Aug 26, 2024

Throughput/Crank Report ⚡

daniel-romano-DD left a comment

Choose a reason for hiding this comment

NachoEchevarria commented Aug 28, 2024

NachoEchevarria commented Aug 9, 2024 •

edited

Loading

datadog-ddstaging bot commented Aug 9, 2024 •

edited

Loading

andrewlock commented Aug 12, 2024 •

edited

Loading

andrewlock commented Aug 12, 2024 •

edited

Loading

andrewlock commented Aug 13, 2024 •

edited

Loading