[IAST] Remove safe origin ranges #6091
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
daniel-romano-DD
force-pushed
the
dani/iast/remove_safe_origin_ranges
branch
from
b3b2b89
to
b269cad
Compare
Fixed casing
daniel-romano-DD
force-pushed
the
dani/iast/remove_safe_origin_ranges
branch
from
b269cad
to
fec2738
Compare
Snapshots difference summaryThe following differences have been observed in committed snapshots. It is meant to help the reviewer. 1 occurrences of : - "value": "<script language='javascript' type='text/javascript'>alert('Stored XSS attack');</script>",
- "source": 1
- },
- {
- "value": ":443/api/v1/test/123/?param1=pone¶m2=ptwo#fragment1=fone&fragment2=ftwo"
+ "value": "<script language='javascript' type='text/javascript'>alert('Stored XSS attack');</script>:443/api/v1/test/123/?param1=pone¶m2=ptwo#fragment1=fone&fragment2=ftwo"
1 occurrences of : - },
- {
- "origin": "sql.row.value",
- "name": "Details",
- "value": "<script language='javascript' type='text/javascript'>alert('Stored XSS attack');</script>"
|
Datadog ReportBranch report: ✅ 0 Failed, 366220 Passed, 2062 Skipped, 16h 7m 10.51s Total Time |
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing the following branches/commits: Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6091) - mean (70ms) : 67, 73
. : milestone, 70,
master - mean (70ms) : 67, 73
. : milestone, 70,
section CallTarget+Inlining+NGEN
This PR (6091) - mean (1,106ms) : 1084, 1127
. : milestone, 1106,
master - mean (1,100ms) : 1084, 1117
. : milestone, 1100,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6091) - mean (110ms) : 107, 113
. : milestone, 110,
master - mean (109ms) : 105, 112
. : milestone, 109,
section CallTarget+Inlining+NGEN
This PR (6091) - mean (770ms) : 753, 786
. : milestone, 770,
master - mean (768ms) : 747, 789
. : milestone, 768,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6091) - mean (93ms) : 90, 97
. : milestone, 93,
master - mean (92ms) : 90, 95
. : milestone, 92,
section CallTarget+Inlining+NGEN
This PR (6091) - mean (724ms) : 708, 740
. : milestone, 724,
master - mean (730ms) : 715, 746
. : milestone, 730,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6091) - mean (190ms) : 187, 192
. : milestone, 190,
master - mean (190ms) : 186, 194
. : milestone, 190,
section CallTarget+Inlining+NGEN
This PR (6091) - mean (1,194ms) : 1173, 1214
. : milestone, 1194,
master - mean (1,198ms) : 1169, 1227
. : milestone, 1198,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6091) - mean (276ms) : 270, 281
. : milestone, 276,
master - mean (276ms) : 272, 280
. : milestone, 276,
section CallTarget+Inlining+NGEN
This PR (6091) - mean (935ms) : 920, 951
. : milestone, 935,
master - mean (942ms) : 923, 961
. : milestone, 942,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6091) - mean (264ms) : 261, 268
. : milestone, 264,
master - mean (264ms) : 262, 267
. : milestone, 264,
section CallTarget+Inlining+NGEN
This PR (6091) - mean (925ms) : 907, 944
. : milestone, 925,
master - mean (926ms) : 905, 947
. : milestone, 926,
|
andrewlock
approved these changes
Sep 27, 2024
Comment on lines
234
to
246
| List<Range> insecureRanges = new List<Range>(ranges.Length); | ||
| for (int x = 0; x < ranges.Length; x++) | ||
| { | ||
| var range = ranges[x]; | ||
| if (range.IsMarked(safeMarks) || range.IsSafeSource(safeSources)) | ||
| { | ||
| continue; | ||
| } | ||
|
|
||
| insecureRanges.Add(range); | ||
| } | ||
|
|
||
| return insecureRanges.ToArray(); |
There was a problem hiding this comment.
If you want to reduce allocations here, you could
- In the previous
forloop, don'tbreakearly. Just count the number of unsafe ranges. - Instead of using a list, allocate the Range[] with the correct size.
Might actually be easier to follow too, but it's just a nit 🤷♂️
There was a problem hiding this comment.
I was torn between reducing allocations and not checking twice here...
Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
robertpi
approved these changes
Sep 27, 2024
andrewlock
approved these changes
Sep 27, 2024
| @@ -10,3 +10,5 @@ | |||
| #if NETFRAMEWORK || NETSTANDARD2_0 | |||
| global using Datadog.Trace.VendoredMicrosoftCode.System; | |||
| #endif | |||
|
|
|||
| global using Datadog.Trace.ExtensionMethods; | |||
| // This is made in order to avoid unnecessary allocations (most common situation) | ||
| return ranges; | ||
| } | ||
|
|
There was a problem hiding this comment.
nit: could also cater to the easy one:
Suggested change
| if (insecureCount == 0) | |
| { | |
| return []; | |
| } |
| @@ -206,22 +207,42 @@ internal static Range[] CopyWithMark(Range[] ranges, SecureMarks secureMarks) | |||
| return newRanges.ToArray(); | |||
| } | |||
|
|
|||
| internal static bool ContainsUnsafeRange(IEnumerable<Range>? ranges) | |||
| internal static Range[]? GetUnsafeRanges(Range[] ranges, SecureMarks safeMarks, SourceType[]? safeSources) | |||
There was a problem hiding this comment.
I think this always returns non null?
Suggested change
| internal static Range[]? GetUnsafeRanges(Range[] ranges, SecureMarks safeMarks, SourceType[]? safeSources) | |
| internal static Range[] GetUnsafeRanges(Range[] ranges, SecureMarks safeMarks, SourceType[]? safeSources) |
Benchmarks Report for appsec 🐌Benchmarks for #6091 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.Asm.AppSecBodyBenchmark - Faster 🎉 Same allocations ✔️
|
| Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody‑net472 | 1.248 | 4,815.74 | 3,860.15 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | AllCycleSimpleBody |
net6.0 | 72μs | 162ns | 626ns | 0.0719 | 0 | 0 | 6 KB |
| master | AllCycleSimpleBody |
netcoreapp3.1 | 61.9μs | 95.1ns | 368ns | 0.0925 | 0 | 0 | 6.95 KB |
| master | AllCycleSimpleBody |
net472 | 48.3μs | 66.1ns | 256ns | 1.31 | 0 | 0 | 8.34 KB |
| master | AllCycleMoreComplexBody |
net6.0 | 77.8μs | 91ns | 352ns | 0.117 | 0 | 0 | 9.51 KB |
| master | AllCycleMoreComplexBody |
netcoreapp3.1 | 69.7μs | 76.4ns | 286ns | 0.104 | 0 | 0 | 10.36 KB |
| master | AllCycleMoreComplexBody |
net472 | 55.3μs | 49ns | 177ns | 1.88 | 0.0276 | 0 | 11.85 KB |
| master | ObjectExtractorSimpleBody |
net6.0 | 143ns | 0.674ns | 2.61ns | 0.00392 | 0 | 0 | 280 B |
| master | ObjectExtractorSimpleBody |
netcoreapp3.1 | 205ns | 0.187ns | 0.726ns | 0.00371 | 0 | 0 | 272 B |
| master | ObjectExtractorSimpleBody |
net472 | 178ns | 0.172ns | 0.645ns | 0.0446 | 0 | 0 | 281 B |
| master | ObjectExtractorMoreComplexBody |
net6.0 | 3.09μs | 0.961ns | 3.72ns | 0.0527 | 0 | 0 | 3.78 KB |
| master | ObjectExtractorMoreComplexBody |
netcoreapp3.1 | 3.84μs | 1.43ns | 5.52ns | 0.0499 | 0 | 0 | 3.69 KB |
| master | ObjectExtractorMoreComplexBody |
net472 | 4.82μs | 1.38ns | 5.35ns | 0.601 | 0.00481 | 0 | 3.8 KB |
| #6091 | AllCycleSimpleBody |
net6.0 | 72μs | 127ns | 490ns | 0.0723 | 0 | 0 | 6 KB |
| #6091 | AllCycleSimpleBody |
netcoreapp3.1 | 61.3μs | 68ns | 254ns | 0.0919 | 0 | 0 | 6.95 KB |
| #6091 | AllCycleSimpleBody |
net472 | 49μs | 100ns | 388ns | 1.31 | 0 | 0 | 8.34 KB |
| #6091 | AllCycleMoreComplexBody |
net6.0 | 76.8μs | 54ns | 209ns | 0.116 | 0 | 0 | 9.51 KB |
| #6091 | AllCycleMoreComplexBody |
netcoreapp3.1 | 68.5μs | 85.4ns | 331ns | 0.138 | 0 | 0 | 10.36 KB |
| #6091 | AllCycleMoreComplexBody |
net472 | 56.5μs | 32.7ns | 127ns | 1.87 | 0.0283 | 0 | 11.85 KB |
| #6091 | ObjectExtractorSimpleBody |
net6.0 | 140ns | 0.204ns | 0.788ns | 0.00397 | 0 | 0 | 280 B |
| #6091 | ObjectExtractorSimpleBody |
netcoreapp3.1 | 204ns | 0.214ns | 0.829ns | 0.0037 | 0 | 0 | 272 B |
| #6091 | ObjectExtractorSimpleBody |
net472 | 162ns | 0.243ns | 0.942ns | 0.0446 | 0 | 0 | 281 B |
| #6091 | ObjectExtractorMoreComplexBody |
net6.0 | 3.04μs | 1.91ns | 7.14ns | 0.0532 | 0 | 0 | 3.78 KB |
| #6091 | ObjectExtractorMoreComplexBody |
netcoreapp3.1 | 4μs | 2.62ns | 10.1ns | 0.05 | 0 | 0 | 3.69 KB |
| #6091 | ObjectExtractorMoreComplexBody |
net472 | 3.86μs | 1.81ns | 6.53ns | 0.603 | 0.00578 | 0 | 3.8 KB |
Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | EncodeArgs |
net6.0 | 37μs | 23.2ns | 89.9ns | 0.446 | 0 | 0 | 32.4 KB |
| master | EncodeArgs |
netcoreapp3.1 | 53.5μs | 9.82ns | 35.4ns | 0.429 | 0 | 0 | 32.4 KB |
| master | EncodeArgs |
net472 | 66μs | 31.5ns | 122ns | 5.16 | 0.0661 | 0 | 32.5 KB |
| master | EncodeLegacyArgs |
net6.0 | 76.5μs | 73.4ns | 275ns | 0 | 0 | 0 | 2.14 KB |
| master | EncodeLegacyArgs |
netcoreapp3.1 | 108μs | 73ns | 273ns | 0 | 0 | 0 | 2.14 KB |
| master | EncodeLegacyArgs |
net472 | 152μs | 83.2ns | 311ns | 0.302 | 0 | 0 | 2.15 KB |
| #6091 | EncodeArgs |
net6.0 | 36.8μs | 30ns | 116ns | 0.454 | 0 | 0 | 32.4 KB |
| #6091 | EncodeArgs |
netcoreapp3.1 | 54.3μs | 24.1ns | 86.9ns | 0.431 | 0 | 0 | 32.4 KB |
| #6091 | EncodeArgs |
net472 | 65.7μs | 24.6ns | 92.2ns | 5.14 | 0.0655 | 0 | 32.5 KB |
| #6091 | EncodeLegacyArgs |
net6.0 | 74.6μs | 44ns | 171ns | 0 | 0 | 0 | 2.14 KB |
| #6091 | EncodeLegacyArgs |
netcoreapp3.1 | 104μs | 98.5ns | 382ns | 0 | 0 | 0 | 2.15 KB |
| #6091 | EncodeLegacyArgs |
net472 | 151μs | 88ns | 341ns | 0.301 | 0 | 0 | 2.15 KB |
Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | RunWafRealisticBenchmark |
net6.0 | 186μs | 132ns | 511ns | 0 | 0 | 0 | 2.44 KB |
| master | RunWafRealisticBenchmark |
netcoreapp3.1 | 195μs | 197ns | 762ns | 0 | 0 | 0 | 2.39 KB |
| master | RunWafRealisticBenchmark |
net472 | 208μs | 42.7ns | 165ns | 0.311 | 0 | 0 | 2.46 KB |
| master | RunWafRealisticBenchmarkWithAttack |
net6.0 | 122μs | 36ns | 125ns | 0 | 0 | 0 | 1.47 KB |
| master | RunWafRealisticBenchmarkWithAttack |
netcoreapp3.1 | 130μs | 80.6ns | 312ns | 0 | 0 | 0 | 1.46 KB |
| master | RunWafRealisticBenchmarkWithAttack |
net472 | 139μs | 30.9ns | 120ns | 0.208 | 0 | 0 | 1.49 KB |
| #6091 | RunWafRealisticBenchmark |
net6.0 | 185μs | 106ns | 382ns | 0 | 0 | 0 | 2.44 KB |
| #6091 | RunWafRealisticBenchmark |
netcoreapp3.1 | 199μs | 109ns | 406ns | 0 | 0 | 0 | 2.39 KB |
| #6091 | RunWafRealisticBenchmark |
net472 | 208μs | 215ns | 834ns | 0.31 | 0 | 0 | 2.46 KB |
| #6091 | RunWafRealisticBenchmarkWithAttack |
net6.0 | 122μs | 40.2ns | 156ns | 0 | 0 | 0 | 1.47 KB |
| #6091 | RunWafRealisticBenchmarkWithAttack |
netcoreapp3.1 | 129μs | 101ns | 379ns | 0 | 0 | 0 | 1.46 KB |
| #6091 | RunWafRealisticBenchmarkWithAttack |
net472 | 138μs | 38ns | 142ns | 0.207 | 0 | 0 | 1.49 KB |
Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ Fewer allocations 🎉
Fewer allocations 🎉 in #6091
Benchmark
Base Allocated
Diff Allocated
Change
Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0
256.8 KB
253.27 KB
-3.53 KB
-1.37%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net472
286.72 KB
278.53 KB
-8.19 KB
-2.86%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1
264.59 KB
253.53 KB
-11.06 KB
-4.18%
| Benchmark | Base Allocated | Diff Allocated | Change | Change % |
|---|---|---|---|---|
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0 | 256.8 KB | 253.27 KB | -3.53 KB | -1.37% |
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net472 | 286.72 KB | 278.53 KB | -8.19 KB | -2.86% |
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1 | 264.59 KB | 253.53 KB | -11.06 KB | -4.18% |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StringConcatBenchmark |
net6.0 | 51μs | 189ns | 707ns | 0 | 0 | 0 | 43.44 KB |
| master | StringConcatBenchmark |
netcoreapp3.1 | 61.1μs | 865ns | 8.65μs | 0 | 0 | 0 | 42.64 KB |
| master | StringConcatBenchmark |
net472 | 37μs | 79.5ns | 297ns | 0 | 0 | 0 | 59.07 KB |
| master | StringConcatAspectBenchmark |
net6.0 | 321μs | 1E+03ns | 3.61μs | 0 | 0 | 0 | 256.8 KB |
| master | StringConcatAspectBenchmark |
netcoreapp3.1 | 343μs | 1.94μs | 13.4μs | 0 | 0 | 0 | 264.59 KB |
| master | StringConcatAspectBenchmark |
net472 | 282μs | 7.54μs | 73.1μs | 0 | 0 | 0 | 286.72 KB |
| #6091 | StringConcatBenchmark |
net6.0 | 59.6μs | 743ns | 7.4μs | 0 | 0 | 0 | 43.44 KB |
| #6091 | StringConcatBenchmark |
netcoreapp3.1 | 52.8μs | 253ns | 1.16μs | 0 | 0 | 0 | 42.64 KB |
| #6091 | StringConcatBenchmark |
net472 | 36.8μs | 58.2ns | 210ns | 0 | 0 | 0 | 59.14 KB |
| #6091 | StringConcatAspectBenchmark |
net6.0 | 281μs | 5.51μs | 54.3μs | 0 | 0 | 0 | 253.27 KB |
| #6091 | StringConcatAspectBenchmark |
netcoreapp3.1 | 335μs | 1.61μs | 6.65μs | 0 | 0 | 0 | 253.53 KB |
| #6091 | StringConcatAspectBenchmark |
net472 | 274μs | 5.72μs | 56.4μs | 0 | 0 | 0 | 278.53 KB |
Benchmarks Report for tracer 🐌Benchmarks for #6091 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SpanBenchmark - Faster 🎉 Same allocations ✔️
|
| Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.SpanBenchmark.StartFinishScope‑net6.0 | 1.131 | 530.22 | 468.98 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StartFinishSpan |
net6.0 | 393ns | 0.255ns | 0.987ns | 0.00811 | 0 | 0 | 576 B |
| master | StartFinishSpan |
netcoreapp3.1 | 595ns | 0.253ns | 0.981ns | 0.00782 | 0 | 0 | 576 B |
| master | StartFinishSpan |
net472 | 598ns | 0.889ns | 3.33ns | 0.0918 | 0 | 0 | 578 B |
| master | StartFinishScope |
net6.0 | 530ns | 0.321ns | 1.24ns | 0.00962 | 0 | 0 | 696 B |
| master | StartFinishScope |
netcoreapp3.1 | 726ns | 0.969ns | 3.75ns | 0.00944 | 0 | 0 | 696 B |
| master | StartFinishScope |
net472 | 813ns | 0.917ns | 3.43ns | 0.104 | 0 | 0 | 658 B |
| #6091 | StartFinishSpan |
net6.0 | 395ns | 0.171ns | 0.662ns | 0.00802 | 0 | 0 | 576 B |
| #6091 | StartFinishSpan |
netcoreapp3.1 | 617ns | 1.52ns | 5.88ns | 0.00797 | 0 | 0 | 576 B |
| #6091 | StartFinishSpan |
net472 | 579ns | 0.637ns | 2.47ns | 0.0918 | 0 | 0 | 578 B |
| #6091 | StartFinishScope |
net6.0 | 469ns | 0.124ns | 0.482ns | 0.00965 | 0 | 0 | 696 B |
| #6091 | StartFinishScope |
netcoreapp3.1 | 691ns | 0.59ns | 2.21ns | 0.00934 | 0 | 0 | 696 B |
| #6091 | StartFinishScope |
net472 | 811ns | 0.522ns | 2.02ns | 0.104 | 0 | 0 | 658 B |
Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | RunOnMethodBegin |
net6.0 | 644ns | 0.341ns | 1.32ns | 0.00978 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
netcoreapp3.1 | 1E+03ns | 0.987ns | 3.82ns | 0.00962 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
net472 | 1.12μs | 1.29ns | 4.99ns | 0.104 | 0 | 0 | 658 B |
| #6091 | RunOnMethodBegin |
net6.0 | 686ns | 0.649ns | 2.52ns | 0.0099 | 0 | 0 | 696 B |
| #6091 | RunOnMethodBegin |
netcoreapp3.1 | 926ns | 0.371ns | 1.39ns | 0.00927 | 0 | 0 | 696 B |
| #6091 | RunOnMethodBegin |
net472 | 1.16μs | 0.385ns | 1.49ns | 0.104 | 0 | 0 | 658 B |
Throughput/Crank Report ⚡Throughput results for AspNetCoreSimpleController comparing the following branches/commits: Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red. Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards! gantt
title Throughput Linux x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6091) (11.095M) : 0, 11094821
master (10.927M) : 0, 10927139
benchmarks/2.9.0 (11.081M) : 0, 11080577
section Automatic
This PR (6091) (7.362M) : 0, 7362087
master (7.322M) : 0, 7322055
benchmarks/2.9.0 (7.732M) : 0, 7732233
section Trace stats
master (7.600M) : 0, 7600325
section Manual
master (10.941M) : 0, 10940627
section Manual + Automatic
This PR (6091) (6.826M) : 0, 6825741
master (6.568M) : 0, 6568140
section DD_TRACE_ENABLED=0
master (10.242M) : 0, 10242149
gantt
title Throughput Linux arm64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6091) (9.639M) : 0, 9639389
master (9.577M) : 0, 9577232
benchmarks/2.9.0 (9.798M) : 0, 9798067
section Automatic
This PR (6091) (6.588M) : 0, 6587913
master (6.625M) : 0, 6625219
section Trace stats
master (6.872M) : 0, 6872290
section Manual
master (9.590M) : 0, 9589966
section Manual + Automatic
This PR (6091) (6.035M) : 0, 6034508
master (6.216M) : 0, 6216360
section DD_TRACE_ENABLED=0
master (8.849M) : 0, 8848858
gantt
title Throughput Windows x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6091) (10.014M) : 0, 10013687
master (10.054M) : 0, 10053618
benchmarks/2.9.0 (10.067M) : 0, 10067315
section Automatic
This PR (6091) (6.603M) : 0, 6602733
master (6.652M) : 0, 6652460
benchmarks/2.9.0 (7.552M) : 0, 7552193
section Trace stats
master (7.361M) : 0, 7361092
section Manual
master (9.980M) : 0, 9980178
section Manual + Automatic
This PR (6091) (6.071M) : 0, 6070667
master (6.131M) : 0, 6130507
section DD_TRACE_ENABLED=0
master (9.497M) : 0, 9496505
|
nhulston
pushed a commit
that referenced
this pull request
Sep 27, 2024
## Summary of changes
Remove ranges from safe origins from vulnerability evidence
## Reason for change
Until now, only ranges marked with a secure mark were removed from
evidence, but ranges from safe sources (like database values in non XSS
or SQLi injections) were being sent.
SecureMarks are marks added to a range that indicates that it has been
sanitized (and thus, secured) for that vulnerability.
In the same manner, there some origins that do not apply to certain
vulnerabilities, like database values not applying in injection but XSS
and SQLi. So in these cases, those ranges should be removed from the
evidence.
## Implementation details
Filter ranges by source as well as by secure marks
## Test coverage
Unit and integration tests
## Other details
<!-- Fixes #{issue} -->
<!-- ⚠️ Note: where possible, please obtain 2 approvals prior to
merging. Unless CODEOWNERS specifies otherwise, for external teams it is
typically best to have one review from a team member, and one review
from apm-dotnet. Trivial changes do not require 2 reviews. -->
---------
Co-authored-by: Andrew Lock <andrew.lock@datadoghq.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary of changes
Remove ranges from safe origins from vulnerability evidence
Reason for change
Until now, only ranges marked with a secure mark were removed from evidence, but ranges from safe sources (like database values in non XSS or SQLi injections) were being sent.
SecureMarks are marks added to a range that indicates that it has been sanitized (and thus, secured) for that vulnerability.
In the same manner, there some origins that do not apply to certain vulnerabilities, like database values not applying in injection but XSS and SQLi. So in these cases, those ranges should be removed from the evidence.
Implementation details
Filter ranges by source as well as by secure marks
Test coverage
Unit and integration tests
Other details