[ASM] Restrict RASP Lfi operations to read operation only #6221

NachoEchevarria · 2024-10-30T14:45:44Z

Summary of changes

In order to avoid too many calls to the WAF, after some discussions, it was agreed that we should only call the WAF in RASP when accessing a file for read operations.

Reason for change

Performance.

Implementation details

Test coverage

Other details

datadog-ddstaging · 2024-10-30T15:07:31Z

Datadog Report

Branch report: nacho/RestrictRaspToFileRead
Commit report: 6946c17
Test service: dd-trace-dotnet

✅ 0 Failed, 474289 Passed, 3273 Skipped, 39h 37m 15.42s Total Time
❄️ 1 New Flaky
⌛ 2 Performance Regressions

New Flaky Tests (1)

NoExceptions - Datadog.Trace.ClrProfiler.IntegrationTests.SmokeTests.AssemblyResolveMscorlibResourcesInfiniteRecursionCrashSmokeTest - Last Failure
Expand for error
```
 Expected no errors in smoke test: ptrace(GETREGS, 15918) FAILED 3 (No such process)
 
 Expected: True
 Actual:   False
```

⌛ Performance Regressions vs Default Branch (2)

Profiler_garbagecollections - scenarios 2.61s (+78.21ms, +3%) - Details
StartStopWithChild - Benchmarks.Trace.ActivityBenchmark 18.59µs (+2.31µs, +14%) - Details

andrewlock · 2024-10-30T15:15:59Z

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing the following branches/commits:

Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:

Welch test with statistical test for significance of 5%
Only results indicating a difference greater than 5% and 5 ms are considered.

Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.

Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).

gantt
    title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6221) - mean (70ms)  : 68, 73
     .   : milestone, 70,
    master - mean (70ms)  : 68, 72
     .   : milestone, 70,

    section CallTarget+Inlining+NGEN
    This PR (6221) - mean (1,119ms)  : 1100, 1139
     .   : milestone, 1119,
    master - mean (1,119ms)  : 1098, 1141
     .   : milestone, 1119,

gantt
    title Execution time (ms) FakeDbCommand (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6221) - mean (110ms)  : 106, 114
     .   : milestone, 110,
    master - mean (110ms)  : 107, 114
     .   : milestone, 110,

    section CallTarget+Inlining+NGEN
    This PR (6221) - mean (781ms)  : 769, 794
     .   : milestone, 781,
    master - mean (782ms)  : 763, 801
     .   : milestone, 782,

gantt
    title Execution time (ms) FakeDbCommand (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6221) - mean (93ms)  : 90, 96
     .   : milestone, 93,
    master - mean (93ms)  : 90, 96
     .   : milestone, 93,

    section CallTarget+Inlining+NGEN
    This PR (6221) - mean (739ms)  : 719, 758
     .   : milestone, 739,
    master - mean (738ms)  : 722, 753
     .   : milestone, 738,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6221) - mean (197ms)  : 192, 201
     .   : milestone, 197,
    master - mean (190ms)  : 188, 193
     .   : milestone, 190,

    section CallTarget+Inlining+NGEN
    This PR (6221) - mean (1,265ms)  : 1249, 1281
     .   : milestone, 1265,
    master - mean (1,225ms)  : 1202, 1248
     .   : milestone, 1225,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6221) - mean (285ms)  : 281, 290
     .   : milestone, 285,
    master - mean (287ms)  : 257, 317
     .   : milestone, 287,

    section CallTarget+Inlining+NGEN
    This PR (6221) - mean (980ms)  : 961, 999
     .   : milestone, 980,
    master - mean (952ms)  : 931, 973
     .   : milestone, 952,

gantt
    title Execution time (ms) HttpMessageHandler (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6221) - mean (273ms)  : 269, 278
     .   : milestone, 273,
    master - mean (265ms)  : 261, 269
     .   : milestone, 265,

    section CallTarget+Inlining+NGEN
    This PR (6221) - mean (965ms)  : 941, 988
     .   : milestone, 965,
    master - mean (953ms)  : 917, 990
     .   : milestone, 953,

andrewlock · 2024-10-30T16:08:54Z

Benchmarks Report for tracer 🐌

Benchmarks for #6221 compared to master:

1 benchmarks are faster, with geometric mean 1.128
1 benchmarks are slower, with geometric mean 1.130
All benchmarks have the same allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.ActivityBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #6221

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.ActivityBenchmark.StartStopWithChild‑net472	1.130	16,474.08	18,612.45

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`StartStopWithChild`	net6.0	8.08μs	44ns	245ns	0.0197	0.00787	0	5.62 KB
master	`StartStopWithChild`	netcoreapp3.1	10.1μs	53.6ns	273ns	0.0247	0.00986	0	5.8 KB
master	`StartStopWithChild`	net472	16.6μs	78.9ns	335ns	1.04	0.311	0.09	6.21 KB
#6221	`StartStopWithChild`	net6.0	8.14μs	46.7ns	349ns	0.0198	0.00791	0	5.61 KB
#6221	`StartStopWithChild`	netcoreapp3.1	10.2μs	55.7ns	310ns	0.0199	0.00996	0	5.8 KB
#6221	`StartStopWithChild`	net472	18.6μs	88.7ns	344ns	1.05	0.319	0.0924	6.21 KB

Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	478μs	347ns	1.35μs	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	655μs	241ns	868ns	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	net472	835μs	699ns	2.71μs	0.417	3.3 KB
#6221	`WriteAndFlushEnrichedTraces`	net6.0	469μs	573ns	2.22μs	0	2.7 KB
#6221	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	632μs	736ns	2.85μs	0	2.7 KB
#6221	`WriteAndFlushEnrichedTraces`	net472	839μs	438ns	1.7μs	0.417	3.3 KB

Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendRequest`	net6.0	203μs	1.18μs	10.1μs	0.2	18.73 KB
master	`SendRequest`	netcoreapp3.1	222μs	1.29μs	11.3μs	0.217	20.89 KB
master	`SendRequest`	net472	0.00183ns	0.000833ns	0.00312ns	0	0 b
#6221	`SendRequest`	net6.0	202μs	1.17μs	10.8μs	0.197	18.73 KB
#6221	`SendRequest`	netcoreapp3.1	216μs	1.18μs	6.56μs	0.207	20.89 KB
#6221	`SendRequest`	net472	0.000594ns	0.00029ns	0.00108ns	0	0 b

Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	564μs	2.89μs	16.4μs	0.563	0	0	41.49 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	681μs	3.5μs	15.6μs	0.336	0	0	41.84 KB
master	`WriteAndFlushEnrichedTraces`	net472	898μs	4.17μs	15.6μs	8.36	2.64	0.44	53.29 KB
#6221	`WriteAndFlushEnrichedTraces`	net6.0	576μs	2.86μs	12.5μs	0.566	0	0	41.61 KB
#6221	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	690μs	3.55μs	16.7μs	0.351	0	0	41.77 KB
#6221	`WriteAndFlushEnrichedTraces`	net472	863μs	2.51μs	9.71μs	8.3	2.62	0.437	53.29 KB

Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`ExecuteNonQuery`	net6.0	1.23μs	1.52ns	5.88ns	0.0141	0	1.02 KB
master	`ExecuteNonQuery`	netcoreapp3.1	1.78μs	0.855ns	3.31ns	0.0132	0	1.02 KB
master	`ExecuteNonQuery`	net472	2.04μs	1.61ns	6.25ns	0.156	0.00102	987 B
#6221	`ExecuteNonQuery`	net6.0	1.36μs	1.14ns	4.25ns	0.0143	0	1.02 KB
#6221	`ExecuteNonQuery`	netcoreapp3.1	1.71μs	1.65ns	6.19ns	0.0137	0	1.02 KB
#6221	`ExecuteNonQuery`	net472	2.12μs	1.61ns	6.04ns	0.156	0.00106	987 B

Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`CallElasticsearch`	net6.0	1.29μs	1.1ns	4.11ns	0.0133	976 B
master	`CallElasticsearch`	netcoreapp3.1	1.59μs	1.1ns	4.27ns	0.0134	976 B
master	`CallElasticsearch`	net472	2.62μs	1.49ns	5.78ns	0.157	995 B
master	`CallElasticsearchAsync`	net6.0	1.31μs	3.32ns	12.9ns	0.0132	952 B
master	`CallElasticsearchAsync`	netcoreapp3.1	1.72μs	2.67ns	9.97ns	0.0138	1.02 KB
master	`CallElasticsearchAsync`	net472	2.48μs	1.28ns	4.95ns	0.167	1.05 KB
#6221	`CallElasticsearch`	net6.0	1.19μs	0.697ns	2.51ns	0.0137	976 B
#6221	`CallElasticsearch`	netcoreapp3.1	1.58μs	8.01ns	38.4ns	0.0129	976 B
#6221	`CallElasticsearch`	net472	2.51μs	3.35ns	12.1ns	0.158	995 B
#6221	`CallElasticsearchAsync`	net6.0	1.31μs	0.728ns	2.82ns	0.013	952 B
#6221	`CallElasticsearchAsync`	netcoreapp3.1	1.66μs	7.76ns	30.1ns	0.0138	1.02 KB
#6221	`CallElasticsearchAsync`	net472	2.69μs	11.4ns	44.3ns	0.166	1.05 KB

Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`ExecuteAsync`	net6.0	1.35μs	0.357ns	1.38ns	0.0136	952 B
master	`ExecuteAsync`	netcoreapp3.1	1.61μs	1.23ns	4.59ns	0.0129	952 B
master	`ExecuteAsync`	net472	1.79μs	1.04ns	4.03ns	0.145	915 B
#6221	`ExecuteAsync`	net6.0	1.26μs	0.909ns	3.52ns	0.0133	952 B
#6221	`ExecuteAsync`	netcoreapp3.1	1.67μs	0.747ns	2.69ns	0.0133	952 B
#6221	`ExecuteAsync`	net472	1.76μs	1.31ns	4.91ns	0.145	915 B

Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendAsync`	net6.0	4.46μs	3.51ns	13.6ns	0.031	2.31 KB
master	`SendAsync`	netcoreapp3.1	5.2μs	1.62ns	6.29ns	0.0392	2.85 KB
master	`SendAsync`	net472	7.33μs	2.44ns	9.11ns	0.495	3.12 KB
#6221	`SendAsync`	net6.0	4.28μs	2.18ns	7.88ns	0.0325	2.31 KB
#6221	`SendAsync`	netcoreapp3.1	5.18μs	2.96ns	11.1ns	0.0364	2.85 KB
#6221	`SendAsync`	net472	7.55μs	2.43ns	9.41ns	0.495	3.12 KB

Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	1.47μs	0.895ns	3.47ns	0.0228	1.64 KB
master	`EnrichedLog`	netcoreapp3.1	2.17μs	1.1ns	4.1ns	0.0227	1.64 KB
master	`EnrichedLog`	net472	2.59μs	1ns	3.89ns	0.249	1.57 KB
#6221	`EnrichedLog`	net6.0	1.55μs	0.728ns	2.72ns	0.0233	1.64 KB
#6221	`EnrichedLog`	netcoreapp3.1	2.17μs	1.92ns	7.44ns	0.0225	1.64 KB
#6221	`EnrichedLog`	net472	2.52μs	0.681ns	2.55ns	0.249	1.57 KB

Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EnrichedLog`	net6.0	120μs	364ns	1.41μs	0	0	4.28 KB
master	`EnrichedLog`	netcoreapp3.1	123μs	196ns	759ns	0	0	4.28 KB
master	`EnrichedLog`	net472	153μs	233ns	902ns	0.685	0.228	4.46 KB
#6221	`EnrichedLog`	net6.0	118μs	134ns	520ns	0	0	4.28 KB
#6221	`EnrichedLog`	netcoreapp3.1	123μs	155ns	580ns	0.0615	0	4.28 KB
#6221	`EnrichedLog`	net472	153μs	150ns	580ns	0.686	0.229	4.46 KB

Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	3.11μs	1.67ns	6.47ns	0.031	2.2 KB
master	`EnrichedLog`	netcoreapp3.1	4.3μs	1.24ns	4.46ns	0.0279	2.2 KB
master	`EnrichedLog`	net472	4.72μs	1.55ns	6.02ns	0.319	2.02 KB
#6221	`EnrichedLog`	net6.0	2.93μs	1.16ns	4.49ns	0.031	2.2 KB
#6221	`EnrichedLog`	netcoreapp3.1	4.2μs	1.23ns	4.62ns	0.0293	2.2 KB
#6221	`EnrichedLog`	net472	4.99μs	1.38ns	5.35ns	0.321	2.02 KB

Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendReceive`	net6.0	1.35μs	0.854ns	3.31ns	0.0156	1.14 KB
master	`SendReceive`	netcoreapp3.1	1.83μs	1.05ns	3.93ns	0.0156	1.14 KB
master	`SendReceive`	net472	2.18μs	1.22ns	4.73ns	0.183	1.16 KB
#6221	`SendReceive`	net6.0	1.33μs	0.589ns	2.28ns	0.0159	1.14 KB
#6221	`SendReceive`	netcoreapp3.1	1.81μs	0.944ns	3.66ns	0.0154	1.14 KB
#6221	`SendReceive`	net472	2.11μs	0.791ns	2.96ns	0.183	1.16 KB

Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	2.69μs	0.906ns	3.39ns	0.0228	1.6 KB
master	`EnrichedLog`	netcoreapp3.1	3.98μs	1.4ns	5.26ns	0.0219	1.65 KB
master	`EnrichedLog`	net472	4.44μs	1.15ns	4.47ns	0.323	2.04 KB
#6221	`EnrichedLog`	net6.0	2.71μs	1.1ns	4.27ns	0.0217	1.6 KB
#6221	`EnrichedLog`	netcoreapp3.1	4.18μs	3.81ns	13.7ns	0.0208	1.65 KB
#6221	`EnrichedLog`	net472	4.29μs	2.51ns	9.73ns	0.323	2.04 KB

Benchmarks.Trace.SpanBenchmark - Faster 🎉 Same allocations ✔️

Faster 🎉 in #6221

Benchmark	base/diff	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.SpanBenchmark.StartFinishScope‑netcoreapp3.1	1.128	777.65	689.43

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`StartFinishSpan`	net6.0	418ns	1.15ns	4.45ns	0.00806	576 B
master	`StartFinishSpan`	netcoreapp3.1	584ns	0.784ns	3.04ns	0.00774	576 B
master	`StartFinishSpan`	net472	706ns	1.29ns	4.99ns	0.0918	578 B
master	`StartFinishScope`	net6.0	487ns	1.11ns	4.31ns	0.00974	696 B
master	`StartFinishScope`	netcoreapp3.1	777ns	0.777ns	3.01ns	0.00945	696 B
master	`StartFinishScope`	net472	855ns	0.374ns	1.45ns	0.105	658 B
#6221	`StartFinishSpan`	net6.0	410ns	1.38ns	5.36ns	0.008	576 B
#6221	`StartFinishSpan`	netcoreapp3.1	590ns	0.431ns	1.67ns	0.00766	576 B
#6221	`StartFinishSpan`	net472	697ns	1.61ns	6.22ns	0.0917	578 B
#6221	`StartFinishScope`	net6.0	537ns	0.673ns	2.61ns	0.00969	696 B
#6221	`StartFinishScope`	netcoreapp3.1	689ns	0.419ns	1.57ns	0.00932	696 B
#6221	`StartFinishScope`	net472	949ns	1.34ns	5ns	0.105	658 B

Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunOnMethodBegin`	net6.0	654ns	0.871ns	3.37ns	0.00982	696 B
master	`RunOnMethodBegin`	netcoreapp3.1	1.01μs	0.415ns	1.61ns	0.0093	696 B
master	`RunOnMethodBegin`	net472	1.16μs	0.451ns	1.75ns	0.105	658 B
#6221	`RunOnMethodBegin`	net6.0	649ns	0.345ns	1.34ns	0.00977	696 B
#6221	`RunOnMethodBegin`	netcoreapp3.1	916ns	4.93ns	27.4ns	0.00906	696 B
#6221	`RunOnMethodBegin`	net472	1.2μs	0.874ns	3.39ns	0.105	658 B

andrewlock · 2024-10-30T21:19:26Z

Throughput/Crank Report ⚡

Throughput results for AspNetCoreSimpleController comparing the following branches/commits:

Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red.

Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards!

gantt
    title Throughput Linux x64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (6221) (11.078M)   : 0, 11077521
    master (11.211M)   : 0, 11210815
    benchmarks/2.9.0 (11.038M)   : 0, 11038036

    section Automatic
    This PR (6221) (7.417M)   : 0, 7416666
    master (7.226M)   : 0, 7225835
    benchmarks/2.9.0 (7.724M)   : 0, 7723503

    section Trace stats
    master (7.508M)   : 0, 7507683

    section Manual
    master (11.211M)   : 0, 11211273

    section Manual + Automatic
    This PR (6221) (6.813M)   : 0, 6812666
    master (6.690M)   : 0, 6690199

    section DD_TRACE_ENABLED=0
    master (10.177M)   : 0, 10177475

gantt
    title Throughput Linux arm64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (6221) (9.482M)   : 0, 9481849
    master (9.502M)   : 0, 9502157
    benchmarks/2.9.0 (9.579M)   : 0, 9578713

    section Automatic
    This PR (6221) (6.536M)   : 0, 6535545
    master (6.577M)   : 0, 6576607

    section Trace stats
    master (6.865M)   : 0, 6865112

    section Manual
    master (9.458M)   : 0, 9457937

    section Manual + Automatic
    This PR (6221) (6.051M)   : 0, 6050979
    master (6.072M)   : 0, 6071940

    section DD_TRACE_ENABLED=0
    master (8.854M)   : 0, 8853711

gantt
    title Throughput Windows x64 (Total requests) 
    dateFormat  X
    axisFormat %s
    section Baseline
    This PR (6221) (10.284M)   : 0, 10284435
    master (10.209M)   : 0, 10208733
    benchmarks/2.9.0 (9.814M)   : 0, 9814080

    section Automatic
    This PR (6221) (6.548M)   : 0, 6547931
    master (6.509M)   : 0, 6509223
    benchmarks/2.9.0 (7.108M)   : 0, 7108110

    section Trace stats
    master (7.106M)   : 0, 7106053

    section Manual
    master (9.874M)   : 0, 9873766

    section Manual + Automatic
    This PR (6221) (6.146M)   : 0, 6145518
    master (6.036M)   : 0, 6035517

    section DD_TRACE_ENABLED=0
    master (9.290M)   : 0, 9289819

andrewlock · 2024-10-31T15:11:42Z

Benchmarks Report for appsec 🐌

Benchmarks for #6221 compared to master:

2 benchmarks are faster, with geometric mean 1.240
3 benchmarks have more allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.Asm.AppSecBodyBenchmark - Faster 🎉 Same allocations ✔️

Faster 🎉 in #6221

Benchmark	base/diff	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody‑netcoreapp3.1	1.266	246.15	194.42
Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody‑net472	1.215	4,523.15	3,724.15

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`AllCycleSimpleBody`	net6.0	75.6μs	139ns	536ns	0.0756	0	6 KB
master	`AllCycleSimpleBody`	netcoreapp3.1	63.6μs	48.1ns	186ns	0.0637	0	6.95 KB
master	`AllCycleSimpleBody`	net472	48.1μs	35.7ns	138ns	1.31	0	8.34 KB
master	`AllCycleMoreComplexBody`	net6.0	78.6μs	44ns	164ns	0.118	0	9.51 KB
master	`AllCycleMoreComplexBody`	netcoreapp3.1	69.9μs	55ns	206ns	0.14	0	10.36 KB
master	`AllCycleMoreComplexBody`	net472	56.3μs	32ns	120ns	1.88	0.028	11.85 KB
master	`ObjectExtractorSimpleBody`	net6.0	138ns	0.145ns	0.542ns	0.00396	0	280 B
master	`ObjectExtractorSimpleBody`	netcoreapp3.1	246ns	0.266ns	1.03ns	0.00369	0	272 B
master	`ObjectExtractorSimpleBody`	net472	170ns	0.084ns	0.314ns	0.0446	0	281 B
master	`ObjectExtractorMoreComplexBody`	net6.0	2.99μs	1.3ns	4.85ns	0.0526	0	3.78 KB
master	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	3.86μs	2.87ns	11.1ns	0.0504	0	3.69 KB
master	`ObjectExtractorMoreComplexBody`	net472	4.52μs	2.11ns	7.89ns	0.602	0.00452	3.8 KB
#6221	`AllCycleSimpleBody`	net6.0	72.4μs	106ns	409ns	0.072	0	6.01 KB
#6221	`AllCycleSimpleBody`	netcoreapp3.1	63.3μs	71.3ns	267ns	0.0944	0	6.95 KB
#6221	`AllCycleSimpleBody`	net472	48.4μs	67ns	251ns	1.32	0	8.34 KB
#6221	`AllCycleMoreComplexBody`	net6.0	79.5μs	63.3ns	237ns	0.119	0	9.51 KB
#6221	`AllCycleMoreComplexBody`	netcoreapp3.1	70.9μs	72.8ns	273ns	0.141	0	10.37 KB
#6221	`AllCycleMoreComplexBody`	net472	55.4μs	31ns	116ns	1.86	0.0278	11.85 KB
#6221	`ObjectExtractorSimpleBody`	net6.0	142ns	0.177ns	0.687ns	0.00395	0	280 B
#6221	`ObjectExtractorSimpleBody`	netcoreapp3.1	195ns	0.307ns	1.19ns	0.00364	0	272 B
#6221	`ObjectExtractorSimpleBody`	net472	174ns	0.196ns	0.76ns	0.0446	0	281 B
#6221	`ObjectExtractorMoreComplexBody`	net6.0	3.23μs	3.78ns	14.1ns	0.0529	0	3.78 KB
#6221	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	3.85μs	2.91ns	11.3ns	0.0499	0	3.69 KB
#6221	`ObjectExtractorMoreComplexBody`	net472	3.73μs	4.69ns	18.2ns	0.602	0.00561	3.8 KB

Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EncodeArgs`	net6.0	37.4μs	20ns	75ns	0.448	0	32.4 KB
master	`EncodeArgs`	netcoreapp3.1	55.8μs	128ns	494ns	0.44	0	32.4 KB
master	`EncodeArgs`	net472	66.3μs	22.8ns	88.3ns	5.16	0.0662	32.5 KB
master	`EncodeLegacyArgs`	net6.0	75.8μs	417ns	2.43μs	0	0	2.14 KB
master	`EncodeLegacyArgs`	netcoreapp3.1	106μs	35.2ns	136ns	0	0	2.14 KB
master	`EncodeLegacyArgs`	net472	154μs	35.8ns	124ns	0.308	0	2.15 KB
#6221	`EncodeArgs`	net6.0	39.3μs	64.1ns	231ns	0.445	0	32.4 KB
#6221	`EncodeArgs`	netcoreapp3.1	54.4μs	35.4ns	132ns	0.434	0	32.4 KB
#6221	`EncodeArgs`	net472	65.7μs	30.5ns	118ns	5.16	0.0657	32.5 KB
#6221	`EncodeLegacyArgs`	net6.0	82.1μs	96.1ns	360ns	0	0	2.14 KB
#6221	`EncodeLegacyArgs`	netcoreapp3.1	104μs	58.5ns	227ns	0	0	2.14 KB
#6221	`EncodeLegacyArgs`	net472	156μs	51.2ns	198ns	0.31	0	2.15 KB

Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunWafRealisticBenchmark`	net6.0	187μs	155ns	600ns	0	2.44 KB
master	`RunWafRealisticBenchmark`	netcoreapp3.1	199μs	193ns	746ns	0	2.39 KB
master	`RunWafRealisticBenchmark`	net472	210μs	131ns	507ns	0.314	2.46 KB
master	`RunWafRealisticBenchmarkWithAttack`	net6.0	123μs	95ns	368ns	0	1.47 KB
master	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	131μs	228ns	884ns	0	1.46 KB
master	`RunWafRealisticBenchmarkWithAttack`	net472	139μs	82.1ns	318ns	0.208	1.48 KB
#6221	`RunWafRealisticBenchmark`	net6.0	185μs	137ns	531ns	0	2.44 KB
#6221	`RunWafRealisticBenchmark`	netcoreapp3.1	196μs	155ns	600ns	0	2.39 KB
#6221	`RunWafRealisticBenchmark`	net472	211μs	85.4ns	319ns	0.315	2.46 KB
#6221	`RunWafRealisticBenchmarkWithAttack`	net6.0	124μs	61.7ns	239ns	0	1.47 KB
#6221	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	131μs	112ns	433ns	0	1.46 KB
#6221	`RunWafRealisticBenchmarkWithAttack`	net472	140μs	78.5ns	304ns	0.209	1.49 KB

Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ More allocations ⚠️

More allocations ⚠️ in #6221

Benchmark	Base Allocated	Diff Allocated	Change	Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑net472	57.34 KB	62.21 KB	4.86 KB	8.48%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0	253.15 KB	265.54 KB	12.39 KB	4.90%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1	253.34 KB	261.8 KB	8.46 KB	3.34%

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Allocated
master	`StringConcatBenchmark`	net6.0	53.1μs	273ns	1.31μs	43.44 KB
master	`StringConcatBenchmark`	netcoreapp3.1	62.3μs	812ns	8.12μs	42.64 KB
master	`StringConcatBenchmark`	net472	37.5μs	104ns	388ns	57.34 KB
master	`StringConcatAspectBenchmark`	net6.0	303μs	1.7μs	11.2μs	253.15 KB
master	`StringConcatAspectBenchmark`	netcoreapp3.1	343μs	1.96μs	14.4μs	253.34 KB
master	`StringConcatAspectBenchmark`	net472	280μs	6.28μs	61.2μs	278.53 KB
#6221	`StringConcatBenchmark`	net6.0	52.4μs	235ns	879ns	43.44 KB
#6221	`StringConcatBenchmark`	netcoreapp3.1	54.6μs	289ns	1.42μs	42.64 KB
#6221	`StringConcatBenchmark`	net472	37.7μs	87.1ns	314ns	62.21 KB
#6221	`StringConcatAspectBenchmark`	net6.0	320μs	1.79μs	11.5μs	265.54 KB
#6221	`StringConcatAspectBenchmark`	netcoreapp3.1	335μs	1.81μs	11.3μs	261.8 KB
#6221	`StringConcatAspectBenchmark`	net472	266μs	5.75μs	54.9μs	278.53 KB

NachoEchevarria · 2024-11-05T13:52:51Z

Thanks for you reviews!

Restrict RASP lfI operations to read

d024191

github-actions bot added the area:tracer The core tracer library (Datadog.Trace, does not include OpenTracing, native code, or integrations) label Oct 30, 2024

Update autegenerated files

362971d

NachoEchevarria changed the title ~~Restrict RASP lfI operations to read~~ [ASM] Restrict RASP Lfi operations to read operation only Oct 31, 2024

NachoEchevarria added the area:asm label Oct 31, 2024

Merge branch 'master' into nacho/RestrictRaspToFileRead

6b9b509

NachoEchevarria marked this pull request as ready for review November 4, 2024 13:47

NachoEchevarria requested review from a team as code owners November 4, 2024 13:47

NachoEchevarria added 2 commits November 4, 2024 14:49

Update FileAspect.cs

e15c0c7

Merge branch 'master' into nacho/RestrictRaspToFileRead

6946c17

lucaspimentel approved these changes Nov 4, 2024

View reviewed changes

robertpi approved these changes Nov 5, 2024

View reviewed changes

NachoEchevarria merged commit d7f025c into master Nov 5, 2024
78 checks passed

NachoEchevarria deleted the nacho/RestrictRaspToFileRead branch November 5, 2024 13:53

github-actions bot added this to the vNext-v3 milestone Nov 5, 2024

andrewlock added type:performance Performance, speed, latency, resource usage (CPU, memory) and removed area:tracer The core tracer library (Datadog.Trace, does not include OpenTracing, native code, or integrations) labels Nov 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ASM] Restrict RASP Lfi operations to read operation only #6221

[ASM] Restrict RASP Lfi operations to read operation only #6221

NachoEchevarria commented Oct 30, 2024 •

edited

Loading

datadog-ddstaging bot commented Oct 30, 2024 •

edited

Loading

andrewlock commented Oct 30, 2024 •

edited

Loading

andrewlock commented Oct 30, 2024 •

edited

Loading

Slower ⚠️ in #6221

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Faster 🎉 in #6221

Raw results

Raw results

andrewlock commented Oct 30, 2024 •

edited

Loading

andrewlock commented Oct 31, 2024 •

edited

Loading

Faster 🎉 in #6221

Raw results

Raw results

Raw results

More allocations ⚠️ in #6221

Raw results

NachoEchevarria commented Nov 5, 2024

[ASM] Restrict RASP Lfi operations to read operation only #6221

[ASM] Restrict RASP Lfi operations to read operation only #6221

Conversation

NachoEchevarria commented Oct 30, 2024 • edited Loading

Summary of changes

Reason for change

Implementation details

Test coverage

Other details

datadog-ddstaging bot commented Oct 30, 2024 • edited Loading

Datadog Report

New Flaky Tests (1)

⌛ Performance Regressions vs Default Branch (2)

andrewlock commented Oct 30, 2024 • edited Loading

Execution-Time Benchmarks Report ⏱️

andrewlock commented Oct 30, 2024 • edited Loading

Benchmarks Report for tracer 🐌

Benchmark details

Slower ⚠️ in #6221

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Faster 🎉 in #6221

Raw results

Raw results

andrewlock commented Oct 30, 2024 • edited Loading

Throughput/Crank Report ⚡

andrewlock commented Oct 31, 2024 • edited Loading

Benchmarks Report for appsec 🐌

Benchmark details

Faster 🎉 in #6221

Raw results

Raw results

Raw results

More allocations ⚠️ in #6221

Raw results

NachoEchevarria commented Nov 5, 2024

NachoEchevarria commented Oct 30, 2024 •

edited

Loading

datadog-ddstaging bot commented Oct 30, 2024 •

edited

Loading

andrewlock commented Oct 30, 2024 •

edited

Loading

andrewlock commented Oct 30, 2024 •

edited

Loading

andrewlock commented Oct 30, 2024 •

edited

Loading

andrewlock commented Oct 31, 2024 •

edited

Loading