Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sql injection Exploit Prevention implementation for mysql2 library #4712

Merged
merged 9 commits into from
Oct 4, 2024

Conversation

uurien
Copy link
Collaborator

@uurien uurien commented Sep 20, 2024

What does this PR do?

Instrument new methods in mysql2 to be able to detect the exploit when we are in a stack with app code. We need to have app code file and line in the stack to be able to share the exploited line.
In these new points, we support abortcontroller to stop sql execution when a exploit is detected.

Motivation

Detect and stop sql injection attacks.

Checklist

  • Unit tests.

Additional Notes

Copy link

github-actions bot commented Sep 20, 2024

Overall package size

Self size: 7.25 MB
Deduped: 62.65 MB
No deduping: 62.93 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | @datadog/native-appsec | 8.1.1 | 18.67 MB | 18.68 MB | | @datadog/native-iast-taint-tracking | 3.1.0 | 12.27 MB | 12.28 MB | | @datadog/pprof | 5.3.0 | 9.85 MB | 10.22 MB | | protobufjs | 7.2.5 | 2.77 MB | 5.16 MB | | @datadog/native-iast-rewriter | 2.4.1 | 2.14 MB | 2.23 MB | | @opentelemetry/core | 1.14.0 | 872.87 kB | 1.47 MB | | @datadog/native-metrics | 2.0.0 | 898.77 kB | 1.3 MB | | @opentelemetry/api | 1.8.0 | 1.21 MB | 1.21 MB | | jsonpath-plus | 9.0.0 | 580.4 kB | 1.03 MB | | import-in-the-middle | 1.11.2 | 112.74 kB | 826.22 kB | | msgpack-lite | 0.1.26 | 201.16 kB | 281.59 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | pprof-format | 2.1.0 | 111.69 kB | 111.69 kB | | @datadog/sketches-js | 2.1.0 | 109.9 kB | 109.9 kB | | semver | 7.6.3 | 95.82 kB | 95.82 kB | | lodash.sortby | 4.7.0 | 75.76 kB | 75.76 kB | | lru-cache | 7.14.0 | 74.95 kB | 74.95 kB | | ignore | 5.3.1 | 51.46 kB | 51.46 kB | | int64-buffer | 0.1.10 | 49.18 kB | 49.18 kB | | shell-quote | 1.8.1 | 44.96 kB | 44.96 kB | | istanbul-lib-coverage | 3.2.0 | 29.34 kB | 29.34 kB | | rfdc | 1.3.1 | 25.21 kB | 25.21 kB | | tlhunter-sorted-set | 0.1.0 | 24.94 kB | 24.94 kB | | limiter | 1.1.5 | 23.17 kB | 23.17 kB | | dc-polyfill | 0.1.4 | 23.1 kB | 23.1 kB | | retry | 0.13.1 | 18.85 kB | 18.85 kB | | jest-docblock | 29.7.0 | 8.99 kB | 12.76 kB | | crypto-randomuuid | 1.0.0 | 11.18 kB | 11.18 kB | | koalas | 1.0.2 | 6.47 kB | 6.47 kB | | path-to-regexp | 0.1.10 | 6.38 kB | 6.38 kB | | module-details-from-path | 1.0.3 | 4.47 kB | 4.47 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@pr-commenter
Copy link

pr-commenter bot commented Sep 20, 2024

Benchmarks

Benchmark execution time: 2024-10-03 15:19:18

Comparing candidate commit 3d50c7d in PR branch ugaitz/rasp-sqli-mysql2 with baseline commit 470194a in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 260 metrics, 6 unstable metrics.

@uurien uurien force-pushed the ugaitz/rasp-sqli-mysql2 branch from ba9cc15 to 95b88fb Compare September 23, 2024 06:42
@uurien uurien force-pushed the ugaitz/rasp-sqli-mysql2 branch from 95b88fb to d09f6f9 Compare September 23, 2024 08:58
@@ -24,5 +24,6 @@ module.exports = {
setUncaughtExceptionCaptureCallbackStart: dc.channel('datadog:process:setUncaughtExceptionCaptureCallback:start'),
pgQueryStart: dc.channel('apm:pg:query:start'),
pgPoolQueryStart: dc.channel('datadog:pg:pool:query:start'),
mysql2OuterQueryStart: dc.channel('datadog:mysql2:outerquery:start'),
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Open for suggestions for a better name...

@uurien uurien marked this pull request as ready for review September 24, 2024 07:51
@uurien uurien requested review from a team as code owners September 24, 2024 07:51
@uurien uurien merged commit a00c9c8 into master Oct 4, 2024
194 checks passed
@uurien uurien deleted the ugaitz/rasp-sqli-mysql2 branch October 4, 2024 07:44
@bengl bengl mentioned this pull request Oct 16, 2024
@bengl bengl mentioned this pull request Oct 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants