Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(wsgi): remove some appsec code from wsgi contrib #6326

Merged
merged 80 commits into from
Jul 17, 2023

Conversation

emmettbutler
Copy link
Collaborator

@emmettbutler emmettbutler commented Jul 11, 2023

This change adjusts the flask_block callback-setting logic to use the Core API rather than the AppSec-specific set_value call it had used previously.

In the case of request blocking, the separation of concerns ideally breaks down as follows. The AppSec Product code in the ddtrace/appsec directory knows how to make a block/don't block decision based on communication with libddwaf. The Wsgi code in ddtrace/contrib knows how to take that blocking decision into account when processing requests.

Checklist

  • Change(s) are motivated and described in the PR description.
  • Testing strategy is described if automated tests are not included in the PR.
  • Risk is outlined (performance impact, potential for breakage, maintainability, etc).
  • Change is maintainable (easy to change, telemetry, documentation).
  • Library release note guidelines are followed. If no release note is required, add label changelog/no-changelog.
  • Documentation is included (in-code, generated user docs, public corp docs).
  • Backport labels are set (if applicable)

Reviewer Checklist

  • Title is accurate.
  • No unnecessary changes are introduced.
  • Description motivates each change.
  • Avoids breaking API changes unless absolutely necessary.
  • Testing strategy adequately addresses listed risk(s).
  • Change is maintainable (easy to change, telemetry, documentation).
  • Release note makes sense to a user of the library.
  • Reviewer has explicitly acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment.
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

…on a context that still exists by the time the test assertion runs
explicitly set expected config because config can leak between tests
…atibility with tests that rely on the root span continuing to exist
@emmettbutler emmettbutler requested review from tabgok and removed request for a team July 11, 2023 15:41
@emmettbutler emmettbutler marked this pull request as draft July 11, 2023 16:06
Base automatically changed from emmett.butler/core-api to 1.x July 12, 2023 15:43
@emmettbutler emmettbutler marked this pull request as ready for review July 12, 2023 18:20
@emmettbutler emmettbutler added the ASM Application Security Monitoring label Jul 12, 2023
juanjux
juanjux previously approved these changes Jul 13, 2023
@emmettbutler emmettbutler enabled auto-merge (squash) July 13, 2023 15:18
@pr-commenter
Copy link

pr-commenter bot commented Jul 13, 2023

Benchmarks

Comparing candidate commit 2947218 in PR branch emmett.butler/wsgi-no-appsec with baseline commit a0803f9 in branch 1.x.

Found 1 performance improvements and 0 performance regressions! Performance is the same for 93 cases.

scenario:flasksimple-appsec-get

  • 🟩 execution_time [-0.317ms; -0.295ms] or [-5.035%; -4.689%]

@emmettbutler emmettbutler merged commit 9a3693f into 1.x Jul 17, 2023
20 of 23 checks passed
@emmettbutler emmettbutler deleted the emmett.butler/wsgi-no-appsec branch July 17, 2023 22:35
@github-actions github-actions bot added this to the v1.18.0 milestone Jul 17, 2023
romainkomorndatadog pushed a commit that referenced this pull request Aug 8, 2023
This change adjusts the `flask_block` callback-setting logic to use the
Core API rather than the AppSec-specific `set_value` call it had used
previously.

In the case of request blocking, the separation of concerns ideally
breaks down as follows. The AppSec Product code in the `ddtrace/appsec`
directory knows how to make a block/don't block decision based on
communication with libddwaf. The Wsgi code in `ddtrace/contrib` knows
how to take that blocking decision into account when processing
requests.

## Checklist

- [x] Change(s) are motivated and described in the PR description.
- [x] Testing strategy is described if automated tests are not included
in the PR.
- [x] Risk is outlined (performance impact, potential for breakage,
maintainability, etc).
- [x] Change is maintainable (easy to change, telemetry, documentation).
- [x] [Library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
are followed. If no release note is required, add label
`changelog/no-changelog`.
- [x] Documentation is included (in-code, generated user docs, [public
corp docs](https://github.com/DataDog/documentation/)).
- [x] Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

## Reviewer Checklist

- [ ] Title is accurate.
- [ ] No unnecessary changes are introduced.
- [ ] Description motivates each change.
- [ ] Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes unless absolutely necessary.
- [ ] Testing strategy adequately addresses listed risk(s).
- [ ] Change is maintainable (easy to change, telemetry, documentation).
- [ ] Release note makes sense to a user of the library.
- [ ] Reviewer has explicitly acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment.
- [ ] Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

---------

Co-authored-by: Federico Mon <federico.mon@datadoghq.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ASM Application Security Monitoring changelog/no-changelog A changelog entry is not required for this PR.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants