[ASM] iast: Fix Microsoft.Data.Sqlite database tainting#6295
Conversation
Snapshots difference summaryThe following differences have been observed in committed snapshots. It is meant to help the reviewer. 1 occurrences of : - http.url: http://localhost:00000/Iast/StoredSqli,
+ http.url: http://localhost:00000/Iast/StoredSqli?useMicrosoftDataDb=...,
1 occurrences of : - http.url: http://localhost:00000/Iast/StoredXss?param=%3Cb%3ERawValue%3C/b%3E,
+ http.url: http://localhost:00000/Iast/StoredXss?param=%3Cb%3ERawValue%3C/b%3E&useMicrosoftDataDb=...,
1 occurrences of : - http.url: http://localhost:00000/Iast/StoredXssEscaped,
+ http.url: http://localhost:00000/Iast/StoredXssEscaped?useMicrosoftDataDb=...,
|
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing the following branches/commits: Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6295) - mean (71ms) : 65, 78
. : milestone, 71,
master - mean (71ms) : 64, 78
. : milestone, 71,
section CallTarget+Inlining+NGEN
This PR (6295) - mean (1,110ms) : 1085, 1134
. : milestone, 1110,
master - mean (1,110ms) : 1093, 1127
. : milestone, 1110,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6295) - mean (108ms) : 106, 110
. : milestone, 108,
master - mean (109ms) : 105, 112
. : milestone, 109,
section CallTarget+Inlining+NGEN
This PR (6295) - mean (768ms) : 754, 782
. : milestone, 768,
master - mean (765ms) : 749, 781
. : milestone, 765,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6295) - mean (92ms) : 90, 94
. : milestone, 92,
master - mean (92ms) : 90, 94
. : milestone, 92,
section CallTarget+Inlining+NGEN
This PR (6295) - mean (721ms) : 708, 733
. : milestone, 721,
master - mean (726ms) : 709, 742
. : milestone, 726,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6295) - mean (190ms) : 186, 194
. : milestone, 190,
master - mean (192ms) : 186, 197
. : milestone, 192,
section CallTarget+Inlining+NGEN
This PR (6295) - mean (1,213ms) : 1191, 1234
. : milestone, 1213,
master - mean (1,213ms) : 1188, 1238
. : milestone, 1213,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6295) - mean (276ms) : 272, 281
. : milestone, 276,
master - mean (277ms) : 272, 282
. : milestone, 277,
section CallTarget+Inlining+NGEN
This PR (6295) - mean (939ms) : 920, 958
. : milestone, 939,
master - mean (945ms) : 923, 968
. : milestone, 945,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6295) - mean (265ms) : 260, 270
. : milestone, 265,
master - mean (266ms) : 262, 270
. : milestone, 266,
section CallTarget+Inlining+NGEN
This PR (6295) - mean (920ms) : 898, 941
. : milestone, 920,
master - mean (930ms) : 910, 950
. : milestone, 930,
|
Datadog ReportBranch report: ❌ 6 Failed (0 Known Flaky), 453518 Passed, 2745 Skipped, 20h 21m 34.28s Total Time ❌ Failed Tests (6)
|
Throughput/Crank Report ⚡Throughput results for AspNetCoreSimpleController comparing the following branches/commits: Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red. Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards! gantt
title Throughput Linux x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6295) (11.201M) : 0, 11200848
master (11.155M) : 0, 11154721
benchmarks/2.9.0 (11.033M) : 0, 11032866
section Automatic
This PR (6295) (7.234M) : 0, 7234172
master (7.297M) : 0, 7297200
benchmarks/2.9.0 (7.786M) : 0, 7785853
section Trace stats
master (7.684M) : 0, 7684145
section Manual
master (11.069M) : 0, 11068901
section Manual + Automatic
This PR (6295) (6.775M) : 0, 6775118
master (6.786M) : 0, 6785523
section DD_TRACE_ENABLED=0
master (10.249M) : 0, 10249493
gantt
title Throughput Linux arm64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6295) (9.456M) : 0, 9455807
master (9.602M) : 0, 9601778
benchmarks/2.9.0 (9.495M) : 0, 9494821
section Automatic
This PR (6295) (6.315M) : 0, 6314721
master (6.210M) : 0, 6209560
section Trace stats
master (6.728M) : 0, 6728350
section Manual
master (9.437M) : 0, 9436743
section Manual + Automatic
This PR (6295) (6.104M) : 0, 6103551
master (5.810M) : 0, 5809535
section DD_TRACE_ENABLED=0
master (8.705M) : 0, 8705485
gantt
title Throughput Windows x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6295) (10.082M) : 0, 10082011
master (10.329M) : 0, 10328534
benchmarks/2.9.0 (10.020M) : 0, 10019592
section Automatic
This PR (6295) (6.602M) : 0, 6601902
master (6.617M) : 0, 6616689
benchmarks/2.9.0 (7.255M) : 0, 7255257
section Trace stats
master (7.166M) : 0, 7165623
section Manual
master (10.093M) : 0, 10093300
section Manual + Automatic
This PR (6295) (6.257M) : 0, 6257009
master (6.311M) : 0, 6310782
section DD_TRACE_ENABLED=0
master (9.459M) : 0, 9459125
|
86e5c95 to
9411f11
Compare
Microsoft.Data.Sqlite database taintingMicrosoft.Data.Sqlite database tainting
dromanol
left a comment
There was a problem hiding this comment.
Good catch. Thanks a lot
Benchmarks Report for tracer 🐌Benchmarks for #6295 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ More allocations
|
| Benchmark | Base Allocated | Diff Allocated | Change | Change % |
|---|---|---|---|---|
| Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces‑netcoreapp3.1 | 41.74 KB | 41.97 KB | 235 B | 0.56% |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | WriteAndFlushEnrichedTraces |
net6.0 | 562μs | 2.69μs | 10.4μs | 0.571 | 0 | 0 | 41.58 KB |
| master | WriteAndFlushEnrichedTraces |
netcoreapp3.1 | 666μs | 2.83μs | 10.9μs | 0.34 | 0 | 0 | 41.74 KB |
| master | WriteAndFlushEnrichedTraces |
net472 | 881μs | 3.68μs | 15.2μs | 8.3 | 2.62 | 0.437 | 53.33 KB |
| #6295 | WriteAndFlushEnrichedTraces |
net6.0 | 544μs | 2.6μs | 10.4μs | 0.561 | 0 | 0 | 41.56 KB |
| #6295 | WriteAndFlushEnrichedTraces |
netcoreapp3.1 | 676μs | 3.48μs | 17.7μs | 0.322 | 0 | 0 | 41.97 KB |
| #6295 | WriteAndFlushEnrichedTraces |
net472 | 857μs | 3.99μs | 15.9μs | 8.13 | 2.57 | 0.428 | 53.32 KB |
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | ExecuteNonQuery |
net6.0 | 1.29μs | 1.43ns | 5.53ns | 0.0144 | 0 | 0 | 1.02 KB |
| master | ExecuteNonQuery |
netcoreapp3.1 | 1.71μs | 1.04ns | 3.88ns | 0.0138 | 0 | 0 | 1.02 KB |
| master | ExecuteNonQuery |
net472 | 1.96μs | 1.3ns | 4.88ns | 0.157 | 0.000986 | 0 | 987 B |
| #6295 | ExecuteNonQuery |
net6.0 | 1.24μs | 1.12ns | 4.32ns | 0.0143 | 0 | 0 | 1.02 KB |
| #6295 | ExecuteNonQuery |
netcoreapp3.1 | 1.8μs | 1.31ns | 4.92ns | 0.0134 | 0 | 0 | 1.02 KB |
| #6295 | ExecuteNonQuery |
net472 | 2.11μs | 9.87ns | 47.3ns | 0.156 | 0.00103 | 0 | 987 B |
Benchmarks.Trace.ElasticsearchBenchmark - Slower ⚠️ Same allocations ✔️
Slower ⚠️ in #6295
Benchmark
diff/base
Base Median (ns)
Diff Median (ns)
Modality
Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch‑net6.0
1.187
1,091.05
1,295.11
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearch‑net6.0 | 1.187 | 1,091.05 | 1,295.11 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | CallElasticsearch |
net6.0 | 1.09μs | 0.612ns | 2.29ns | 0.0133 | 0 | 0 | 976 B |
| master | CallElasticsearch |
netcoreapp3.1 | 1.58μs | 1.8ns | 6.73ns | 0.0126 | 0 | 0 | 976 B |
| master | CallElasticsearch |
net472 | 2.46μs | 1.82ns | 6.83ns | 0.158 | 0 | 0 | 995 B |
| master | CallElasticsearchAsync |
net6.0 | 1.3μs | 0.306ns | 1.14ns | 0.013 | 0 | 0 | 952 B |
| master | CallElasticsearchAsync |
netcoreapp3.1 | 1.59μs | 0.901ns | 3.49ns | 0.0134 | 0 | 0 | 1.02 KB |
| master | CallElasticsearchAsync |
net472 | 2.58μs | 1.45ns | 5.62ns | 0.167 | 0 | 0 | 1.05 KB |
| #6295 | CallElasticsearch |
net6.0 | 1.3μs | 0.504ns | 1.89ns | 0.0139 | 0 | 0 | 976 B |
| #6295 | CallElasticsearch |
netcoreapp3.1 | 1.62μs | 1.1ns | 4.25ns | 0.0134 | 0 | 0 | 976 B |
| #6295 | CallElasticsearch |
net472 | 2.61μs | 2.18ns | 8.14ns | 0.157 | 0 | 0 | 995 B |
| #6295 | CallElasticsearchAsync |
net6.0 | 1.37μs | 1.47ns | 5.52ns | 0.0138 | 0 | 0 | 952 B |
| #6295 | CallElasticsearchAsync |
netcoreapp3.1 | 1.6μs | 0.603ns | 2.25ns | 0.0137 | 0 | 0 | 1.02 KB |
| #6295 | CallElasticsearchAsync |
net472 | 2.51μs | 1.26ns | 4.87ns | 0.166 | 0 | 0 | 1.05 KB |
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | ExecuteAsync |
net6.0 | 1.24μs | 0.489ns | 1.83ns | 0.0132 | 0 | 0 | 952 B |
| master | ExecuteAsync |
netcoreapp3.1 | 1.59μs | 0.665ns | 2.4ns | 0.0127 | 0 | 0 | 952 B |
| master | ExecuteAsync |
net472 | 1.87μs | 0.602ns | 2.33ns | 0.145 | 0 | 0 | 915 B |
| #6295 | ExecuteAsync |
net6.0 | 1.21μs | 0.739ns | 2.77ns | 0.0133 | 0 | 0 | 952 B |
| #6295 | ExecuteAsync |
netcoreapp3.1 | 1.63μs | 0.374ns | 1.4ns | 0.0124 | 0 | 0 | 952 B |
| #6295 | ExecuteAsync |
net472 | 1.8μs | 0.561ns | 2.1ns | 0.145 | 0 | 0 | 915 B |
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | SendAsync |
net6.0 | 4.33μs | 1.68ns | 6.49ns | 0.0325 | 0 | 0 | 2.31 KB |
| master | SendAsync |
netcoreapp3.1 | 5.43μs | 2.45ns | 9.18ns | 0.0384 | 0 | 0 | 2.85 KB |
| master | SendAsync |
net472 | 7.31μs | 1.31ns | 4.53ns | 0.493 | 0 | 0 | 3.12 KB |
| #6295 | SendAsync |
net6.0 | 4.34μs | 2.36ns | 8.82ns | 0.0326 | 0 | 0 | 2.31 KB |
| #6295 | SendAsync |
netcoreapp3.1 | 5.33μs | 1.18ns | 4.57ns | 0.0375 | 0 | 0 | 2.85 KB |
| #6295 | SendAsync |
net472 | 7.36μs | 2ns | 7.75ns | 0.494 | 0 | 0 | 3.12 KB |
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | EnrichedLog |
net6.0 | 1.55μs | 7.37ns | 28.6ns | 0.0231 | 0 | 0 | 1.64 KB |
| master | EnrichedLog |
netcoreapp3.1 | 2.22μs | 1.78ns | 6.9ns | 0.0221 | 0 | 0 | 1.64 KB |
| master | EnrichedLog |
net472 | 2.71μs | 0.906ns | 3.51ns | 0.249 | 0 | 0 | 1.57 KB |
| #6295 | EnrichedLog |
net6.0 | 1.52μs | 1.16ns | 4.34ns | 0.0227 | 0 | 0 | 1.64 KB |
| #6295 | EnrichedLog |
netcoreapp3.1 | 2.23μs | 1.24ns | 4.81ns | 0.0223 | 0 | 0 | 1.64 KB |
| #6295 | EnrichedLog |
net472 | 2.56μs | 1.31ns | 4.89ns | 0.25 | 0 | 0 | 1.57 KB |
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | EnrichedLog |
net6.0 | 119μs | 115ns | 429ns | 0 | 0 | 0 | 4.28 KB |
| master | EnrichedLog |
netcoreapp3.1 | 125μs | 229ns | 888ns | 0 | 0 | 0 | 4.28 KB |
| master | EnrichedLog |
net472 | 153μs | 128ns | 496ns | 0.69 | 0.23 | 0 | 4.46 KB |
| #6295 | EnrichedLog |
net6.0 | 118μs | 320ns | 1.24μs | 0 | 0 | 0 | 4.28 KB |
| #6295 | EnrichedLog |
netcoreapp3.1 | 124μs | 176ns | 659ns | 0 | 0 | 0 | 4.28 KB |
| #6295 | EnrichedLog |
net472 | 152μs | 152ns | 589ns | 0.683 | 0.228 | 0 | 4.46 KB |
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | EnrichedLog |
net6.0 | 3.01μs | 1.27ns | 4.91ns | 0.0301 | 0 | 0 | 2.2 KB |
| master | EnrichedLog |
netcoreapp3.1 | 4.13μs | 4.47ns | 17.3ns | 0.0288 | 0 | 0 | 2.2 KB |
| master | EnrichedLog |
net472 | 4.82μs | 1.69ns | 6.56ns | 0.32 | 0 | 0 | 2.02 KB |
| #6295 | EnrichedLog |
net6.0 | 3.05μs | 1.17ns | 4.54ns | 0.0305 | 0 | 0 | 2.2 KB |
| #6295 | EnrichedLog |
netcoreapp3.1 | 4.07μs | 1.3ns | 4.7ns | 0.0306 | 0 | 0 | 2.2 KB |
| #6295 | EnrichedLog |
net472 | 4.91μs | 1.22ns | 4.57ns | 0.319 | 0 | 0 | 2.02 KB |
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | SendReceive |
net6.0 | 1.37μs | 0.784ns | 3.04ns | 0.0158 | 0 | 0 | 1.14 KB |
| master | SendReceive |
netcoreapp3.1 | 1.78μs | 4.34ns | 16.3ns | 0.0157 | 0 | 0 | 1.14 KB |
| master | SendReceive |
net472 | 1.96μs | 1.16ns | 4.49ns | 0.183 | 0 | 0 | 1.16 KB |
| #6295 | SendReceive |
net6.0 | 1.32μs | 1.25ns | 4.86ns | 0.0159 | 0 | 0 | 1.14 KB |
| #6295 | SendReceive |
netcoreapp3.1 | 1.81μs | 0.916ns | 3.43ns | 0.0152 | 0 | 0 | 1.14 KB |
| #6295 | SendReceive |
net472 | 2.1μs | 1.38ns | 5.33ns | 0.183 | 0 | 0 | 1.16 KB |
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | EnrichedLog |
net6.0 | 2.62μs | 0.798ns | 3.09ns | 0.0223 | 0 | 0 | 1.6 KB |
| master | EnrichedLog |
netcoreapp3.1 | 3.96μs | 2.07ns | 7.76ns | 0.0218 | 0 | 0 | 1.65 KB |
| master | EnrichedLog |
net472 | 4.38μs | 2.2ns | 8.52ns | 0.322 | 0 | 0 | 2.04 KB |
| #6295 | EnrichedLog |
net6.0 | 2.75μs | 1.16ns | 4.48ns | 0.022 | 0 | 0 | 1.6 KB |
| #6295 | EnrichedLog |
netcoreapp3.1 | 3.89μs | 3ns | 11.6ns | 0.0214 | 0 | 0 | 1.65 KB |
| #6295 | EnrichedLog |
net472 | 4.3μs | 1.48ns | 5.35ns | 0.323 | 0 | 0 | 2.04 KB |
Benchmarks.Trace.SpanBenchmark - Faster 🎉 Same allocations ✔️
Faster 🎉 in #6295
Benchmark
base/diff
Base Median (ns)
Diff Median (ns)
Modality
Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net6.0
1.134
454.05
400.41
| Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net6.0 | 1.134 | 454.05 | 400.41 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StartFinishSpan |
net6.0 | 454ns | 0.303ns | 1.17ns | 0.00815 | 0 | 0 | 576 B |
| master | StartFinishSpan |
netcoreapp3.1 | 566ns | 0.425ns | 1.65ns | 0.00774 | 0 | 0 | 576 B |
| master | StartFinishSpan |
net472 | 628ns | 1.12ns | 4.32ns | 0.0917 | 0 | 0 | 578 B |
| master | StartFinishScope |
net6.0 | 491ns | 0.488ns | 1.89ns | 0.00965 | 0 | 0 | 696 B |
| master | StartFinishScope |
netcoreapp3.1 | 714ns | 0.597ns | 2.31ns | 0.00955 | 0 | 0 | 696 B |
| master | StartFinishScope |
net472 | 916ns | 1.2ns | 4.64ns | 0.104 | 0 | 0 | 658 B |
| #6295 | StartFinishSpan |
net6.0 | 400ns | 0.374ns | 1.45ns | 0.00804 | 0 | 0 | 576 B |
| #6295 | StartFinishSpan |
netcoreapp3.1 | 623ns | 0.427ns | 1.65ns | 0.00774 | 0 | 0 | 576 B |
| #6295 | StartFinishSpan |
net472 | 621ns | 0.934ns | 3.62ns | 0.0916 | 0 | 0 | 578 B |
| #6295 | StartFinishScope |
net6.0 | 481ns | 0.501ns | 1.94ns | 0.00975 | 0 | 0 | 696 B |
| #6295 | StartFinishScope |
netcoreapp3.1 | 680ns | 0.548ns | 2.12ns | 0.00947 | 0 | 0 | 696 B |
| #6295 | StartFinishScope |
net472 | 901ns | 0.781ns | 2.92ns | 0.104 | 0 | 0 | 658 B |
Benchmarks.Trace.TraceAnnotationsBenchmark - Faster 🎉 Same allocations ✔️
Faster 🎉 in #6295
Benchmark
base/diff
Base Median (ns)
Diff Median (ns)
Modality
Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑netcoreapp3.1
1.150
1,007.16
876.12
| Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑netcoreapp3.1 | 1.150 | 1,007.16 | 876.12 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | RunOnMethodBegin |
net6.0 | 595ns | 0.655ns | 2.54ns | 0.00989 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
netcoreapp3.1 | 1.01μs | 1.39ns | 5.39ns | 0.00919 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
net472 | 1.11μs | 1.23ns | 4.78ns | 0.105 | 0 | 0 | 658 B |
| #6295 | RunOnMethodBegin |
net6.0 | 644ns | 0.575ns | 2.23ns | 0.00972 | 0 | 0 | 696 B |
| #6295 | RunOnMethodBegin |
netcoreapp3.1 | 877ns | 0.913ns | 3.42ns | 0.00925 | 0 | 0 | 696 B |
| #6295 | RunOnMethodBegin |
net472 | 1.06μs | 1.13ns | 4.09ns | 0.105 | 0 | 0 | 658 B |
9411f11 to
b67d03d
Compare
5b3f184 to
ba0a872
Compare
1cecea3 to
65ef423
Compare
Summary of changes
The instrumentation introduced for tainting values coming from database was incorrect for
Microsoft.Data.Sqlite.A typo was introduced in the name
Microsoft.Data.Sqlite.SqliteDataReader, thus making the instrumentation fail.Instrumentations now use the latest dotnet version supported (here dotnet 9)
Test coverage
Tests on database tainting such as Stored XSS or Stored SQLI has been updated to also create an SQLite connection using
Microsoft.Data.Sqlitewhile also keeping theSystem.Data.SQLiteconnection.Other details
Original implementation PR: #5804