[ASM] Fix NullReferenceException on HttpTransport get_StatusCode#6602
Conversation
df5f3bb to
14b5e2c
Compare
Datadog ReportBranch report: ✅ 0 Failed, 248121 Passed, 2421 Skipped, 19h 4m 20.67s Total Time |
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing the following branches/commits: Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6602) - mean (69ms) : 67, 71
. : milestone, 69,
master - mean (70ms) : 65, 74
. : milestone, 70,
section CallTarget+Inlining+NGEN
This PR (6602) - mean (992ms) : 969, 1014
. : milestone, 992,
master - mean (991ms) : 973, 1009
. : milestone, 991,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6602) - mean (102ms) : 100, 105
. : milestone, 102,
master - mean (102ms) : 100, 104
. : milestone, 102,
section CallTarget+Inlining+NGEN
This PR (6602) - mean (670ms) : 654, 685
. : milestone, 670,
master - mean (670ms) : 654, 686
. : milestone, 670,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6602) - mean (90ms) : 88, 91
. : milestone, 90,
master - mean (90ms) : 88, 92
. : milestone, 90,
section CallTarget+Inlining+NGEN
This PR (6602) - mean (624ms) : 605, 644
. : milestone, 624,
master - mean (633ms) : 614, 651
. : milestone, 633,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6602) - mean (190ms) : 187, 193
. : milestone, 190,
master - mean (190ms) : 185, 195
. : milestone, 190,
section CallTarget+Inlining+NGEN
This PR (6602) - mean (1,100ms) : 1077, 1124
. : milestone, 1100,
master - mean (1,100ms) : 1071, 1130
. : milestone, 1100,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6602) - mean (269ms) : 266, 273
. : milestone, 269,
master - mean (269ms) : 265, 273
. : milestone, 269,
section CallTarget+Inlining+NGEN
This PR (6602) - mean (861ms) : 831, 891
. : milestone, 861,
master - mean (862ms) : 829, 894
. : milestone, 862,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6602) - mean (262ms) : 258, 266
. : milestone, 262,
master - mean (261ms) : 257, 266
. : milestone, 261,
section CallTarget+Inlining+NGEN
This PR (6602) - mean (839ms) : 813, 866
. : milestone, 839,
master - mean (846ms) : 817, 875
. : milestone, 846,
|
Benchmarks Report for appsec 🐌Benchmarks for #6602 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.Asm.AppSecBodyBenchmark - Slower
|
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody‑net6.0 | 1.344 | 140.41 | 188.78 | |
| Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody‑net472 | 1.187 | 165.77 | 196.80 | |
| Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleMoreComplexBody‑net472 | 1.138 | 276,278.98 | 314,449.82 |
| Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody‑net472 | 1.187 | 4,306.18 | 3,628.67 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | AllCycleSimpleBody |
net6.0 | 205μs | 90.1ns | 349ns | 2.66 | 0 | 0 | 188.88 KB |
| master | AllCycleSimpleBody |
netcoreapp3.1 | 303μs | 170ns | 658ns | 2.69 | 0 | 0 | 196.21 KB |
| master | AllCycleSimpleBody |
net472 | 269μs | 175ns | 678ns | 35.8 | 2.01 | 0 | 226.09 KB |
| master | AllCycleMoreComplexBody |
net6.0 | 210μs | 75.4ns | 292ns | 2.74 | 0 | 0 | 192.38 KB |
| master | AllCycleMoreComplexBody |
netcoreapp3.1 | 319μs | 90.1ns | 337ns | 2.7 | 0 | 0 | 199.62 KB |
| master | AllCycleMoreComplexBody |
net472 | 276μs | 178ns | 690ns | 36.4 | 2.06 | 0 | 229.6 KB |
| master | ObjectExtractorSimpleBody |
net6.0 | 140ns | 0.135ns | 0.504ns | 0.00398 | 0 | 0 | 280 B |
| master | ObjectExtractorSimpleBody |
netcoreapp3.1 | 196ns | 0.155ns | 0.599ns | 0.00373 | 0 | 0 | 272 B |
| master | ObjectExtractorSimpleBody |
net472 | 166ns | 0.0964ns | 0.348ns | 0.0446 | 0 | 0 | 281 B |
| master | ObjectExtractorMoreComplexBody |
net6.0 | 2.97μs | 1.93ns | 7.2ns | 0.0536 | 0 | 0 | 3.78 KB |
| master | ObjectExtractorMoreComplexBody |
netcoreapp3.1 | 3.91μs | 1.93ns | 7.24ns | 0.0488 | 0 | 0 | 3.69 KB |
| master | ObjectExtractorMoreComplexBody |
net472 | 4.31μs | 2.94ns | 11.4ns | 0.603 | 0.00646 | 0 | 3.8 KB |
| #6602 | AllCycleSimpleBody |
net6.0 | 202μs | 164ns | 634ns | 2.63 | 0 | 0 | 188.88 KB |
| #6602 | AllCycleSimpleBody |
netcoreapp3.1 | 310μs | 161ns | 602ns | 2.63 | 0 | 0 | 196.21 KB |
| #6602 | AllCycleSimpleBody |
net472 | 272μs | 334ns | 1.29μs | 35.8 | 2.03 | 0 | 226.09 KB |
| #6602 | AllCycleMoreComplexBody |
net6.0 | 212μs | 54.2ns | 203ns | 2.76 | 0 | 0 | 192.39 KB |
| #6602 | AllCycleMoreComplexBody |
netcoreapp3.1 | 316μs | 118ns | 443ns | 2.7 | 0 | 0 | 199.62 KB |
| #6602 | AllCycleMoreComplexBody |
net472 | 314μs | 757ns | 2.93μs | 36.4 | 2.07 | 0 | 229.6 KB |
| #6602 | ObjectExtractorSimpleBody |
net6.0 | 189ns | 0.0782ns | 0.303ns | 0.00394 | 0 | 0 | 280 B |
| #6602 | ObjectExtractorSimpleBody |
netcoreapp3.1 | 202ns | 0.412ns | 1.59ns | 0.0037 | 0 | 0 | 272 B |
| #6602 | ObjectExtractorSimpleBody |
net472 | 197ns | 0.286ns | 1.03ns | 0.0446 | 0 | 0 | 281 B |
| #6602 | ObjectExtractorMoreComplexBody |
net6.0 | 2.93μs | 1.22ns | 4.74ns | 0.0533 | 0 | 0 | 3.78 KB |
| #6602 | ObjectExtractorMoreComplexBody |
netcoreapp3.1 | 3.74μs | 2.38ns | 8.6ns | 0.0508 | 0 | 0 | 3.69 KB |
| #6602 | ObjectExtractorMoreComplexBody |
net472 | 3.63μs | 2.3ns | 8.93ns | 0.603 | 0.00548 | 0 | 3.8 KB |
Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | EncodeArgs |
net6.0 | 36.3μs | 15.6ns | 58.4ns | 0.455 | 0 | 0 | 32.4 KB |
| master | EncodeArgs |
netcoreapp3.1 | 54μs | 22.1ns | 85.8ns | 0.432 | 0 | 0 | 32.4 KB |
| master | EncodeArgs |
net472 | 66.4μs | 30ns | 112ns | 5.14 | 0.0663 | 0 | 32.5 KB |
| master | EncodeLegacyArgs |
net6.0 | 77.5μs | 42.7ns | 165ns | 0 | 0 | 0 | 2.14 KB |
| master | EncodeLegacyArgs |
netcoreapp3.1 | 108μs | 386ns | 1.49μs | 0 | 0 | 0 | 2.14 KB |
| master | EncodeLegacyArgs |
net472 | 153μs | 76.5ns | 286ns | 0.306 | 0 | 0 | 2.15 KB |
| #6602 | EncodeArgs |
net6.0 | 38.7μs | 15.2ns | 56.9ns | 0.46 | 0 | 0 | 32.4 KB |
| #6602 | EncodeArgs |
netcoreapp3.1 | 54.3μs | 15.9ns | 61.7ns | 0.434 | 0 | 0 | 32.4 KB |
| #6602 | EncodeArgs |
net472 | 66.2μs | 47.6ns | 184ns | 5.16 | 0.0658 | 0 | 32.5 KB |
| #6602 | EncodeLegacyArgs |
net6.0 | 74.6μs | 85.1ns | 330ns | 0 | 0 | 0 | 2.14 KB |
| #6602 | EncodeLegacyArgs |
netcoreapp3.1 | 105μs | 116ns | 448ns | 0 | 0 | 0 | 2.14 KB |
| #6602 | EncodeLegacyArgs |
net472 | 152μs | 126ns | 487ns | 0.306 | 0 | 0 | 2.15 KB |
Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | RunWafRealisticBenchmark |
net6.0 | 178μs | 29ns | 108ns | 0 | 0 | 0 | 2.54 KB |
| master | RunWafRealisticBenchmark |
netcoreapp3.1 | 185μs | 85ns | 329ns | 0 | 0 | 0 | 2.49 KB |
| master | RunWafRealisticBenchmark |
net472 | 200μs | 88.6ns | 343ns | 0.4 | 0 | 0 | 2.55 KB |
| master | RunWafRealisticBenchmarkWithAttack |
net6.0 | 117μs | 81ns | 314ns | 0 | 0 | 0 | 1.57 KB |
| master | RunWafRealisticBenchmarkWithAttack |
netcoreapp3.1 | 123μs | 96ns | 359ns | 0 | 0 | 0 | 1.55 KB |
| master | RunWafRealisticBenchmarkWithAttack |
net472 | 131μs | 33.2ns | 124ns | 0.197 | 0 | 0 | 1.58 KB |
| #6602 | RunWafRealisticBenchmark |
net6.0 | 177μs | 104ns | 402ns | 0 | 0 | 0 | 2.54 KB |
| #6602 | RunWafRealisticBenchmark |
netcoreapp3.1 | 187μs | 338ns | 1.31μs | 0 | 0 | 0 | 2.49 KB |
| #6602 | RunWafRealisticBenchmark |
net472 | 199μs | 68.2ns | 255ns | 0.397 | 0 | 0 | 2.55 KB |
| #6602 | RunWafRealisticBenchmarkWithAttack |
net6.0 | 116μs | 193ns | 749ns | 0 | 0 | 0 | 1.57 KB |
| #6602 | RunWafRealisticBenchmarkWithAttack |
netcoreapp3.1 | 123μs | 125ns | 486ns | 0 | 0 | 0 | 1.55 KB |
| #6602 | RunWafRealisticBenchmarkWithAttack |
net472 | 133μs | 80.2ns | 310ns | 0.198 | 0 | 0 | 1.58 KB |
Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ More allocations ⚠️
More allocations ⚠️ in #6602
Benchmark
Base Allocated
Diff Allocated
Change
Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0
253.93 KB
264.02 KB
10.1 KB
3.98%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1
254.5 KB
255.9 KB
1.4 KB
0.55%
Fewer allocations 🎉 in #6602
Benchmark
Base Allocated
Diff Allocated
Change
Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑net472
59.81 KB
59.18 KB
-632 B
-1.06%
| Benchmark | Base Allocated | Diff Allocated | Change | Change % |
|---|---|---|---|---|
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0 | 253.93 KB | 264.02 KB | 10.1 KB | 3.98% |
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1 | 254.5 KB | 255.9 KB | 1.4 KB | 0.55% |
| Benchmark | Base Allocated | Diff Allocated | Change | Change % |
|---|---|---|---|---|
| Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑net472 | 59.81 KB | 59.18 KB | -632 B | -1.06% |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StringConcatBenchmark |
net6.0 | 58.9μs | 682ns | 6.82μs | 0 | 0 | 0 | 43.44 KB |
| master | StringConcatBenchmark |
netcoreapp3.1 | 62.3μs | 805ns | 7.97μs | 0 | 0 | 0 | 42.64 KB |
| master | StringConcatBenchmark |
net472 | 37.3μs | 57.6ns | 208ns | 0 | 0 | 0 | 59.81 KB |
| master | StringConcatAspectBenchmark |
net6.0 | 308μs | 1.42μs | 8.06μs | 0 | 0 | 0 | 253.93 KB |
| master | StringConcatAspectBenchmark |
netcoreapp3.1 | 348μs | 1.63μs | 9.64μs | 0 | 0 | 0 | 254.5 KB |
| master | StringConcatAspectBenchmark |
net472 | 281μs | 4.84μs | 46.9μs | 0 | 0 | 0 | 278.53 KB |
| #6602 | StringConcatBenchmark |
net6.0 | 59.9μs | 764ns | 7.52μs | 0 | 0 | 0 | 43.44 KB |
| #6602 | StringConcatBenchmark |
netcoreapp3.1 | 53.3μs | 237ns | 820ns | 0 | 0 | 0 | 42.64 KB |
| #6602 | StringConcatBenchmark |
net472 | 36.9μs | 99.7ns | 359ns | 0 | 0 | 0 | 59.18 KB |
| #6602 | StringConcatAspectBenchmark |
net6.0 | 314μs | 1.78μs | 12.3μs | 0 | 0 | 0 | 264.02 KB |
| #6602 | StringConcatAspectBenchmark |
netcoreapp3.1 | 351μs | 1.76μs | 9.5μs | 0 | 0 | 0 | 255.9 KB |
| #6602 | StringConcatAspectBenchmark |
net472 | 271μs | 5.36μs | 51.9μs | 0 | 0 | 0 | 278.53 KB |
Benchmarks Report for tracer 🐌Benchmarks for #6602 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SpanBenchmark - Slower
|
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net6.0 | 1.144 | 403.70 | 461.68 | |
| Benchmarks.Trace.SpanBenchmark.StartFinishScope‑net6.0 | 1.117 | 480.69 | 537.08 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | StartFinishSpan |
net6.0 | 404ns | 0.446ns | 1.73ns | 0.00813 | 0 | 0 | 576 B |
| master | StartFinishSpan |
netcoreapp3.1 | 553ns | 0.558ns | 2.16ns | 0.00771 | 0 | 0 | 576 B |
| master | StartFinishSpan |
net472 | 583ns | 0.701ns | 2.71ns | 0.0918 | 0 | 0 | 578 B |
| master | StartFinishScope |
net6.0 | 481ns | 0.471ns | 1.82ns | 0.0098 | 0 | 0 | 696 B |
| master | StartFinishScope |
netcoreapp3.1 | 786ns | 0.929ns | 3.6ns | 0.00952 | 0 | 0 | 696 B |
| master | StartFinishScope |
net472 | 776ns | 1.2ns | 4.63ns | 0.104 | 0 | 0 | 658 B |
| #6602 | StartFinishSpan |
net6.0 | 462ns | 0.261ns | 1.01ns | 0.00802 | 0 | 0 | 576 B |
| #6602 | StartFinishSpan |
netcoreapp3.1 | 562ns | 0.487ns | 1.89ns | 0.00755 | 0 | 0 | 576 B |
| #6602 | StartFinishSpan |
net472 | 639ns | 0.231ns | 0.864ns | 0.0917 | 0 | 0 | 578 B |
| #6602 | StartFinishScope |
net6.0 | 537ns | 0.116ns | 0.419ns | 0.00982 | 0 | 0 | 696 B |
| #6602 | StartFinishScope |
netcoreapp3.1 | 782ns | 0.758ns | 2.94ns | 0.00935 | 0 | 0 | 696 B |
| #6602 | StartFinishScope |
net472 | 824ns | 2.14ns | 8.29ns | 0.104 | 0 | 0 | 658 B |
Benchmarks.Trace.TraceAnnotationsBenchmark - Slower ⚠️ Same allocations ✔️
Slower ⚠️ in #6602
Benchmark
diff/base
Base Median (ns)
Diff Median (ns)
Modality
Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑net6.0
1.159
592.23
686.39
| Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
|---|---|---|---|---|
| Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑net6.0 | 1.159 | 592.23 | 686.39 |
Raw results
| Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
|---|---|---|---|---|---|---|---|---|---|
| master | RunOnMethodBegin |
net6.0 | 592ns | 0.54ns | 2.09ns | 0.00974 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
netcoreapp3.1 | 901ns | 1.51ns | 5.86ns | 0.00942 | 0 | 0 | 696 B |
| master | RunOnMethodBegin |
net472 | 1.11μs | 1.36ns | 5.28ns | 0.104 | 0 | 0 | 658 B |
| #6602 | RunOnMethodBegin |
net6.0 | 686ns | 0.25ns | 0.934ns | 0.00989 | 0 | 0 | 696 B |
| #6602 | RunOnMethodBegin |
netcoreapp3.1 | 935ns | 0.349ns | 1.3ns | 0.00919 | 0 | 0 | 696 B |
| #6602 | RunOnMethodBegin |
net472 | 1.09μs | 0.436ns | 1.63ns | 0.104 | 0 | 0 | 658 B |
e0cfc66 to
1f4749b
Compare
14b5e2c to
6b8d61b
Compare
b309883 to
b03bf16
Compare
|
Any tests for this? |
b03bf16 to
d1e7f01
Compare
## Summary of changes Handle the errors when trying to access the `StatusCode` of the `HttpResponse` from the Context. ## Reason for change Errors in telemetry identified by these stacktraces: ``` System.NullReferenceException at Microsoft.AspNetCore.Http.DefaultHttpResponse.get_StatusCode() at Datadog.Trace.AppSec.Coordinator.SecurityCoordinator.RunWaf(Dictionary`2 args, Boolean lastWafCall, Boolean runWithEphemeral, Boolean isRasp) ``` A `ObjectDisposedException` and a `NullReferenceException` can happen in concurrent access to the `HttpContext`. This situation of race condition can happen while the request is finished while async jobs still run in the background and the waf for RASP is run. The HttpContext can be disposed from different manner by the user. You can find more information in this [PR](#6529). ## Implementation details - The getter for the `StatusCode` has been changed so it could return a `int?` if an exception has been triggered. - The method `ShouldAnalyzeSchema()` is already working with a null `StatusCode`.
Summary of changes
Handle the errors when trying to access the
StatusCodeof theHttpResponsefrom the Context.Reason for change
Errors in telemetry identified by these stacktraces:
A
ObjectDisposedExceptionand aNullReferenceExceptioncan happen in concurrent access to theHttpContext.This situation of race condition can happen while the request is finished while async jobs still run in the background and the waf for RASP is run.
The HttpContext can be disposed from different manner by the user. You can find more information in this PR.
Implementation details
StatusCodehas been changed so it could return aint?if an exception has been triggered.ShouldAnalyzeSchema()is already working with a nullStatusCode.