Skip to content

Add IAST instrumentation for nimbusds' jose-jwt and auth0's java-jwt#5076

Merged
DDJavierSantos merged 2 commits into
masterfrom
jsantos/jose-jwt-instrumentation
Apr 26, 2023
Merged

Add IAST instrumentation for nimbusds' jose-jwt and auth0's java-jwt#5076
DDJavierSantos merged 2 commits into
masterfrom
jsantos/jose-jwt-instrumentation

Conversation

@DDJavierSantos

@DDJavierSantos DDJavierSantos commented Apr 17, 2023 •
edited by smola
Loading

Copy link
Copy Markdown
Contributor

What Does This Do

Instruments the auth0's java-jwt and nimbusds's jose-jwt parsers to taint JWT tokens as sources for vulnerability detection.

Motivation

We need to cover vulnerabilities created by JWTs (Java web token) and Jose is the most popular library for dealing with JWT in java.

Additional Notes

@DDJavierSantos
DDJavierSantos requested a review from smola April 17, 2023 15:01
@smola smola added the comp: asm iast Application Security Management (IAST) label Apr 18, 2023
smola
smola requested changes Apr 18, 2023
View reviewed changes
Comment thread dd-java-agent/instrumentation/jose-jwt/build.gradle Outdated
Comment thread dd-java-agent/instrumentation/jose-jwt/build.gradle Outdated
Comment thread dd-java-agent/instrumentation/jose-jwt/build.gradle Outdated
Comment thread ...n/jose-jwt/src/main/java/datadog/trace/instrumentation/josejwt/JWTParserInstrumentation.java Outdated
Comment thread ...n/jose-jwt/src/main/java/datadog/trace/instrumentation/josejwt/JWTParserInstrumentation.java Outdated
Comment thread ...n/jose-jwt/src/main/java/datadog/trace/instrumentation/josejwt/JWTParserInstrumentation.java Outdated
Comment thread dd-java-agent/instrumentation/jose-jwt/src/test/groovy/JWTParserInstrumentationTest.groovy Outdated
Comment thread dd-smoke-tests/spring-security/src/main/java/com/example/jwt/MainController.java Outdated
Comment thread dd-smoke-tests/spring-security/src/test/groovy/datadog/smoketest/SpringSecurityJwtTest.groovy Outdated
Comment thread dd-smoke-tests/spring-security/src/test/groovy/datadog/smoketest/SpringSecurityJwtTest.groovy Outdated
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/jose-jwt-instrumentation branch from c836d96 to 379cc2a Compare April 19, 2023 08:37
@smola smola changed the title Jsantos/jose jwt instrumentation Add IAST instrumentation for nimbusds' jose-jwt and auth0's java-jwt Apr 20, 2023
@DDJavierSantos
DDJavierSantos requested a review from smola April 23, 2023 22:31
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/jose-jwt-instrumentation branch from 48e80cf to 8b0708b Compare April 24, 2023 08:02
smola
smola requested changes Apr 24, 2023
View reviewed changes
Comment thread dd-java-agent/instrumentation/jose-jwt/build.gradle Outdated
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/jose-jwt-instrumentation branch from 8b0708b to 571ac07 Compare April 25, 2023 10:57
@pr-commenter

pr-commenter Bot commented Apr 25, 2023 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Parameters

Baseline Candidate
commit 1.13.0-SNAPSHOT~36f811ace6 1.13.0-SNAPSHOT~c74d3717bc
config baseline candidate
See matching parameters
Baseline Candidate
module Agent Agent
parent None None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 22 cases.

See unchanged results
scenario Δ mean execution_time
scenario:Startup-base-Agent same
scenario:Startup-base-Agent.start same
scenario:Startup-base-BytebuddyAgent same
scenario:Startup-base-GlobalTracer same
scenario:Startup-base-AppSec same
scenario:Startup-base-Remote Config same
scenario:Startup-base-Telemetry same
scenario:Startup-iast-Agent same
scenario:Startup-iast-Agent.start same
scenario:Startup-iast-BytebuddyAgent same
scenario:Startup-iast-GlobalTracer same
scenario:Startup-iast-AppSec same
scenario:Startup-iast-IAST same
scenario:Startup-iast-Remote Config same
scenario:Startup-iast-Telemetry same
scenario:Startup-waf-Agent same
scenario:Startup-waf-Agent.start same
scenario:Startup-waf-BytebuddyAgent same
scenario:Startup-waf-GlobalTracer same
scenario:Startup-waf-AppSec same
scenario:Startup-waf-Remote Config same
scenario:Startup-waf-Telemetry same

@DDJavierSantos
DDJavierSantos requested a review from smola April 25, 2023 12:50
@DDJavierSantos
DDJavierSantos marked this pull request as ready for review April 26, 2023 08:51
@DDJavierSantos
DDJavierSantos requested a review from a team April 26, 2023 08:51
@DDJavierSantos
DDJavierSantos requested a review from a team as a code owner April 26, 2023 08:51
@DDJavierSantos
DDJavierSantos merged commit 9d5129b into master Apr 26, 2023
@DDJavierSantos
DDJavierSantos deleted the jsantos/jose-jwt-instrumentation branch April 26, 2023 09:03
@github-actions github-actions Bot added this to the 1.13.0 milestone Apr 26, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.13.0

Development

Successfully merging this pull request may close these issues.

2 participants

@DDJavierSantos @smola