Skip to content

X-Content-Type missing header vulnerability#5571

Merged
DDJavierSantos merged 3 commits into
masterfrom
jsantos/Content_type_sniffing_vulnerability
Aug 29, 2023
Merged

X-Content-Type missing header vulnerability#5571
DDJavierSantos merged 3 commits into
masterfrom
jsantos/Content_type_sniffing_vulnerability

Conversation

@DDJavierSantos

@DDJavierSantos DDJavierSantos commented Jul 12, 2023 •
edited by smola
Loading

Copy link
Copy Markdown
Contributor

What Does This Do

Implement X-Content-Type missing header vulnerability detection

Motivation

Additional Notes

@smola smola added the comp: asm iast Application Security Management (IAST) label Jul 12, 2023
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/Content_type_sniffing_vulnerability branch 2 times, most recently from 7f76297 to 54a4a44 Compare August 10, 2023 08:50
@pr-commenter

pr-commenter Bot commented Aug 11, 2023 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~995e9c41d8 1.20.0-SNAPSHOT~73e32360fb
config baseline candidate
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
module Agent Agent
parent None None
variant appsec appsec

Summary

Found 0 performance improvements and 1 performance regressions! Performance is the same for 61 cases.

scenario Δ mean execution_time candidate mean execution_time baseline mean execution_time
scenario:insecure-bank:iast:IAST worse
[+292.721µs; +614.293µs] or [+2.097%; +4.400%]		 14.415ms 13.962ms
Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~73e32360fb, baseline=1.20.0-SNAPSHOT~995e9c41d8

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (987.321 ms) : 0, 987321
Total [baseline] (8.69 s) : 0, 8690065
Agent [candidate] (989.146 ms) : 0, 989146
Total [candidate] (8.666 s) : 0, 8665700
section appsec
Agent [baseline] (1.071 s) : 0, 1070520
Total [baseline] (8.733 s) : 0, 8732953
Agent [candidate] (1.072 s) : 0, 1072243
Total [candidate] (8.717 s) : 0, 8717345
section iast
Agent [baseline] (1.09 s) : 0, 1090403
Total [baseline] (9.179 s) : 0, 9178670
Agent [candidate] (1.092 s) : 0, 1091937
Total [candidate] (9.163 s) : 0, 9162723
section profiling
Agent [baseline] (1.167 s) : 0, 1166869
Total [baseline] (8.871 s) : 0, 8871398
Agent [candidate] (1.16 s) : 0, 1160006
Total [candidate] (8.876 s) : 0, 8875812
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 987.321 ms -
Agent appsec 1.071 s 83.199 ms (8.4%)
Agent iast 1.09 s 103.082 ms (10.4%)
Agent profiling 1.167 s 179.548 ms (18.2%)
Total tracing 8.69 s -
Total appsec 8.733 s 42.888 ms (0.5%)
Total iast 9.179 s 488.604 ms (5.6%)
Total profiling 8.871 s 181.332 ms (2.1%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 989.146 ms -
Agent appsec 1.072 s 83.098 ms (8.4%)
Agent iast 1.092 s 102.792 ms (10.4%)
Agent profiling 1.16 s 170.86 ms (17.3%)
Total tracing 8.666 s -
Total appsec 8.717 s 51.645 ms (0.6%)
Total iast 9.163 s 497.024 ms (5.7%)
Total profiling 8.876 s 210.113 ms (2.4%) 
gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~73e32360fb, baseline=1.20.0-SNAPSHOT~995e9c41d8

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (612.634 ms) : 0, 612634
BytebuddyAgent [candidate] (613.145 ms) : 0, 613145
GlobalTracer [baseline] (283.579 ms) : 0, 283579
GlobalTracer [candidate] (284.962 ms) : 0, 284962
AppSec [baseline] (50.153 ms) : 0, 50153
AppSec [candidate] (50.037 ms) : 0, 50037
Remote Config [baseline] (657.947 µs) : 0, 658
Remote Config [candidate] (670.849 µs) : 0, 671
Telemetry [baseline] (6.005 ms) : 0, 6005
Telemetry [candidate] (6.016 ms) : 0, 6016
section appsec
BytebuddyAgent [baseline] (611.575 ms) : 0, 611575
BytebuddyAgent [candidate] (612.336 ms) : 0, 612336
GlobalTracer [baseline] (283.311 ms) : 0, 283311
GlobalTracer [candidate] (283.987 ms) : 0, 283987
AppSec [baseline] (135.02 ms) : 0, 135020
AppSec [candidate] (135.26 ms) : 0, 135260
Remote Config [baseline] (723.278 µs) : 0, 723
Remote Config [candidate] (714.521 µs) : 0, 715
Telemetry [baseline] (5.734 ms) : 0, 5734
Telemetry [candidate] (5.75 ms) : 0, 5750
section iast
BytebuddyAgent [baseline] (718.391 ms) : 0, 718391
BytebuddyAgent [candidate] (719.249 ms) : 0, 719249
GlobalTracer [baseline] (270.254 ms) : 0, 270254
GlobalTracer [candidate] (270.547 ms) : 0, 270547
AppSec [baseline] (47.332 ms) : 0, 47332
AppSec [candidate] (47.187 ms) : 0, 47187
IAST [baseline] (13.962 ms) : 0, 13962
IAST [candidate] (14.415 ms) : 0, 14415
Remote Config [baseline] (548.817 µs) : 0, 549
Remote Config [candidate] (552.658 µs) : 0, 553
Telemetry [baseline] (5.718 ms) : 0, 5718
Telemetry [candidate] (5.69 ms) : 0, 5690
section profiling
BytebuddyAgent [baseline] (629.586 ms) : 0, 629586
BytebuddyAgent [candidate] (625.614 ms) : 0, 625614
GlobalTracer [baseline] (350.113 ms) : 0, 350113
GlobalTracer [candidate] (348.461 ms) : 0, 348461
AppSec [baseline] (49.263 ms) : 0, 49263
AppSec [candidate] (48.966 ms) : 0, 48966
Remote Config [baseline] (644.628 µs) : 0, 645
Remote Config [candidate] (640.573 µs) : 0, 641
Telemetry [baseline] (5.974 ms) : 0, 5974
Telemetry [candidate] (5.971 ms) : 0, 5971
ProfilingAgent [baseline] (78.128 ms) : 0, 78128
ProfilingAgent [candidate] (77.636 ms) : 0, 77636
Profiling [baseline] (78.153 ms) : 0, 78153
Profiling [candidate] (77.661 ms) : 0, 77661
Loading
Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~73e32360fb, baseline=1.20.0-SNAPSHOT~995e9c41d8

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (996.448 ms) : 0, 996448
Total [baseline] (9.175 s) : 0, 9174893
Agent [candidate] (988.634 ms) : 0, 988634
Total [candidate] (9.166 s) : 0, 9166133
section appsec
Agent [baseline] (1.082 s) : 0, 1081719
Total [baseline] (9.361 s) : 0, 9361159
Agent [candidate] (1.073 s) : 0, 1072842
Total [candidate] (9.289 s) : 0, 9289158
section iast
Agent [baseline] (1.089 s) : 0, 1089216
Total [baseline] (9.453 s) : 0, 9453023
Agent [candidate] (1.092 s) : 0, 1091849
Total [candidate] (9.408 s) : 0, 9407882
section profiling
Agent [baseline] (1.169 s) : 0, 1168508
Total [baseline] (9.475 s) : 0, 9475431
Agent [candidate] (1.162 s) : 0, 1161702
Total [candidate] (9.468 s) : 0, 9467919
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 996.448 ms -
Agent appsec 1.082 s 85.271 ms (8.6%)
Agent iast 1.089 s 92.767 ms (9.3%)
Agent profiling 1.169 s 172.06 ms (17.3%)
Total tracing 9.175 s -
Total appsec 9.361 s 186.267 ms (2.0%)
Total iast 9.453 s 278.131 ms (3.0%)
Total profiling 9.475 s 300.539 ms (3.3%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 988.634 ms -
Agent appsec 1.073 s 84.209 ms (8.5%)
Agent iast 1.092 s 103.215 ms (10.4%)
Agent profiling 1.162 s 173.068 ms (17.5%)
Total tracing 9.166 s -
Total appsec 9.289 s 123.025 ms (1.3%)
Total iast 9.408 s 241.749 ms (2.6%)
Total profiling 9.468 s 301.786 ms (3.3%) 
gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~73e32360fb, baseline=1.20.0-SNAPSHOT~995e9c41d8

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (618.498 ms) : 0, 618498
BytebuddyAgent [candidate] (613.196 ms) : 0, 613196
GlobalTracer [baseline] (286.432 ms) : 0, 286432
GlobalTracer [candidate] (284.383 ms) : 0, 284383
AppSec [baseline] (50.23 ms) : 0, 50230
AppSec [candidate] (50.171 ms) : 0, 50171
Remote Config [baseline] (672.116 µs) : 0, 672
Remote Config [candidate] (662.341 µs) : 0, 662
Telemetry [baseline] (6.043 ms) : 0, 6043
Telemetry [candidate] (5.976 ms) : 0, 5976
section appsec
BytebuddyAgent [baseline] (617.884 ms) : 0, 617884
BytebuddyAgent [candidate] (612.924 ms) : 0, 612924
GlobalTracer [baseline] (286.678 ms) : 0, 286678
GlobalTracer [candidate] (284.219 ms) : 0, 284219
AppSec [baseline] (136.083 ms) : 0, 136083
AppSec [candidate] (134.985 ms) : 0, 134985
Remote Config [baseline] (726.291 µs) : 0, 726
Remote Config [candidate] (726.74 µs) : 0, 727
Telemetry [baseline] (5.801 ms) : 0, 5801
Telemetry [candidate] (5.719 ms) : 0, 5719
section iast
BytebuddyAgent [baseline] (717.633 ms) : 0, 717633
BytebuddyAgent [candidate] (718.517 ms) : 0, 718517
GlobalTracer [baseline] (269.94 ms) : 0, 269940
GlobalTracer [candidate] (270.862 ms) : 0, 270862
AppSec [baseline] (47.175 ms) : 0, 47175
AppSec [candidate] (47.584 ms) : 0, 47584
IAST [baseline] (13.984 ms) : 0, 13984
IAST [candidate] (14.431 ms) : 0, 14431
Remote Config [baseline] (550.77 µs) : 0, 551
Remote Config [candidate] (549.755 µs) : 0, 550
Telemetry [baseline] (5.663 ms) : 0, 5663
Telemetry [candidate] (5.654 ms) : 0, 5654
section profiling
BytebuddyAgent [baseline] (630.823 ms) : 0, 630823
BytebuddyAgent [candidate] (627.602 ms) : 0, 627602
GlobalTracer [baseline] (349.833 ms) : 0, 349833
GlobalTracer [candidate] (349.206 ms) : 0, 349206
AppSec [baseline] (49.463 ms) : 0, 49463
AppSec [candidate] (49.035 ms) : 0, 49035
Remote Config [baseline] (658.019 µs) : 0, 658
Remote Config [candidate] (640.078 µs) : 0, 640
Telemetry [baseline] (6.057 ms) : 0, 6057
Telemetry [candidate] (6.003 ms) : 0, 6003
ProfilingAgent [baseline] (78.284 ms) : 0, 78284
ProfilingAgent [candidate] (76.182 ms) : 0, 76182
Profiling [baseline] (78.308 ms) : 0, 78308
Profiling [candidate] (76.207 ms) : 0, 76207
Loading

Load

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~995e9c41d8 1.20.0-SNAPSHOT~73e32360fb
config baseline candidate
end_time 2023-08-28T15:40:51 2023-08-28T15:58:54
start_time 2023-08-28T15:40:33 2023-08-28T15:58:37
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~73e32360fb, baseline=1.20.0-SNAPSHOT~995e9c41d8
    dateFormat X
    axisFormat %s
section baseline
no_agent (361.778 µs) : 342, 382
.   : milestone, 362,
appsec (668.74 µs) : 647, 690
.   : milestone, 669,
iast (455.444 µs) : 434, 476
.   : milestone, 455,
iast_FULL (513.898 µs) : 493, 534
.   : milestone, 514,
iast_INACTIVE (430.829 µs) : 410, 452
.   : milestone, 431,
profiling (438.206 µs) : 417, 459
.   : milestone, 438,
tracing (430.393 µs) : 410, 451
.   : milestone, 430,
section candidate
no_agent (361.482 µs) : 342, 381
.   : milestone, 361,
appsec (669.07 µs) : 648, 690
.   : milestone, 669,
iast (456.522 µs) : 436, 477
.   : milestone, 457,
iast_FULL (521.653 µs) : 501, 543
.   : milestone, 522,
iast_INACTIVE (429.851 µs) : 409, 451
.   : milestone, 430,
profiling (434.679 µs) : 414, 456
.   : milestone, 435,
tracing (428.485 µs) : 408, 449
.   : milestone, 428,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 361.778 µs [341.976 µs, 381.58 µs] -
appsec 668.74 µs [647.371 µs, 690.11 µs] 306.963 µs (84.8%)
iast 455.444 µs [434.411 µs, 476.478 µs] 93.667 µs (25.9%)
iast_FULL 513.898 µs [493.445 µs, 534.351 µs] 152.121 µs (42.0%)
iast_INACTIVE 430.829 µs [410.102 µs, 451.556 µs] 69.051 µs (19.1%)
profiling 438.206 µs [417.287 µs, 459.124 µs] 76.428 µs (21.1%)
tracing 430.393 µs [410.079 µs, 450.708 µs] 68.616 µs (19.0%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 361.482 µs [341.567 µs, 381.396 µs] -
appsec 669.07 µs [648.134 µs, 690.007 µs] 307.589 µs (85.1%)
iast 456.522 µs [435.552 µs, 477.493 µs] 95.041 µs (26.3%)
iast_FULL 521.653 µs [500.762 µs, 542.544 µs] 160.171 µs (44.3%)
iast_INACTIVE 429.851 µs [408.915 µs, 450.787 µs] 68.369 µs (18.9%)
profiling 434.679 µs [413.551 µs, 455.806 µs] 73.197 µs (20.2%)
tracing 428.485 µs [407.805 µs, 449.166 µs] 67.004 µs (18.5%)
Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~73e32360fb, baseline=1.20.0-SNAPSHOT~995e9c41d8
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.329 ms) : 1310, 1349
.   : milestone, 1329,
appsec (1.646 ms) : 1621, 1670
.   : milestone, 1646,
iast (1.482 ms) : 1459, 1506
.   : milestone, 1482,
profiling (1.456 ms) : 1431, 1481
.   : milestone, 1456,
tracing (1.437 ms) : 1413, 1461
.   : milestone, 1437,
section candidate
no_agent (1.32 ms) : 1300, 1339
.   : milestone, 1320,
appsec (1.679 ms) : 1655, 1703
.   : milestone, 1679,
iast (1.431 ms) : 1407, 1456
.   : milestone, 1431,
profiling (1.454 ms) : 1429, 1479
.   : milestone, 1454,
tracing (1.46 ms) : 1435, 1485
.   : milestone, 1460,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.329 ms [1.31 ms, 1.349 ms] -
appsec 1.646 ms [1.621 ms, 1.67 ms] 316.284 µs (23.8%)
iast 1.482 ms [1.459 ms, 1.506 ms] 152.823 µs (11.5%)
profiling 1.456 ms [1.431 ms, 1.481 ms] 126.351 µs (9.5%)
tracing 1.437 ms [1.413 ms, 1.461 ms] 107.731 µs (8.1%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.32 ms [1.3 ms, 1.339 ms] -
appsec 1.679 ms [1.655 ms, 1.703 ms] 359.316 µs (27.2%)
iast 1.431 ms [1.407 ms, 1.456 ms] 111.858 µs (8.5%)
profiling 1.454 ms [1.429 ms, 1.479 ms] 134.567 µs (10.2%)
tracing 1.46 ms [1.435 ms, 1.485 ms] 140.746 µs (10.7%)

@DDJavierSantos
DDJavierSantos marked this pull request as ready for review August 11, 2023 15:23
@DDJavierSantos
DDJavierSantos requested a review from a team August 11, 2023 15:23
@DDJavierSantos
DDJavierSantos requested a review from a team as a code owner August 11, 2023 15:23
@DDJavierSantos DDJavierSantos changed the title Jsantos/content type sniffing vulnerability X-Content-Type missing header vulnerability Aug 17, 2023
smola
smola reviewed Aug 17, 2023
View reviewed changes
Comment thread dd-java-agent/agent-iast/src/main/java/com/datadog/iast/util/HttpHeader.java
Comment thread internal-api/src/main/java/datadog/trace/api/iast/VulnerabilityTypes.java Outdated
Comment thread internal-api/src/main/java/datadog/trace/api/iast/InstrumentationBridge.java Outdated
Comment thread internal-api/src/main/java/datadog/trace/api/iast/InstrumentationBridge.java
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/Content_type_sniffing_vulnerability branch from 8c88972 to 6582ea8 Compare August 21, 2023 08:11
@DDJavierSantos
DDJavierSantos requested a review from smola August 21, 2023 08:51
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/Content_type_sniffing_vulnerability branch from 1b510de to d846234 Compare August 28, 2023 10:10
@DDJavierSantos
DDJavierSantos requested a review from a team as a code owner August 28, 2023 10:10
@DDJavierSantos
DDJavierSantos requested a review from smola August 28, 2023 11:10
@DDJavierSantos
Added X content type header missing vulnerability detection
65467a5 
merge fixed

safer check for protocol

removing unnecesary throw statement
@DDJavierSantos
Added X content type header missing vulnerability detection
8c4df7b 
merge fixed

safer check for protocol

removing unnecesary throw statement

spotless
@DDJavierSantos
DDJavierSantos force-pushed the jsantos/Content_type_sniffing_vulnerability branch from e59e92f to 8c4df7b Compare August 28, 2023 14:17
@DDJavierSantos
DDJavierSantos merged commit 892d6f7 into master Aug 29, 2023
@DDJavierSantos
DDJavierSantos deleted the jsantos/Content_type_sniffing_vulnerability branch August 29, 2023 14:19
@github-actions github-actions Bot added this to the 1.20.0 milestone Aug 29, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes
@jandro996 jandro996 Awaiting requested review from jandro996
@manuel-alvarez-alvarez manuel-alvarez-alvarez Awaiting requested review from manuel-alvarez-alvarez

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.20.0

Development

Successfully merging this pull request may close these issues.

3 participants

@DDJavierSantos @smola @manuel-alvarez-alvarez