Skip to content

Add freemarker.template.utility.StringUtil tainting support#5645

Merged
jandro996 merged 4 commits into
masterfrom
alejandro.gonzalez/freemarker_escape_taint_traking
Aug 18, 2023
Merged

Add freemarker.template.utility.StringUtil tainting support#5645
jandro996 merged 4 commits into
masterfrom
alejandro.gonzalez/freemarker_escape_taint_traking

Conversation

@jandro996

@jandro996 jandro996 commented Jul 27, 2023

Copy link
Copy Markdown
Member

What Does This Do

Add tainting support to:

freemarker.template.utility.StringUtil#HTMLEnc
freemarker.template.utility.StringUtil#XMLEnc
freemarker.template.utility.StringUtil#XHTMLEnc
freemarker.template.utility.StringUtil#javaStringEnc
freemarker.template.utility.StringUtil#javaScriptStringEnc
freemarker.template.utility.StringUtil#jsonStringEnc

Motivation

Additional Notes

@pr-commenter

pr-commenter Bot commented Jul 27, 2023 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~aed58b8056 1.20.0-SNAPSHOT~90a8300a38
config baseline candidate
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
module Agent Agent
parent None None
variant appsec appsec

Summary

Found 2 performance improvements and 0 performance regressions! Performance is the same for 60 cases.

scenario Δ mean execution_time candidate mean execution_time baseline mean execution_time
scenario:insecure-bank:iast:Remote Config better
[-89.942µs; -44.982µs] or [-14.377%; -7.190%]		 558.142µs 625.604µs
scenario:petclinic:iast:Remote Config better
[-82.848µs; -31.946µs] or [-13.265%; -5.115%]		 567.178µs 624.575µs
Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~90a8300a38, baseline=1.20.0-SNAPSHOT~aed58b8056

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (993.006 ms) : 0, 993006
Total [baseline] (9.248 s) : 0, 9247747
Agent [candidate] (992.925 ms) : 0, 992925
Total [candidate] (9.201 s) : 0, 9201007
section appsec
Agent [baseline] (1.069 s) : 0, 1069408
Total [baseline] (9.307 s) : 0, 9307316
Agent [candidate] (1.07 s) : 0, 1070468
Total [candidate] (9.228 s) : 0, 9227917
section iast
Agent [baseline] (1.086 s) : 0, 1086133
Total [baseline] (9.385 s) : 0, 9385033
Agent [candidate] (1.093 s) : 0, 1092617
Total [candidate] (9.41 s) : 0, 9410221
section profiling
Agent [baseline] (1.16 s) : 0, 1160448
Total [baseline] (9.52 s) : 0, 9519753
Agent [candidate] (1.156 s) : 0, 1156206
Total [candidate] (9.42 s) : 0, 9419779
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 993.006 ms -
Agent appsec 1.069 s 76.402 ms (7.7%)
Agent iast 1.086 s 93.127 ms (9.4%)
Agent profiling 1.16 s 167.443 ms (16.9%)
Total tracing 9.248 s -
Total appsec 9.307 s 59.569 ms (0.6%)
Total iast 9.385 s 137.285 ms (1.5%)
Total profiling 9.52 s 272.005 ms (2.9%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 992.925 ms -
Agent appsec 1.07 s 77.543 ms (7.8%)
Agent iast 1.093 s 99.693 ms (10.0%)
Agent profiling 1.156 s 163.281 ms (16.4%)
Total tracing 9.201 s -
Total appsec 9.228 s 26.909 ms (0.3%)
Total iast 9.41 s 209.214 ms (2.3%)
Total profiling 9.42 s 218.772 ms (2.4%) 
gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~90a8300a38, baseline=1.20.0-SNAPSHOT~aed58b8056

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (615.657 ms) : 0, 615657
BytebuddyAgent [candidate] (614.491 ms) : 0, 614491
GlobalTracer [baseline] (285.828 ms) : 0, 285828
GlobalTracer [candidate] (286.995 ms) : 0, 286995
AppSec [baseline] (50.267 ms) : 0, 50267
AppSec [candidate] (50.419 ms) : 0, 50419
Remote Config [baseline] (666.565 µs) : 0, 667
Remote Config [candidate] (662.455 µs) : 0, 662
Telemetry [baseline] (6.024 ms) : 0, 6024
Telemetry [candidate] (5.998 ms) : 0, 5998
section appsec
BytebuddyAgent [baseline] (610.362 ms) : 0, 610362
BytebuddyAgent [candidate] (610.442 ms) : 0, 610442
GlobalTracer [baseline] (283.004 ms) : 0, 283004
GlobalTracer [candidate] (283.967 ms) : 0, 283967
AppSec [baseline] (135.31 ms) : 0, 135310
AppSec [candidate] (135.361 ms) : 0, 135361
Remote Config [baseline] (750.578 µs) : 0, 751
Remote Config [candidate] (737.129 µs) : 0, 737
Telemetry [baseline] (5.726 ms) : 0, 5726
Telemetry [candidate] (5.718 ms) : 0, 5718
section iast
BytebuddyAgent [baseline] (713.877 ms) : 0, 713877
BytebuddyAgent [candidate] (718.715 ms) : 0, 718715
GlobalTracer [baseline] (270.734 ms) : 0, 270734
GlobalTracer [candidate] (272.116 ms) : 0, 272116
AppSec [baseline] (46.51 ms) : 0, 46510
AppSec [candidate] (46.886 ms) : 0, 46886
Remote Config [baseline] (624.575 µs) : 0, 625
Remote Config [candidate] (567.178 µs) : 0, 567
Telemetry [baseline] (5.817 ms) : 0, 5817
Telemetry [candidate] (5.774 ms) : 0, 5774
IAST [baseline] (14.341 ms) : 0, 14341
IAST [candidate] (14.107 ms) : 0, 14107
section profiling
BytebuddyAgent [baseline] (623.795 ms) : 0, 623795
BytebuddyAgent [candidate] (621.753 ms) : 0, 621753
GlobalTracer [baseline] (349.044 ms) : 0, 349044
GlobalTracer [candidate] (348.904 ms) : 0, 348904
AppSec [baseline] (49.485 ms) : 0, 49485
AppSec [candidate] (49.195 ms) : 0, 49195
Remote Config [baseline] (660.008 µs) : 0, 660
Remote Config [candidate] (664.188 µs) : 0, 664
Telemetry [baseline] (5.913 ms) : 0, 5913
Telemetry [candidate] (5.93 ms) : 0, 5930
ProfilingAgent [baseline] (78.519 ms) : 0, 78519
ProfilingAgent [candidate] (76.957 ms) : 0, 76957
Profiling [baseline] (78.544 ms) : 0, 78544
Profiling [candidate] (76.981 ms) : 0, 76981
Loading
Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~90a8300a38, baseline=1.20.0-SNAPSHOT~aed58b8056

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (990.458 ms) : 0, 990458
Total [baseline] (8.638 s) : 0, 8637963
Agent [candidate] (984.598 ms) : 0, 984598
Total [candidate] (8.647 s) : 0, 8647368
section appsec
Agent [baseline] (1.07 s) : 0, 1070109
Total [baseline] (8.695 s) : 0, 8695097
Agent [candidate] (1.07 s) : 0, 1069652
Total [candidate] (8.727 s) : 0, 8726541
section iast
Agent [baseline] (1.084 s) : 0, 1083528
Total [baseline] (9.142 s) : 0, 9141823
Agent [candidate] (1.087 s) : 0, 1087436
Total [candidate] (9.137 s) : 0, 9137221
section profiling
Agent [baseline] (1.153 s) : 0, 1153400
Total [baseline] (8.861 s) : 0, 8861406
Agent [candidate] (1.162 s) : 0, 1162216
Total [candidate] (8.856 s) : 0, 8855561
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 990.458 ms -
Agent appsec 1.07 s 79.651 ms (8.0%)
Agent iast 1.084 s 93.07 ms (9.4%)
Agent profiling 1.153 s 162.942 ms (16.5%)
Total tracing 8.638 s -
Total appsec 8.695 s 57.133 ms (0.7%)
Total iast 9.142 s 503.86 ms (5.8%)
Total profiling 8.861 s 223.442 ms (2.6%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 984.598 ms -
Agent appsec 1.07 s 85.055 ms (8.6%)
Agent iast 1.087 s 102.838 ms (10.4%)
Agent profiling 1.162 s 177.618 ms (18.0%)
Total tracing 8.647 s -
Total appsec 8.727 s 79.174 ms (0.9%)
Total iast 9.137 s 489.854 ms (5.7%)
Total profiling 8.856 s 208.194 ms (2.4%) 
gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~90a8300a38, baseline=1.20.0-SNAPSHOT~aed58b8056

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (614.588 ms) : 0, 614588
BytebuddyAgent [candidate] (610.212 ms) : 0, 610212
GlobalTracer [baseline] (284.855 ms) : 0, 284855
GlobalTracer [candidate] (283.439 ms) : 0, 283439
AppSec [baseline] (49.793 ms) : 0, 49793
AppSec [candidate] (50.056 ms) : 0, 50056
Remote Config [baseline] (664.93 µs) : 0, 665
Remote Config [candidate] (658.725 µs) : 0, 659
Telemetry [baseline] (6.03 ms) : 0, 6030
Telemetry [candidate] (5.936 ms) : 0, 5936
section appsec
BytebuddyAgent [baseline] (610.548 ms) : 0, 610548
BytebuddyAgent [candidate] (609.77 ms) : 0, 609770
GlobalTracer [baseline] (283.859 ms) : 0, 283859
GlobalTracer [candidate] (283.82 ms) : 0, 283820
AppSec [baseline] (134.883 ms) : 0, 134883
AppSec [candidate] (135.356 ms) : 0, 135356
Remote Config [baseline] (729.059 µs) : 0, 729
Remote Config [candidate] (718.912 µs) : 0, 719
Telemetry [baseline] (5.725 ms) : 0, 5725
Telemetry [candidate] (5.726 ms) : 0, 5726
section iast
BytebuddyAgent [baseline] (712.305 ms) : 0, 712305
BytebuddyAgent [candidate] (714.733 ms) : 0, 714733
GlobalTracer [baseline] (269.844 ms) : 0, 269844
GlobalTracer [candidate] (271.379 ms) : 0, 271379
AppSec [baseline] (46.379 ms) : 0, 46379
AppSec [candidate] (46.604 ms) : 0, 46604
Remote Config [baseline] (625.604 µs) : 0, 626
Remote Config [candidate] (558.142 µs) : 0, 558
Telemetry [baseline] (5.844 ms) : 0, 5844
Telemetry [candidate] (5.752 ms) : 0, 5752
IAST [baseline] (14.234 ms) : 0, 14234
IAST [candidate] (14.059 ms) : 0, 14059
section profiling
BytebuddyAgent [baseline] (621.967 ms) : 0, 621967
BytebuddyAgent [candidate] (627.29 ms) : 0, 627290
GlobalTracer [baseline] (347.917 ms) : 0, 347917
GlobalTracer [candidate] (350.723 ms) : 0, 350723
AppSec [baseline] (49.156 ms) : 0, 49156
AppSec [candidate] (49.271 ms) : 0, 49271
Remote Config [baseline] (655.881 µs) : 0, 656
Remote Config [candidate] (668.972 µs) : 0, 669
Telemetry [baseline] (5.879 ms) : 0, 5879
Telemetry [candidate] (5.974 ms) : 0, 5974
ProfilingAgent [baseline] (74.953 ms) : 0, 74953
ProfilingAgent [candidate] (75.104 ms) : 0, 75104
Profiling [baseline] (74.978 ms) : 0, 74978
Profiling [candidate] (75.128 ms) : 0, 75128
Loading

Load

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~aed58b8056 1.20.0-SNAPSHOT~90a8300a38
config baseline candidate
end_time 2023-08-18T10:10:55 2023-08-18T10:28:57
start_time 2023-08-18T10:10:38 2023-08-18T10:28:39
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~90a8300a38, baseline=1.20.0-SNAPSHOT~aed58b8056
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.304 ms) : 1285, 1323
.   : milestone, 1304,
appsec (1.675 ms) : 1650, 1699
.   : milestone, 1675,
iast (1.435 ms) : 1411, 1460
.   : milestone, 1435,
profiling (1.466 ms) : 1442, 1490
.   : milestone, 1466,
tracing (1.44 ms) : 1416, 1463
.   : milestone, 1440,
section candidate
no_agent (1.306 ms) : 1287, 1325
.   : milestone, 1306,
appsec (1.678 ms) : 1654, 1703
.   : milestone, 1678,
iast (1.44 ms) : 1416, 1464
.   : milestone, 1440,
profiling (1.473 ms) : 1445, 1500
.   : milestone, 1473,
tracing (1.453 ms) : 1429, 1477
.   : milestone, 1453,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.304 ms [1.285 ms, 1.323 ms] -
appsec 1.675 ms [1.65 ms, 1.699 ms] 370.691 µs (28.4%)
iast 1.435 ms [1.411 ms, 1.46 ms] 131.215 µs (10.1%)
profiling 1.466 ms [1.442 ms, 1.49 ms] 162.073 µs (12.4%)
tracing 1.44 ms [1.416 ms, 1.463 ms] 135.649 µs (10.4%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.306 ms [1.287 ms, 1.325 ms] -
appsec 1.678 ms [1.654 ms, 1.703 ms] 372.239 µs (28.5%)
iast 1.44 ms [1.416 ms, 1.464 ms] 134.131 µs (10.3%)
profiling 1.473 ms [1.445 ms, 1.5 ms] 166.474 µs (12.7%)
tracing 1.453 ms [1.429 ms, 1.477 ms] 147.18 µs (11.3%)
Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~90a8300a38, baseline=1.20.0-SNAPSHOT~aed58b8056
    dateFormat X
    axisFormat %s
section baseline
no_agent (356.193 µs) : 337, 376
.   : milestone, 356,
appsec (653.687 µs) : 633, 674
.   : milestone, 654,
iast (456.512 µs) : 435, 478
.   : milestone, 457,
iast_FULL (513.248 µs) : 493, 534
.   : milestone, 513,
iast_INACTIVE (430.229 µs) : 409, 451
.   : milestone, 430,
profiling (430.896 µs) : 410, 451
.   : milestone, 431,
tracing (429.489 µs) : 409, 450
.   : milestone, 429,
section candidate
no_agent (359.863 µs) : 340, 379
.   : milestone, 360,
appsec (661.122 µs) : 640, 682
.   : milestone, 661,
iast (448.816 µs) : 428, 469
.   : milestone, 449,
iast_FULL (516.329 µs) : 496, 537
.   : milestone, 516,
iast_INACTIVE (433.948 µs) : 413, 455
.   : milestone, 434,
profiling (438.708 µs) : 418, 460
.   : milestone, 439,
tracing (422.533 µs) : 402, 443
.   : milestone, 423,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 356.193 µs [336.519 µs, 375.868 µs] -
appsec 653.687 µs [633.385 µs, 673.99 µs] 297.494 µs (83.5%)
iast 456.512 µs [435.147 µs, 477.877 µs] 100.319 µs (28.2%)
iast_FULL 513.248 µs [492.895 µs, 533.602 µs] 157.055 µs (44.1%)
iast_INACTIVE 430.229 µs [409.314 µs, 451.144 µs] 74.035 µs (20.8%)
profiling 430.896 µs [410.474 µs, 451.317 µs] 74.702 µs (21.0%)
tracing 429.489 µs [408.751 µs, 450.227 µs] 73.296 µs (20.6%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 359.863 µs [340.273 µs, 379.454 µs] -
appsec 661.122 µs [640.051 µs, 682.193 µs] 301.259 µs (83.7%)
iast 448.816 µs [428.447 µs, 469.184 µs] 88.952 µs (24.7%)
iast_FULL 516.329 µs [495.593 µs, 537.066 µs] 156.466 µs (43.5%)
iast_INACTIVE 433.948 µs [412.768 µs, 455.127 µs] 74.085 µs (20.6%)
profiling 438.708 µs [417.51 µs, 459.906 µs] 78.845 µs (21.9%)
tracing 422.533 µs [401.773 µs, 443.294 µs] 62.67 µs (17.4%)

@smola smola added the comp: asm iast Application Security Management (IAST) label Jul 31, 2023
@jandro996
jandro996 marked this pull request as ready for review August 16, 2023 06:42
@jandro996
jandro996 requested a review from a team as a code owner August 16, 2023 06:42
@jandro996
jandro996 force-pushed the alejandro.gonzalez/freemarker_escape_taint_traking branch from 509843c to fb16140 Compare August 17, 2023 07:01
@jandro996
jandro996 requested review from a team and DDJavierSantos August 17, 2023 07:53
@jandro996
jandro996 requested a review from smola August 17, 2023 11:58
@jandro996
jandro996 force-pushed the alejandro.gonzalez/freemarker_escape_taint_traking branch from 1252fd2 to 421b5be Compare August 18, 2023 07:49
@jandro996
jandro996 merged commit 686943e into master Aug 18, 2023
@jandro996
jandro996 deleted the alejandro.gonzalez/freemarker_escape_taint_traking branch August 18, 2023 10:49
@github-actions github-actions Bot added this to the 1.20.0 milestone Aug 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes
@DDJavierSantos DDJavierSantos Awaiting requested review from DDJavierSantos

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.20.0

Development

Successfully merging this pull request may close these issues.

2 participants

@jandro996 @smola