Skip to content

Add unbescape escape functions tainting support#5647

Merged
jandro996 merged 5 commits into
masterfrom
alejandro.gonzalez/unbescape_taint_tracking
Aug 18, 2023
Merged

Add unbescape escape functions tainting support#5647
jandro996 merged 5 commits into
masterfrom
alejandro.gonzalez/unbescape_taint_tracking

Conversation

@jandro996

@jandro996 jandro996 commented Jul 27, 2023

Copy link
Copy Markdown
Member

What Does This Do

Add tainting support to:

org.unbescape.html.HtmlEscape#escapeHtml4Xml
org.unbescape.html.HtmlEscape#escapeHtml4
org.unbescape.html.HtmlEscape#escapeHtml5Xml
org.unbescape.html.HtmlEscape#escapeHtml5
org.unbescape.javascript.JavaScriptEscape#escapeJavaScript

Motivation

Additional Notes

@pr-commenter

pr-commenter Bot commented Jul 27, 2023 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~5bb31ca076 1.20.0-SNAPSHOT~03e6d44559
config baseline candidate
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
module Agent Agent
parent None None
variant appsec appsec

Summary

Found 2 performance improvements and 0 performance regressions! Performance is the same for 60 cases.

scenario Δ mean execution_time candidate mean execution_time baseline mean execution_time
scenario:insecure-bank:iast:Remote Config better
[-91.331µs; -48.211µs] or [-14.868%; -7.848%]		 544.523µs 614.294µs
scenario:petclinic:iast:Remote Config better
[-78.874µs; -15.210µs] or [-13.068%; -2.520%]		 556.506µs 603.548µs
Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~03e6d44559, baseline=1.20.0-SNAPSHOT~5bb31ca076

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (981.261 ms) : 0, 981261
Total [baseline] (8.61 s) : 0, 8610188
Agent [candidate] (985.493 ms) : 0, 985493
Total [candidate] (8.594 s) : 0, 8594382
section appsec
Agent [baseline] (1.067 s) : 0, 1067088
Total [baseline] (8.683 s) : 0, 8683318
Agent [candidate] (1.077 s) : 0, 1077241
Total [candidate] (8.721 s) : 0, 8721247
section iast
Agent [baseline] (1.083 s) : 0, 1082605
Total [baseline] (9.126 s) : 0, 9126109
Agent [candidate] (1.086 s) : 0, 1085885
Total [candidate] (9.137 s) : 0, 9137192
section profiling
Agent [baseline] (1.154 s) : 0, 1153846
Total [baseline] (8.897 s) : 0, 8897070
Agent [candidate] (1.162 s) : 0, 1161634
Total [candidate] (8.897 s) : 0, 8897400
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 981.261 ms -
Agent appsec 1.067 s 85.828 ms (8.7%)
Agent iast 1.083 s 101.344 ms (10.3%)
Agent profiling 1.154 s 172.585 ms (17.6%)
Total tracing 8.61 s -
Total appsec 8.683 s 73.13 ms (0.8%)
Total iast 9.126 s 515.921 ms (6.0%)
Total profiling 8.897 s 286.882 ms (3.3%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 985.493 ms -
Agent appsec 1.077 s 91.748 ms (9.3%)
Agent iast 1.086 s 100.393 ms (10.2%)
Agent profiling 1.162 s 176.141 ms (17.9%)
Total tracing 8.594 s -
Total appsec 8.721 s 126.865 ms (1.5%)
Total iast 9.137 s 542.81 ms (6.3%)
Total profiling 8.897 s 303.018 ms (3.5%) 
gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~03e6d44559, baseline=1.20.0-SNAPSHOT~5bb31ca076

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (607.792 ms) : 0, 607792
BytebuddyAgent [candidate] (610.427 ms) : 0, 610427
GlobalTracer [baseline] (283.078 ms) : 0, 283078
GlobalTracer [candidate] (284.27 ms) : 0, 284270
AppSec [baseline] (50.031 ms) : 0, 50031
AppSec [candidate] (50.409 ms) : 0, 50409
Remote Config [baseline] (659.201 µs) : 0, 659
Remote Config [candidate] (657.286 µs) : 0, 657
Telemetry [baseline] (5.445 ms) : 0, 5445
Telemetry [candidate] (5.44 ms) : 0, 5440
section appsec
BytebuddyAgent [baseline] (608.988 ms) : 0, 608988
BytebuddyAgent [candidate] (615.116 ms) : 0, 615116
GlobalTracer [baseline] (283.351 ms) : 0, 283351
GlobalTracer [candidate] (285.953 ms) : 0, 285953
AppSec [baseline] (134.632 ms) : 0, 134632
AppSec [candidate] (135.734 ms) : 0, 135734
Remote Config [baseline] (730.298 µs) : 0, 730
Remote Config [candidate] (724.181 µs) : 0, 724
Telemetry [baseline] (5.16 ms) : 0, 5160
Telemetry [candidate] (5.247 ms) : 0, 5247
section iast
BytebuddyAgent [baseline] (711.562 ms) : 0, 711562
BytebuddyAgent [candidate] (714.88 ms) : 0, 714880
GlobalTracer [baseline] (270.143 ms) : 0, 270143
GlobalTracer [candidate] (270.614 ms) : 0, 270614
AppSec [baseline] (46.563 ms) : 0, 46563
AppSec [candidate] (46.51 ms) : 0, 46510
IAST [baseline] (14.253 ms) : 0, 14253
IAST [candidate] (13.947 ms) : 0, 13947
Remote Config [baseline] (614.294 µs) : 0, 614
Remote Config [candidate] (544.523 µs) : 0, 545
Telemetry [baseline] (5.256 ms) : 0, 5256
Telemetry [candidate] (5.122 ms) : 0, 5122
section profiling
BytebuddyAgent [baseline] (621.843 ms) : 0, 621843
BytebuddyAgent [candidate] (625.863 ms) : 0, 625863
GlobalTracer [baseline] (347.735 ms) : 0, 347735
GlobalTracer [candidate] (350.546 ms) : 0, 350546
AppSec [baseline] (48.892 ms) : 0, 48892
AppSec [candidate] (49.351 ms) : 0, 49351
Remote Config [baseline] (655.31 µs) : 0, 655
Remote Config [candidate] (672.671 µs) : 0, 673
Telemetry [baseline] (5.283 ms) : 0, 5283
Telemetry [candidate] (5.38 ms) : 0, 5380
ProfilingAgent [baseline] (76.686 ms) : 0, 76686
ProfilingAgent [candidate] (76.651 ms) : 0, 76651
Profiling [baseline] (76.71 ms) : 0, 76710
Profiling [candidate] (76.676 ms) : 0, 76676
Loading
Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~03e6d44559, baseline=1.20.0-SNAPSHOT~5bb31ca076

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (996.278 ms) : 0, 996278
Total [baseline] (9.17 s) : 0, 9169859
Agent [candidate] (985.409 ms) : 0, 985409
Total [candidate] (9.143 s) : 0, 9143431
section appsec
Agent [baseline] (1.064 s) : 0, 1064166
Total [baseline] (9.169 s) : 0, 9168965
Agent [candidate] (1.073 s) : 0, 1072669
Total [candidate] (9.269 s) : 0, 9268667
section iast
Agent [baseline] (1.091 s) : 0, 1090825
Total [baseline] (9.434 s) : 0, 9434401
Agent [candidate] (1.083 s) : 0, 1083172
Total [candidate] (9.352 s) : 0, 9351955
section profiling
Agent [baseline] (1.168 s) : 0, 1167979
Total [baseline] (9.462 s) : 0, 9462414
Agent [candidate] (1.166 s) : 0, 1165622
Total [candidate] (9.421 s) : 0, 9420632
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 996.278 ms -
Agent appsec 1.064 s 67.888 ms (6.8%)
Agent iast 1.091 s 94.547 ms (9.5%)
Agent profiling 1.168 s 171.701 ms (17.2%)
Total tracing 9.17 s -
Total appsec 9.169 s -893.948 µs (-0.0%)
Total iast 9.434 s 264.542 ms (2.9%)
Total profiling 9.462 s 292.555 ms (3.2%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 985.409 ms -
Agent appsec 1.073 s 87.261 ms (8.9%)
Agent iast 1.083 s 97.763 ms (9.9%)
Agent profiling 1.166 s 180.213 ms (18.3%)
Total tracing 9.143 s -
Total appsec 9.269 s 125.237 ms (1.4%)
Total iast 9.352 s 208.524 ms (2.3%)
Total profiling 9.421 s 277.201 ms (3.0%) 
gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~03e6d44559, baseline=1.20.0-SNAPSHOT~5bb31ca076

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (617.733 ms) : 0, 617733
BytebuddyAgent [candidate] (610.352 ms) : 0, 610352
GlobalTracer [baseline] (287.405 ms) : 0, 287405
GlobalTracer [candidate] (284.241 ms) : 0, 284241
AppSec [baseline] (50.23 ms) : 0, 50230
AppSec [candidate] (50.492 ms) : 0, 50492
Remote Config [baseline] (667.009 µs) : 0, 667
Remote Config [candidate] (659.661 µs) : 0, 660
Telemetry [baseline] (5.462 ms) : 0, 5462
Telemetry [candidate] (5.408 ms) : 0, 5408
section appsec
BytebuddyAgent [baseline] (607.439 ms) : 0, 607439
BytebuddyAgent [candidate] (610.772 ms) : 0, 610772
GlobalTracer [baseline] (282.43 ms) : 0, 282430
GlobalTracer [candidate] (285.538 ms) : 0, 285538
AppSec [baseline] (134.355 ms) : 0, 134355
AppSec [candidate] (136.267 ms) : 0, 136267
Remote Config [baseline] (725.197 µs) : 0, 725
Remote Config [candidate] (725.716 µs) : 0, 726
Telemetry [baseline] (5.139 ms) : 0, 5139
Telemetry [candidate] (5.181 ms) : 0, 5181
section iast
BytebuddyAgent [baseline] (718.076 ms) : 0, 718076
BytebuddyAgent [candidate] (712.807 ms) : 0, 712807
GlobalTracer [baseline] (271.702 ms) : 0, 271702
GlobalTracer [candidate] (270.254 ms) : 0, 270254
AppSec [baseline] (46.517 ms) : 0, 46517
AppSec [candidate] (46.231 ms) : 0, 46231
IAST [baseline] (14.203 ms) : 0, 14203
IAST [candidate] (14.055 ms) : 0, 14055
Remote Config [baseline] (603.548 µs) : 0, 604
Remote Config [candidate] (556.506 µs) : 0, 557
Telemetry [baseline] (5.201 ms) : 0, 5201
Telemetry [candidate] (5.099 ms) : 0, 5099
section profiling
BytebuddyAgent [baseline] (629.907 ms) : 0, 629907
BytebuddyAgent [candidate] (627.567 ms) : 0, 627567
GlobalTracer [baseline] (351.631 ms) : 0, 351631
GlobalTracer [candidate] (351.524 ms) : 0, 351524
AppSec [baseline] (49.495 ms) : 0, 49495
AppSec [candidate] (49.584 ms) : 0, 49584
Remote Config [baseline] (663.353 µs) : 0, 663
Remote Config [candidate] (663.39 µs) : 0, 663
Telemetry [baseline] (5.382 ms) : 0, 5382
Telemetry [candidate] (5.367 ms) : 0, 5367
ProfilingAgent [baseline] (77.244 ms) : 0, 77244
ProfilingAgent [candidate] (77.751 ms) : 0, 77751
Profiling [baseline] (77.268 ms) : 0, 77268
Profiling [candidate] (77.776 ms) : 0, 77776
Loading

Load

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~5bb31ca076 1.20.0-SNAPSHOT~03e6d44559
config baseline candidate
end_time 2023-08-17T12:23:20 2023-08-17T12:41:20
start_time 2023-08-17T12:23:03 2023-08-17T12:41:03
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~03e6d44559, baseline=1.20.0-SNAPSHOT~5bb31ca076
    dateFormat X
    axisFormat %s
section baseline
no_agent (360.666 µs) : 341, 381
.   : milestone, 361,
appsec (650.066 µs) : 630, 670
.   : milestone, 650,
iast (442.834 µs) : 422, 463
.   : milestone, 443,
iast_FULL (515.082 µs) : 494, 536
.   : milestone, 515,
iast_INACTIVE (429.238 µs) : 408, 451
.   : milestone, 429,
profiling (430.68 µs) : 410, 451
.   : milestone, 431,
tracing (426.932 µs) : 406, 448
.   : milestone, 427,
section candidate
no_agent (361.833 µs) : 342, 382
.   : milestone, 362,
appsec (651.661 µs) : 631, 672
.   : milestone, 652,
iast (448.262 µs) : 427, 469
.   : milestone, 448,
iast_FULL (516.125 µs) : 495, 537
.   : milestone, 516,
iast_INACTIVE (427.898 µs) : 407, 449
.   : milestone, 428,
profiling (430.606 µs) : 410, 451
.   : milestone, 431,
tracing (427.1 µs) : 406, 448
.   : milestone, 427,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 360.666 µs [340.774 µs, 380.557 µs] -
appsec 650.066 µs [629.639 µs, 670.493 µs] 289.4 µs (80.2%)
iast 442.834 µs [422.287 µs, 463.381 µs] 82.168 µs (22.8%)
iast_FULL 515.082 µs [494.265 µs, 535.9 µs] 154.417 µs (42.8%)
iast_INACTIVE 429.238 µs [407.975 µs, 450.501 µs] 68.573 µs (19.0%)
profiling 430.68 µs [410.105 µs, 451.254 µs] 70.014 µs (19.4%)
tracing 426.932 µs [405.938 µs, 447.925 µs] 66.266 µs (18.4%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 361.833 µs [341.529 µs, 382.136 µs] -
appsec 651.661 µs [631.432 µs, 671.891 µs] 289.829 µs (80.1%)
iast 448.262 µs [427.498 µs, 469.026 µs] 86.429 µs (23.9%)
iast_FULL 516.125 µs [495.474 µs, 536.777 µs] 154.293 µs (42.6%)
iast_INACTIVE 427.898 µs [406.837 µs, 448.96 µs] 66.066 µs (18.3%)
profiling 430.606 µs [409.767 µs, 451.445 µs] 68.773 µs (19.0%)
tracing 427.1 µs [405.964 µs, 448.235 µs] 65.267 µs (18.0%)
Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~03e6d44559, baseline=1.20.0-SNAPSHOT~5bb31ca076
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.334 ms) : 1316, 1353
.   : milestone, 1334,
appsec (1.655 ms) : 1631, 1679
.   : milestone, 1655,
iast (1.438 ms) : 1413, 1462
.   : milestone, 1438,
profiling (1.463 ms) : 1439, 1487
.   : milestone, 1463,
tracing (1.436 ms) : 1412, 1460
.   : milestone, 1436,
section candidate
no_agent (1.326 ms) : 1308, 1345
.   : milestone, 1326,
appsec (1.661 ms) : 1637, 1686
.   : milestone, 1661,
iast (1.45 ms) : 1426, 1474
.   : milestone, 1450,
profiling (1.466 ms) : 1442, 1490
.   : milestone, 1466,
tracing (1.416 ms) : 1392, 1440
.   : milestone, 1416,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.334 ms [1.316 ms, 1.353 ms] -
appsec 1.655 ms [1.631 ms, 1.679 ms] 320.537 µs (24.0%)
iast 1.438 ms [1.413 ms, 1.462 ms] 103.136 µs (7.7%)
profiling 1.463 ms [1.439 ms, 1.487 ms] 128.707 µs (9.6%)
tracing 1.436 ms [1.412 ms, 1.46 ms] 101.921 µs (7.6%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.326 ms [1.308 ms, 1.345 ms] -
appsec 1.661 ms [1.637 ms, 1.686 ms] 334.698 µs (25.2%)
iast 1.45 ms [1.426 ms, 1.474 ms] 123.293 µs (9.3%)
profiling 1.466 ms [1.442 ms, 1.49 ms] 139.498 µs (10.5%)
tracing 1.416 ms [1.392 ms, 1.44 ms] 89.648 µs (6.8%)

@smola smola added the comp: asm iast Application Security Management (IAST) label Jul 31, 2023
@jandro996
jandro996 marked this pull request as ready for review August 16, 2023 06:50
@jandro996
jandro996 requested a review from a team as a code owner August 16, 2023 06:50
@jandro996
jandro996 force-pushed the alejandro.gonzalez/unbescape_taint_tracking branch from edee5bf to 5a53d72 Compare August 16, 2023 07:56
@jandro996
jandro996 force-pushed the alejandro.gonzalez/unbescape_taint_tracking branch from 5a53d72 to 51238c0 Compare August 17, 2023 06:57
@jandro996
jandro996 requested review from a team and smola August 17, 2023 07:53
@jandro996
jandro996 merged commit 49f020e into master Aug 18, 2023
@jandro996
jandro996 deleted the alejandro.gonzalez/unbescape_taint_tracking branch August 18, 2023 10:49
@github-actions github-actions Bot added this to the 1.20.0 milestone Aug 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.20.0

Development

Successfully merging this pull request may close these issues.

2 participants

@jandro996 @smola