Skip to content

Add JavaScriptUtils.javaScriptEscape tainting support#5648

Merged
jandro996 merged 3 commits into
masterfrom
alejandro.gonzalez/spring_js_utils_taint_tracking
Aug 18, 2023
Merged

Add JavaScriptUtils.javaScriptEscape tainting support#5648
jandro996 merged 3 commits into
masterfrom
alejandro.gonzalez/spring_js_utils_taint_tracking

Conversation

@jandro996

@jandro996 jandro996 commented Jul 27, 2023

Copy link
Copy Markdown
Member

What Does This Do

Add org.springframework.web.util.JavaScriptUtils.javaScriptEscape tainting support
Refactor HtmlUtilsCallSite

Motivation

Additional Notes

@jandro996 jandro996 added the comp: asm iast Application Security Management (IAST) label Jul 27, 2023
@pr-commenter

pr-commenter Bot commented Jul 27, 2023 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~e3aa415c99 1.20.0-SNAPSHOT~a4924ae1d0
config baseline candidate
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
module Agent Agent
parent None None
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 62 cases.

Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~a4924ae1d0, baseline=1.20.0-SNAPSHOT~e3aa415c99

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (999.257 ms) : 0, 999257
Total [baseline] (8.74 s) : 0, 8740373
Agent [candidate] (987.215 ms) : 0, 987215
Total [candidate] (8.639 s) : 0, 8638591
section appsec
Agent [baseline] (1.078 s) : 0, 1077622
Total [baseline] (8.749 s) : 0, 8748700
Agent [candidate] (1.074 s) : 0, 1073797
Total [candidate] (8.72 s) : 0, 8719902
section iast
Agent [baseline] (1.085 s) : 0, 1085452
Total [baseline] (9.136 s) : 0, 9135557
Agent [candidate] (1.09 s) : 0, 1090422
Total [candidate] (9.168 s) : 0, 9168239
section profiling
Agent [baseline] (1.156 s) : 0, 1156364
Total [baseline] (8.848 s) : 0, 8848283
Agent [candidate] (1.164 s) : 0, 1163892
Total [candidate] (8.884 s) : 0, 8883517
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 999.257 ms -
Agent appsec 1.078 s 78.365 ms (7.8%)
Agent iast 1.085 s 86.195 ms (8.6%)
Agent profiling 1.156 s 157.107 ms (15.7%)
Total tracing 8.74 s -
Total appsec 8.749 s 8.327 ms (0.1%)
Total iast 9.136 s 395.184 ms (4.5%)
Total profiling 8.848 s 107.911 ms (1.2%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 987.215 ms -
Agent appsec 1.074 s 86.581 ms (8.8%)
Agent iast 1.09 s 103.207 ms (10.5%)
Agent profiling 1.164 s 176.676 ms (17.9%)
Total tracing 8.639 s -
Total appsec 8.72 s 81.311 ms (0.9%)
Total iast 9.168 s 529.648 ms (6.1%)
Total profiling 8.884 s 244.926 ms (2.8%) 
gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~a4924ae1d0, baseline=1.20.0-SNAPSHOT~e3aa415c99

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (618.738 ms) : 0, 618738
BytebuddyAgent [candidate] (611.605 ms) : 0, 611605
GlobalTracer [baseline] (288.044 ms) : 0, 288044
GlobalTracer [candidate] (284.006 ms) : 0, 284006
AppSec [baseline] (50.865 ms) : 0, 50865
AppSec [candidate] (50.541 ms) : 0, 50541
Remote Config [baseline] (673.799 µs) : 0, 674
Remote Config [candidate] (667.337 µs) : 0, 667
Telemetry [baseline] (6.121 ms) : 0, 6121
Telemetry [candidate] (6.064 ms) : 0, 6064
section appsec
BytebuddyAgent [baseline] (614.765 ms) : 0, 614765
BytebuddyAgent [candidate] (612.377 ms) : 0, 612377
GlobalTracer [baseline] (285.737 ms) : 0, 285737
GlobalTracer [candidate] (285.1 ms) : 0, 285100
AppSec [baseline] (136.079 ms) : 0, 136079
AppSec [candidate] (135.509 ms) : 0, 135509
Remote Config [baseline] (718.963 µs) : 0, 719
Remote Config [candidate] (722.676 µs) : 0, 723
Telemetry [baseline] (5.759 ms) : 0, 5759
Telemetry [candidate] (5.72 ms) : 0, 5720
section iast
BytebuddyAgent [baseline] (715.076 ms) : 0, 715076
BytebuddyAgent [candidate] (716.963 ms) : 0, 716963
GlobalTracer [baseline] (269.122 ms) : 0, 269122
GlobalTracer [candidate] (271.867 ms) : 0, 271867
AppSec [baseline] (47.001 ms) : 0, 47001
AppSec [candidate] (47.156 ms) : 0, 47156
Remote Config [baseline] (555.929 µs) : 0, 556
Remote Config [candidate] (548.732 µs) : 0, 549
Telemetry [baseline] (5.682 ms) : 0, 5682
Telemetry [candidate] (5.734 ms) : 0, 5734
IAST [baseline] (13.778 ms) : 0, 13778
IAST [candidate] (13.885 ms) : 0, 13885
section profiling
ProfilingAgent [baseline] (75.796 ms) : 0, 75796
ProfilingAgent [candidate] (76.243 ms) : 0, 76243
BytebuddyAgent [baseline] (623.218 ms) : 0, 623218
BytebuddyAgent [candidate] (627.479 ms) : 0, 627479
GlobalTracer [baseline] (348.567 ms) : 0, 348567
GlobalTracer [candidate] (350.884 ms) : 0, 350884
AppSec [baseline] (49.276 ms) : 0, 49276
AppSec [candidate] (49.413 ms) : 0, 49413
Remote Config [baseline] (657.518 µs) : 0, 658
Remote Config [candidate] (665.296 µs) : 0, 665
Telemetry [baseline] (5.918 ms) : 0, 5918
Telemetry [candidate] (5.954 ms) : 0, 5954
Profiling [baseline] (75.821 ms) : 0, 75821
Profiling [candidate] (76.267 ms) : 0, 76267
Loading
Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~a4924ae1d0, baseline=1.20.0-SNAPSHOT~e3aa415c99

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (986.05 ms) : 0, 986050
Total [baseline] (9.142 s) : 0, 9142420
Agent [candidate] (995.383 ms) : 0, 995383
Total [candidate] (9.224 s) : 0, 9223886
section appsec
Agent [baseline] (1.069 s) : 0, 1069074
Total [baseline] (9.272 s) : 0, 9271909
Agent [candidate] (1.08 s) : 0, 1079933
Total [candidate] (9.286 s) : 0, 9285810
section iast
Agent [baseline] (1.089 s) : 0, 1088613
Total [baseline] (9.404 s) : 0, 9403534
Agent [candidate] (1.091 s) : 0, 1090668
Total [candidate] (9.465 s) : 0, 9465420
section profiling
Agent [baseline] (1.159 s) : 0, 1158883
Total [baseline] (9.466 s) : 0, 9465558
Agent [candidate] (1.158 s) : 0, 1158025
Total [candidate] (9.462 s) : 0, 9462438
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 986.05 ms -
Agent appsec 1.069 s 83.024 ms (8.4%)
Agent iast 1.089 s 102.562 ms (10.4%)
Agent profiling 1.159 s 172.833 ms (17.5%)
Total tracing 9.142 s -
Total appsec 9.272 s 129.489 ms (1.4%)
Total iast 9.404 s 261.113 ms (2.9%)
Total profiling 9.466 s 323.138 ms (3.5%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 995.383 ms -
Agent appsec 1.08 s 84.551 ms (8.5%)
Agent iast 1.091 s 95.285 ms (9.6%)
Agent profiling 1.158 s 162.642 ms (16.3%)
Total tracing 9.224 s -
Total appsec 9.286 s 61.925 ms (0.7%)
Total iast 9.465 s 241.535 ms (2.6%)
Total profiling 9.462 s 238.552 ms (2.6%) 
gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~a4924ae1d0, baseline=1.20.0-SNAPSHOT~e3aa415c99

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (611.122 ms) : 0, 611122
BytebuddyAgent [candidate] (616.43 ms) : 0, 616430
GlobalTracer [baseline] (283.184 ms) : 0, 283184
GlobalTracer [candidate] (287.199 ms) : 0, 287199
AppSec [baseline] (50.846 ms) : 0, 50846
AppSec [candidate] (50.43 ms) : 0, 50430
Remote Config [baseline] (664.555 µs) : 0, 665
Remote Config [candidate] (667.568 µs) : 0, 668
Telemetry [baseline] (6.032 ms) : 0, 6032
Telemetry [candidate] (6.066 ms) : 0, 6066
section appsec
BytebuddyAgent [baseline] (609.787 ms) : 0, 609787
BytebuddyAgent [candidate] (615.915 ms) : 0, 615915
GlobalTracer [baseline] (283.433 ms) : 0, 283433
GlobalTracer [candidate] (286.945 ms) : 0, 286945
AppSec [baseline] (135.291 ms) : 0, 135291
AppSec [candidate] (135.981 ms) : 0, 135981
Remote Config [baseline] (719.451 µs) : 0, 719
Remote Config [candidate] (731.179 µs) : 0, 731
Telemetry [baseline] (5.7 ms) : 0, 5700
Telemetry [candidate] (5.783 ms) : 0, 5783
section iast
BytebuddyAgent [baseline] (716.38 ms) : 0, 716380
BytebuddyAgent [candidate] (718.703 ms) : 0, 718703
GlobalTracer [baseline] (270.651 ms) : 0, 270651
GlobalTracer [candidate] (270.62 ms) : 0, 270620
AppSec [baseline] (47.038 ms) : 0, 47038
AppSec [candidate] (46.86 ms) : 0, 46860
Remote Config [baseline] (551.141 µs) : 0, 551
Remote Config [candidate] (566.92 µs) : 0, 567
Telemetry [baseline] (5.748 ms) : 0, 5748
Telemetry [candidate] (5.714 ms) : 0, 5714
IAST [baseline] (13.889 ms) : 0, 13889
IAST [candidate] (13.82 ms) : 0, 13820
section profiling
ProfilingAgent [baseline] (76.742 ms) : 0, 76742
ProfilingAgent [candidate] (76.329 ms) : 0, 76329
BytebuddyAgent [baseline] (623.683 ms) : 0, 623683
BytebuddyAgent [candidate] (623.827 ms) : 0, 623827
GlobalTracer [baseline] (349.636 ms) : 0, 349636
GlobalTracer [candidate] (349.131 ms) : 0, 349131
AppSec [baseline] (49.191 ms) : 0, 49191
AppSec [candidate] (49.16 ms) : 0, 49160
Remote Config [baseline] (657.016 µs) : 0, 657
Remote Config [candidate] (665.035 µs) : 0, 665
Telemetry [baseline] (5.981 ms) : 0, 5981
Telemetry [candidate] (5.98 ms) : 0, 5980
Profiling [baseline] (76.767 ms) : 0, 76767
Profiling [candidate] (76.353 ms) : 0, 76353
Loading

Load

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~e3aa415c99 1.20.0-SNAPSHOT~a4924ae1d0
config baseline candidate
end_time 2023-08-18T11:30:06 2023-08-18T11:48:10
start_time 2023-08-18T11:29:48 2023-08-18T11:47:53
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~a4924ae1d0, baseline=1.20.0-SNAPSHOT~e3aa415c99
    dateFormat X
    axisFormat %s
section baseline
no_agent (365.789 µs) : 344, 387
.   : milestone, 366,
appsec (653.837 µs) : 633, 674
.   : milestone, 654,
iast (456.871 µs) : 436, 478
.   : milestone, 457,
iast_FULL (512.863 µs) : 492, 534
.   : milestone, 513,
iast_INACTIVE (426.415 µs) : 406, 447
.   : milestone, 426,
profiling (432.442 µs) : 412, 453
.   : milestone, 432,
tracing (437.878 µs) : 417, 459
.   : milestone, 438,
section candidate
no_agent (362.089 µs) : 342, 382
.   : milestone, 362,
appsec (649.92 µs) : 630, 670
.   : milestone, 650,
iast (450.863 µs) : 430, 472
.   : milestone, 451,
iast_FULL (518.113 µs) : 498, 539
.   : milestone, 518,
iast_INACTIVE (432.498 µs) : 411, 454
.   : milestone, 432,
profiling (438.851 µs) : 418, 460
.   : milestone, 439,
tracing (427.824 µs) : 407, 449
.   : milestone, 428,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 365.789 µs [344.453 µs, 387.126 µs] -
appsec 653.837 µs [633.32 µs, 674.355 µs] 288.048 µs (78.7%)
iast 456.871 µs [435.659 µs, 478.083 µs] 91.082 µs (24.9%)
iast_FULL 512.863 µs [492.211 µs, 533.515 µs] 147.074 µs (40.2%)
iast_INACTIVE 426.415 µs [405.824 µs, 447.007 µs] 60.626 µs (16.6%)
profiling 432.442 µs [411.698 µs, 453.185 µs] 66.652 µs (18.2%)
tracing 437.878 µs [416.899 µs, 458.857 µs] 72.089 µs (19.7%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 362.089 µs [342.208 µs, 381.971 µs] -
appsec 649.92 µs [630.16 µs, 669.68 µs] 287.831 µs (79.5%)
iast 450.863 µs [430.067 µs, 471.658 µs] 88.773 µs (24.5%)
iast_FULL 518.113 µs [497.6 µs, 538.627 µs] 156.024 µs (43.1%)
iast_INACTIVE 432.498 µs [411.428 µs, 453.567 µs] 70.408 µs (19.4%)
profiling 438.851 µs [417.518 µs, 460.185 µs] 76.762 µs (21.2%)
tracing 427.824 µs [407.075 µs, 448.573 µs] 65.735 µs (18.2%)
Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~a4924ae1d0, baseline=1.20.0-SNAPSHOT~e3aa415c99
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.32 ms) : 1301, 1339
.   : milestone, 1320,
appsec (1.649 ms) : 1624, 1673
.   : milestone, 1649,
iast (1.453 ms) : 1428, 1479
.   : milestone, 1453,
profiling (1.438 ms) : 1413, 1462
.   : milestone, 1438,
tracing (1.436 ms) : 1411, 1461
.   : milestone, 1436,
section candidate
no_agent (1.321 ms) : 1302, 1340
.   : milestone, 1321,
appsec (1.678 ms) : 1654, 1703
.   : milestone, 1678,
iast (1.427 ms) : 1403, 1451
.   : milestone, 1427,
profiling (1.457 ms) : 1431, 1483
.   : milestone, 1457,
tracing (1.424 ms) : 1399, 1448
.   : milestone, 1424,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.32 ms [1.301 ms, 1.339 ms] -
appsec 1.649 ms [1.624 ms, 1.673 ms] 328.761 µs (24.9%)
iast 1.453 ms [1.428 ms, 1.479 ms] 133.297 µs (10.1%)
profiling 1.438 ms [1.413 ms, 1.462 ms] 117.571 µs (8.9%)
tracing 1.436 ms [1.411 ms, 1.461 ms] 116.049 µs (8.8%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.321 ms [1.302 ms, 1.34 ms] -
appsec 1.678 ms [1.654 ms, 1.703 ms] 357.451 µs (27.1%)
iast 1.427 ms [1.403 ms, 1.451 ms] 106.522 µs (8.1%)
profiling 1.457 ms [1.431 ms, 1.483 ms] 136.105 µs (10.3%)
tracing 1.424 ms [1.399 ms, 1.448 ms] 102.87 µs (7.8%)

@jandro996
jandro996 marked this pull request as ready for review August 16, 2023 06:52
@jandro996
jandro996 requested a review from a team as a code owner August 16, 2023 06:52
@jandro996
jandro996 force-pushed the alejandro.gonzalez/spring_js_utils_taint_tracking branch 2 times, most recently from 38da5f1 to 64a253c Compare August 17, 2023 06:59
@jandro996
jandro996 requested review from a team and ValentinZakharov August 17, 2023 07:53
@jandro996
jandro996 force-pushed the alejandro.gonzalez/spring_js_utils_taint_tracking branch from 4a98d3f to a4924ae Compare August 18, 2023 11:07
@jandro996
jandro996 merged commit 4663dd5 into master Aug 18, 2023
@jandro996
jandro996 deleted the alejandro.gonzalez/spring_js_utils_taint_tracking branch August 18, 2023 12:20
@github-actions github-actions Bot added this to the 1.20.0 milestone Aug 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes
@ValentinZakharov ValentinZakharov Awaiting requested review from ValentinZakharov

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.20.0

Development

Successfully merging this pull request may close these issues.

2 participants

@jandro996 @smola