Skip to content

Add URLEncoder tainting support#5656

Merged
jandro996 merged 3 commits into
masterfrom
alejandro.gonzalez/url_encoder_secure_mark
Aug 18, 2023
Merged

Add URLEncoder tainting support#5656
jandro996 merged 3 commits into
masterfrom
alejandro.gonzalez/url_encoder_secure_mark

Conversation

@jandro996

@jandro996 jandro996 commented Jul 28, 2023 •
edited
Loading

Copy link
Copy Markdown
Member

What Does This Do

Add java.net.URLEncoder#encode tainting support

Motivation

Additional Notes

@jandro996 jandro996 added the comp: asm iast Application Security Management (IAST) label Jul 28, 2023
@pr-commenter

pr-commenter Bot commented Jul 28, 2023 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~5bb31ca076 1.20.0-SNAPSHOT~b1bfba638c
config baseline candidate
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
module Agent Agent
parent None None
variant appsec appsec

Summary

Found 0 performance improvements and 1 performance regressions! Performance is the same for 61 cases.

scenario Δ mean execution_time candidate mean execution_time baseline mean execution_time
scenario:insecure-bank:iast:Remote Config worse
[+13.576µs; +48.899µs] or [+2.243%; +8.078%]		 636.571µs 605.333µs
Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~b1bfba638c, baseline=1.20.0-SNAPSHOT~5bb31ca076

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (990.801 ms) : 0, 990801
Total [baseline] (8.641 s) : 0, 8641216
Agent [candidate] (990.619 ms) : 0, 990619
Total [candidate] (8.655 s) : 0, 8654711
section appsec
Agent [baseline] (1.076 s) : 0, 1075908
Total [baseline] (8.711 s) : 0, 8711330
Agent [candidate] (1.082 s) : 0, 1082228
Total [candidate] (8.757 s) : 0, 8757037
section iast
Agent [baseline] (1.094 s) : 0, 1093712
Total [baseline] (9.251 s) : 0, 9251259
Agent [candidate] (1.094 s) : 0, 1094078
Total [candidate] (9.146 s) : 0, 9146180
section profiling
Agent [baseline] (1.163 s) : 0, 1162674
Total [baseline] (8.886 s) : 0, 8885604
Agent [candidate] (1.179 s) : 0, 1178502
Total [candidate] (8.92 s) : 0, 8920239
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 990.801 ms -
Agent appsec 1.076 s 85.108 ms (8.6%)
Agent iast 1.094 s 102.912 ms (10.4%)
Agent profiling 1.163 s 171.873 ms (17.3%)
Total tracing 8.641 s -
Total appsec 8.711 s 70.113 ms (0.8%)
Total iast 9.251 s 610.043 ms (7.1%)
Total profiling 8.886 s 244.387 ms (2.8%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 990.619 ms -
Agent appsec 1.082 s 91.609 ms (9.2%)
Agent iast 1.094 s 103.459 ms (10.4%)
Agent profiling 1.179 s 187.883 ms (19.0%)
Total tracing 8.655 s -
Total appsec 8.757 s 102.327 ms (1.2%)
Total iast 9.146 s 491.47 ms (5.7%)
Total profiling 8.92 s 265.528 ms (3.1%) 
gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~b1bfba638c, baseline=1.20.0-SNAPSHOT~5bb31ca076

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (614.349 ms) : 0, 614349
BytebuddyAgent [candidate] (613.376 ms) : 0, 613376
GlobalTracer [baseline] (285.427 ms) : 0, 285427
GlobalTracer [candidate] (286.079 ms) : 0, 286079
AppSec [baseline] (50.451 ms) : 0, 50451
AppSec [candidate] (50.496 ms) : 0, 50496
Remote Config [baseline] (666.956 µs) : 0, 667
Remote Config [candidate] (671.107 µs) : 0, 671
Telemetry [baseline] (5.418 ms) : 0, 5418
Telemetry [candidate] (5.44 ms) : 0, 5440
section appsec
BytebuddyAgent [baseline] (614.375 ms) : 0, 614375
BytebuddyAgent [candidate] (616.649 ms) : 0, 616649
GlobalTracer [baseline] (285.318 ms) : 0, 285318
GlobalTracer [candidate] (289.126 ms) : 0, 289126
AppSec [baseline] (135.879 ms) : 0, 135879
AppSec [candidate] (135.913 ms) : 0, 135913
Remote Config [baseline] (728.37 µs) : 0, 728
Remote Config [candidate] (734.101 µs) : 0, 734
Telemetry [baseline] (5.185 ms) : 0, 5185
Telemetry [candidate] (5.207 ms) : 0, 5207
section iast
BytebuddyAgent [baseline] (719.701 ms) : 0, 719701
BytebuddyAgent [candidate] (719.758 ms) : 0, 719758
GlobalTracer [baseline] (272.649 ms) : 0, 272649
GlobalTracer [candidate] (272.474 ms) : 0, 272474
AppSec [baseline] (46.704 ms) : 0, 46704
AppSec [candidate] (46.838 ms) : 0, 46838
Remote Config [baseline] (605.333 µs) : 0, 605
Remote Config [candidate] (636.571 µs) : 0, 637
Telemetry [baseline] (5.219 ms) : 0, 5219
Telemetry [candidate] (5.275 ms) : 0, 5275
IAST [baseline] (14.276 ms) : 0, 14276
IAST [candidate] (14.669 ms) : 0, 14669
section profiling
BytebuddyAgent [baseline] (627.111 ms) : 0, 627111
BytebuddyAgent [candidate] (635.945 ms) : 0, 635945
GlobalTracer [baseline] (351.034 ms) : 0, 351034
GlobalTracer [candidate] (355.423 ms) : 0, 355423
AppSec [baseline] (49.324 ms) : 0, 49324
AppSec [candidate] (50.072 ms) : 0, 50072
Remote Config [baseline] (673.216 µs) : 0, 673
Remote Config [candidate] (688.598 µs) : 0, 689
Telemetry [baseline] (5.359 ms) : 0, 5359
Telemetry [candidate] (5.43 ms) : 0, 5430
ProfilingAgent [baseline] (75.921 ms) : 0, 75921
ProfilingAgent [candidate] (76.812 ms) : 0, 76812
Profiling [baseline] (75.945 ms) : 0, 75945
Profiling [candidate] (76.837 ms) : 0, 76837
Loading
Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~b1bfba638c, baseline=1.20.0-SNAPSHOT~5bb31ca076

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (988.978 ms) : 0, 988978
Total [baseline] (9.201 s) : 0, 9200837
Agent [candidate] (992.481 ms) : 0, 992481
Total [candidate] (9.158 s) : 0, 9157888
section appsec
Agent [baseline] (1.071 s) : 0, 1071239
Total [baseline] (9.239 s) : 0, 9239011
Agent [candidate] (1.07 s) : 0, 1069805
Total [candidate] (9.223 s) : 0, 9222693
section iast
Agent [baseline] (1.091 s) : 0, 1091486
Total [baseline] (9.425 s) : 0, 9424892
Agent [candidate] (1.084 s) : 0, 1084036
Total [candidate] (9.363 s) : 0, 9362540
section profiling
Agent [baseline] (1.155 s) : 0, 1155331
Total [baseline] (9.417 s) : 0, 9417412
Agent [candidate] (1.162 s) : 0, 1162498
Total [candidate] (9.53 s) : 0, 9529834
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 988.978 ms -
Agent appsec 1.071 s 82.261 ms (8.3%)
Agent iast 1.091 s 102.508 ms (10.4%)
Agent profiling 1.155 s 166.352 ms (16.8%)
Total tracing 9.201 s -
Total appsec 9.239 s 38.174 ms (0.4%)
Total iast 9.425 s 224.055 ms (2.4%)
Total profiling 9.417 s 216.574 ms (2.4%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 992.481 ms -
Agent appsec 1.07 s 77.323 ms (7.8%)
Agent iast 1.084 s 91.555 ms (9.2%)
Agent profiling 1.162 s 170.016 ms (17.1%)
Total tracing 9.158 s -
Total appsec 9.223 s 64.806 ms (0.7%)
Total iast 9.363 s 204.652 ms (2.2%)
Total profiling 9.53 s 371.946 ms (4.1%) 
gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~b1bfba638c, baseline=1.20.0-SNAPSHOT~5bb31ca076

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (612.671 ms) : 0, 612671
BytebuddyAgent [candidate] (614.586 ms) : 0, 614586
GlobalTracer [baseline] (285.494 ms) : 0, 285494
GlobalTracer [candidate] (286.804 ms) : 0, 286804
AppSec [baseline] (50.378 ms) : 0, 50378
AppSec [candidate] (50.475 ms) : 0, 50475
Remote Config [baseline] (663.926 µs) : 0, 664
Remote Config [candidate] (664.511 µs) : 0, 665
Telemetry [baseline] (5.421 ms) : 0, 5421
Telemetry [candidate] (5.488 ms) : 0, 5488
section appsec
BytebuddyAgent [baseline] (610.418 ms) : 0, 610418
BytebuddyAgent [candidate] (610.195 ms) : 0, 610195
GlobalTracer [baseline] (284.996 ms) : 0, 284996
GlobalTracer [candidate] (283.819 ms) : 0, 283819
AppSec [baseline] (135.722 ms) : 0, 135722
AppSec [candidate] (135.77 ms) : 0, 135770
Remote Config [baseline] (719.699 µs) : 0, 720
Remote Config [candidate] (727.899 µs) : 0, 728
Telemetry [baseline] (5.218 ms) : 0, 5218
Telemetry [candidate] (5.148 ms) : 0, 5148
section iast
BytebuddyAgent [baseline] (717.993 ms) : 0, 717993
BytebuddyAgent [candidate] (712.792 ms) : 0, 712792
GlobalTracer [baseline] (272.178 ms) : 0, 272178
GlobalTracer [candidate] (270.579 ms) : 0, 270579
AppSec [baseline] (46.656 ms) : 0, 46656
AppSec [candidate] (46.688 ms) : 0, 46688
Remote Config [baseline] (620.061 µs) : 0, 620
Remote Config [candidate] (601.956 µs) : 0, 602
Telemetry [baseline] (5.255 ms) : 0, 5255
Telemetry [candidate] (5.081 ms) : 0, 5081
IAST [baseline] (14.386 ms) : 0, 14386
IAST [candidate] (14.103 ms) : 0, 14103
section profiling
BytebuddyAgent [baseline] (623.518 ms) : 0, 623518
BytebuddyAgent [candidate] (625.45 ms) : 0, 625450
GlobalTracer [baseline] (348.479 ms) : 0, 348479
GlobalTracer [candidate] (350.527 ms) : 0, 350527
AppSec [baseline] (49.001 ms) : 0, 49001
AppSec [candidate] (49.515 ms) : 0, 49515
Remote Config [baseline] (656.774 µs) : 0, 657
Remote Config [candidate] (660.81 µs) : 0, 661
Telemetry [baseline] (5.342 ms) : 0, 5342
Telemetry [candidate] (5.411 ms) : 0, 5411
ProfilingAgent [baseline] (75.444 ms) : 0, 75444
ProfilingAgent [candidate] (77.923 ms) : 0, 77923
Profiling [baseline] (75.468 ms) : 0, 75468
Profiling [candidate] (77.948 ms) : 0, 77948
Loading

Load

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~5bb31ca076 1.20.0-SNAPSHOT~b1bfba638c
config baseline candidate
end_time 2023-08-17T12:10:03 2023-08-17T12:28:08
start_time 2023-08-17T12:09:46 2023-08-17T12:27:51
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~b1bfba638c, baseline=1.20.0-SNAPSHOT~5bb31ca076
    dateFormat X
    axisFormat %s
section baseline
no_agent (361.741 µs) : 342, 382
.   : milestone, 362,
appsec (658.095 µs) : 637, 679
.   : milestone, 658,
iast (449.166 µs) : 429, 470
.   : milestone, 449,
iast_FULL (509.479 µs) : 489, 530
.   : milestone, 509,
iast_INACTIVE (430.726 µs) : 410, 451
.   : milestone, 431,
profiling (426.896 µs) : 406, 448
.   : milestone, 427,
tracing (424.438 µs) : 404, 445
.   : milestone, 424,
section candidate
no_agent (359.363 µs) : 339, 380
.   : milestone, 359,
appsec (650.402 µs) : 630, 671
.   : milestone, 650,
iast (449.93 µs) : 429, 471
.   : milestone, 450,
iast_FULL (515.623 µs) : 495, 537
.   : milestone, 516,
iast_INACTIVE (430.266 µs) : 409, 452
.   : milestone, 430,
profiling (430.271 µs) : 410, 451
.   : milestone, 430,
tracing (431.893 µs) : 410, 454
.   : milestone, 432,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 361.741 µs [341.789 µs, 381.692 µs] -
appsec 658.095 µs [637.243 µs, 678.948 µs] 296.355 µs (81.9%)
iast 449.166 µs [428.684 µs, 469.649 µs] 87.426 µs (24.2%)
iast_FULL 509.479 µs [488.693 µs, 530.265 µs] 147.738 µs (40.8%)
iast_INACTIVE 430.726 µs [410.047 µs, 451.405 µs] 68.985 µs (19.1%)
profiling 426.896 µs [406.094 µs, 447.698 µs] 65.155 µs (18.0%)
tracing 424.438 µs [404.139 µs, 444.737 µs] 62.698 µs (17.3%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 359.363 µs [338.899 µs, 379.827 µs] -
appsec 650.402 µs [630.148 µs, 670.656 µs] 291.039 µs (81.0%)
iast 449.93 µs [429.187 µs, 470.672 µs] 90.567 µs (25.2%)
iast_FULL 515.623 µs [494.673 µs, 536.573 µs] 156.26 µs (43.5%)
iast_INACTIVE 430.266 µs [409.024 µs, 451.508 µs] 70.903 µs (19.7%)
profiling 430.271 µs [409.564 µs, 450.978 µs] 70.908 µs (19.7%)
tracing 431.893 µs [410.016 µs, 453.771 µs] 72.53 µs (20.2%)
Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~b1bfba638c, baseline=1.20.0-SNAPSHOT~5bb31ca076
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.338 ms) : 1318, 1357
.   : milestone, 1338,
appsec (1.679 ms) : 1655, 1703
.   : milestone, 1679,
iast (1.465 ms) : 1440, 1489
.   : milestone, 1465,
profiling (1.469 ms) : 1444, 1494
.   : milestone, 1469,
tracing (1.466 ms) : 1441, 1490
.   : milestone, 1466,
section candidate
no_agent (1.305 ms) : 1286, 1325
.   : milestone, 1305,
appsec (1.668 ms) : 1643, 1692
.   : milestone, 1668,
iast (1.466 ms) : 1442, 1491
.   : milestone, 1466,
profiling (1.465 ms) : 1438, 1491
.   : milestone, 1465,
tracing (1.438 ms) : 1414, 1462
.   : milestone, 1438,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.338 ms [1.318 ms, 1.357 ms] -
appsec 1.679 ms [1.655 ms, 1.703 ms] 341.29 µs (25.5%)
iast 1.465 ms [1.44 ms, 1.489 ms] 127.049 µs (9.5%)
profiling 1.469 ms [1.444 ms, 1.494 ms] 131.361 µs (9.8%)
tracing 1.466 ms [1.441 ms, 1.49 ms] 128.253 µs (9.6%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.305 ms [1.286 ms, 1.325 ms] -
appsec 1.668 ms [1.643 ms, 1.692 ms] 362.439 µs (27.8%)
iast 1.466 ms [1.442 ms, 1.491 ms] 160.932 µs (12.3%)
profiling 1.465 ms [1.438 ms, 1.491 ms] 159.353 µs (12.2%)
tracing 1.438 ms [1.414 ms, 1.462 ms] 132.543 µs (10.2%)

@jandro996
jandro996 marked this pull request as ready for review August 16, 2023 06:55
@jandro996
jandro996 requested a review from a team as a code owner August 16, 2023 06:55
@jandro996
jandro996 force-pushed the alejandro.gonzalez/url_encoder_secure_mark branch from 498905e to d677d22 Compare August 16, 2023 08:03
@jandro996
jandro996 force-pushed the alejandro.gonzalez/url_encoder_secure_mark branch from d677d22 to e352c44 Compare August 17, 2023 05:52
@jandro996
jandro996 requested review from a team and DDJavierSantos August 17, 2023 07:54
@jandro996
jandro996 merged commit e3aa415 into master Aug 18, 2023
@jandro996
jandro996 deleted the alejandro.gonzalez/url_encoder_secure_mark branch August 18, 2023 10:49
@github-actions github-actions Bot added this to the 1.20.0 milestone Aug 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes
@DDJavierSantos DDJavierSantos Awaiting requested review from DDJavierSantos

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.20.0

Development

Successfully merging this pull request may close these issues.

2 participants

@jandro996 @smola