Skip to content

Redact empty sensitive ranges#5706

Merged
manuel-alvarez-alvarez merged 1 commit into
masterfrom
malvarez/iast-improve-redaction-empty-literals
Aug 11, 2023
Merged

Redact empty sensitive ranges#5706
manuel-alvarez-alvarez merged 1 commit into
masterfrom
malvarez/iast-improve-redaction-empty-literals

Conversation

@manuel-alvarez-alvarez

@manuel-alvarez-alvarez manuel-alvarez-alvarez commented Aug 10, 2023

Copy link
Copy Markdown
Member

What Does This Do

When redacting SQL queries, an empty literal should be redacted as well or we would be leaking information.

Motivation

Additional Notes

@manuel-alvarez-alvarez manuel-alvarez-alvarez added the comp: asm iast Application Security Management (IAST) label Aug 10, 2023
@manuel-alvarez-alvarez
manuel-alvarez-alvarez requested review from a team and jandro996 August 10, 2023 09:01
@pr-commenter

pr-commenter Bot commented Aug 10, 2023

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~8c080b4046 1.20.0-SNAPSHOT~7110d94160
config baseline candidate
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
module Agent Agent
parent None None
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 62 cases.

Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~7110d94160, baseline=1.20.0-SNAPSHOT~8c080b4046

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (986.06 ms) : 0, 986060
Total [baseline] (9.167 s) : 0, 9166613
Agent [candidate] (984.564 ms) : 0, 984564
Total [candidate] (9.204 s) : 0, 9204430
section appsec
Agent [baseline] (1.072 s) : 0, 1072024
Total [baseline] (9.283 s) : 0, 9282597
Agent [candidate] (1.07 s) : 0, 1069700
Total [candidate] (9.248 s) : 0, 9247590
section iast
Agent [baseline] (1.084 s) : 0, 1083676
Total [baseline] (9.432 s) : 0, 9431664
Agent [candidate] (1.085 s) : 0, 1085078
Total [candidate] (9.421 s) : 0, 9420538
section profiling
Agent [baseline] (1.153 s) : 0, 1152628
Total [baseline] (9.47 s) : 0, 9469862
Agent [candidate] (1.165 s) : 0, 1165431
Total [candidate] (9.55 s) : 0, 9549762
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 986.06 ms -
Agent appsec 1.072 s 85.965 ms (8.7%)
Agent iast 1.084 s 97.616 ms (9.9%)
Agent profiling 1.153 s 166.569 ms (16.9%)
Total tracing 9.167 s -
Total appsec 9.283 s 115.985 ms (1.3%)
Total iast 9.432 s 265.051 ms (2.9%)
Total profiling 9.47 s 303.25 ms (3.3%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 984.564 ms -
Agent appsec 1.07 s 85.136 ms (8.6%)
Agent iast 1.085 s 100.514 ms (10.2%)
Agent profiling 1.165 s 180.867 ms (18.4%)
Total tracing 9.204 s -
Total appsec 9.248 s 43.16 ms (0.5%)
Total iast 9.421 s 216.108 ms (2.3%)
Total profiling 9.55 s 345.333 ms (3.8%) 
gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~7110d94160, baseline=1.20.0-SNAPSHOT~8c080b4046

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (611.334 ms) : 0, 611334
BytebuddyAgent [candidate] (610.158 ms) : 0, 610158
GlobalTracer [baseline] (283.702 ms) : 0, 283702
GlobalTracer [candidate] (284.085 ms) : 0, 284085
AppSec [baseline] (50.533 ms) : 0, 50533
AppSec [candidate] (50.061 ms) : 0, 50061
Remote Config [baseline] (677.025 µs) : 0, 677
Remote Config [candidate] (664.106 µs) : 0, 664
Telemetry [baseline] (5.456 ms) : 0, 5456
Telemetry [candidate] (5.395 ms) : 0, 5395
section appsec
BytebuddyAgent [baseline] (611.94 ms) : 0, 611940
BytebuddyAgent [candidate] (610.623 ms) : 0, 610623
GlobalTracer [baseline] (284.323 ms) : 0, 284323
GlobalTracer [candidate] (284.031 ms) : 0, 284031
AppSec [baseline] (135.564 ms) : 0, 135564
AppSec [candidate] (134.938 ms) : 0, 134938
Remote Config [baseline] (727.548 µs) : 0, 728
Remote Config [candidate] (723.342 µs) : 0, 723
Telemetry [baseline] (5.181 ms) : 0, 5181
Telemetry [candidate] (5.2 ms) : 0, 5200
section iast
BytebuddyAgent [baseline] (711.82 ms) : 0, 711820
BytebuddyAgent [candidate] (712.575 ms) : 0, 712575
GlobalTracer [baseline] (270.832 ms) : 0, 270832
GlobalTracer [candidate] (271.494 ms) : 0, 271494
AppSec [baseline] (46.809 ms) : 0, 46809
AppSec [candidate] (46.878 ms) : 0, 46878
Remote Config [baseline] (632.275 µs) : 0, 632
Remote Config [candidate] (627.809 µs) : 0, 628
Telemetry [baseline] (5.515 ms) : 0, 5515
Telemetry [candidate] (5.399 ms) : 0, 5399
IAST [baseline] (13.853 ms) : 0, 13853
IAST [candidate] (13.813 ms) : 0, 13813
section profiling
ProfilingAgent [baseline] (74.471 ms) : 0, 74471
ProfilingAgent [candidate] (77.67 ms) : 0, 77670
BytebuddyAgent [baseline] (622.415 ms) : 0, 622415
BytebuddyAgent [candidate] (627.769 ms) : 0, 627769
GlobalTracer [baseline] (348.096 ms) : 0, 348096
GlobalTracer [candidate] (351.142 ms) : 0, 351142
AppSec [baseline] (48.936 ms) : 0, 48936
AppSec [candidate] (49.611 ms) : 0, 49611
Remote Config [baseline] (651.872 µs) : 0, 652
Remote Config [candidate] (669.769 µs) : 0, 670
Telemetry [baseline] (5.33 ms) : 0, 5330
Telemetry [candidate] (5.441 ms) : 0, 5441
Profiling [baseline] (74.495 ms) : 0, 74495
Profiling [candidate] (77.695 ms) : 0, 77695
Loading
Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~7110d94160, baseline=1.20.0-SNAPSHOT~8c080b4046

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (985.234 ms) : 0, 985234
Total [baseline] (8.639 s) : 0, 8639451
Agent [candidate] (984.857 ms) : 0, 984857
Total [candidate] (8.651 s) : 0, 8650935
section appsec
Agent [baseline] (1.071 s) : 0, 1071430
Total [baseline] (8.73 s) : 0, 8729539
Agent [candidate] (1.071 s) : 0, 1070556
Total [candidate] (8.71 s) : 0, 8710281
section iast
Agent [baseline] (1.087 s) : 0, 1087011
Total [baseline] (9.165 s) : 0, 9165388
Agent [candidate] (1.084 s) : 0, 1083769
Total [candidate] (9.182 s) : 0, 9182146
section profiling
Agent [baseline] (1.175 s) : 0, 1174951
Total [baseline] (8.931 s) : 0, 8931110
Agent [candidate] (1.174 s) : 0, 1173850
Total [candidate] (8.946 s) : 0, 8945926
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 985.234 ms -
Agent appsec 1.071 s 86.196 ms (8.7%)
Agent iast 1.087 s 101.777 ms (10.3%)
Agent profiling 1.175 s 189.717 ms (19.3%)
Total tracing 8.639 s -
Total appsec 8.73 s 90.089 ms (1.0%)
Total iast 9.165 s 525.937 ms (6.1%)
Total profiling 8.931 s 291.659 ms (3.4%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 984.857 ms -
Agent appsec 1.071 s 85.699 ms (8.7%)
Agent iast 1.084 s 98.912 ms (10.0%)
Agent profiling 1.174 s 188.992 ms (19.2%)
Total tracing 8.651 s -
Total appsec 8.71 s 59.345 ms (0.7%)
Total iast 9.182 s 531.21 ms (6.1%)
Total profiling 8.946 s 294.991 ms (3.4%) 
gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~7110d94160, baseline=1.20.0-SNAPSHOT~8c080b4046

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (610.386 ms) : 0, 610386
BytebuddyAgent [candidate] (610.006 ms) : 0, 610006
GlobalTracer [baseline] (284.385 ms) : 0, 284385
GlobalTracer [candidate] (284.384 ms) : 0, 284384
AppSec [baseline] (50.074 ms) : 0, 50074
AppSec [candidate] (50.248 ms) : 0, 50248
Remote Config [baseline] (668.849 µs) : 0, 669
Remote Config [candidate] (663.798 µs) : 0, 664
Telemetry [baseline] (5.427 ms) : 0, 5427
Telemetry [candidate] (5.407 ms) : 0, 5407
section appsec
BytebuddyAgent [baseline] (611.136 ms) : 0, 611136
BytebuddyAgent [candidate] (611.129 ms) : 0, 611129
GlobalTracer [baseline] (284.889 ms) : 0, 284889
GlobalTracer [candidate] (283.978 ms) : 0, 283978
AppSec [baseline] (135.259 ms) : 0, 135259
AppSec [candidate] (135.408 ms) : 0, 135408
Remote Config [baseline] (728.673 µs) : 0, 729
Remote Config [candidate] (729.991 µs) : 0, 730
Telemetry [baseline] (5.163 ms) : 0, 5163
Telemetry [candidate] (5.16 ms) : 0, 5160
section iast
BytebuddyAgent [baseline] (714.53 ms) : 0, 714530
BytebuddyAgent [candidate] (711.462 ms) : 0, 711462
GlobalTracer [baseline] (270.951 ms) : 0, 270951
GlobalTracer [candidate] (270.704 ms) : 0, 270704
AppSec [baseline] (47.054 ms) : 0, 47054
AppSec [candidate] (47.16 ms) : 0, 47160
Remote Config [baseline] (640.891 µs) : 0, 641
Remote Config [candidate] (652.744 µs) : 0, 653
Telemetry [baseline] (5.546 ms) : 0, 5546
Telemetry [candidate] (5.58 ms) : 0, 5580
IAST [baseline] (13.885 ms) : 0, 13885
IAST [candidate] (13.96 ms) : 0, 13960
section profiling
ProfilingAgent [baseline] (76.274 ms) : 0, 76274
ProfilingAgent [candidate] (77.874 ms) : 0, 77874
BytebuddyAgent [baseline] (634.392 ms) : 0, 634392
BytebuddyAgent [candidate] (632.231 ms) : 0, 632231
GlobalTracer [baseline] (354.619 ms) : 0, 354619
GlobalTracer [candidate] (353.869 ms) : 0, 353869
AppSec [baseline] (49.614 ms) : 0, 49614
AppSec [candidate] (50.055 ms) : 0, 50055
Remote Config [baseline] (664.303 µs) : 0, 664
Remote Config [candidate] (665.351 µs) : 0, 665
Telemetry [baseline] (5.467 ms) : 0, 5467
Telemetry [candidate] (5.444 ms) : 0, 5444
Profiling [baseline] (76.301 ms) : 0, 76301
Profiling [candidate] (77.898 ms) : 0, 77898
Loading

Load

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~8c080b4046 1.20.0-SNAPSHOT~7110d94160
config baseline candidate
end_time 2023-08-10T09:21:08 2023-08-10T09:39:14
start_time 2023-08-10T09:20:50 2023-08-10T09:38:56
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~7110d94160, baseline=1.20.0-SNAPSHOT~8c080b4046
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.341 ms) : 1322, 1360
.   : milestone, 1341,
appsec (1.67 ms) : 1645, 1695
.   : milestone, 1670,
iast (1.466 ms) : 1442, 1490
.   : milestone, 1466,
profiling (1.441 ms) : 1415, 1466
.   : milestone, 1441,
tracing (1.459 ms) : 1435, 1482
.   : milestone, 1459,
section candidate
no_agent (1.34 ms) : 1321, 1359
.   : milestone, 1340,
appsec (1.68 ms) : 1656, 1704
.   : milestone, 1680,
iast (1.463 ms) : 1440, 1487
.   : milestone, 1463,
profiling (1.459 ms) : 1433, 1485
.   : milestone, 1459,
tracing (1.445 ms) : 1421, 1470
.   : milestone, 1445,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.341 ms [1.322 ms, 1.36 ms] -
appsec 1.67 ms [1.645 ms, 1.695 ms] 328.926 µs (24.5%)
iast 1.466 ms [1.442 ms, 1.49 ms] 124.698 µs (9.3%)
profiling 1.441 ms [1.415 ms, 1.466 ms] 99.46 µs (7.4%)
tracing 1.459 ms [1.435 ms, 1.482 ms] 117.315 µs (8.7%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.34 ms [1.321 ms, 1.359 ms] -
appsec 1.68 ms [1.656 ms, 1.704 ms] 339.792 µs (25.4%)
iast 1.463 ms [1.44 ms, 1.487 ms] 123.435 µs (9.2%)
profiling 1.459 ms [1.433 ms, 1.485 ms] 119.288 µs (8.9%)
tracing 1.445 ms [1.421 ms, 1.47 ms] 105.483 µs (7.9%)
Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~7110d94160, baseline=1.20.0-SNAPSHOT~8c080b4046
    dateFormat X
    axisFormat %s
section baseline
no_agent (363.599 µs) : 343, 384
.   : milestone, 364,
appsec (661.405 µs) : 640, 682
.   : milestone, 661,
iast (460.277 µs) : 439, 481
.   : milestone, 460,
iast_FULL (517.095 µs) : 496, 538
.   : milestone, 517,
iast_INACTIVE (439.636 µs) : 419, 461
.   : milestone, 440,
profiling (432.235 µs) : 412, 453
.   : milestone, 432,
tracing (435.415 µs) : 415, 456
.   : milestone, 435,
section candidate
no_agent (358.893 µs) : 339, 379
.   : milestone, 359,
appsec (655.469 µs) : 635, 676
.   : milestone, 655,
iast (459.283 µs) : 439, 480
.   : milestone, 459,
iast_FULL (518.853 µs) : 498, 540
.   : milestone, 519,
iast_INACTIVE (432.768 µs) : 411, 454
.   : milestone, 433,
profiling (441.703 µs) : 421, 463
.   : milestone, 442,
tracing (431.63 µs) : 411, 452
.   : milestone, 432,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 363.599 µs [343.019 µs, 384.178 µs] -
appsec 661.405 µs [640.324 µs, 682.485 µs] 297.806 µs (81.9%)
iast 460.277 µs [439.111 µs, 481.443 µs] 96.678 µs (26.6%)
iast_FULL 517.095 µs [496.374 µs, 537.816 µs] 153.496 µs (42.2%)
iast_INACTIVE 439.636 µs [418.566 µs, 460.706 µs] 76.037 µs (20.9%)
profiling 432.235 µs [411.505 µs, 452.965 µs] 68.636 µs (18.9%)
tracing 435.415 µs [414.817 µs, 456.014 µs] 71.817 µs (19.8%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 358.893 µs [338.947 µs, 378.839 µs] -
appsec 655.469 µs [635.297 µs, 675.641 µs] 296.576 µs (82.6%)
iast 459.283 µs [438.632 µs, 479.933 µs] 100.39 µs (28.0%)
iast_FULL 518.853 µs [497.986 µs, 539.719 µs] 159.96 µs (44.6%)
iast_INACTIVE 432.768 µs [411.433 µs, 454.103 µs] 73.875 µs (20.6%)
profiling 441.703 µs [420.683 µs, 462.723 µs] 82.81 µs (23.1%)
tracing 431.63 µs [411.28 µs, 451.981 µs] 72.737 µs (20.3%)

@manuel-alvarez-alvarez
manuel-alvarez-alvarez merged commit 9e16e31 into master Aug 11, 2023
@manuel-alvarez-alvarez
manuel-alvarez-alvarez deleted the malvarez/iast-improve-redaction-empty-literals branch August 11, 2023 07:34
@github-actions github-actions Bot added this to the 1.20.0 milestone Aug 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes
@jandro996 jandro996 Awaiting requested review from jandro996

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST)

Projects

None yet

Milestone

1.20.0

Development

Successfully merging this pull request may close these issues.

2 participants

@manuel-alvarez-alvarez @smola