Fix NullPointerException in unvalidated redirect detection (#5755) by smola · Pull Request #5759 · DataDog/dd-trace-java

smola · 2023-08-23T09:27:23Z

What Does This Do

Under some circumstances, the name field of an IAST source can be null (very rare, and generally an indicative of another issue, but it's currently legal). In this case, the unvalidated redirect detection can throw a NPE.

This NPE is caught in the instrumentation, so it will not break the app, but it will log to debug

Motivation

Additional Notes

Backport of #5755

Under some circumstances, the `name` field of an IAST source can be `null` (very rare, and generally an indicative of another issue, but it's currently legal). In this case, the unvalidated redirect detection can throw a NPE. This NPE is caught in the instrumentation, so it will not break the app, but it will log to debug: ``` [dd.trace 2023-08-22 18:49:20:322 +0200] [http-nio-20002-exec-3] DEBUG datadog.trace.bootstrap.ExceptionLogger - Failed to handle exception in instrumentation for org.springframework.web.method.support.InvocableHandlerMethod java.lang.NullPointerException at com.datadog.iast.sink.UnvalidatedRedirectModuleImpl.isRefererHeader(UnvalidatedRedirectModuleImpl.java:102) at com.datadog.iast.sink.UnvalidatedRedirectModuleImpl.checkUnvalidatedRedirect(UnvalidatedRedirectModuleImpl.java:74) at com.datadog.iast.sink.UnvalidatedRedirectModuleImpl.onRedirect(UnvalidatedRedirectModuleImpl.java:41) at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:150) at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:117) at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:895) at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:808) at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1070) at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:963) at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1006) at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898) at javax.servlet.http.HttpServlet.service(HttpServlet.java:655) ```

pr-commenter · 2023-08-23T10:13:17Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
commit	1.20.0-SNAPSHOT~cbe55c2700	1.20.0-SNAPSHOT~1d67af6510
config	baseline	candidate

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
module	Agent	Agent
parent	None	None
variant	appsec	appsec

Summary

Found 8 performance improvements and 2 performance regressions! Performance is the same for 52 cases.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:insecure-bank:appsec:Telemetry	better [-683.715µs; -527.694µs] or [-11.836%; -9.135%]	5.171ms	5.777ms
scenario:insecure-bank:iast:IAST	better [-713.314µs; -398.271µs] or [-5.183%; -2.894%]	13.208ms	13.764ms
scenario:insecure-bank:iast:Remote Config	worse [+75.147µs; +103.157µs] or [+13.756%; +18.884%]	635.428µs	546.276µs
scenario:insecure-bank:profiling:Telemetry	better [-709.614µs; -466.726µs] or [-11.920%; -7.840%]	5.365ms	5.953ms
scenario:insecure-bank:tracing:Telemetry	better [-681.289µs; -482.454µs] or [-11.351%; -8.038%]	5.420ms	6.002ms
scenario:petclinic:appsec:Telemetry	better [-606.715µs; -546.729µs] or [-10.616%; -9.566%]	5.139ms	5.715ms
scenario:petclinic:iast:IAST	better [-883.153µs; -334.123µs] or [-6.380%; -2.414%]	13.233ms	13.842ms
scenario:petclinic:iast:Remote Config	worse [+73.514µs; +104.607µs] or [+13.404%; +19.073%]	637.519µs	548.459µs
scenario:petclinic:profiling:Telemetry	better [-720.958µs; -481.913µs] or [-12.079%; -8.074%]	5.367ms	5.968ms
scenario:petclinic:tracing:Telemetry	better [-753.132µs; -592.489µs] or [-12.497%; -9.831%]	5.354ms	6.027ms

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~1d67af6510, baseline=1.20.0-SNAPSHOT~cbe55c2700

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (987.473 ms) : 0, 987473
Total [baseline] (8.666 s) : 0, 8665713
Agent [candidate] (982.543 ms) : 0, 982543
Total [candidate] (8.642 s) : 0, 8641762
section appsec
Agent [baseline] (1.073 s) : 0, 1072551
Total [baseline] (8.718 s) : 0, 8717682
Agent [candidate] (1.076 s) : 0, 1076095
Total [candidate] (8.726 s) : 0, 8725810
section iast
Agent [baseline] (1.088 s) : 0, 1087785
Total [baseline] (9.201 s) : 0, 9200803
Agent [candidate] (1.081 s) : 0, 1081498
Total [candidate] (9.206 s) : 0, 9205582
section profiling
Agent [baseline] (1.159 s) : 0, 1158584
Total [baseline] (8.895 s) : 0, 8895310
Agent [candidate] (1.153 s) : 0, 1153414
Total [candidate] (8.876 s) : 0, 8875613

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	987.473 ms	-
Agent	appsec	1.073 s	85.078 ms (8.6%)
Agent	iast	1.088 s	100.313 ms (10.2%)
Agent	profiling	1.159 s	171.112 ms (17.3%)
Total	tracing	8.666 s	-
Total	appsec	8.718 s	51.969 ms (0.6%)
Total	iast	9.201 s	535.09 ms (6.2%)
Total	profiling	8.895 s	229.596 ms (2.6%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	982.543 ms	-
Agent	appsec	1.076 s	93.552 ms (9.5%)
Agent	iast	1.081 s	98.955 ms (10.1%)
Agent	profiling	1.153 s	170.871 ms (17.4%)
Total	tracing	8.642 s	-
Total	appsec	8.726 s	84.048 ms (1.0%)
Total	iast	9.206 s	563.819 ms (6.5%)
Total	profiling	8.876 s	233.851 ms (2.7%)

gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~1d67af6510, baseline=1.20.0-SNAPSHOT~cbe55c2700

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (612.026 ms) : 0, 612026
BytebuddyAgent [candidate] (608.014 ms) : 0, 608014
GlobalTracer [baseline] (284.041 ms) : 0, 284041
GlobalTracer [candidate] (283.62 ms) : 0, 283620
AppSec [baseline] (50.387 ms) : 0, 50387
AppSec [candidate] (50.674 ms) : 0, 50674
Remote Config [baseline] (666.086 µs) : 0, 666
Remote Config [candidate] (667.953 µs) : 0, 668
Telemetry [baseline] (6.002 ms) : 0, 6002
Telemetry [candidate] (5.42 ms) : 0, 5420
section appsec
BytebuddyAgent [baseline] (611.892 ms) : 0, 611892
BytebuddyAgent [candidate] (613.587 ms) : 0, 613587
GlobalTracer [baseline] (284.448 ms) : 0, 284448
GlobalTracer [candidate] (286.283 ms) : 0, 286283
AppSec [baseline] (135.39 ms) : 0, 135390
AppSec [candidate] (135.86 ms) : 0, 135860
Remote Config [baseline] (728.555 µs) : 0, 729
Remote Config [candidate] (721.15 µs) : 0, 721
Telemetry [baseline] (5.777 ms) : 0, 5777
Telemetry [candidate] (5.171 ms) : 0, 5171
section iast
BytebuddyAgent [baseline] (716.581 ms) : 0, 716581
BytebuddyAgent [candidate] (710.16 ms) : 0, 710160
GlobalTracer [baseline] (269.761 ms) : 0, 269761
GlobalTracer [candidate] (270.692 ms) : 0, 270692
AppSec [baseline] (47.163 ms) : 0, 47163
AppSec [candidate] (47.04 ms) : 0, 47040
Remote Config [baseline] (546.276 µs) : 0, 546
Remote Config [candidate] (635.428 µs) : 0, 635
Telemetry [baseline] (5.671 ms) : 0, 5671
Telemetry [candidate] (5.562 ms) : 0, 5562
IAST [baseline] (13.764 ms) : 0, 13764
IAST [candidate] (13.208 ms) : 0, 13208
section profiling
BytebuddyAgent [baseline] (627.035 ms) : 0, 627035
BytebuddyAgent [candidate] (622.95 ms) : 0, 622950
GlobalTracer [baseline] (346.656 ms) : 0, 346656
GlobalTracer [candidate] (346.918 ms) : 0, 346918
AppSec [baseline] (49.118 ms) : 0, 49118
AppSec [candidate] (49.18 ms) : 0, 49180
Remote Config [baseline] (652.261 µs) : 0, 652
Remote Config [candidate] (665.304 µs) : 0, 665
Telemetry [baseline] (5.953 ms) : 0, 5953
Telemetry [candidate] (5.365 ms) : 0, 5365
ProfilingAgent [baseline] (76.002 ms) : 0, 76002
ProfilingAgent [candidate] (75.634 ms) : 0, 75634
Profiling [baseline] (76.028 ms) : 0, 76028
Profiling [candidate] (75.658 ms) : 0, 75658

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~1d67af6510, baseline=1.20.0-SNAPSHOT~cbe55c2700

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (987.686 ms) : 0, 987686
Total [baseline] (9.221 s) : 0, 9220798
Agent [candidate] (983.216 ms) : 0, 983216
Total [candidate] (9.177 s) : 0, 9177476
section appsec
Agent [baseline] (1.07 s) : 0, 1070343
Total [baseline] (9.244 s) : 0, 9243765
Agent [candidate] (1.069 s) : 0, 1068918
Total [candidate] (9.256 s) : 0, 9256270
section iast
Agent [baseline] (1.094 s) : 0, 1094111
Total [baseline] (9.415 s) : 0, 9414545
Agent [candidate] (1.084 s) : 0, 1083577
Total [candidate] (9.416 s) : 0, 9416187
section profiling
Agent [baseline] (1.157 s) : 0, 1157238
Total [baseline] (9.483 s) : 0, 9482996
Agent [candidate] (1.157 s) : 0, 1156701
Total [candidate] (9.46 s) : 0, 9459958

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	987.686 ms	-
Agent	appsec	1.07 s	82.657 ms (8.4%)
Agent	iast	1.094 s	106.425 ms (10.8%)
Agent	profiling	1.157 s	169.552 ms (17.2%)
Total	tracing	9.221 s	-
Total	appsec	9.244 s	22.968 ms (0.2%)
Total	iast	9.415 s	193.747 ms (2.1%)
Total	profiling	9.483 s	262.199 ms (2.8%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	983.216 ms	-
Agent	appsec	1.069 s	85.702 ms (8.7%)
Agent	iast	1.084 s	100.36 ms (10.2%)
Agent	profiling	1.157 s	173.484 ms (17.6%)
Total	tracing	9.177 s	-
Total	appsec	9.256 s	78.794 ms (0.9%)
Total	iast	9.416 s	238.711 ms (2.6%)
Total	profiling	9.46 s	282.482 ms (3.1%)

gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~1d67af6510, baseline=1.20.0-SNAPSHOT~cbe55c2700

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (612.21 ms) : 0, 612210
BytebuddyAgent [candidate] (608.751 ms) : 0, 608751
GlobalTracer [baseline] (284.492 ms) : 0, 284492
GlobalTracer [candidate] (283.752 ms) : 0, 283752
AppSec [baseline] (49.94 ms) : 0, 49940
AppSec [candidate] (50.575 ms) : 0, 50575
Remote Config [baseline] (665.082 µs) : 0, 665
Remote Config [candidate] (663.5 µs) : 0, 664
Telemetry [baseline] (6.027 ms) : 0, 6027
Telemetry [candidate] (5.354 ms) : 0, 5354
section appsec
BytebuddyAgent [baseline] (610.878 ms) : 0, 610878
BytebuddyAgent [candidate] (609.453 ms) : 0, 609453
GlobalTracer [baseline] (283.382 ms) : 0, 283382
GlobalTracer [candidate] (283.877 ms) : 0, 283877
AppSec [baseline] (135.417 ms) : 0, 135417
AppSec [candidate] (135.572 ms) : 0, 135572
Remote Config [baseline] (729.884 µs) : 0, 730
Remote Config [candidate] (727.06 µs) : 0, 727
Telemetry [baseline] (5.715 ms) : 0, 5715
Telemetry [candidate] (5.139 ms) : 0, 5139
section iast
BytebuddyAgent [baseline] (721.277 ms) : 0, 721277
BytebuddyAgent [candidate] (711.129 ms) : 0, 711129
GlobalTracer [baseline] (271.039 ms) : 0, 271039
GlobalTracer [candidate] (271.736 ms) : 0, 271736
AppSec [baseline] (47.295 ms) : 0, 47295
AppSec [candidate] (47.09 ms) : 0, 47090
Remote Config [baseline] (548.459 µs) : 0, 548
Remote Config [candidate] (637.519 µs) : 0, 638
Telemetry [baseline] (5.665 ms) : 0, 5665
Telemetry [candidate] (5.499 ms) : 0, 5499
IAST [baseline] (13.842 ms) : 0, 13842
IAST [candidate] (13.233 ms) : 0, 13233
section profiling
BytebuddyAgent [baseline] (624.523 ms) : 0, 624523
BytebuddyAgent [candidate] (624.506 ms) : 0, 624506
GlobalTracer [baseline] (345.772 ms) : 0, 345772
GlobalTracer [candidate] (347.892 ms) : 0, 347892
AppSec [baseline] (49.067 ms) : 0, 49067
AppSec [candidate] (49.313 ms) : 0, 49313
Remote Config [baseline] (650.028 µs) : 0, 650
Remote Config [candidate] (659.7 µs) : 0, 660
Telemetry [baseline] (5.968 ms) : 0, 5968
Telemetry [candidate] (5.367 ms) : 0, 5367
ProfilingAgent [baseline] (78.335 ms) : 0, 78335
ProfilingAgent [candidate] (75.897 ms) : 0, 75897
Profiling [baseline] (78.361 ms) : 0, 78361
Profiling [candidate] (75.922 ms) : 0, 75922

Load

Parameters

	Baseline	Candidate
commit	1.20.0-SNAPSHOT~cbe55c2700	1.20.0-SNAPSHOT~1d67af6510
config	baseline	candidate
end_time	2023-08-23T09:50:01	2023-08-23T10:08:05
start_time	2023-08-23T09:49:43	2023-08-23T10:07:47

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~1d67af6510, baseline=1.20.0-SNAPSHOT~cbe55c2700
    dateFormat X
    axisFormat %s
section baseline
no_agent (359.127 µs) : 339, 379
.   : milestone, 359,
appsec (666.254 µs) : 645, 688
.   : milestone, 666,
iast (447.281 µs) : 427, 468
.   : milestone, 447,
iast_FULL (525.408 µs) : 505, 546
.   : milestone, 525,
iast_INACTIVE (436.025 µs) : 415, 457
.   : milestone, 436,
profiling (440.444 µs) : 419, 462
.   : milestone, 440,
tracing (427.992 µs) : 407, 449
.   : milestone, 428,
section candidate
no_agent (364.894 µs) : 344, 385
.   : milestone, 365,
appsec (657.121 µs) : 637, 677
.   : milestone, 657,
iast (459.686 µs) : 438, 481
.   : milestone, 460,
iast_FULL (519.984 µs) : 499, 541
.   : milestone, 520,
iast_INACTIVE (439.003 µs) : 418, 460
.   : milestone, 439,
profiling (438.068 µs) : 417, 459
.   : milestone, 438,
tracing (432.879 µs) : 412, 453
.   : milestone, 433,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	359.127 µs [339.235 µs, 379.019 µs]	-
appsec	666.254 µs [644.947 µs, 687.56 µs]	307.127 µs (85.5%)
iast	447.281 µs [426.977 µs, 467.586 µs]	88.155 µs (24.5%)
iast_FULL	525.408 µs [504.885 µs, 545.932 µs]	166.282 µs (46.3%)
iast_INACTIVE	436.025 µs [414.753 µs, 457.297 µs]	76.898 µs (21.4%)
profiling	440.444 µs [419.27 µs, 461.619 µs]	81.318 µs (22.6%)
tracing	427.992 µs [407.23 µs, 448.754 µs]	68.865 µs (19.2%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	364.894 µs [344.443 µs, 385.345 µs]	-
appsec	657.121 µs [636.814 µs, 677.428 µs]	292.227 µs (80.1%)
iast	459.686 µs [438.236 µs, 481.137 µs]	94.792 µs (26.0%)
iast_FULL	519.984 µs [499.409 µs, 540.559 µs]	155.09 µs (42.5%)
iast_INACTIVE	439.003 µs [417.97 µs, 460.036 µs]	74.109 µs (20.3%)
profiling	438.068 µs [416.8 µs, 459.336 µs]	73.174 µs (20.1%)
tracing	432.879 µs [412.479 µs, 453.278 µs]	67.985 µs (18.6%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~1d67af6510, baseline=1.20.0-SNAPSHOT~cbe55c2700
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.322 ms) : 1302, 1341
.   : milestone, 1322,
appsec (1.671 ms) : 1647, 1695
.   : milestone, 1671,
iast (1.431 ms) : 1407, 1456
.   : milestone, 1431,
profiling (1.472 ms) : 1447, 1497
.   : milestone, 1472,
tracing (1.443 ms) : 1419, 1467
.   : milestone, 1443,
section candidate
no_agent (1.343 ms) : 1324, 1362
.   : milestone, 1343,
appsec (1.698 ms) : 1674, 1722
.   : milestone, 1698,
iast (1.448 ms) : 1423, 1473
.   : milestone, 1448,
profiling (1.438 ms) : 1414, 1463
.   : milestone, 1438,
tracing (1.437 ms) : 1413, 1461
.   : milestone, 1437,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.322 ms [1.302 ms, 1.341 ms]	-
appsec	1.671 ms [1.647 ms, 1.695 ms]	349.459 µs (26.4%)
iast	1.431 ms [1.407 ms, 1.456 ms]	109.89 µs (8.3%)
profiling	1.472 ms [1.447 ms, 1.497 ms]	150.226 µs (11.4%)
tracing	1.443 ms [1.419 ms, 1.467 ms]	121.679 µs (9.2%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.343 ms [1.324 ms, 1.362 ms]	-
appsec	1.698 ms [1.674 ms, 1.722 ms]	355.295 µs (26.5%)
iast	1.448 ms [1.423 ms, 1.473 ms]	105.273 µs (7.8%)
profiling	1.438 ms [1.414 ms, 1.463 ms]	95.466 µs (7.1%)
tracing	1.437 ms [1.413 ms, 1.461 ms]	93.706 µs (7.0%)

smola added type: bug fix Bug fix comp: asm iast Application Security Management (IAST) labels Aug 23, 2023

smola requested review from a team and jandro996 August 23, 2023 09:27

manuel-alvarez-alvarez approved these changes Aug 23, 2023

View reviewed changes

smola merged commit 0697c9d into release/v1.19.x Aug 23, 2023

smola deleted the smola/5755-backport branch August 23, 2023 12:13

smola added this to the 1.19.3 milestone Aug 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix NullPointerException in unvalidated redirect detection (#5755)#5759

Fix NullPointerException in unvalidated redirect detection (#5755)#5759
smola merged 1 commit into
release/v1.19.xfrom
smola/5755-backport

smola commented Aug 23, 2023

Uh oh!

pr-commenter Bot commented Aug 23, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

smola commented Aug 23, 2023

What Does This Do

Motivation

Additional Notes

Uh oh!

pr-commenter Bot commented Aug 23, 2023

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants