Prevent IAST from creating empty spans for duplicated vulnerabilities by manuel-alvarez-alvarez · Pull Request #5780 · DataDog/dd-trace-java

manuel-alvarez-alvarez · 2023-08-24T19:17:17Z

What Does This Do

Skips span creation when a duplicate vulnerability is detected and there is no active span.

Motivation

We have detected excessive span creation by IAST due to duplicated vulnerabilities creating span that latter were not used.

Additional Notes

manuel-alvarez-alvarez · 2023-08-24T19:20:50Z

@@ -52,10 +52,10 @@ class ReporterTest extends DDSpecification {
    span.getSpanId() >> spanId


Suddenly spotless is formatting this file out of the blue 😢

I noticed this with some Groovy tests, and no idea why.

pr-commenter · 2023-08-24T20:02:02Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
commit	1.20.0-SNAPSHOT~199de1b8ea	1.20.0-SNAPSHOT~0b6e43ed69
config	baseline	candidate

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
module	Agent	Agent
parent	None	None
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 62 cases.

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~0b6e43ed69, baseline=1.20.0-SNAPSHOT~199de1b8ea

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (988.582 ms) : 0, 988582
Total [baseline] (9.169 s) : 0, 9169407
Agent [candidate] (986.862 ms) : 0, 986862
Total [candidate] (9.185 s) : 0, 9185266
section appsec
Agent [baseline] (1.072 s) : 0, 1071505
Total [baseline] (9.242 s) : 0, 9241941
Agent [candidate] (1.075 s) : 0, 1074799
Total [candidate] (9.271 s) : 0, 9271386
section iast
Agent [baseline] (1.097 s) : 0, 1097398
Total [baseline] (9.442 s) : 0, 9442228
Agent [candidate] (1.092 s) : 0, 1091764
Total [candidate] (9.435 s) : 0, 9434801
section profiling
Agent [baseline] (1.155 s) : 0, 1154877
Total [baseline] (9.461 s) : 0, 9460765
Agent [candidate] (1.155 s) : 0, 1155100
Total [candidate] (9.475 s) : 0, 9474939

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	988.582 ms	-
Agent	appsec	1.072 s	82.923 ms (8.4%)
Agent	iast	1.097 s	108.816 ms (11.0%)
Agent	profiling	1.155 s	166.295 ms (16.8%)
Total	tracing	9.169 s	-
Total	appsec	9.242 s	72.533 ms (0.8%)
Total	iast	9.442 s	272.821 ms (3.0%)
Total	profiling	9.461 s	291.358 ms (3.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	986.862 ms	-
Agent	appsec	1.075 s	87.937 ms (8.9%)
Agent	iast	1.092 s	104.902 ms (10.6%)
Agent	profiling	1.155 s	168.239 ms (17.0%)
Total	tracing	9.185 s	-
Total	appsec	9.271 s	86.12 ms (0.9%)
Total	iast	9.435 s	249.535 ms (2.7%)
Total	profiling	9.475 s	289.673 ms (3.2%)

gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~0b6e43ed69, baseline=1.20.0-SNAPSHOT~199de1b8ea

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (613.007 ms) : 0, 613007
BytebuddyAgent [candidate] (612.119 ms) : 0, 612119
GlobalTracer [baseline] (284.475 ms) : 0, 284475
GlobalTracer [candidate] (283.618 ms) : 0, 283618
AppSec [baseline] (50.117 ms) : 0, 50117
AppSec [candidate] (50.306 ms) : 0, 50306
Remote Config [baseline] (658.84 µs) : 0, 659
Remote Config [candidate] (667.296 µs) : 0, 667
Telemetry [baseline] (6.03 ms) : 0, 6030
Telemetry [candidate] (5.977 ms) : 0, 5977
section appsec
BytebuddyAgent [baseline] (611.81 ms) : 0, 611810
BytebuddyAgent [candidate] (613.974 ms) : 0, 613974
GlobalTracer [baseline] (283.595 ms) : 0, 283595
GlobalTracer [candidate] (285.219 ms) : 0, 285219
AppSec [baseline] (135.396 ms) : 0, 135396
AppSec [candidate] (134.84 ms) : 0, 134840
Remote Config [baseline] (727.606 µs) : 0, 728
Remote Config [candidate] (725.017 µs) : 0, 725
Telemetry [baseline] (5.751 ms) : 0, 5751
Telemetry [candidate] (5.732 ms) : 0, 5732
section iast
BytebuddyAgent [baseline] (724.561 ms) : 0, 724561
BytebuddyAgent [candidate] (719.164 ms) : 0, 719164
GlobalTracer [baseline] (270.941 ms) : 0, 270941
GlobalTracer [candidate] (270.885 ms) : 0, 270885
AppSec [baseline] (47.168 ms) : 0, 47168
AppSec [candidate] (47.184 ms) : 0, 47184
Remote Config [baseline] (556.776 µs) : 0, 557
Remote Config [candidate] (557.751 µs) : 0, 558
Telemetry [baseline] (5.703 ms) : 0, 5703
Telemetry [candidate] (5.732 ms) : 0, 5732
IAST [baseline] (13.918 ms) : 0, 13918
IAST [candidate] (13.881 ms) : 0, 13881
section profiling
ProfilingAgent [baseline] (76.897 ms) : 0, 76897
ProfilingAgent [candidate] (75.669 ms) : 0, 75669
BytebuddyAgent [baseline] (624.152 ms) : 0, 624152
BytebuddyAgent [candidate] (625.093 ms) : 0, 625093
GlobalTracer [baseline] (345.314 ms) : 0, 345314
GlobalTracer [candidate] (345.842 ms) : 0, 345842
AppSec [baseline] (49.029 ms) : 0, 49029
AppSec [candidate] (48.859 ms) : 0, 48859
Remote Config [baseline] (648.181 µs) : 0, 648
Remote Config [candidate] (649.78 µs) : 0, 650
Telemetry [baseline] (5.993 ms) : 0, 5993
Telemetry [candidate] (5.986 ms) : 0, 5986
Profiling [baseline] (76.922 ms) : 0, 76922
Profiling [candidate] (75.693 ms) : 0, 75693

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~0b6e43ed69, baseline=1.20.0-SNAPSHOT~199de1b8ea

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.003 s) : 0, 1002505
Total [baseline] (8.666 s) : 0, 8666330
Agent [candidate] (988.324 ms) : 0, 988324
Total [candidate] (8.69 s) : 0, 8690360
section appsec
Agent [baseline] (1.082 s) : 0, 1081574
Total [baseline] (8.728 s) : 0, 8727828
Agent [candidate] (1.074 s) : 0, 1073781
Total [candidate] (8.738 s) : 0, 8738195
section iast
Agent [baseline] (1.091 s) : 0, 1090599
Total [baseline] (9.155 s) : 0, 9155491
Agent [candidate] (1.092 s) : 0, 1091551
Total [candidate] (9.191 s) : 0, 9191090
section profiling
Agent [baseline] (1.158 s) : 0, 1158121
Total [baseline] (8.897 s) : 0, 8897467
Agent [candidate] (1.157 s) : 0, 1156961
Total [candidate] (8.861 s) : 0, 8860560

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.003 s	-
Agent	appsec	1.082 s	79.068 ms (7.9%)
Agent	iast	1.091 s	88.093 ms (8.8%)
Agent	profiling	1.158 s	155.616 ms (15.5%)
Total	tracing	8.666 s	-
Total	appsec	8.728 s	61.498 ms (0.7%)
Total	iast	9.155 s	489.161 ms (5.6%)
Total	profiling	8.897 s	231.136 ms (2.7%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	988.324 ms	-
Agent	appsec	1.074 s	85.457 ms (8.6%)
Agent	iast	1.092 s	103.227 ms (10.4%)
Agent	profiling	1.157 s	168.636 ms (17.1%)
Total	tracing	8.69 s	-
Total	appsec	8.738 s	47.835 ms (0.6%)
Total	iast	9.191 s	500.73 ms (5.8%)
Total	profiling	8.861 s	170.2 ms (2.0%)

gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~0b6e43ed69, baseline=1.20.0-SNAPSHOT~199de1b8ea

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (622.058 ms) : 0, 622058
BytebuddyAgent [candidate] (612.933 ms) : 0, 612933
GlobalTracer [baseline] (288.836 ms) : 0, 288836
GlobalTracer [candidate] (284.367 ms) : 0, 284367
AppSec [baseline] (50.011 ms) : 0, 50011
AppSec [candidate] (50.083 ms) : 0, 50083
Remote Config [baseline] (669.885 µs) : 0, 670
Remote Config [candidate] (662.091 µs) : 0, 662
Telemetry [baseline] (6.042 ms) : 0, 6042
Telemetry [candidate] (6.0 ms) : 0, 6000
section appsec
BytebuddyAgent [baseline] (617.573 ms) : 0, 617573
BytebuddyAgent [candidate] (612.584 ms) : 0, 612584
GlobalTracer [baseline] (286.821 ms) : 0, 286821
GlobalTracer [candidate] (284.326 ms) : 0, 284326
AppSec [baseline] (136.05 ms) : 0, 136050
AppSec [candidate] (136.1 ms) : 0, 136100
Remote Config [baseline] (721.782 µs) : 0, 722
Remote Config [candidate] (727.615 µs) : 0, 728
Telemetry [baseline] (5.805 ms) : 0, 5805
Telemetry [candidate] (5.752 ms) : 0, 5752
section iast
BytebuddyAgent [baseline] (718.337 ms) : 0, 718337
BytebuddyAgent [candidate] (718.401 ms) : 0, 718401
GlobalTracer [baseline] (270.436 ms) : 0, 270436
GlobalTracer [candidate] (271.284 ms) : 0, 271284
AppSec [baseline] (47.455 ms) : 0, 47455
AppSec [candidate] (47.38 ms) : 0, 47380
Remote Config [baseline] (550.83 µs) : 0, 551
Remote Config [candidate] (550.772 µs) : 0, 551
Telemetry [baseline] (5.704 ms) : 0, 5704
Telemetry [candidate] (5.678 ms) : 0, 5678
IAST [baseline] (13.852 ms) : 0, 13852
IAST [candidate] (14.014 ms) : 0, 14014
section profiling
ProfilingAgent [baseline] (76.927 ms) : 0, 76927
ProfilingAgent [candidate] (76.493 ms) : 0, 76493
BytebuddyAgent [baseline] (626.111 ms) : 0, 626111
BytebuddyAgent [candidate] (625.747 ms) : 0, 625747
GlobalTracer [baseline] (346.309 ms) : 0, 346309
GlobalTracer [candidate] (345.916 ms) : 0, 345916
AppSec [baseline] (49.239 ms) : 0, 49239
AppSec [candidate] (49.266 ms) : 0, 49266
Remote Config [baseline] (647.132 µs) : 0, 647
Remote Config [candidate] (645.587 µs) : 0, 646
Telemetry [baseline] (5.974 ms) : 0, 5974
Telemetry [candidate] (6.046 ms) : 0, 6046
Profiling [baseline] (76.951 ms) : 0, 76951
Profiling [candidate] (76.518 ms) : 0, 76518

Load

Parameters

	Baseline	Candidate
commit	1.20.0-SNAPSHOT~199de1b8ea	1.20.0-SNAPSHOT~0b6e43ed69
config	baseline	candidate
end_time	2023-08-24T19:42:22	2023-08-24T20:00:28
start_time	2023-08-24T19:42:05	2023-08-24T20:00:10

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~0b6e43ed69, baseline=1.20.0-SNAPSHOT~199de1b8ea
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.331 ms) : 1311, 1351
.   : milestone, 1331,
appsec (1.676 ms) : 1652, 1700
.   : milestone, 1676,
iast (1.467 ms) : 1442, 1491
.   : milestone, 1467,
profiling (1.473 ms) : 1447, 1499
.   : milestone, 1473,
tracing (1.465 ms) : 1441, 1489
.   : milestone, 1465,
section candidate
no_agent (1.312 ms) : 1293, 1330
.   : milestone, 1312,
appsec (1.684 ms) : 1660, 1708
.   : milestone, 1684,
iast (1.447 ms) : 1422, 1471
.   : milestone, 1447,
profiling (1.468 ms) : 1442, 1494
.   : milestone, 1468,
tracing (1.434 ms) : 1410, 1458
.   : milestone, 1434,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.331 ms [1.311 ms, 1.351 ms]	-
appsec	1.676 ms [1.652 ms, 1.7 ms]	344.849 µs (25.9%)
iast	1.467 ms [1.442 ms, 1.491 ms]	135.349 µs (10.2%)
profiling	1.473 ms [1.447 ms, 1.499 ms]	141.874 µs (10.7%)
tracing	1.465 ms [1.441 ms, 1.489 ms]	133.518 µs (10.0%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.312 ms [1.293 ms, 1.33 ms]	-
appsec	1.684 ms [1.66 ms, 1.708 ms]	372.388 µs (28.4%)
iast	1.447 ms [1.422 ms, 1.471 ms]	135.003 µs (10.3%)
profiling	1.468 ms [1.442 ms, 1.494 ms]	155.773 µs (11.9%)
tracing	1.434 ms [1.41 ms, 1.458 ms]	121.881 µs (9.3%)

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~0b6e43ed69, baseline=1.20.0-SNAPSHOT~199de1b8ea
    dateFormat X
    axisFormat %s
section baseline
no_agent (361.741 µs) : 342, 382
.   : milestone, 362,
appsec (659.092 µs) : 639, 680
.   : milestone, 659,
iast (448.819 µs) : 428, 470
.   : milestone, 449,
iast_FULL (514.194 µs) : 494, 535
.   : milestone, 514,
iast_INACTIVE (433.945 µs) : 412, 456
.   : milestone, 434,
profiling (436.939 µs) : 415, 459
.   : milestone, 437,
tracing (428.426 µs) : 408, 449
.   : milestone, 428,
section candidate
no_agent (355.814 µs) : 335, 376
.   : milestone, 356,
appsec (657.774 µs) : 637, 678
.   : milestone, 658,
iast (454.701 µs) : 434, 475
.   : milestone, 455,
iast_FULL (522.395 µs) : 502, 543
.   : milestone, 522,
iast_INACTIVE (426.412 µs) : 405, 448
.   : milestone, 426,
profiling (439.822 µs) : 419, 461
.   : milestone, 440,
tracing (425.627 µs) : 405, 446
.   : milestone, 426,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	361.741 µs [341.537 µs, 381.945 µs]	-
appsec	659.092 µs [638.515 µs, 679.669 µs]	297.351 µs (82.2%)
iast	448.819 µs [427.918 µs, 469.721 µs]	87.078 µs (24.1%)
iast_FULL	514.194 µs [493.565 µs, 534.823 µs]	152.453 µs (42.1%)
iast_INACTIVE	433.945 µs [412.281 µs, 455.609 µs]	72.205 µs (20.0%)
profiling	436.939 µs [415.332 µs, 458.546 µs]	75.198 µs (20.8%)
tracing	428.426 µs [407.59 µs, 449.263 µs]	66.686 µs (18.4%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	355.814 µs [335.473 µs, 376.154 µs]	-
appsec	657.774 µs [637.494 µs, 678.054 µs]	301.96 µs (84.9%)
iast	454.701 µs [433.962 µs, 475.44 µs]	98.887 µs (27.8%)
iast_FULL	522.395 µs [501.783 µs, 543.007 µs]	166.581 µs (46.8%)
iast_INACTIVE	426.412 µs [404.947 µs, 447.876 µs]	70.598 µs (19.8%)
profiling	439.822 µs [418.745 µs, 460.898 µs]	84.008 µs (23.6%)
tracing	425.627 µs [405.154 µs, 446.101 µs]	69.814 µs (19.6%)

manuel-alvarez-alvarez added the comp: asm iast Application Security Management (IAST) label Aug 24, 2023

manuel-alvarez-alvarez requested a review from a team as a code owner August 24, 2023 19:17

manuel-alvarez-alvarez requested a review from ValentinZakharov August 24, 2023 19:17

Prevent IAST from creating empty spans for duplicated vulnerabilities

0b6e43e

manuel-alvarez-alvarez force-pushed the malvarez/iast-fix-span-creation branch from c49f616 to 0b6e43e Compare August 24, 2023 19:19

manuel-alvarez-alvarez commented Aug 24, 2023

View reviewed changes

smola approved these changes Aug 25, 2023

View reviewed changes

manuel-alvarez-alvarez merged commit 50e7edc into master Aug 25, 2023

manuel-alvarez-alvarez deleted the malvarez/iast-fix-span-creation branch August 25, 2023 08:38

github-actions Bot added this to the 1.20.0 milestone Aug 25, 2023

manuel-alvarez-alvarez added the tag: no release notes Changes to exclude from release notes label Aug 30, 2023

smola added type: bug fix Bug fix and removed tag: no release notes Changes to exclude from release notes labels Aug 31, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Prevent IAST from creating empty spans for duplicated vulnerabilities#5780

Prevent IAST from creating empty spans for duplicated vulnerabilities#5780
manuel-alvarez-alvarez merged 1 commit into
masterfrom
malvarez/iast-fix-span-creation

manuel-alvarez-alvarez commented Aug 24, 2023

Uh oh!

manuel-alvarez-alvarez Aug 24, 2023

Uh oh!

smola Aug 25, 2023

Uh oh!

pr-commenter Bot commented Aug 24, 2023 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		@@ -52,10 +52,10 @@ class ReporterTest extends DDSpecification {
		span.getSpanId() >> spanId

Uh oh!

Conversation

manuel-alvarez-alvarez commented Aug 24, 2023

What Does This Do

Motivation

Additional Notes

Uh oh!

manuel-alvarez-alvarez Aug 24, 2023

Choose a reason for hiding this comment

Uh oh!

smola Aug 25, 2023

Choose a reason for hiding this comment

Uh oh!

pr-commenter Bot commented Aug 24, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pr-commenter Bot commented Aug 24, 2023 •

edited

Loading