Skip to content

Use a NoOp tainted objects for vulnerabilities without context#5786

Merged
manuel-alvarez-alvarez merged 1 commit into
masterfrom
malvarez/iast-out-of-ctx-noop-tainteds
Aug 28, 2023
Merged

Use a NoOp tainted objects for vulnerabilities without context#5786
manuel-alvarez-alvarez merged 1 commit into
masterfrom
malvarez/iast-out-of-ctx-noop-tainteds

Conversation

@manuel-alvarez-alvarez

@manuel-alvarez-alvarez manuel-alvarez-alvarez commented Aug 25, 2023

Copy link
Copy Markdown
Member

What Does This Do

Remove the need to acquire a full tainted objects instance when reporting with a custom span

Motivation

Additional Notes

@manuel-alvarez-alvarez manuel-alvarez-alvarez added tag: performance Performance related changes comp: asm iast Application Security Management (IAST) labels Aug 25, 2023
@manuel-alvarez-alvarez
manuel-alvarez-alvarez requested a review from a team as a code owner August 25, 2023 12:51
@pr-commenter

pr-commenter Bot commented Aug 25, 2023

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~4a1be495da 1.20.0-SNAPSHOT~04c0eea4c8
config baseline candidate
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
module Agent Agent
parent None None
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 62 cases.

Startup time reports for insecure-bank 
gantt
    title insecure-bank - global startup overhead: candidate=1.20.0-SNAPSHOT~04c0eea4c8, baseline=1.20.0-SNAPSHOT~4a1be495da

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (986.93 ms) : 0, 986930
Total [baseline] (8.636 s) : 0, 8636175
Agent [candidate] (987.695 ms) : 0, 987695
Total [candidate] (8.656 s) : 0, 8655591
section appsec
Agent [baseline] (1.08 s) : 0, 1079862
Total [baseline] (8.737 s) : 0, 8736544
Agent [candidate] (1.072 s) : 0, 1072144
Total [candidate] (8.753 s) : 0, 8753380
section iast
Agent [baseline] (1.089 s) : 0, 1088878
Total [baseline] (9.118 s) : 0, 9117618
Agent [candidate] (1.092 s) : 0, 1091631
Total [candidate] (9.213 s) : 0, 9213298
section profiling
Agent [baseline] (1.158 s) : 0, 1158264
Total [baseline] (8.846 s) : 0, 8845892
Agent [candidate] (1.163 s) : 0, 1162778
Total [candidate] (8.895 s) : 0, 8895110
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 986.93 ms -
Agent appsec 1.08 s 92.932 ms (9.4%)
Agent iast 1.089 s 101.948 ms (10.3%)
Agent profiling 1.158 s 171.334 ms (17.4%)
Total tracing 8.636 s -
Total appsec 8.737 s 100.369 ms (1.2%)
Total iast 9.118 s 481.443 ms (5.6%)
Total profiling 8.846 s 209.717 ms (2.4%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 987.695 ms -
Agent appsec 1.072 s 84.449 ms (8.6%)
Agent iast 1.092 s 103.935 ms (10.5%)
Agent profiling 1.163 s 175.083 ms (17.7%)
Total tracing 8.656 s -
Total appsec 8.753 s 97.789 ms (1.1%)
Total iast 9.213 s 557.707 ms (6.4%)
Total profiling 8.895 s 239.519 ms (2.8%) 
gantt
    title insecure-bank - break down per module: candidate=1.20.0-SNAPSHOT~04c0eea4c8, baseline=1.20.0-SNAPSHOT~4a1be495da

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (611.927 ms) : 0, 611927
BytebuddyAgent [candidate] (612.85 ms) : 0, 612850
GlobalTracer [baseline] (283.801 ms) : 0, 283801
GlobalTracer [candidate] (283.91 ms) : 0, 283910
AppSec [baseline] (50.174 ms) : 0, 50174
AppSec [candidate] (49.981 ms) : 0, 49981
Remote Config [baseline] (666.845 µs) : 0, 667
Remote Config [candidate] (667.056 µs) : 0, 667
Telemetry [baseline] (6.05 ms) : 0, 6050
Telemetry [candidate] (6.015 ms) : 0, 6015
section appsec
BytebuddyAgent [baseline] (616.512 ms) : 0, 616512
BytebuddyAgent [candidate] (612.163 ms) : 0, 612163
GlobalTracer [baseline] (286.798 ms) : 0, 286798
GlobalTracer [candidate] (284.164 ms) : 0, 284164
AppSec [baseline] (135.533 ms) : 0, 135533
AppSec [candidate] (135.168 ms) : 0, 135168
Remote Config [baseline] (730.512 µs) : 0, 731
Remote Config [candidate] (717.941 µs) : 0, 718
Telemetry [baseline] (5.798 ms) : 0, 5798
Telemetry [candidate] (5.729 ms) : 0, 5729
section iast
BytebuddyAgent [baseline] (717.367 ms) : 0, 717367
BytebuddyAgent [candidate] (718.88 ms) : 0, 718880
GlobalTracer [baseline] (270.109 ms) : 0, 270109
GlobalTracer [candidate] (271.109 ms) : 0, 271109
AppSec [baseline] (47.048 ms) : 0, 47048
AppSec [candidate] (47.112 ms) : 0, 47112
Remote Config [baseline] (550.726 µs) : 0, 551
Remote Config [candidate] (550.067 µs) : 0, 550
Telemetry [baseline] (5.701 ms) : 0, 5701
Telemetry [candidate] (5.715 ms) : 0, 5715
IAST [baseline] (13.827 ms) : 0, 13827
IAST [candidate] (13.949 ms) : 0, 13949
section profiling
ProfilingAgent [baseline] (77.887 ms) : 0, 77887
ProfilingAgent [candidate] (76.551 ms) : 0, 76551
BytebuddyAgent [baseline] (625.405 ms) : 0, 625405
BytebuddyAgent [candidate] (628.754 ms) : 0, 628754
GlobalTracer [baseline] (346.187 ms) : 0, 346187
GlobalTracer [candidate] (348.31 ms) : 0, 348310
AppSec [baseline] (49.293 ms) : 0, 49293
AppSec [candidate] (49.309 ms) : 0, 49309
Remote Config [baseline] (657.841 µs) : 0, 658
Remote Config [candidate] (652.672 µs) : 0, 653
Telemetry [baseline] (6.026 ms) : 0, 6026
Telemetry [candidate] (6.054 ms) : 0, 6054
Profiling [baseline] (77.911 ms) : 0, 77911
Profiling [candidate] (76.575 ms) : 0, 76575
Loading
Startup time reports for petclinic 
gantt
    title petclinic - global startup overhead: candidate=1.20.0-SNAPSHOT~04c0eea4c8, baseline=1.20.0-SNAPSHOT~4a1be495da

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (988.021 ms) : 0, 988021
Total [baseline] (9.185 s) : 0, 9185497
Agent [candidate] (987.881 ms) : 0, 987881
Total [candidate] (9.165 s) : 0, 9164748
section appsec
Agent [baseline] (1.073 s) : 0, 1072709
Total [baseline] (9.26 s) : 0, 9259831
Agent [candidate] (1.073 s) : 0, 1072711
Total [candidate] (9.312 s) : 0, 9312315
section iast
Agent [baseline] (1.091 s) : 0, 1090828
Total [baseline] (9.399 s) : 0, 9398705
Agent [candidate] (1.095 s) : 0, 1095486
Total [candidate] (9.428 s) : 0, 9427854
section profiling
Agent [baseline] (1.156 s) : 0, 1155592
Total [baseline] (9.434 s) : 0, 9433828
Agent [candidate] (1.172 s) : 0, 1171679
Total [candidate] (9.573 s) : 0, 9572814
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 988.021 ms -
Agent appsec 1.073 s 84.689 ms (8.6%)
Agent iast 1.091 s 102.807 ms (10.4%)
Agent profiling 1.156 s 167.571 ms (17.0%)
Total tracing 9.185 s -
Total appsec 9.26 s 74.334 ms (0.8%)
Total iast 9.399 s 213.208 ms (2.3%)
Total profiling 9.434 s 248.331 ms (2.7%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 987.881 ms -
Agent appsec 1.073 s 84.83 ms (8.6%)
Agent iast 1.095 s 107.605 ms (10.9%)
Agent profiling 1.172 s 183.798 ms (18.6%)
Total tracing 9.165 s -
Total appsec 9.312 s 147.567 ms (1.6%)
Total iast 9.428 s 263.105 ms (2.9%)
Total profiling 9.573 s 408.066 ms (4.5%) 
gantt
    title petclinic - break down per module: candidate=1.20.0-SNAPSHOT~04c0eea4c8, baseline=1.20.0-SNAPSHOT~4a1be495da

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (612.692 ms) : 0, 612692
BytebuddyAgent [candidate] (613.021 ms) : 0, 613021
GlobalTracer [baseline] (283.7 ms) : 0, 283700
GlobalTracer [candidate] (284.167 ms) : 0, 284167
AppSec [baseline] (50.547 ms) : 0, 50547
AppSec [candidate] (49.765 ms) : 0, 49765
Remote Config [baseline] (669.177 µs) : 0, 669
Remote Config [candidate] (662.556 µs) : 0, 663
Telemetry [baseline] (6.056 ms) : 0, 6056
Telemetry [candidate] (6.016 ms) : 0, 6016
section appsec
BytebuddyAgent [baseline] (612.053 ms) : 0, 612053
BytebuddyAgent [candidate] (612.782 ms) : 0, 612782
GlobalTracer [baseline] (284.368 ms) : 0, 284368
GlobalTracer [candidate] (283.948 ms) : 0, 283948
AppSec [baseline] (135.611 ms) : 0, 135611
AppSec [candidate] (135.26 ms) : 0, 135260
Remote Config [baseline] (715.622 µs) : 0, 716
Remote Config [candidate] (720.789 µs) : 0, 721
Telemetry [baseline] (5.729 ms) : 0, 5729
Telemetry [candidate] (5.73 ms) : 0, 5730
section iast
BytebuddyAgent [baseline] (718.453 ms) : 0, 718453
BytebuddyAgent [candidate] (723.511 ms) : 0, 723511
GlobalTracer [baseline] (270.672 ms) : 0, 270672
GlobalTracer [candidate] (270.116 ms) : 0, 270116
AppSec [baseline] (47.294 ms) : 0, 47294
AppSec [candidate] (47.203 ms) : 0, 47203
Remote Config [baseline] (554.599 µs) : 0, 555
Remote Config [candidate] (543.538 µs) : 0, 544
Telemetry [baseline] (5.726 ms) : 0, 5726
Telemetry [candidate] (5.669 ms) : 0, 5669
IAST [baseline] (13.828 ms) : 0, 13828
IAST [candidate] (13.92 ms) : 0, 13920
section profiling
ProfilingAgent [baseline] (78.42 ms) : 0, 78420
ProfilingAgent [candidate] (78.29 ms) : 0, 78290
BytebuddyAgent [baseline] (624.187 ms) : 0, 624187
BytebuddyAgent [candidate] (633.466 ms) : 0, 633466
GlobalTracer [baseline] (344.835 ms) : 0, 344835
GlobalTracer [candidate] (350.189 ms) : 0, 350189
AppSec [baseline] (48.752 ms) : 0, 48752
AppSec [candidate] (49.407 ms) : 0, 49407
Remote Config [baseline] (651.62 µs) : 0, 652
Remote Config [candidate] (660.103 µs) : 0, 660
Telemetry [baseline] (5.952 ms) : 0, 5952
Telemetry [candidate] (6.068 ms) : 0, 6068
Profiling [baseline] (78.445 ms) : 0, 78445
Profiling [candidate] (78.314 ms) : 0, 78314
Loading

Load

Parameters

Baseline Candidate
commit 1.20.0-SNAPSHOT~4a1be495da 1.20.0-SNAPSHOT~04c0eea4c8
config baseline candidate
end_time 2023-08-25T13:13:16 2023-08-25T13:31:25
start_time 2023-08-25T13:12:59 2023-08-25T13:31:07
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 cases.

Request duration reports for insecure-bank 
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~04c0eea4c8, baseline=1.20.0-SNAPSHOT~4a1be495da
    dateFormat X
    axisFormat %s
section baseline
no_agent (367.898 µs) : 347, 388
.   : milestone, 368,
appsec (664.055 µs) : 643, 685
.   : milestone, 664,
iast (456.015 µs) : 435, 477
.   : milestone, 456,
iast_FULL (514.733 µs) : 494, 535
.   : milestone, 515,
iast_INACTIVE (436.321 µs) : 414, 458
.   : milestone, 436,
profiling (436.246 µs) : 415, 458
.   : milestone, 436,
tracing (429.237 µs) : 408, 450
.   : milestone, 429,
section candidate
no_agent (366.567 µs) : 346, 387
.   : milestone, 367,
appsec (665.387 µs) : 644, 687
.   : milestone, 665,
iast (460.13 µs) : 439, 481
.   : milestone, 460,
iast_FULL (513.506 µs) : 493, 534
.   : milestone, 514,
iast_INACTIVE (427.795 µs) : 407, 448
.   : milestone, 428,
profiling (450.623 µs) : 429, 472
.   : milestone, 451,
tracing (431.405 µs) : 411, 452
.   : milestone, 431,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 367.898 µs [347.353 µs, 388.443 µs] -
appsec 664.055 µs [643.312 µs, 684.798 µs] 296.157 µs (80.5%)
iast 456.015 µs [434.954 µs, 477.076 µs] 88.117 µs (24.0%)
iast_FULL 514.733 µs [494.128 µs, 535.338 µs] 146.835 µs (39.9%)
iast_INACTIVE 436.321 µs [414.445 µs, 458.196 µs] 68.423 µs (18.6%)
profiling 436.246 µs [414.739 µs, 457.752 µs] 68.348 µs (18.6%)
tracing 429.237 µs [408.218 µs, 450.257 µs] 61.339 µs (16.7%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 366.567 µs [346.187 µs, 386.947 µs] -
appsec 665.387 µs [643.986 µs, 686.787 µs] 298.82 µs (81.5%)
iast 460.13 µs [438.903 µs, 481.356 µs] 93.563 µs (25.5%)
iast_FULL 513.506 µs [492.861 µs, 534.15 µs] 146.939 µs (40.1%)
iast_INACTIVE 427.795 µs [407.333 µs, 448.258 µs] 61.228 µs (16.7%)
profiling 450.623 µs [429.301 µs, 471.946 µs] 84.057 µs (22.9%)
tracing 431.405 µs [410.621 µs, 452.189 µs] 64.838 µs (17.7%)
Request duration reports for petclinic 
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.20.0-SNAPSHOT~04c0eea4c8, baseline=1.20.0-SNAPSHOT~4a1be495da
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.333 ms) : 1314, 1352
.   : milestone, 1333,
appsec (1.699 ms) : 1675, 1723
.   : milestone, 1699,
iast (1.431 ms) : 1407, 1455
.   : milestone, 1431,
profiling (1.484 ms) : 1458, 1511
.   : milestone, 1484,
tracing (1.454 ms) : 1430, 1478
.   : milestone, 1454,
section candidate
no_agent (1.329 ms) : 1310, 1348
.   : milestone, 1329,
appsec (1.685 ms) : 1660, 1710
.   : milestone, 1685,
iast (1.478 ms) : 1455, 1502
.   : milestone, 1478,
profiling (1.452 ms) : 1426, 1478
.   : milestone, 1452,
tracing (1.433 ms) : 1409, 1458
.   : milestone, 1433,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.333 ms [1.314 ms, 1.352 ms] -
appsec 1.699 ms [1.675 ms, 1.723 ms] 365.883 µs (27.4%)
iast 1.431 ms [1.407 ms, 1.455 ms] 98.263 µs (7.4%)
profiling 1.484 ms [1.458 ms, 1.511 ms] 151.281 µs (11.3%)
tracing 1.454 ms [1.43 ms, 1.478 ms] 120.812 µs (9.1%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.329 ms [1.31 ms, 1.348 ms] -
appsec 1.685 ms [1.66 ms, 1.71 ms] 355.394 µs (26.7%)
iast 1.478 ms [1.455 ms, 1.502 ms] 148.79 µs (11.2%)
profiling 1.452 ms [1.426 ms, 1.478 ms] 122.932 µs (9.2%)
tracing 1.433 ms [1.409 ms, 1.458 ms] 104.102 µs (7.8%)

@manuel-alvarez-alvarez
manuel-alvarez-alvarez merged commit 72572d1 into master Aug 28, 2023
@manuel-alvarez-alvarez
manuel-alvarez-alvarez deleted the malvarez/iast-out-of-ctx-noop-tainteds branch August 28, 2023 08:09
@github-actions github-actions Bot added this to the 1.20.0 milestone Aug 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@smola smola smola approved these changes
@DDJavierSantos DDJavierSantos Awaiting requested review from DDJavierSantos DDJavierSantos is a code owner automatically assigned from DataDog/asm-java

Assignees

No one assigned

Labels

comp: asm iast Application Security Management (IAST) tag: performance Performance related changes

Projects

None yet

Milestone

1.20.0

Development

Successfully merging this pull request may close these issues.

2 participants

@manuel-alvarez-alvarez @smola