Added GraphQL monitoring support by ValentinZakharov · Pull Request #6375 · DataDog/dd-trace-java

ValentinZakharov · 2023-12-15T15:44:36Z

What Does This Do

Implemented GraphQL monitoring support for ASM. Allows to detect and report attacks via GraphQL.
Current implementation consist of extension of GraphQL instrumentation along with new smoke-test application for testing resolvers.
ASM GraphQL monitoring will be enabled if the AppSec is enabled.

Motivation

The implementation support of GraphQL in our application security product is driven by the evolving landscape of customer needs and the growing adoption of GraphQL. GraphQL applications are susceptible to traditional types of attacks like Cross-Site Scripting (XSS) and SQL injection. Recognising potential security risks, we implemented GraphQL support in the ASM product to shielded from both novel and conventional threats.

Additional Notes

Jira ticket: APPSEC-11459

pr-commenter · 2023-12-15T17:49:54Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	vzakharov/api_security_graphql
git_commit_date	1710435433	1710437143
git_commit_sha	`6d2f2ad`	`25f4a37`
release_version	1.32.0-SNAPSHOT~6d2f2adf41	1.32.0-SNAPSHOT~25f4a37a6d

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1710440662	1710440662
ci_job_id	460109787	460109787
ci_pipeline_id	30122656	30122656
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
module	Agent	Agent
parent	None	None
variant	iast	iast

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 47 metrics, 15 unstable metrics.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:startup:petclinic:tracing:Telemetry	better [-665.031µs; -259.085µs] or [-8.467%; -3.298%]	7.393ms	7.855ms

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.32.0-SNAPSHOT~25f4a37a6d, baseline=1.32.0-SNAPSHOT~6d2f2adf41

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.092 s) : 0, 1092087
Total [baseline] (8.602 s) : 0, 8602281
Agent [candidate] (1.081 s) : 0, 1080658
Total [candidate] (8.602 s) : 0, 8602356
section iast
Agent [baseline] (1.211 s) : 0, 1211066
Total [baseline] (9.045 s) : 0, 9044693
Agent [candidate] (1.216 s) : 0, 1215936
Total [candidate] (9.08 s) : 0, 9079611
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.203 s) : 0, 1203161
Total [baseline] (8.995 s) : 0, 8995297
Agent [candidate] (1.214 s) : 0, 1213530
Total [candidate] (9.027 s) : 0, 9027491
section iast_TELEMETRY_OFF
Agent [baseline] (1.213 s) : 0, 1212929
Total [baseline] (9.088 s) : 0, 9087836
Agent [candidate] (1.202 s) : 0, 1202277
Total [candidate] (9.07 s) : 0, 9069761

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.092 s	-
Agent	iast	1.211 s	118.979 ms (10.9%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.203 s	111.075 ms (10.2%)
Agent	iast_TELEMETRY_OFF	1.213 s	120.842 ms (11.1%)
Total	tracing	8.602 s	-
Total	iast	9.045 s	442.412 ms (5.1%)
Total	iast_HARDCODED_SECRET_DISABLED	8.995 s	393.016 ms (4.6%)
Total	iast_TELEMETRY_OFF	9.088 s	485.554 ms (5.6%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.081 s	-
Agent	iast	1.216 s	135.277 ms (12.5%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.214 s	132.872 ms (12.3%)
Agent	iast_TELEMETRY_OFF	1.202 s	121.618 ms (11.3%)
Total	tracing	8.602 s	-
Total	iast	9.08 s	477.255 ms (5.5%)
Total	iast_HARDCODED_SECRET_DISABLED	9.027 s	425.135 ms (4.9%)
Total	iast_TELEMETRY_OFF	9.07 s	467.405 ms (5.4%)

gantt
    title insecure-bank - break down per module: candidate=1.32.0-SNAPSHOT~25f4a37a6d, baseline=1.32.0-SNAPSHOT~6d2f2adf41

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (705.074 ms) : 0, 705074
BytebuddyAgent [candidate] (696.335 ms) : 0, 696335
GlobalTracer [baseline] (294.62 ms) : 0, 294620
GlobalTracer [candidate] (292.264 ms) : 0, 292264
AppSec [baseline] (49.086 ms) : 0, 49086
AppSec [candidate] (49.095 ms) : 0, 49095
Remote Config [baseline] (743.742 µs) : 0, 744
Remote Config [candidate] (1.093 ms) : 0, 1093
Telemetry [baseline] (7.856 ms) : 0, 7856
Telemetry [candidate] (7.576 ms) : 0, 7576
section iast
BytebuddyAgent [baseline] (806.259 ms) : 0, 806259
BytebuddyAgent [candidate] (807.663 ms) : 0, 807663
GlobalTracer [baseline] (289.093 ms) : 0, 289093
GlobalTracer [candidate] (291.641 ms) : 0, 291641
AppSec [baseline] (50.841 ms) : 0, 50841
AppSec [candidate] (49.736 ms) : 0, 49736
IAST [baseline] (22.969 ms) : 0, 22969
IAST [candidate] (24.244 ms) : 0, 24244
Remote Config [baseline] (599.038 µs) : 0, 599
Remote Config [candidate] (584.732 µs) : 0, 585
Telemetry [baseline] (6.624 ms) : 0, 6624
Telemetry [candidate] (7.496 ms) : 0, 7496
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (799.074 ms) : 0, 799074
BytebuddyAgent [candidate] (805.985 ms) : 0, 805985
GlobalTracer [baseline] (288.785 ms) : 0, 288785
GlobalTracer [candidate] (291.213 ms) : 0, 291213
AppSec [baseline] (49.317 ms) : 0, 49317
AppSec [candidate] (50.717 ms) : 0, 50717
IAST [baseline] (22.908 ms) : 0, 22908
IAST [candidate] (23.869 ms) : 0, 23869
Remote Config [baseline] (597.444 µs) : 0, 597
Remote Config [candidate] (584.758 µs) : 0, 585
Telemetry [baseline] (8.146 ms) : 0, 8146
Telemetry [candidate] (6.588 ms) : 0, 6588
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (803.551 ms) : 0, 803551
BytebuddyAgent [candidate] (795.841 ms) : 0, 795841
GlobalTracer [baseline] (292.415 ms) : 0, 292415
GlobalTracer [candidate] (290.72 ms) : 0, 290720
AppSec [baseline] (49.232 ms) : 0, 49232
AppSec [candidate] (51.19 ms) : 0, 51190
IAST [baseline] (24.307 ms) : 0, 24307
IAST [candidate] (21.921 ms) : 0, 21921
Remote Config [baseline] (579.552 µs) : 0, 580
Remote Config [candidate] (580.507 µs) : 0, 581
Telemetry [baseline] (8.115 ms) : 0, 8115
Telemetry [candidate] (7.441 ms) : 0, 7441

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.32.0-SNAPSHOT~25f4a37a6d, baseline=1.32.0-SNAPSHOT~6d2f2adf41

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.08 s) : 0, 1080479
Total [baseline] (9.159 s) : 0, 9158785
Agent [candidate] (1.087 s) : 0, 1087311
Total [candidate] (9.171 s) : 0, 9170575
section appsec
Agent [baseline] (1.201 s) : 0, 1200764
Total [baseline] (9.333 s) : 0, 9332522
Agent [candidate] (1.203 s) : 0, 1203466
Total [candidate] (9.428 s) : 0, 9427853
section iast
Agent [baseline] (1.207 s) : 0, 1207122
Total [baseline] (9.405 s) : 0, 9404600
Agent [candidate] (1.214 s) : 0, 1214020
Total [candidate] (9.403 s) : 0, 9403344
section profiling
Agent [baseline] (1.273 s) : 0, 1272707
Total [baseline] (9.398 s) : 0, 9397658
Agent [candidate] (1.274 s) : 0, 1273847
Total [candidate] (9.392 s) : 0, 9392239

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.08 s	-
Agent	appsec	1.201 s	120.285 ms (11.1%)
Agent	iast	1.207 s	126.643 ms (11.7%)
Agent	profiling	1.273 s	192.228 ms (17.8%)
Total	tracing	9.159 s	-
Total	appsec	9.333 s	173.737 ms (1.9%)
Total	iast	9.405 s	245.815 ms (2.7%)
Total	profiling	9.398 s	238.873 ms (2.6%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.087 s	-
Agent	appsec	1.203 s	116.154 ms (10.7%)
Agent	iast	1.214 s	126.709 ms (11.7%)
Agent	profiling	1.274 s	186.536 ms (17.2%)
Total	tracing	9.171 s	-
Total	appsec	9.428 s	257.279 ms (2.8%)
Total	iast	9.403 s	232.77 ms (2.5%)
Total	profiling	9.392 s	221.664 ms (2.4%)

gantt
    title petclinic - break down per module: candidate=1.32.0-SNAPSHOT~25f4a37a6d, baseline=1.32.0-SNAPSHOT~6d2f2adf41

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (697.345 ms) : 0, 697345
BytebuddyAgent [candidate] (701.017 ms) : 0, 701017
GlobalTracer [baseline] (291.568 ms) : 0, 291568
GlobalTracer [candidate] (293.972 ms) : 0, 293972
AppSec [baseline] (48.758 ms) : 0, 48758
AppSec [candidate] (49.333 ms) : 0, 49333
Remote Config [baseline] (746.754 µs) : 0, 747
Remote Config [candidate] (1.129 ms) : 0, 1129
Telemetry [baseline] (7.855 ms) : 0, 7855
Telemetry [candidate] (7.393 ms) : 0, 7393
section appsec
BytebuddyAgent [baseline] (696.859 ms) : 0, 696859
BytebuddyAgent [candidate] (697.576 ms) : 0, 697576
GlobalTracer [baseline] (290.912 ms) : 0, 290912
GlobalTracer [candidate] (292.257 ms) : 0, 292257
AppSec [baseline] (153.33 ms) : 0, 153330
AppSec [candidate] (153.822 ms) : 0, 153822
Remote Config [baseline] (611.839 µs) : 0, 612
Remote Config [candidate] (619.775 µs) : 0, 620
Telemetry [baseline] (6.873 ms) : 0, 6873
Telemetry [candidate] (6.929 ms) : 0, 6929
IAST [baseline] (17.877 ms) : 0, 17877
IAST [candidate] (18.005 ms) : 0, 18005
section iast
BytebuddyAgent [baseline] (802.69 ms) : 0, 802690
BytebuddyAgent [candidate] (807.238 ms) : 0, 807238
GlobalTracer [baseline] (289.071 ms) : 0, 289071
GlobalTracer [candidate] (291.315 ms) : 0, 291315
AppSec [baseline] (50.027 ms) : 0, 50027
AppSec [candidate] (52.033 ms) : 0, 52033
Remote Config [baseline] (603.702 µs) : 0, 604
Remote Config [candidate] (582.849 µs) : 0, 583
Telemetry [baseline] (7.371 ms) : 0, 7371
Telemetry [candidate] (6.762 ms) : 0, 6762
IAST [baseline] (22.957 ms) : 0, 22957
IAST [candidate] (21.511 ms) : 0, 21511
section profiling
BytebuddyAgent [baseline] (688.696 ms) : 0, 688696
BytebuddyAgent [candidate] (689.202 ms) : 0, 689202
GlobalTracer [baseline] (375.831 ms) : 0, 375831
GlobalTracer [candidate] (376.361 ms) : 0, 376361
AppSec [baseline] (49.629 ms) : 0, 49629
AppSec [candidate] (49.854 ms) : 0, 49854
Remote Config [baseline] (793.653 µs) : 0, 794
Remote Config [candidate] (880.275 µs) : 0, 880
Telemetry [baseline] (7.397 ms) : 0, 7397
Telemetry [candidate] (7.286 ms) : 0, 7286
ProfilingAgent [baseline] (94.251 ms) : 0, 94251
ProfilingAgent [candidate] (94.105 ms) : 0, 94105
Profiling [baseline] (94.275 ms) : 0, 94275
Profiling [candidate] (94.128 ms) : 0, 94128

Load

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.32.0-SNAPSHOT~25f4a37a6d, baseline=1.32.0-SNAPSHOT~6d2f2adf41
    dateFormat X
    axisFormat %s
section baseline
no_agent (360.918 µs) : 341, 380
.   : milestone, 361,
iast (468.534 µs) : 448, 489
.   : milestone, 469,
iast_FULL (533.601 µs) : 513, 554
.   : milestone, 534,
iast_GLOBAL (490.61 µs) : 470, 512
.   : milestone, 491,
iast_HARDCODED_SECRET_DISABLED (476.809 µs) : 456, 498
.   : milestone, 477,
iast_INACTIVE (448.624 µs) : 427, 470
.   : milestone, 449,
iast_TELEMETRY_OFF (467.385 µs) : 447, 488
.   : milestone, 467,
tracing (448.722 µs) : 428, 470
.   : milestone, 449,
section candidate
no_agent (358.903 µs) : 339, 378
.   : milestone, 359,
iast (470.558 µs) : 450, 491
.   : milestone, 471,
iast_FULL (537.172 µs) : 516, 558
.   : milestone, 537,
iast_GLOBAL (495.071 µs) : 474, 516
.   : milestone, 495,
iast_HARDCODED_SECRET_DISABLED (470.334 µs) : 450, 491
.   : milestone, 470,
iast_INACTIVE (443.293 µs) : 423, 463
.   : milestone, 443,
iast_TELEMETRY_OFF (468.824 µs) : 448, 490
.   : milestone, 469,
tracing (445.174 µs) : 424, 466
.   : milestone, 445,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	360.918 µs [341.464 µs, 380.372 µs]	-
iast	468.534 µs [447.924 µs, 489.144 µs]	107.616 µs (29.8%)
iast_FULL	533.601 µs [513.082 µs, 554.119 µs]	172.682 µs (47.8%)
iast_GLOBAL	490.61 µs [469.541 µs, 511.679 µs]	129.692 µs (35.9%)
iast_HARDCODED_SECRET_DISABLED	476.809 µs [455.69 µs, 497.927 µs]	115.89 µs (32.1%)
iast_INACTIVE	448.624 µs [427.032 µs, 470.215 µs]	87.706 µs (24.3%)
iast_TELEMETRY_OFF	467.385 µs [446.807 µs, 487.963 µs]	106.467 µs (29.5%)
tracing	448.722 µs [427.568 µs, 469.877 µs]	87.804 µs (24.3%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	358.903 µs [339.413 µs, 378.393 µs]	-
iast	470.558 µs [450.054 µs, 491.062 µs]	111.655 µs (31.1%)
iast_FULL	537.172 µs [516.486 µs, 557.857 µs]	178.269 µs (49.7%)
iast_GLOBAL	495.071 µs [473.969 µs, 516.173 µs]	136.168 µs (37.9%)
iast_HARDCODED_SECRET_DISABLED	470.334 µs [449.987 µs, 490.68 µs]	111.431 µs (31.0%)
iast_INACTIVE	443.293 µs [423.091 µs, 463.495 µs]	84.39 µs (23.5%)
iast_TELEMETRY_OFF	468.824 µs [448.024 µs, 489.623 µs]	109.921 µs (30.6%)
tracing	445.174 µs [423.963 µs, 466.385 µs]	86.271 µs (24.0%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.32.0-SNAPSHOT~25f4a37a6d, baseline=1.32.0-SNAPSHOT~6d2f2adf41
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.343 ms) : 1324, 1362
.   : milestone, 1343,
appsec (1.76 ms) : 1737, 1784
.   : milestone, 1760,
iast (1.512 ms) : 1489, 1535
.   : milestone, 1512,
profiling (1.521 ms) : 1497, 1544
.   : milestone, 1521,
tracing (1.486 ms) : 1462, 1509
.   : milestone, 1486,
section candidate
no_agent (1.349 ms) : 1330, 1368
.   : milestone, 1349,
appsec (1.778 ms) : 1754, 1801
.   : milestone, 1778,
iast (1.506 ms) : 1483, 1530
.   : milestone, 1506,
profiling (1.51 ms) : 1487, 1534
.   : milestone, 1510,
tracing (1.498 ms) : 1475, 1522
.   : milestone, 1498,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.343 ms [1.324 ms, 1.362 ms]	-
appsec	1.76 ms [1.737 ms, 1.784 ms]	417.008 µs (31.0%)
iast	1.512 ms [1.489 ms, 1.535 ms]	168.584 µs (12.5%)
profiling	1.521 ms [1.497 ms, 1.544 ms]	177.248 µs (13.2%)
tracing	1.486 ms [1.462 ms, 1.509 ms]	142.273 µs (10.6%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.349 ms [1.33 ms, 1.368 ms]	-
appsec	1.778 ms [1.754 ms, 1.801 ms]	428.584 µs (31.8%)
iast	1.506 ms [1.483 ms, 1.53 ms]	157.309 µs (11.7%)
profiling	1.51 ms [1.487 ms, 1.534 ms]	161.415 µs (12.0%)
tracing	1.498 ms [1.475 ms, 1.522 ms]	149.477 µs (11.1%)

smola · 2023-12-18T09:37:48Z


  Address<Map<String, Object>> WAF_CONTEXT_PROCESSOR = new Address<>("waf.context.processor");

+  Address<Map<String, ?>> SERVER_GRAPHQL_ALL_RESOLVERS =


Have you checked whether latest GraphQL rules support the server.graphql.all_resolvers at all? Or they moved to server.graphql.resolver only?

Yes, both are supported everywhere

ValentinZakharov added the comp: asm waf Application Security Management (WAF) label Dec 15, 2023

ValentinZakharov self-assigned this Dec 15, 2023

ValentinZakharov force-pushed the vzakharov/api_security_graphql branch from d51aa7f to 9c0fcc0 Compare December 15, 2023 17:06

ValentinZakharov force-pushed the vzakharov/api_security_graphql branch from 9c0fcc0 to e04e4f6 Compare December 16, 2023 10:43

smola reviewed Dec 18, 2023

View reviewed changes

ValentinZakharov force-pushed the vzakharov/api_security_graphql branch from 1af2443 to 038d5bf Compare December 18, 2023 15:16

ValentinZakharov force-pushed the vzakharov/api_security_graphql branch from 038d5bf to 49df193 Compare January 24, 2024 22:08

ValentinZakharov added 7 commits January 30, 2024 01:45

Added smoke-test SpringBoot GraphQL appication

d0b2b8b

Arguments capturing in GraphQL

b9cdf9b

Refactor

2969005

Fixed tests

6c7a8a5

Fixed tests

193cbd2

Fixed GraphQL resolver address

9d31868

Missing smoke-test

cdfd44e

ValentinZakharov force-pushed the vzakharov/api_security_graphql branch from 6d29583 to cdfd44e Compare January 30, 2024 00:45

ValentinZakharov marked this pull request as ready for review January 30, 2024 01:04

ValentinZakharov requested review from a team as code owners January 30, 2024 01:04

ValentinZakharov requested review from am312, jandro996, mcculls and smola January 30, 2024 01:04

Merge branch 'master' into vzakharov/api_security_graphql

17c7709

jandro996 approved these changes Feb 2, 2024

View reviewed changes

This was referenced Feb 9, 2024

Upgrade to libddwaf 1.16.0 (libsqreen 9.0.1) #6658

Merged

Replace ASM transient mechanism with WAF ephemeral addresses #6687

Merged

ValentinZakharov added 3 commits March 14, 2024 10:56

Merge branch 'master' into vzakharov/api_security_graphql

e879d76

Merge branch 'master' into vzakharov/api_security_graphql

beef7cd

Merge branch 'master' into vzakharov/api_security_graphql

25f4a37

Fixed tests

6aac96c

ValentinZakharov merged commit 36e924e into master Mar 15, 2024

ValentinZakharov deleted the vzakharov/api_security_graphql branch March 15, 2024 18:17

github-actions Bot added this to the 1.32.0 milestone Mar 15, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Added GraphQL monitoring support#6375

Added GraphQL monitoring support#6375
ValentinZakharov merged 12 commits into
masterfrom
vzakharov/api_security_graphql

ValentinZakharov commented Dec 15, 2023 •

edited by atlassian Bot

Loading

Uh oh!

pr-commenter Bot commented Dec 15, 2023 •

edited

Loading

Uh oh!

smola Dec 18, 2023

Uh oh!

ValentinZakharov Dec 20, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants


		Address<Map<String, Object>> WAF_CONTEXT_PROCESSOR = new Address<>("waf.context.processor");

		Address<Map<String, ?>> SERVER_GRAPHQL_ALL_RESOLVERS =

Uh oh!

Conversation

ValentinZakharov commented Dec 15, 2023 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Uh oh!

pr-commenter Bot commented Dec 15, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Uh oh!

smola Dec 18, 2023

Choose a reason for hiding this comment

Uh oh!

ValentinZakharov Dec 20, 2023

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ValentinZakharov commented Dec 15, 2023 •

edited by atlassian Bot

Loading

pr-commenter Bot commented Dec 15, 2023 •

edited

Loading