Skip to content

Provide path params to appsec#2395

Merged
estringana merged 40 commits into
masterfrom
estringana/request-params
Mar 28, 2024
Merged

Provide path params to appsec#2395
estringana merged 40 commits into
masterfrom
estringana/request-params

Conversation

@estringana

@estringana estringana commented Nov 28, 2023

Copy link
Copy Markdown
Contributor

Description

Extracts path parameters from incoming requests and attaches them to the span.

The implementation extracts params from the framework's route match result, which already has the parameter map populated after routing and adds them to the span. Works across Laravel, Symfony, and WordPress using each framework's native param extraction.

Readiness checklist

  • (only for Members) Changelog has been added to the release document.
  • Tests added for this feature/bug.

Reviewer checklist

  • Appropriate labels assigned.
  • Milestone is set.
  • Changelog has been added to the release document. For community contributors the reviewer is in charge of this task.

APPSEC-14738

@estringana
estringana force-pushed the estringana/request-params branch from d66167b to 191cf92 Compare November 30, 2023 14:48
@estringana
estringana force-pushed the estringana/request-params branch from 78603d4 to dbb9ebd Compare December 14, 2023 09:58
@estringana
estringana marked this pull request as ready for review December 14, 2023 15:45
@estringana
estringana requested review from a team as code owners December 14, 2023 15:45
Comment thread appsec/src/extension/tags.c Outdated
Comment thread appsec/src/extension/tags.c Outdated
Comment thread appsec/src/extension/tags.c Outdated
@estringana
estringana force-pushed the estringana/request-params branch from c084565 to cd8c66e Compare December 22, 2023 14:14
@estringana
estringana requested a review from Anilm3 January 2, 2024 11:12
@estringana
estringana force-pushed the estringana/request-params branch from cd8c66e to 8af66e2 Compare January 8, 2024 16:37
@estringana
estringana requested a review from PROFeNoM January 10, 2024 09:23

@PROFeNoM PROFeNoM left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 😃 I would rebase onto master/merge master, though, before merging into master, considering the Debug Logs PR was merged and could spot errors, if any :)

@estringana
estringana force-pushed the estringana/request-params branch from 3a1d871 to f2f61ff Compare January 18, 2024 10:12
@pr-commenter

pr-commenter Bot commented Jan 18, 2024

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2024-03-28 10:19:27

Comparing candidate commit 6c0628b in PR branch estringana/request-params with baseline commit 76e98df in branch master.

Found 3 performance improvements and 3 performance regressions! Performance is the same for 176 metrics, 0 unstable metrics.

scenario:ContextPropagationBench/benchExtractHeaders64Bit-opcache

  • 🟩 execution_time [-644.843ns; -531.157ns] or [-19.186%; -15.804%]

scenario:ContextPropagationBench/benchExtractTraceContext128Bit-opcache

  • 🟥 execution_time [+491.765ns; +662.235ns] or [+11.176%; +15.051%]

scenario:ContextPropagationBench/benchExtractTraceContext64Bit-opcache

  • 🟩 execution_time [-680.891ns; -595.109ns] or [-26.902%; -23.513%]

scenario:LogsInjectionBench/benchLogsInfoBaseline-opcache

  • 🟥 execution_time [+482.777ns; +524.023ns] or [+15.285%; +16.590%]

scenario:PDOBench/benchPDOOverheadWithDBM-opcache

  • 🟥 mem_peak [+99.696KB; +99.696KB] or [+4.423%; +4.423%]

scenario:TraceSerializationBench/benchSerializeTrace

  • 🟩 execution_time [-13.719µs; -9.281µs] or [-3.978%; -2.691%]

Comment thread appsec/src/extension/tags.c Outdated
Comment thread appsec/tests/extension/push_params.phpt Outdated
Comment thread appsec/tests/extension/push_params.phpt Outdated
Comment thread appsec/src/extension/tags.c Outdated
Comment thread appsec/src/extension/tags.c Outdated
@estringana estringana changed the title Provide path params to appsec Provide path params to appsec on Symfony and Laravel Feb 5, 2024
@estringana estringana changed the title Provide path params to appsec on Symfony and Laravel Provide path params to appsec Feb 5, 2024
@estringana
estringana force-pushed the estringana/request-params branch from f2f61ff to 3b7fc5c Compare February 5, 2024 17:24
@estringana
estringana requested a review from bwoebi February 6, 2024 10:09

@Anilm3 Anilm3 left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just did a quick pass over the extension code and left a few comments.

On the other hand, note that request_init already sends an inferred path_params. Do you have any thoughts on how we could avoid sending those unnecessary path_params ?

Comment thread appsec/src/extension/ddappsec.c Outdated
Comment thread appsec/src/extension/tags.c Outdated
Comment thread appsec/src/extension/ddappsec.c Outdated
Comment thread appsec/src/extension/ddappsec.c Outdated
@Anilm3

Anilm3 commented Feb 6, 2024

Copy link
Copy Markdown
Contributor

There should also be appsec integration tests .

@estringana
estringana force-pushed the estringana/request-params branch 2 times, most recently from 8f56c6d to ae18b39 Compare February 16, 2024 15:30
@estringana

Copy link
Copy Markdown
Contributor Author

Just did a quick pass over the extension code and left a few comments.

On the other hand, note that request_init already sends an inferred path_params. Do you have any thoughts on how we could avoid sending those unnecessary path_params ?

Right now there is nothing implemented that makes this easy. The options are:

  • Implement a new feature on the tracer that once a integration is used, maps the request targeted script to a framework. From that moment any request to that script we know it's a specific framework and then avoid sending generic parameters. This approach makes that the first request a target script will either send only the generic params or boths.
  • Send generic params at rshutdown if no framework has sent them

@Anilm3

Anilm3 commented Feb 19, 2024

Copy link
Copy Markdown
Contributor

Just did a quick pass over the extension code and left a few comments.
On the other hand, note that request_init already sends an inferred path_params. Do you have any thoughts on how we could avoid sending those unnecessary path_params ?

Right now there is nothing implemented that makes this easy. The options are:

  • Implement a new feature on the tracer that once a integration is used, maps the request targeted script to a framework. From that moment any request to that script we know it's a specific framework and then avoid sending generic parameters. This approach makes that the first request a target script will either send only the generic params or boths.
  • Send generic params at rshutdown if no framework has sent them

RSHUTDOWN is already too late for blocking on path_params, perhaps the first approach could work but it's a relatively large effort so perhaps it would make sense to do that in the future.

@estringana
estringana force-pushed the estringana/request-params branch 2 times, most recently from ddaf9e6 to 305bd51 Compare February 19, 2024 14:11
@codecov-commenter

codecov-commenter commented Feb 21, 2024

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 71.11111% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.78%. Comparing base (76e98df) to head (6c0628b).
⚠️ Report is 828 commits behind head on master.

Files with missing lines Patch % Lines
appsec/src/extension/ddappsec.c 51.85% 8 Missing and 5 partials ⚠️

❌ Your patch status has failed because the patch coverage (71.11%) is below the target coverage (90.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff              @@
##             master    #2395      +/-   ##
============================================
- Coverage     76.90%   75.78%   -1.12%     
- Complexity     2564     2577      +13     
============================================
  Files           215      241      +26     
  Lines         23095    27112    +4017     
  Branches          0      985     +985     
============================================
+ Hits          17761    20548    +2787     
- Misses         5334     6039     +705     
- Partials          0      525     +525     
Flag Coverage Δ
appsec-extension 69.01% <51.85%> (?)
tracer-extension 78.65% <ø> (ø)
tracer-php 74.86% <100.00%> (+0.13%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
...ations/Integrations/Laravel/LaravelIntegration.php 82.12% <100.00%> (+0.21%) ⬆️
...ations/Integrations/Symfony/SymfonyIntegration.php 83.51% <100.00%> (+0.22%) ⬆️
...ns/Integrations/WordPress/WordPressIntegration.php 93.18% <100.00%> (+0.77%) ⬆️
appsec/src/extension/ddappsec.c 77.10% <51.85%> (ø)

... and 26 files with indirect coverage changes


Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 76e98df...6c0628b. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@estringana
estringana force-pushed the estringana/request-params branch from 85a35c3 to c421615 Compare March 27, 2024 08:51
@estringana
estringana merged commit 8e98f4d into master Mar 28, 2024
@estringana
estringana deleted the estringana/request-params branch March 28, 2024 13:50
@github-actions github-actions Bot added this to the 0.99.0 milestone Mar 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants