HTTP response schema collection and data classification #8938
+158
−0
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sezen-datadog
force-pushed
the
sezen.leblay/APPSEC-57259-extract-schema-spring
branch
from
f3bdd40 to
7c044fd
Compare
BenchmarksStartupParameters
See matching parameters
SummaryFound 1 performance improvements and 2 performance regressions! Performance is the same for 54 metrics, 14 unstable metrics.
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.50.0-SNAPSHOT~89f9cac69e, baseline=1.50.0-SNAPSHOT~7787af738f
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.033 s) : 0, 1032650
Total [baseline] (11.16 s) : 0, 11160418
Agent [candidate] (1.033 s) : 0, 1032960
Total [candidate] (11.177 s) : 0, 11177108
section appsec
Agent [baseline] (1.165 s) : 0, 1164679
Total [baseline] (11.235 s) : 0, 11234939
Agent [candidate] (1.167 s) : 0, 1166569
Total [candidate] (11.315 s) : 0, 11315466
section iast
Agent [baseline] (1.155 s) : 0, 1154939
Total [baseline] (11.381 s) : 0, 11381198
Agent [candidate] (1.155 s) : 0, 1155331
Total [candidate] (11.393 s) : 0, 11392654
section profiling
Agent [baseline] (1.285 s) : 0, 1284600
Total [baseline] (11.662 s) : 0, 11662079
Agent [candidate] (1.276 s) : 0, 1276265
Total [candidate] (11.441 s) : 0, 11440724
gantt
title petclinic - break down per module: candidate=1.50.0-SNAPSHOT~89f9cac69e, baseline=1.50.0-SNAPSHOT~7787af738f
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (690.768 ms) : 0, 690768
BytebuddyAgent [candidate] (685.228 ms) : 0, 685228
GlobalTracer [baseline] (242.864 ms) : 0, 242864
GlobalTracer [candidate] (241.693 ms) : 0, 241693
AppSec [baseline] (56.827 ms) : 0, 56827
AppSec [candidate] (61.057 ms) : 0, 61057
Debugger [baseline] (6.279 ms) : 0, 6279
Debugger [candidate] (6.361 ms) : 0, 6361
Remote Config [baseline] (740.857 µs) : 0, 741
Remote Config [candidate] (701.905 µs) : 0, 702
Telemetry [baseline] (11.36 ms) : 0, 11360
Telemetry [candidate] (14.376 ms) : 0, 14376
section appsec
BytebuddyAgent [baseline] (701.76 ms) : 0, 701760
BytebuddyAgent [candidate] (702.094 ms) : 0, 702094
GlobalTracer [baseline] (238.341 ms) : 0, 238341
GlobalTracer [candidate] (238.608 ms) : 0, 238608
AppSec [baseline] (176.159 ms) : 0, 176159
AppSec [candidate] (177.37 ms) : 0, 177370
Debugger [baseline] (5.942 ms) : 0, 5942
Debugger [candidate] (6.004 ms) : 0, 6004
Remote Config [baseline] (628.627 µs) : 0, 629
Remote Config [candidate] (630.183 µs) : 0, 630
Telemetry [baseline] (7.363 ms) : 0, 7363
Telemetry [candidate] (7.367 ms) : 0, 7367
IAST [baseline] (21.754 ms) : 0, 21754
IAST [candidate] (21.82 ms) : 0, 21820
section iast
BytebuddyAgent [baseline] (804.29 ms) : 0, 804290
BytebuddyAgent [candidate] (802.34 ms) : 0, 802340
GlobalTracer [baseline] (232.214 ms) : 0, 232214
GlobalTracer [candidate] (230.575 ms) : 0, 230575
AppSec [baseline] (56.344 ms) : 0, 56344
AppSec [candidate] (58.623 ms) : 0, 58623
Debugger [baseline] (6.014 ms) : 0, 6014
Debugger [candidate] (5.898 ms) : 0, 5898
Remote Config [baseline] (604.161 µs) : 0, 604
Remote Config [candidate] (593.692 µs) : 0, 594
Telemetry [baseline] (7.977 ms) : 0, 7977
Telemetry [candidate] (7.878 ms) : 0, 7878
IAST [baseline] (23.95 ms) : 0, 23950
IAST [candidate] (25.923 ms) : 0, 25923
section profiling
BytebuddyAgent [baseline] (685.232 ms) : 0, 685232
BytebuddyAgent [candidate] (681.192 ms) : 0, 681192
GlobalTracer [baseline] (365.33 ms) : 0, 365330
GlobalTracer [candidate] (360.969 ms) : 0, 360969
AppSec [baseline] (62.607 ms) : 0, 62607
AppSec [candidate] (66.785 ms) : 0, 66785
Debugger [baseline] (6.135 ms) : 0, 6135
Debugger [candidate] (6.17 ms) : 0, 6170
Remote Config [baseline] (677.03 µs) : 0, 677
Remote Config [candidate] (635.513 µs) : 0, 636
Telemetry [baseline] (8.176 ms) : 0, 8176
Telemetry [candidate] (8.123 ms) : 0, 8123
ProfilingAgent [baseline] (104.915 ms) : 0, 104915
ProfilingAgent [candidate] (101.154 ms) : 0, 101154
Profiling [baseline] (104.939 ms) : 0, 104939
Profiling [candidate] (101.179 ms) : 0, 101179
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.50.0-SNAPSHOT~89f9cac69e, baseline=1.50.0-SNAPSHOT~7787af738f
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.028 s) : 0, 1028460
Total [baseline] (8.55 s) : 0, 8550005
Agent [candidate] (1.035 s) : 0, 1035329
Total [candidate] (8.535 s) : 0, 8534762
section iast
Agent [baseline] (1.153 s) : 0, 1153161
Total [baseline] (9.179 s) : 0, 9178672
Agent [candidate] (1.155 s) : 0, 1154541
Total [candidate] (9.189 s) : 0, 9189271
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.166 s) : 0, 1165825
Total [baseline] (9.17 s) : 0, 9169766
Agent [candidate] (1.163 s) : 0, 1162671
Total [candidate] (9.147 s) : 0, 9146670
section iast_TELEMETRY_OFF
Agent [baseline] (1.154 s) : 0, 1153802
Total [baseline] (9.217 s) : 0, 9216780
Agent [candidate] (1.153 s) : 0, 1153413
Total [candidate] (9.26 s) : 0, 9259528
gantt
title insecure-bank - break down per module: candidate=1.50.0-SNAPSHOT~89f9cac69e, baseline=1.50.0-SNAPSHOT~7787af738f
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (686.555 ms) : 0, 686555
BytebuddyAgent [candidate] (687.905 ms) : 0, 687905
GlobalTracer [baseline] (241.513 ms) : 0, 241513
GlobalTracer [candidate] (241.675 ms) : 0, 241675
AppSec [baseline] (57.014 ms) : 0, 57014
AppSec [candidate] (62.082 ms) : 0, 62082
Debugger [baseline] (6.191 ms) : 0, 6191
Debugger [candidate] (6.254 ms) : 0, 6254
Remote Config [baseline] (723.77 µs) : 0, 724
Remote Config [candidate] (680.268 µs) : 0, 680
Telemetry [baseline] (12.945 ms) : 0, 12945
Telemetry [candidate] (12.933 ms) : 0, 12933
section iast
BytebuddyAgent [baseline] (805.331 ms) : 0, 805331
BytebuddyAgent [candidate] (800.906 ms) : 0, 800906
GlobalTracer [baseline] (230.69 ms) : 0, 230690
GlobalTracer [candidate] (230.79 ms) : 0, 230790
AppSec [baseline] (51.45 ms) : 0, 51450
AppSec [candidate] (59.596 ms) : 0, 59596
Debugger [baseline] (5.943 ms) : 0, 5943
Debugger [candidate] (5.938 ms) : 0, 5938
Remote Config [baseline] (592.162 µs) : 0, 592
Remote Config [candidate] (603.367 µs) : 0, 603
Telemetry [baseline] (7.907 ms) : 0, 7907
Telemetry [candidate] (7.824 ms) : 0, 7824
IAST [baseline] (27.637 ms) : 0, 27637
IAST [candidate] (25.418 ms) : 0, 25418
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (813.635 ms) : 0, 813635
BytebuddyAgent [candidate] (807.629 ms) : 0, 807629
GlobalTracer [baseline] (233.054 ms) : 0, 233054
GlobalTracer [candidate] (231.724 ms) : 0, 231724
AppSec [baseline] (52.279 ms) : 0, 52279
AppSec [candidate] (57.113 ms) : 0, 57113
Debugger [baseline] (6.022 ms) : 0, 6022
Debugger [candidate] (6.026 ms) : 0, 6026
Remote Config [baseline] (608.511 µs) : 0, 609
Remote Config [candidate] (616.459 µs) : 0, 616
Telemetry [baseline] (8.133 ms) : 0, 8133
Telemetry [candidate] (7.991 ms) : 0, 7991
IAST [baseline] (28.297 ms) : 0, 28297
IAST [candidate] (27.876 ms) : 0, 27876
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (804.02 ms) : 0, 804020
BytebuddyAgent [candidate] (799.559 ms) : 0, 799559
GlobalTracer [baseline] (232.143 ms) : 0, 232143
GlobalTracer [candidate] (231.405 ms) : 0, 231405
AppSec [baseline] (50.461 ms) : 0, 50461
AppSec [candidate] (58.034 ms) : 0, 58034
Debugger [baseline] (6.041 ms) : 0, 6041
Debugger [candidate] (5.972 ms) : 0, 5972
Remote Config [baseline] (603.691 µs) : 0, 604
Remote Config [candidate] (611.641 µs) : 0, 612
Telemetry [baseline] (7.901 ms) : 0, 7901
Telemetry [candidate] (7.902 ms) : 0, 7902
IAST [baseline] (28.953 ms) : 0, 28953
IAST [candidate] (25.579 ms) : 0, 25579
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 3 performance regressions! Performance is the same for 0 metrics, 11 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~89f9cac69e, baseline=1.50.0-SNAPSHOT~7787af738f
dateFormat X
axisFormat %s
section baseline
no_agent (8.753 ms) : 8730, 8775
. : milestone, 8753,
appsec (63.362 ms) : 62467, 64256
. : milestone, 63362,
appsec_no_iast (72.132 ms) : 71068, 73196
. : milestone, 72132,
code_origins (86.369 ms) : 84358, 88381
. : milestone, 86369,
iast (79.982 ms) : 78667, 81297
. : milestone, 79982,
profiling (53.182 ms) : 52393, 53971
. : milestone, 53182,
tracing (12.402 ms) : 12284, 12520
. : milestone, 12402,
section candidate
no_agent (117.423 ms) : 114743, 120103
. : milestone, 117423,
appsec (135.322 ms) : 131424, 139220
. : milestone, 135322,
appsec_no_iast (144.376 ms) : 139419, 149333
. : milestone, 144376,
code_origins (149.763 ms) : 139896, 159631
. : milestone, 149763,
iast (158.791 ms) : 151999, 165583
. : milestone, 158791,
profiling (128.162 ms) : 124870, 131454
. : milestone, 128162,
tracing (121.275 ms) : 118377, 124174
. : milestone, 121275,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~89f9cac69e, baseline=1.50.0-SNAPSHOT~7787af738f
dateFormat X
axisFormat %s
section baseline
no_agent (1.474 ms) : 1463, 1486
. : milestone, 1474,
appsec (2.414 ms) : 2365, 2463
. : milestone, 2414,
iast (2.186 ms) : 2125, 2247
. : milestone, 2186,
iast_GLOBAL (2.229 ms) : 2167, 2290
. : milestone, 2229,
profiling (2.036 ms) : 1986, 2086
. : milestone, 2036,
tracing (2.001 ms) : 1954, 2049
. : milestone, 2001,
section candidate
no_agent (1.472 ms) : 1460, 1483
. : milestone, 1472,
appsec (2.394 ms) : 2345, 2442
. : milestone, 2394,
iast (2.183 ms) : 2122, 2245
. : milestone, 2183,
iast_GLOBAL (2.252 ms) : 2189, 2315
. : milestone, 2252,
profiling (2.033 ms) : 1983, 2082
. : milestone, 2033,
tracing (2.014 ms) : 1966, 2062
. : milestone, 2014,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~89f9cac69e, baseline=1.50.0-SNAPSHOT~7787af738f
dateFormat X
axisFormat %s
section baseline
no_agent (14.987 s) : 14987000, 14987000
. : milestone, 14987000,
appsec (14.72 s) : 14720000, 14720000
. : milestone, 14720000,
iast (18.97 s) : 18970000, 18970000
. : milestone, 18970000,
iast_GLOBAL (18.03 s) : 18030000, 18030000
. : milestone, 18030000,
profiling (15.257 s) : 15257000, 15257000
. : milestone, 15257000,
tracing (15.023 s) : 15023000, 15023000
. : milestone, 15023000,
section candidate
no_agent (14.796 s) : 14796000, 14796000
. : milestone, 14796000,
appsec (14.862 s) : 14862000, 14862000
. : milestone, 14862000,
iast (18.762 s) : 18762000, 18762000
. : milestone, 18762000,
iast_GLOBAL (17.759 s) : 17759000, 17759000
. : milestone, 17759000,
profiling (15.36 s) : 15360000, 15360000
. : milestone, 15360000,
tracing (14.884 s) : 14884000, 14884000
. : milestone, 14884000,
|
jandro996
reviewed
Jun 9, 2025
| @@ -627,6 +671,38 @@ private Flow<Void> onRequestBodyDone(RequestContext ctx_, StoredBodySupplier sup | |||
| } | |||
| } | |||
|
|
|||
| private Flow<Void> onResponseBodyDone(RequestContext ctx_, StoredBodySupplier supplier) { | |||
There was a problem hiding this comment.
I need to check the RFC properly but AFAIK response body raw doesn't applies to schema collection
jandro996
reviewed
Jun 10, 2025
Comment on lines
+149
to
+160
| if (action instanceof Flow.Action.RequestBlockingAction) { | ||
| Flow.Action.RequestBlockingAction rba = (Flow.Action.RequestBlockingAction) action; | ||
| BlockResponseFunction brf = reqCtx.getBlockResponseFunction(); | ||
| if (brf != null) { | ||
| brf.tryCommitBlockingResponse( | ||
| reqCtx.getTraceSegment(), | ||
| rba.getStatusCode(), | ||
| rba.getBlockingContentType(), | ||
| rba.getExtraHeaders()); | ||
| } | ||
| throw new BlockingException("Blocked response (for HttpMessageConverter/write)"); | ||
| } |
There was a problem hiding this comment.
Do we need to do this here? we do this in the request to block if it's necessary.
jandro996
reviewed
Jun 10, 2025
| @Advice.OnMethodEnter(suppress = Throwable.class) | ||
| public static void before( | ||
| @Advice.Argument(0) final Object obj, @ActiveRequestContext RequestContext reqCtx) { | ||
| if (obj == null) { |
There was a problem hiding this comment.
As we don't want to collect the response if the request is blocked, maybe it's a good point to check something like AppSecRequestContext#isWafBlocked (only works for waf but we can add another flag for RASP)
jandro996
reviewed
Jun 10, 2025
| if (subInfo == null || subInfo.isEmpty()) { | ||
| return NoopFlow.INSTANCE; | ||
| } | ||
| Object converted = ObjectIntrospection.convert(obj, ctx, () -> {}); |
There was a problem hiding this comment.
We need to change the ObjectInstrospection#conver to be able to use it for response schema collection
Limits
Currently most libraries enforce a set of limits before serialising addresses into ddwaf_object. The default global object limits are the following:
Maximum string length: 4096 bytes
Maximum container depth: 20 levels
Maximum container size: 256 nodes
The schema extraction algorithm has a different set of limits, which are lower than the limits mentioned above:
Maximum container depth: 18 levels
Maximum array size: 10 nodes
Maximum record size: 255 nodes
When serialising addresses to ddwaf_object which aren’t used for anything other than schema extraction, the library may use the schema extraction limits, rather than the global object limits.
https://docs.google.com/document/d/1965kNw_1CScNM15GgLZ0jvMhFH2kLpDYGztw8YeOfjM/edit?tab=t.0
jandro996
reviewed
Jun 10, 2025
There was a problem hiding this comment.
I think that we only need the RESPONSE_BODY_CONVERTED
jandro996
reviewed
Jun 10, 2025
There was a problem hiding this comment.
Same here, I think that we are ok just with RESPONSE_BODY_CONVERTED_ID
jandro996
reviewed
Jun 10, 2025
| @@ -98,6 +98,7 @@ public class AppSecRequestContext implements DataBundle, Closeable { | |||
| private String inferredClientIp; | |||
|
|
|||
| private volatile StoredBodySupplier storedRequestBodySupplier; | |||
| private volatile StoredBodySupplier storedResponseBodySupplier; | |||
There was a problem hiding this comment.
I think we don't need this, as we can pass the response object via callback directly
jandro996
reviewed
Jun 10, 2025
| @@ -106,6 +107,8 @@ public class AppSecRequestContext implements DataBundle, Closeable { | |||
| private boolean rawReqBodyPublished; | |||
| private boolean convertedReqBodyPublished; | |||
| private boolean respDataPublished; | |||
| private boolean rawRespBodyPublished; | |||
sezen-datadog
force-pushed
the
sezen.leblay/APPSEC-57259-extract-schema-spring
branch
2 times, most recently
from
ade8110 to
5aa9177
Compare
sezen-datadog
changed the base branch from
master
to
malvarez/vertx-response-extraction
Signed-off-by: sezen.leblay <[email protected]>
sezen-datadog
force-pushed
the
sezen.leblay/APPSEC-57259-extract-schema-spring
branch
from
5aa9177 to
5000116
Compare
Signed-off-by: sezen.leblay <[email protected]>
Signed-off-by: sezen.leblay <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Motivation
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any usefull labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-57259