-
Notifications
You must be signed in to change notification settings - Fork 142
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[IAST] Change filtered cookie vuln hash #6032
Conversation
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing the following branches/commits: Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:
Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard. Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph). gantt
title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6032) - mean (70ms) : 66, 73
. : milestone, 70,
master - mean (69ms) : 67, 71
. : milestone, 69,
section CallTarget+Inlining+NGEN
This PR (6032) - mean (1,117ms) : 1091, 1143
. : milestone, 1117,
master - mean (1,116ms) : 1093, 1140
. : milestone, 1116,
gantt
title Execution time (ms) FakeDbCommand (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6032) - mean (109ms) : 106, 112
. : milestone, 109,
master - mean (108ms) : 105, 111
. : milestone, 108,
section CallTarget+Inlining+NGEN
This PR (6032) - mean (810ms) : 787, 834
. : milestone, 810,
master - mean (815ms) : 794, 836
. : milestone, 815,
gantt
title Execution time (ms) FakeDbCommand (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6032) - mean (93ms) : 90, 96
. : milestone, 93,
master - mean (93ms) : 90, 95
. : milestone, 93,
section CallTarget+Inlining+NGEN
This PR (6032) - mean (767ms) : 745, 790
. : milestone, 767,
master - mean (773ms) : 749, 797
. : milestone, 773,
gantt
title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6032) - mean (191ms) : 186, 197
. : milestone, 191,
master - mean (191ms) : 188, 193
. : milestone, 191,
section CallTarget+Inlining+NGEN
This PR (6032) - mean (1,199ms) : 1173, 1225
. : milestone, 1199,
master - mean (1,196ms) : 1171, 1220
. : milestone, 1196,
gantt
title Execution time (ms) HttpMessageHandler (.NET Core 3.1)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6032) - mean (276ms) : 272, 280
. : milestone, 276,
master - mean (276ms) : 272, 280
. : milestone, 276,
section CallTarget+Inlining+NGEN
This PR (6032) - mean (970ms) : 951, 989
. : milestone, 970,
master - mean (971ms) : 948, 994
. : milestone, 971,
gantt
title Execution time (ms) HttpMessageHandler (.NET 6)
dateFormat X
axisFormat %s
todayMarker off
section Baseline
This PR (6032) - mean (265ms) : 261, 270
. : milestone, 265,
master - mean (265ms) : 261, 268
. : milestone, 265,
section CallTarget+Inlining+NGEN
This PR (6032) - mean (947ms) : 926, 967
. : milestone, 947,
master - mean (944ms) : 923, 966
. : milestone, 944,
|
Datadog ReportBranch report: ✅ 0 Failed, 365621 Passed, 2096 Skipped, 15h 46m 40.45s Total Time |
Benchmarks Report for appsec 🐌Benchmarks for #6032 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.Asm.AppSecBodyBenchmark - Faster 🎉 Same allocations ✔️
|
Benchmark | base/diff | Base Median (ns) | Diff Median (ns) | Modality |
---|---|---|---|---|
Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody‑netcoreapp3.1 | 1.119 | 230.23 | 205.78 |
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | AllCycleSimpleBody |
net6.0 | 72.4μs | 79.2ns | 307ns | 0.0716 | 0 | 0 | 6.01 KB |
master | AllCycleSimpleBody |
netcoreapp3.1 | 61.5μs | 88.3ns | 342ns | 0.093 | 0 | 0 | 6.95 KB |
master | AllCycleSimpleBody |
net472 | 48.9μs | 39.2ns | 152ns | 1.31 | 0 | 0 | 8.34 KB |
master | AllCycleMoreComplexBody |
net6.0 | 77μs | 52.1ns | 202ns | 0.116 | 0 | 0 | 9.51 KB |
master | AllCycleMoreComplexBody |
netcoreapp3.1 | 70.3μs | 104ns | 375ns | 0.14 | 0 | 0 | 10.36 KB |
master | AllCycleMoreComplexBody |
net472 | 56μs | 97.4ns | 377ns | 1.87 | 0.0276 | 0 | 11.85 KB |
master | ObjectExtractorSimpleBody |
net6.0 | 147ns | 0.133ns | 0.497ns | 0.00399 | 0 | 0 | 280 B |
master | ObjectExtractorSimpleBody |
netcoreapp3.1 | 231ns | 0.22ns | 0.85ns | 0.00371 | 0 | 0 | 272 B |
master | ObjectExtractorSimpleBody |
net472 | 172ns | 0.154ns | 0.595ns | 0.0446 | 0 | 0 | 281 B |
master | ObjectExtractorMoreComplexBody |
net6.0 | 3.16μs | 2.19ns | 8.19ns | 0.0525 | 0 | 0 | 3.78 KB |
master | ObjectExtractorMoreComplexBody |
netcoreapp3.1 | 4μs | 2.28ns | 8.54ns | 0.0499 | 0 | 0 | 3.69 KB |
master | ObjectExtractorMoreComplexBody |
net472 | 3.87μs | 3.61ns | 13.5ns | 0.602 | 0.00781 | 0 | 3.8 KB |
#6032 | AllCycleSimpleBody |
net6.0 | 72.6μs | 109ns | 422ns | 0.0726 | 0 | 0 | 6 KB |
#6032 | AllCycleSimpleBody |
netcoreapp3.1 | 62.3μs | 125ns | 485ns | 0.0925 | 0 | 0 | 6.95 KB |
#6032 | AllCycleSimpleBody |
net472 | 48.9μs | 83.8ns | 313ns | 1.32 | 0 | 0 | 8.34 KB |
#6032 | AllCycleMoreComplexBody |
net6.0 | 77.3μs | 144ns | 558ns | 0.116 | 0 | 0 | 9.51 KB |
#6032 | AllCycleMoreComplexBody |
netcoreapp3.1 | 69.9μs | 100ns | 376ns | 0.104 | 0 | 0 | 10.36 KB |
#6032 | AllCycleMoreComplexBody |
net472 | 56.1μs | 63.3ns | 245ns | 1.86 | 0.0282 | 0 | 11.85 KB |
#6032 | ObjectExtractorSimpleBody |
net6.0 | 145ns | 0.252ns | 0.974ns | 0.00392 | 0 | 0 | 280 B |
#6032 | ObjectExtractorSimpleBody |
netcoreapp3.1 | 206ns | 0.131ns | 0.491ns | 0.00361 | 0 | 0 | 272 B |
#6032 | ObjectExtractorSimpleBody |
net472 | 180ns | 0.272ns | 1.05ns | 0.0446 | 0 | 0 | 281 B |
#6032 | ObjectExtractorMoreComplexBody |
net6.0 | 3.02μs | 1.56ns | 5.84ns | 0.0531 | 0 | 0 | 3.78 KB |
#6032 | ObjectExtractorMoreComplexBody |
netcoreapp3.1 | 4.15μs | 1.79ns | 6.68ns | 0.0496 | 0 | 0 | 3.69 KB |
#6032 | ObjectExtractorMoreComplexBody |
net472 | 3.86μs | 3.65ns | 14.1ns | 0.601 | 0.00584 | 0 | 3.8 KB |
Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | EncodeArgs |
net6.0 | 39.3μs | 13.1ns | 45.4ns | 0.451 | 0 | 0 | 32.4 KB |
master | EncodeArgs |
netcoreapp3.1 | 54.4μs | 19.7ns | 73.7ns | 0.435 | 0 | 0 | 32.4 KB |
master | EncodeArgs |
net472 | 67.3μs | 143ns | 554ns | 5.14 | 0.0672 | 0 | 32.5 KB |
master | EncodeLegacyArgs |
net6.0 | 72.2μs | 69.5ns | 251ns | 0 | 0 | 0 | 2.14 KB |
master | EncodeLegacyArgs |
netcoreapp3.1 | 104μs | 54.7ns | 197ns | 0 | 0 | 0 | 2.14 KB |
master | EncodeLegacyArgs |
net472 | 151μs | 66.4ns | 249ns | 0.303 | 0 | 0 | 2.15 KB |
#6032 | EncodeArgs |
net6.0 | 37.5μs | 32.2ns | 121ns | 0.452 | 0 | 0 | 32.4 KB |
#6032 | EncodeArgs |
netcoreapp3.1 | 54.1μs | 36.3ns | 141ns | 0.432 | 0 | 0 | 32.4 KB |
#6032 | EncodeArgs |
net472 | 66.6μs | 112ns | 435ns | 5.16 | 0.0662 | 0 | 32.5 KB |
#6032 | EncodeLegacyArgs |
net6.0 | 75.7μs | 13.2ns | 49.6ns | 0 | 0 | 0 | 2.14 KB |
#6032 | EncodeLegacyArgs |
netcoreapp3.1 | 106μs | 326ns | 1.26μs | 0 | 0 | 0 | 2.14 KB |
#6032 | EncodeLegacyArgs |
net472 | 151μs | 124ns | 481ns | 0.302 | 0 | 0 | 2.15 KB |
Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | RunWafRealisticBenchmark |
net6.0 | 183μs | 259ns | 1μs | 0 | 0 | 0 | 2.42 KB |
master | RunWafRealisticBenchmark |
netcoreapp3.1 | 195μs | 126ns | 490ns | 0 | 0 | 0 | 2.37 KB |
master | RunWafRealisticBenchmark |
net472 | 208μs | 160ns | 621ns | 0.31 | 0 | 0 | 2.43 KB |
master | RunWafRealisticBenchmarkWithAttack |
net6.0 | 122μs | 65.9ns | 246ns | 0 | 0 | 0 | 1.46 KB |
master | RunWafRealisticBenchmarkWithAttack |
netcoreapp3.1 | 132μs | 156ns | 603ns | 0 | 0 | 0 | 1.45 KB |
master | RunWafRealisticBenchmarkWithAttack |
net472 | 139μs | 63.9ns | 247ns | 0.207 | 0 | 0 | 1.48 KB |
#6032 | RunWafRealisticBenchmark |
net6.0 | 185μs | 107ns | 415ns | 0 | 0 | 0 | 2.42 KB |
#6032 | RunWafRealisticBenchmark |
netcoreapp3.1 | 197μs | 125ns | 485ns | 0 | 0 | 0 | 2.37 KB |
#6032 | RunWafRealisticBenchmark |
net472 | 211μs | 194ns | 750ns | 0.314 | 0 | 0 | 2.43 KB |
#6032 | RunWafRealisticBenchmarkWithAttack |
net6.0 | 122μs | 33ns | 114ns | 0 | 0 | 0 | 1.46 KB |
#6032 | RunWafRealisticBenchmarkWithAttack |
netcoreapp3.1 | 131μs | 189ns | 732ns | 0 | 0 | 0 | 1.45 KB |
#6032 | RunWafRealisticBenchmarkWithAttack |
net472 | 139μs | 31.9ns | 115ns | 0.208 | 0 | 0 | 1.48 KB |
Benchmarks.Trace.Iast.StringAspectsBenchmark - Slower ⚠️ More allocations ⚠️
Slower ⚠️ in #6032
Benchmark
diff/base
Base Median (ns)
Diff Median (ns)
Modality
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑netcoreapp3.1
1.195
52,700.00
63,000.00
multimodal
More allocations ⚠️ in #6032
Benchmark
Base Allocated
Diff Allocated
Change
Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1
253.17 KB
276.79 KB
23.62 KB
9.33%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0
253.87 KB
255.25 KB
1.38 KB
0.54%
Fewer allocations 🎉 in #6032
Benchmark
Base Allocated
Diff Allocated
Change
Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑net472
59.09 KB
58.67 KB
-416 B
-0.70%
Benchmark | diff/base | Base Median (ns) | Diff Median (ns) | Modality |
---|---|---|---|---|
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑netcoreapp3.1 | 1.195 | 52,700.00 | 63,000.00 | multimodal |
Benchmark | Base Allocated | Diff Allocated | Change | Change % |
---|---|---|---|---|
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1 | 253.17 KB | 276.79 KB | 23.62 KB | 9.33% |
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0 | 253.87 KB | 255.25 KB | 1.38 KB | 0.54% |
Benchmark | Base Allocated | Diff Allocated | Change | Change % |
---|---|---|---|---|
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑net472 | 59.09 KB | 58.67 KB | -416 B | -0.70% |
Raw results
Branch | Method | Toolchain | Mean | StdError | StdDev | Gen 0 | Gen 1 | Gen 2 | Allocated |
---|---|---|---|---|---|---|---|---|---|
master | StringConcatBenchmark |
net6.0 | 57.8μs | 741ns | 7.3μs | 0 | 0 | 0 | 43.44 KB |
master | StringConcatBenchmark |
netcoreapp3.1 | 52.7μs | 240ns | 899ns | 0 | 0 | 0 | 42.64 KB |
master | StringConcatBenchmark |
net472 | 37μs | 143ns | 517ns | 0 | 0 | 0 | 59.09 KB |
master | StringConcatAspectBenchmark |
net6.0 | 298μs | 1.4μs | 6.25μs | 0 | 0 | 0 | 253.87 KB |
master | StringConcatAspectBenchmark |
netcoreapp3.1 | 338μs | 1.53μs | 6.3μs | 0 | 0 | 0 | 253.17 KB |
master | StringConcatAspectBenchmark |
net472 | 282μs | 5.93μs | 58.1μs | 0 | 0 | 0 | 278.53 KB |
#6032 | StringConcatBenchmark |
net6.0 | 61.8μs | 795ns | 7.91μs | 0 | 0 | 0 | 43.44 KB |
#6032 | StringConcatBenchmark |
netcoreapp3.1 | 63.8μs | 1.01μs | 10.1μs | 0 | 0 | 0 | 42.64 KB |
#6032 | StringConcatBenchmark |
net472 | 37μs | 166ns | 599ns | 0 | 0 | 0 | 58.67 KB |
#6032 | StringConcatAspectBenchmark |
net6.0 | 306μs | 1.43μs | 8.36μs | 0 | 0 | 0 | 255.25 KB |
#6032 | StringConcatAspectBenchmark |
netcoreapp3.1 | 316μs | 5.1μs | 49.7μs | 0 | 0 | 0 | 276.79 KB |
#6032 | StringConcatAspectBenchmark |
net472 | 269μs | 5.04μs | 48.9μs | 0 | 0 | 0 | 278.53 KB |
Throughput/Crank Report ⚡Throughput results for AspNetCoreSimpleController comparing the following branches/commits: Cases where throughput results for the PR are worse than latest master (5% drop or greater), results are shown in red. Note that these results are based on a single point-in-time result for each branch. For full results, see one of the many, many dashboards! gantt
title Throughput Linux x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6032) (11.081M) : 0, 11080909
master (11.161M) : 0, 11161184
benchmarks/2.9.0 (11.154M) : 0, 11153611
section Automatic
This PR (6032) (7.434M) : 0, 7434152
master (7.296M) : 0, 7296190
benchmarks/2.9.0 (7.817M) : 0, 7816815
section Trace stats
master (7.766M) : 0, 7765846
section Manual
master (11.116M) : 0, 11116386
section Manual + Automatic
This PR (6032) (6.841M) : 0, 6840719
master (6.645M) : 0, 6644949
section DD_TRACE_ENABLED=0
master (10.028M) : 0, 10028352
gantt
title Throughput Linux arm64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6032) (9.647M) : 0, 9646814
master (9.659M) : 0, 9659408
benchmarks/2.9.0 (9.744M) : 0, 9744016
section Automatic
This PR (6032) (6.559M) : 0, 6559288
master (6.482M) : 0, 6482475
section Trace stats
master (6.853M) : 0, 6852923
section Manual
master (9.465M) : 0, 9465366
section Manual + Automatic
This PR (6032) (6.144M) : 0, 6144189
master (6.172M) : 0, 6172300
section DD_TRACE_ENABLED=0
master (8.574M) : 0, 8574222
gantt
title Throughput Windows x64 (Total requests)
dateFormat X
axisFormat %s
section Baseline
This PR (6032) (9.943M) : 0, 9942756
master (10.086M) : 0, 10086150
benchmarks/2.9.0 (10.115M) : 0, 10114811
section Automatic
This PR (6032) (6.665M) : 0, 6665234
master (6.864M) : 0, 6863712
benchmarks/2.9.0 (7.533M) : 0, 7533010
section Trace stats
master (7.392M) : 0, 7392020
section Manual
master (10.018M) : 0, 10018266
section Manual + Automatic
This PR (6032) (6.272M) : 0, 6271902
master (6.182M) : 0, 6181967
section DD_TRACE_ENABLED=0
master (9.453M) : 0, 9453399
|
Benchmarks Report for tracer 🐌Benchmarks for #6032 compared to master:
The following thresholds were used for comparing the benchmark speeds:
Allocation changes below 0.5% are ignored. Benchmark detailsBenchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.SpanBenchmark - Same speed ✔️ Same allocations ✔️Raw results
Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️Raw results
|
Snapshots difference summaryThe following differences have been observed in committed snapshots. It is meant to help the reviewer. 1 occurrences of : - "hash": -1837181716,
+ "hash": -636226626,
[...]
- "hash": 1990393425,
+ "hash": -60481650,
[...]
- "hash": 1170867602,
+ "hash": 990913114,
[...]
- "hash": -1837181716,
+ "hash": -636226626,
[...]
- "hash": 1990393425,
+ "hash": -60481650,
[...]
- "hash": 1170867602,
+ "hash": 990913114,
[...]
- "hash": -1837181716,
+ "hash": -636226626,
[...]
- "hash": 1990393425,
+ "hash": -60481650,
[...]
- "hash": 1170867602,
+ "hash": 990913114,
|
Fixed snapshot
a744a84
to
eac4eae
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM 😄
Summary of changes
Update RFC changes in filtered cookie calculation
Reason for change
Previous option could collide with a cookie named
Filtered
Implementation details
Changed the hash calculation to
FILTERED_VULN
instead ofVULN:Filtered
Test coverage
Added unit test
Other details