Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

appsec: missing SQLi and LFI RC capabilities #2851

Merged
merged 1 commit into from
Sep 10, 2024

Conversation

eliottness
Copy link
Contributor

What does this PR do?

  • List more RC capabilities
  • Add SQLi capability
  • Add LFI capability when built with orchestrion

Reviewer's Checklist

  • Changed code has unit tests for its functionality at or near 100% coverage.
  • System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
  • There is a benchmark for any new code, or changes to existing code.
  • If this interacts with the agent in a new way, a system test has been added.
  • Add an appropriate team label so this PR gets put in the right place for the release notes.
  • Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

@eliottness eliottness requested review from a team as code owners September 9, 2024 16:04
@pr-commenter
Copy link

pr-commenter bot commented Sep 9, 2024

Benchmarks

Benchmark execution time: 2024-09-09 16:30:45

Comparing candidate commit 4eae623 in PR branch eliott.bouhana/more-rc-capabilities with baseline commit c29e8fa in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 59 metrics, 0 unstable metrics.

@@ -409,7 +410,14 @@ func (a *appsec) enableRASP() {
if err := remoteconfig.RegisterCapability(remoteconfig.ASMRASPSSRF); err != nil {
log.Debug("appsec: Remote config: couldn't register RASP SSRF: %v", err)
}
// TODO: register other RASP capabilities when supported
if err := remoteconfig.RegisterCapability(remoteconfig.ASMRASPSQLI); err != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

WDYT of moving the calls to RegisterCapability into the WAF listener's instantiations, like setting the SQLi capability when the SQL listener is being setup?

Copy link
Contributor

@Julio-Guerra Julio-Guerra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

question asked

Copy link
Contributor

@Julio-Guerra Julio-Guerra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

all good, implem details discussed over standup: RC capabilities must be sent regardless of the actual app capabilities.

@eliottness eliottness enabled auto-merge (squash) September 10, 2024 12:46
@eliottness eliottness force-pushed the eliott.bouhana/more-rc-capabilities branch from 4eae623 to b252a99 Compare September 10, 2024 12:46
@eliottness eliottness merged commit 4574919 into main Sep 10, 2024
155 of 156 checks passed
@eliottness eliottness deleted the eliott.bouhana/more-rc-capabilities branch September 10, 2024 12:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants