Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix unvalidated redirect detection in Jetty #5445

Merged
merged 1 commit into from
Jun 22, 2023
Merged

Fix unvalidated redirect detection in Jetty #5445

merged 1 commit into from
Jun 22, 2023

Conversation

jandro996
Copy link
Member

@jandro996 jandro996 commented Jun 22, 2023 •
edited by smola
Loading

What Does This Do

Make method matchers in IAST instrumenter for servlet more precise. Avoids matching the wrong methods in Jetty.

Motivation

Some unvalidated redirects were not detected in Jetty.

Additional Notes

@pr-commenter
Copy link

pr-commenter bot commented Jun 22, 2023

Benchmarks

Parameters

Baseline Candidate
commit 1.17.0-SNAPSHOT~30cb962687 1.17.0-SNAPSHOT~fc5c32f5a5
config baseline candidate
See matching parameters
Baseline Candidate
module Agent Agent
parent None None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 22 cases.

@smola smola changed the title Be more concise defining where to apply the Advices More precise matchers for IAST instrumenters for servlet Jun 22, 2023
@smola smola changed the title More precise matchers for IAST instrumenters for servlet Fix unvalidated redirect detection in Jetty Jun 22, 2023
@smola smola added the comp: asm iast Application Security Management (IAST) label Jun 22, 2023
@jandro996 jandro996 marked this pull request as ready for review June 22, 2023 07:30
@jandro996 jandro996 requested a review from a team as a code owner June 22, 2023 07:30
@jandro996 jandro996 merged commit 7c95912 into master Jun 22, 2023
@jandro996 jandro996 deleted the alejandro.gonzalez/fix_HttpServletResponse_Advice branch June 22, 2023 08:55
@github-actions github-actions bot added this to the 1.17.0 milestone Jun 22, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@manuel-alvarez-alvarez manuel-alvarez-alvarez manuel-alvarez-alvarez approved these changes

@smola smola smola approved these changes

Assignees
No one assigned
Labels
comp: asm iast Application Security Management (IAST)
Projects
None yet
Milestone
1.17.0
Development

Successfully merging this pull request may close these issues.
3 participants
@jandro996 @smola @manuel-alvarez-alvarez