-
Notifications
You must be signed in to change notification settings - Fork 291
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add propagation to String constructors with StringBuffer and StringBuilder #7966
Add propagation to String constructors with StringBuffer and StringBuilder #7966
Conversation
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 54 metrics, 9 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.43.0-SNAPSHOT~86089a8870, baseline=1.43.0-SNAPSHOT~adf9784bfd
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.092 s) : 0, 1091578
Total [baseline] (8.684 s) : 0, 8683852
Agent [candidate] (1.088 s) : 0, 1088465
Total [candidate] (8.684 s) : 0, 8683645
section iast
Agent [baseline] (1.215 s) : 0, 1215240
Total [baseline] (9.186 s) : 0, 9185905
Agent [candidate] (1.233 s) : 0, 1232651
Total [candidate] (9.267 s) : 0, 9266822
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.223 s) : 0, 1223218
Total [baseline] (9.163 s) : 0, 9162692
Agent [candidate] (1.223 s) : 0, 1222926
Total [candidate] (9.188 s) : 0, 9188113
section iast_TELEMETRY_OFF
Agent [baseline] (1.216 s) : 0, 1216061
Total [baseline] (9.186 s) : 0, 9185525
Agent [candidate] (1.215 s) : 0, 1214514
Total [candidate] (9.194 s) : 0, 9193531
gantt
title insecure-bank - break down per module: candidate=1.43.0-SNAPSHOT~86089a8870, baseline=1.43.0-SNAPSHOT~adf9784bfd
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (694.301 ms) : 0, 694301
BytebuddyAgent [candidate] (693.067 ms) : 0, 693067
GlobalTracer [baseline] (318.081 ms) : 0, 318081
GlobalTracer [candidate] (318.484 ms) : 0, 318484
AppSec [baseline] (54.765 ms) : 0, 54765
AppSec [candidate] (54.67 ms) : 0, 54670
Remote Config [baseline] (681.016 µs) : 0, 681
Remote Config [candidate] (679.314 µs) : 0, 679
Telemetry [baseline] (10.018 ms) : 0, 10018
Telemetry [candidate] (7.829 ms) : 0, 7829
section iast
BytebuddyAgent [baseline] (808.183 ms) : 0, 808183
BytebuddyAgent [candidate] (820.089 ms) : 0, 820089
GlobalTracer [baseline] (306.568 ms) : 0, 306568
GlobalTracer [candidate] (310.528 ms) : 0, 310528
AppSec [baseline] (56.645 ms) : 0, 56645
AppSec [candidate] (58.656 ms) : 0, 58656
IAST [baseline] (22.12 ms) : 0, 22120
IAST [candidate] (21.123 ms) : 0, 21123
Remote Config [baseline] (609.601 µs) : 0, 610
Remote Config [candidate] (643.705 µs) : 0, 644
Telemetry [baseline] (7.417 ms) : 0, 7417
Telemetry [candidate] (7.643 ms) : 0, 7643
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (812.696 ms) : 0, 812696
BytebuddyAgent [candidate] (814.888 ms) : 0, 814888
GlobalTracer [baseline] (309.944 ms) : 0, 309944
GlobalTracer [candidate] (307.509 ms) : 0, 307509
AppSec [baseline] (58.069 ms) : 0, 58069
AppSec [candidate] (57.746 ms) : 0, 57746
IAST [baseline] (20.618 ms) : 0, 20618
IAST [candidate] (20.766 ms) : 0, 20766
Remote Config [baseline] (625.258 µs) : 0, 625
Remote Config [candidate] (619.988 µs) : 0, 620
Telemetry [baseline] (7.484 ms) : 0, 7484
Telemetry [candidate] (7.562 ms) : 0, 7562
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (808.059 ms) : 0, 808059
BytebuddyAgent [candidate] (806.525 ms) : 0, 806525
GlobalTracer [baseline] (307.403 ms) : 0, 307403
GlobalTracer [candidate] (307.206 ms) : 0, 307206
AppSec [baseline] (58.262 ms) : 0, 58262
AppSec [candidate] (57.877 ms) : 0, 57877
IAST [baseline] (20.583 ms) : 0, 20583
IAST [candidate] (21.169 ms) : 0, 21169
Remote Config [baseline] (625.077 µs) : 0, 625
Remote Config [candidate] (614.862 µs) : 0, 615
Telemetry [baseline] (7.389 ms) : 0, 7389
Telemetry [candidate] (7.377 ms) : 0, 7377
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.43.0-SNAPSHOT~86089a8870, baseline=1.43.0-SNAPSHOT~adf9784bfd
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.098 s) : 0, 1097654
Total [baseline] (10.479 s) : 0, 10479455
Agent [candidate] (1.096 s) : 0, 1096298
Total [candidate] (10.459 s) : 0, 10458847
section appsec
Agent [baseline] (1.226 s) : 0, 1225593
Total [baseline] (10.739 s) : 0, 10739213
Agent [candidate] (1.23 s) : 0, 1229767
Total [candidate] (10.755 s) : 0, 10754848
section iast
Agent [baseline] (1.222 s) : 0, 1222197
Total [baseline] (10.965 s) : 0, 10965085
Agent [candidate] (1.219 s) : 0, 1218610
Total [candidate] (10.969 s) : 0, 10969419
section profiling
Agent [baseline] (1.289 s) : 0, 1288702
Total [baseline] (10.885 s) : 0, 10885083
Agent [candidate] (1.298 s) : 0, 1297788
Total [candidate] (10.906 s) : 0, 10906010
gantt
title petclinic - break down per module: candidate=1.43.0-SNAPSHOT~86089a8870, baseline=1.43.0-SNAPSHOT~adf9784bfd
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (698.331 ms) : 0, 698331
BytebuddyAgent [candidate] (697.064 ms) : 0, 697064
GlobalTracer [baseline] (320.072 ms) : 0, 320072
GlobalTracer [candidate] (320.023 ms) : 0, 320023
AppSec [baseline] (55.317 ms) : 0, 55317
AppSec [candidate] (55.381 ms) : 0, 55381
Remote Config [baseline] (693.251 µs) : 0, 693
Remote Config [candidate] (695.674 µs) : 0, 696
Telemetry [baseline] (9.386 ms) : 0, 9386
Telemetry [candidate] (9.306 ms) : 0, 9306
section appsec
BytebuddyAgent [baseline] (710.252 ms) : 0, 710252
BytebuddyAgent [candidate] (713.535 ms) : 0, 713535
GlobalTracer [baseline] (315.079 ms) : 0, 315079
GlobalTracer [candidate] (316.044 ms) : 0, 316044
AppSec [baseline] (167.337 ms) : 0, 167337
AppSec [candidate] (167.504 ms) : 0, 167504
IAST [baseline] (19.853 ms) : 0, 19853
IAST [candidate] (19.182 ms) : 0, 19182
Remote Config [baseline] (652.876 µs) : 0, 653
Remote Config [candidate] (644.844 µs) : 0, 645
Telemetry [baseline] (8.616 ms) : 0, 8616
Telemetry [candidate] (8.637 ms) : 0, 8637
section iast
BytebuddyAgent [baseline] (812.339 ms) : 0, 812339
BytebuddyAgent [candidate] (810.913 ms) : 0, 810913
GlobalTracer [baseline] (308.406 ms) : 0, 308406
GlobalTracer [candidate] (307.072 ms) : 0, 307072
AppSec [baseline] (57.522 ms) : 0, 57522
AppSec [candidate] (57.732 ms) : 0, 57732
IAST [baseline] (21.965 ms) : 0, 21965
IAST [candidate] (20.894 ms) : 0, 20894
Remote Config [baseline] (640.454 µs) : 0, 640
Remote Config [candidate] (619.467 µs) : 0, 619
Telemetry [baseline] (7.547 ms) : 0, 7547
Telemetry [candidate] (7.581 ms) : 0, 7581
section profiling
BytebuddyAgent [baseline] (687.097 ms) : 0, 687097
BytebuddyAgent [candidate] (691.725 ms) : 0, 691725
GlobalTracer [baseline] (401.903 ms) : 0, 401903
GlobalTracer [candidate] (403.707 ms) : 0, 403707
AppSec [baseline] (55.434 ms) : 0, 55434
AppSec [candidate] (55.493 ms) : 0, 55493
Remote Config [baseline] (676.89 µs) : 0, 677
Remote Config [candidate] (686.677 µs) : 0, 687
Telemetry [baseline] (9.993 ms) : 0, 9993
Telemetry [candidate] (10.825 ms) : 0, 10825
ProfilingAgent [baseline] (94.505 ms) : 0, 94505
ProfilingAgent [candidate] (95.88 ms) : 0, 95880
Profiling [baseline] (94.529 ms) : 0, 94529
Profiling [candidate] (95.903 ms) : 0, 95903
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 13 metrics, 15 unstable metrics. Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.43.0-SNAPSHOT~86089a8870, baseline=1.43.0-SNAPSHOT~adf9784bfd
dateFormat X
axisFormat %s
section baseline
no_agent (1.345 ms) : 1324, 1366
. : milestone, 1345,
appsec (1.75 ms) : 1726, 1774
. : milestone, 1750,
appsec_no_iast (1.769 ms) : 1745, 1793
. : milestone, 1769,
iast (1.51 ms) : 1488, 1533
. : milestone, 1510,
profiling (1.477 ms) : 1453, 1500
. : milestone, 1477,
tracing (1.49 ms) : 1465, 1515
. : milestone, 1490,
section candidate
no_agent (1.348 ms) : 1329, 1367
. : milestone, 1348,
appsec (1.773 ms) : 1748, 1797
. : milestone, 1773,
appsec_no_iast (1.766 ms) : 1742, 1790
. : milestone, 1766,
iast (1.494 ms) : 1471, 1517
. : milestone, 1494,
profiling (1.504 ms) : 1480, 1529
. : milestone, 1504,
tracing (1.496 ms) : 1471, 1521
. : milestone, 1496,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.43.0-SNAPSHOT~86089a8870, baseline=1.43.0-SNAPSHOT~adf9784bfd
dateFormat X
axisFormat %s
section baseline
no_agent (371.739 µs) : 352, 391
. : milestone, 372,
iast (483.956 µs) : 463, 505
. : milestone, 484,
iast_FULL (644.903 µs) : 624, 666
. : milestone, 645,
iast_GLOBAL (524.037 µs) : 501, 547
. : milestone, 524,
iast_HARDCODED_SECRET_DISABLED (486.114 µs) : 465, 507
. : milestone, 486,
iast_INACTIVE (456.328 µs) : 435, 477
. : milestone, 456,
iast_TELEMETRY_OFF (483.92 µs) : 462, 506
. : milestone, 484,
tracing (443.984 µs) : 424, 464
. : milestone, 444,
section candidate
no_agent (375.792 µs) : 356, 396
. : milestone, 376,
iast (492.77 µs) : 471, 514
. : milestone, 493,
iast_FULL (650.137 µs) : 629, 672
. : milestone, 650,
iast_GLOBAL (528.374 µs) : 505, 552
. : milestone, 528,
iast_HARDCODED_SECRET_DISABLED (492.642 µs) : 471, 515
. : milestone, 493,
iast_INACTIVE (446.302 µs) : 426, 467
. : milestone, 446,
iast_TELEMETRY_OFF (473.715 µs) : 453, 495
. : milestone, 474,
tracing (444.227 µs) : 424, 465
. : milestone, 444,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.43.0-SNAPSHOT~86089a8870, baseline=1.43.0-SNAPSHOT~adf9784bfd
dateFormat X
axisFormat %s
section baseline
no_agent (14.856 s) : 14856000, 14856000
. : milestone, 14856000,
appsec (15.238 s) : 15238000, 15238000
. : milestone, 15238000,
iast (19.065 s) : 19065000, 19065000
. : milestone, 19065000,
iast_GLOBAL (18.115 s) : 18115000, 18115000
. : milestone, 18115000,
profiling (14.831 s) : 14831000, 14831000
. : milestone, 14831000,
tracing (15.205 s) : 15205000, 15205000
. : milestone, 15205000,
section candidate
no_agent (15.267 s) : 15267000, 15267000
. : milestone, 15267000,
appsec (14.97 s) : 14970000, 14970000
. : milestone, 14970000,
iast (18.309 s) : 18309000, 18309000
. : milestone, 18309000,
iast_GLOBAL (18.158 s) : 18158000, 18158000
. : milestone, 18158000,
profiling (14.903 s) : 14903000, 14903000
. : milestone, 14903000,
tracing (14.836 s) : 14836000, 14836000
. : milestone, 14836000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.43.0-SNAPSHOT~86089a8870, baseline=1.43.0-SNAPSHOT~adf9784bfd
dateFormat X
axisFormat %s
section baseline
no_agent (1.472 ms) : 1461, 1484
. : milestone, 1472,
appsec (2.352 ms) : 2311, 2394
. : milestone, 2352,
iast (2.093 ms) : 2040, 2145
. : milestone, 2093,
iast_GLOBAL (2.138 ms) : 2086, 2191
. : milestone, 2138,
profiling (2.424 ms) : 2176, 2671
. : milestone, 2424,
tracing (1.931 ms) : 1891, 1971
. : milestone, 1931,
section candidate
no_agent (1.472 ms) : 1460, 1483
. : milestone, 1472,
appsec (2.347 ms) : 2306, 2389
. : milestone, 2347,
iast (2.089 ms) : 2036, 2141
. : milestone, 2089,
iast_GLOBAL (2.126 ms) : 2074, 2179
. : milestone, 2126,
profiling (1.964 ms) : 1921, 2007
. : milestone, 1964,
tracing (1.93 ms) : 1890, 1970
. : milestone, 1930,
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
What Does This Do
This adds the instrumentation to propagate the taint values through the following constructors of
String
:String(StringBuffer)
String(StringBuilder)
Motivation
Increase propagation of
String
methods/constructors.Additional Notes
This PR also made some small refactors to make some methods more generic.
Contributor Checklist
type:
and (comp:
orinst:
) labels in addition to any usefull labelsclose
,fix
or any linking keywords when referencing an issue.Use
solves
instead, and assign the PR milestone to the issueJira ticket: APPSEC-55355