[IAST] Security Controls #6635

daniel-romano-DD · 2025-02-05T22:18:20Z

Summary of changes

Added a way to mark custom client escape functions able to mark tainted strings as safe for designed vulnerabilities

Reason for change

Implementation of Security Controls RFC

Implementation details

Created on the fly call site definitions to handle the calls to the custom escape functions

Test coverage

Added unit tests

Other details

datadog-ddstaging · 2025-02-05T22:48:57Z

Datadog Report

Branch report: dani/iast/security_controls
Commit report: 0bb8138
Test service: dd-trace-dotnet

✅ 0 Failed, 563001 Passed, 5409 Skipped, 46h 32m 56.19s Total Time
❄️ 1 New Flaky

New Flaky Tests (1)

HttpClient_SubmitsTraces - Datadog.Trace.ClrProfiler.IntegrationTests.HttpMessageHandlerTests - Last Failure
Expand for error
```
 Expected exit code: 0, actual exit code: 139.
```

andrewlock · 2025-02-05T22:57:38Z

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing the following branches/commits:

Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:

Welch test with statistical test for significance of 5%
Only results indicating a difference greater than 5% and 5 ms are considered.

Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.

Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).

gantt
    title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6635) - mean (69ms)  : 67, 72
     .   : milestone, 69,
    master - mean (69ms)  : 66, 73
     .   : milestone, 69,

    section CallTarget+Inlining+NGEN
    This PR (6635) - mean (992ms)  : 968, 1016
     .   : milestone, 992,
    master - mean (993ms)  : 972, 1013
     .   : milestone, 993,

gantt
    title Execution time (ms) FakeDbCommand (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6635) - mean (102ms)  : 100, 104
     .   : milestone, 102,
    master - mean (102ms)  : 100, 105
     .   : milestone, 102,

    section CallTarget+Inlining+NGEN
    This PR (6635) - mean (674ms)  : 660, 687
     .   : milestone, 674,
    master - mean (677ms)  : 662, 692
     .   : milestone, 677,

gantt
    title Execution time (ms) FakeDbCommand (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6635) - mean (90ms)  : 88, 92
     .   : milestone, 90,
    master - mean (90ms)  : 87, 92
     .   : milestone, 90,

    section CallTarget+Inlining+NGEN
    This PR (6635) - mean (629ms)  : 611, 646
     .   : milestone, 629,
    master - mean (629ms)  : 613, 646
     .   : milestone, 629,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6635) - mean (190ms)  : 187, 194
     .   : milestone, 190,
    master - mean (190ms)  : 186, 195
     .   : milestone, 190,

    section CallTarget+Inlining+NGEN
    This PR (6635) - mean (1,098ms)  : 1070, 1127
     .   : milestone, 1098,
    master - mean (1,103ms)  : 1075, 1131
     .   : milestone, 1103,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6635) - mean (269ms)  : 265, 274
     .   : milestone, 269,
    master - mean (270ms)  : 266, 274
     .   : milestone, 270,

    section CallTarget+Inlining+NGEN
    This PR (6635) - mean (918ms)  : crit, 815, 1021
     .   : crit, milestone, 918,
    master - mean (860ms)  : 835, 885
     .   : milestone, 860,

gantt
    title Execution time (ms) HttpMessageHandler (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6635) - mean (267ms)  : 262, 272
     .   : milestone, 267,
    master - mean (261ms)  : 257, 265
     .   : milestone, 261,

    section CallTarget+Inlining+NGEN
    This PR (6635) - mean (850ms)  : 813, 887
     .   : milestone, 850,
    master - mean (841ms)  : 814, 868
     .   : milestone, 841,

andrewlock · 2025-02-05T23:20:43Z

Benchmarks Report for appsec 🐌

Benchmarks for #6635 compared to master:

1 benchmarks are faster, with geometric mean 1.144
2 benchmarks have fewer allocations
1 benchmarks have more allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.Asm.AppSecBodyBenchmark - Faster 🎉 Same allocations ✔️

Faster 🎉 in #6635

Benchmark	base/diff	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorMoreComplexBody‑net472	1.144	4,244.49	3,711.55

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`AllCycleSimpleBody`	net6.0	200μs	96.5ns	348ns	2.6	0	188.88 KB
master	`AllCycleSimpleBody`	netcoreapp3.1	297μs	127ns	494ns	2.68	0	196.21 KB
master	`AllCycleSimpleBody`	net472	267μs	126ns	455ns	35.9	2.01	226.09 KB
master	`AllCycleMoreComplexBody`	net6.0	206μs	78.7ns	295ns	2.69	0	192.38 KB
master	`AllCycleMoreComplexBody`	netcoreapp3.1	309μs	298ns	1.12μs	2.62	0	199.62 KB
master	`AllCycleMoreComplexBody`	net472	276μs	365ns	1.42μs	36.4	2.06	229.6 KB
master	`ObjectExtractorSimpleBody`	net6.0	137ns	0.163ns	0.61ns	0.00396	0	280 B
master	`ObjectExtractorSimpleBody`	netcoreapp3.1	242ns	0.151ns	0.543ns	0.0037	0	272 B
master	`ObjectExtractorSimpleBody`	net472	167ns	0.118ns	0.441ns	0.0446	0	281 B
master	`ObjectExtractorMoreComplexBody`	net6.0	2.96μs	1.47ns	5.29ns	0.0536	0	3.78 KB
master	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	3.78μs	1.27ns	4.56ns	0.0495	0	3.69 KB
master	`ObjectExtractorMoreComplexBody`	net472	4.25μs	2.21ns	8.26ns	0.602	0.00638	3.8 KB
#6635	`AllCycleSimpleBody`	net6.0	204μs	120ns	463ns	2.66	0	188.88 KB
#6635	`AllCycleSimpleBody`	netcoreapp3.1	312μs	121ns	467ns	2.67	0	196.21 KB
#6635	`AllCycleSimpleBody`	net472	274μs	172ns	667ns	35.8	2.08	226.09 KB
#6635	`AllCycleMoreComplexBody`	net6.0	210μs	93.4ns	323ns	2.73	0	192.39 KB
#6635	`AllCycleMoreComplexBody`	netcoreapp3.1	315μs	112ns	418ns	2.68	0	199.62 KB
#6635	`AllCycleMoreComplexBody`	net472	280μs	198ns	765ns	36.4	2.09	229.6 KB
#6635	`ObjectExtractorSimpleBody`	net6.0	139ns	0.132ns	0.493ns	0.00396	0	280 B
#6635	`ObjectExtractorSimpleBody`	netcoreapp3.1	230ns	0.143ns	0.553ns	0.00369	0	272 B
#6635	`ObjectExtractorSimpleBody`	net472	180ns	0.192ns	0.717ns	0.0446	0	281 B
#6635	`ObjectExtractorMoreComplexBody`	net6.0	2.88μs	1.41ns	5.47ns	0.0533	0	3.78 KB
#6635	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	3.84μs	3.14ns	11.8ns	0.0499	0	3.69 KB
#6635	`ObjectExtractorMoreComplexBody`	net472	3.71μs	3.48ns	13.5ns	0.602	0.00563	3.8 KB

Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EncodeArgs`	net6.0	37.2μs	20.7ns	77.5ns	0.449	0	32.4 KB
master	`EncodeArgs`	netcoreapp3.1	54.8μs	19.4ns	75.3ns	0.435	0	32.4 KB
master	`EncodeArgs`	net472	66.2μs	34ns	122ns	5.14	0.0659	32.5 KB
master	`EncodeLegacyArgs`	net6.0	80.9μs	35.8ns	134ns	0	0	2.14 KB
master	`EncodeLegacyArgs`	netcoreapp3.1	107μs	328ns	1.27μs	0	0	2.14 KB
master	`EncodeLegacyArgs`	net472	154μs	139ns	540ns	0.307	0	2.15 KB
#6635	`EncodeArgs`	net6.0	38.1μs	24ns	92.9ns	0.456	0	32.4 KB
#6635	`EncodeArgs`	netcoreapp3.1	54.3μs	19.3ns	74.8ns	0.432	0	32.4 KB
#6635	`EncodeArgs`	net472	66.5μs	42.8ns	166ns	5.15	0.0665	32.5 KB
#6635	`EncodeLegacyArgs`	net6.0	73.6μs	74ns	286ns	0	0	2.14 KB
#6635	`EncodeLegacyArgs`	netcoreapp3.1	106μs	425ns	1.64μs	0	0	2.14 KB
#6635	`EncodeLegacyArgs`	net472	158μs	255ns	918ns	0.314	0	2.15 KB

Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunWafRealisticBenchmark`	net6.0	174μs	364ns	1.41μs	0	2.54 KB
master	`RunWafRealisticBenchmark`	netcoreapp3.1	187μs	96.2ns	372ns	0	2.49 KB
master	`RunWafRealisticBenchmark`	net472	200μs	91ns	352ns	0.401	2.55 KB
master	`RunWafRealisticBenchmarkWithAttack`	net6.0	115μs	179ns	693ns	0	1.57 KB
master	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	125μs	194ns	752ns	0	1.55 KB
master	`RunWafRealisticBenchmarkWithAttack`	net472	133μs	170ns	659ns	0.198	1.58 KB
#6635	`RunWafRealisticBenchmark`	net6.0	175μs	106ns	410ns	0	2.54 KB
#6635	`RunWafRealisticBenchmark`	netcoreapp3.1	187μs	154ns	576ns	0	2.49 KB
#6635	`RunWafRealisticBenchmark`	net472	202μs	165ns	641ns	0.399	2.55 KB
#6635	`RunWafRealisticBenchmarkWithAttack`	net6.0	116μs	47.5ns	178ns	0	1.57 KB
#6635	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	125μs	276ns	1.07μs	0	1.55 KB
#6635	`RunWafRealisticBenchmarkWithAttack`	net472	133μs	274ns	1.06μs	0.198	1.58 KB

Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ More allocations ⚠️

More allocations ⚠️ in #6635

Benchmark	Base Allocated	Diff Allocated	Change	Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1	253.09 KB	266.39 KB	13.3 KB	5.26%

Fewer allocations 🎉 in #6635

Benchmark	Base Allocated	Diff Allocated	Change	Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0	254.98 KB	253.03 KB	-1.94 KB	-0.76%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatBenchmark‑net472	60.95 KB	59.26 KB	-1.69 KB	-2.77%

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Allocated
master	`StringConcatBenchmark`	net6.0	60.4μs	735ns	7.35μs	43.44 KB
master	`StringConcatBenchmark`	netcoreapp3.1	62.2μs	1.06μs	10.6μs	42.64 KB
master	`StringConcatBenchmark`	net472	38.1μs	190ns	830ns	60.95 KB
master	`StringConcatAspectBenchmark`	net6.0	312μs	1.74μs	10.8μs	254.98 KB
master	`StringConcatAspectBenchmark`	netcoreapp3.1	335μs	1.9μs	13.4μs	253.09 KB
master	`StringConcatAspectBenchmark`	net472	301μs	6.99μs	68.5μs	278.53 KB
#6635	`StringConcatBenchmark`	net6.0	61.8μs	615ns	6.02μs	43.44 KB
#6635	`StringConcatBenchmark`	netcoreapp3.1	61.6μs	775ns	7.68μs	42.64 KB
#6635	`StringConcatBenchmark`	net472	38.2μs	145ns	522ns	59.26 KB
#6635	`StringConcatAspectBenchmark`	net6.0	307μs	1.49μs	9.89μs	253.03 KB
#6635	`StringConcatAspectBenchmark`	netcoreapp3.1	361μs	2.08μs	16.6μs	266.39 KB
#6635	`StringConcatAspectBenchmark`	net472	294μs	5.99μs	59μs	278.53 KB

andrewlock · 2025-02-05T23:49:04Z

Benchmarks Report for tracer 🐌

Benchmarks for #6635 compared to master:

1 benchmarks are faster, with geometric mean 1.134
1 benchmarks are slower, with geometric mean 1.162
All benchmarks have the same allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`StartStopWithChild`	net6.0	7.88μs	44ns	282ns	0.0153	0.00765	0	5.6 KB
master	`StartStopWithChild`	netcoreapp3.1	9.94μs	46.7ns	198ns	0.015	0.01	0	5.81 KB
master	`StartStopWithChild`	net472	15.9μs	45.9ns	178ns	1.04	0.311	0.104	6.21 KB
#6635	`StartStopWithChild`	net6.0	8.01μs	41.7ns	253ns	0.0156	0.00391	0	5.61 KB
#6635	`StartStopWithChild`	netcoreapp3.1	10μs	55.6ns	360ns	0.0264	0.0106	0	5.8 KB
#6635	`StartStopWithChild`	net472	16μs	59.5ns	230ns	1.06	0.336	0.102	6.2 KB

Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	486μs	246ns	921ns	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	651μs	349ns	1.31μs	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	net472	857μs	473ns	1.83μs	0.425	3.3 KB
#6635	`WriteAndFlushEnrichedTraces`	net6.0	473μs	313ns	1.13μs	0	2.7 KB
#6635	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	670μs	473ns	1.83μs	0	2.7 KB
#6635	`WriteAndFlushEnrichedTraces`	net472	851μs	646ns	2.5μs	0.425	3.3 KB

Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendRequest`	net6.0	126μs	620ns	2.48μs	0.192	14.47 KB
master	`SendRequest`	netcoreapp3.1	145μs	283ns	1.09μs	0.213	17.28 KB
master	`SendRequest`	net472	0.00409ns	0.00151ns	0.00585ns	0	0 b
#6635	`SendRequest`	net6.0	133μs	508ns	1.97μs	0.199	14.47 KB
#6635	`SendRequest`	netcoreapp3.1	148μs	339ns	1.31μs	0.221	17.27 KB
#6635	`SendRequest`	net472	0.00267ns	0.000995ns	0.00385ns	0	0 b

Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	588μs	3.5μs	34.5μs	0.568	0	0	41.55 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	690μs	3.92μs	28μs	0.353	0	0	41.79 KB
master	`WriteAndFlushEnrichedTraces`	net472	869μs	4.39μs	21μs	8.45	2.53	0.422	53.34 KB
#6635	`WriteAndFlushEnrichedTraces`	net6.0	584μs	3.29μs	21.8μs	0.566	0	0	41.62 KB
#6635	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	694μs	3.95μs	29μs	0.332	0	0	41.66 KB
#6635	`WriteAndFlushEnrichedTraces`	net472	833μs	3.57μs	13.8μs	8.45	2.53	0.422	53.27 KB

Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`ExecuteNonQuery`	net6.0	1.38μs	1.25ns	4.68ns	0.0144	0	1.02 KB
master	`ExecuteNonQuery`	netcoreapp3.1	1.71μs	5.54ns	21.4ns	0.0135	0	1.02 KB
master	`ExecuteNonQuery`	net472	2.11μs	3.24ns	12.5ns	0.156	0.00106	987 B
#6635	`ExecuteNonQuery`	net6.0	1.37μs	1.41ns	5.47ns	0.0143	0	1.02 KB
#6635	`ExecuteNonQuery`	netcoreapp3.1	1.79μs	1.32ns	5.12ns	0.0134	0	1.02 KB
#6635	`ExecuteNonQuery`	net472	2.13μs	4.92ns	19ns	0.156	0.00105	987 B

Benchmarks.Trace.ElasticsearchBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`CallElasticsearch`	net6.0	1.3μs	0.468ns	1.75ns	0.0136	976 B
master	`CallElasticsearch`	netcoreapp3.1	1.55μs	1.94ns	7.53ns	0.0132	976 B
master	`CallElasticsearch`	net472	2.56μs	1.75ns	6.76ns	0.158	995 B
master	`CallElasticsearchAsync`	net6.0	1.3μs	0.569ns	2.13ns	0.0134	952 B
master	`CallElasticsearchAsync`	netcoreapp3.1	1.64μs	0.743ns	2.88ns	0.0139	1.02 KB
master	`CallElasticsearchAsync`	net472	2.65μs	1.91ns	7.39ns	0.166	1.05 KB
#6635	`CallElasticsearch`	net6.0	1.35μs	0.605ns	2.26ns	0.0137	976 B
#6635	`CallElasticsearch`	netcoreapp3.1	1.67μs	1.06ns	4.09ns	0.0133	976 B
#6635	`CallElasticsearch`	net472	2.42μs	2.47ns	9.57ns	0.158	995 B
#6635	`CallElasticsearchAsync`	net6.0	1.4μs	0.719ns	2.69ns	0.0133	952 B
#6635	`CallElasticsearchAsync`	netcoreapp3.1	1.72μs	0.475ns	1.78ns	0.0137	1.02 KB
#6635	`CallElasticsearchAsync`	net472	2.74μs	1.63ns	6.3ns	0.167	1.05 KB

Benchmarks.Trace.GraphQLBenchmark - Faster 🎉 Same allocations ✔️

Faster 🎉 in #6635

Benchmark	base/diff	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.GraphQLBenchmark.ExecuteAsync‑net6.0	1.134	1,400.60	1,235.38

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`ExecuteAsync`	net6.0	1.4μs	0.507ns	1.9ns	0.0134	952 B
master	`ExecuteAsync`	netcoreapp3.1	1.71μs	2.41ns	9.03ns	0.0131	952 B
master	`ExecuteAsync`	net472	1.84μs	0.885ns	3.43ns	0.145	915 B
#6635	`ExecuteAsync`	net6.0	1.24μs	1.46ns	5.25ns	0.0136	952 B
#6635	`ExecuteAsync`	netcoreapp3.1	1.62μs	1.09ns	4.07ns	0.0129	952 B
#6635	`ExecuteAsync`	net472	1.8μs	0.546ns	2.04ns	0.145	915 B

Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendAsync`	net6.0	4.38μs	3.2ns	12.4ns	0.033	2.31 KB
master	`SendAsync`	netcoreapp3.1	5.28μs	1.25ns	4.51ns	0.0368	2.85 KB
master	`SendAsync`	net472	7.42μs	3.12ns	12.1ns	0.493	3.12 KB
#6635	`SendAsync`	net6.0	4.51μs	1.54ns	5.55ns	0.0318	2.31 KB
#6635	`SendAsync`	netcoreapp3.1	5.27μs	2.27ns	8.17ns	0.0396	2.85 KB
#6635	`SendAsync`	net472	7.48μs	3.01ns	11.6ns	0.493	3.12 KB

Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	1.58μs	0.738ns	2.56ns	0.0229	1.64 KB
master	`EnrichedLog`	netcoreapp3.1	2.14μs	1.04ns	4.03ns	0.0224	1.64 KB
master	`EnrichedLog`	net472	2.59μs	0.949ns	3.68ns	0.249	1.57 KB
#6635	`EnrichedLog`	net6.0	1.46μs	0.955ns	3.57ns	0.0233	1.64 KB
#6635	`EnrichedLog`	netcoreapp3.1	2.33μs	1.05ns	3.8ns	0.0222	1.64 KB
#6635	`EnrichedLog`	net472	2.62μs	0.579ns	2.17ns	0.249	1.57 KB

Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EnrichedLog`	net6.0	113μs	94.8ns	367ns	0.0563	0	4.28 KB
master	`EnrichedLog`	netcoreapp3.1	115μs	129ns	498ns	0.0572	0	4.28 KB
master	`EnrichedLog`	net472	151μs	111ns	429ns	0.678	0.226	4.46 KB
#6635	`EnrichedLog`	net6.0	114μs	216ns	835ns	0.0567	0	4.28 KB
#6635	`EnrichedLog`	netcoreapp3.1	116μs	164ns	635ns	0	0	4.28 KB
#6635	`EnrichedLog`	net472	152μs	194ns	750ns	0.681	0.227	4.46 KB

Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	3μs	0.654ns	2.53ns	0.0312	2.2 KB
master	`EnrichedLog`	netcoreapp3.1	4.32μs	1.25ns	4.86ns	0.0304	2.2 KB
master	`EnrichedLog`	net472	4.86μs	2.4ns	9.28ns	0.32	2.02 KB
#6635	`EnrichedLog`	net6.0	3.14μs	1.46ns	5.64ns	0.0313	2.2 KB
#6635	`EnrichedLog`	netcoreapp3.1	4.13μs	1.98ns	7.68ns	0.0288	2.2 KB
#6635	`EnrichedLog`	net472	5.05μs	1.51ns	5.86ns	0.319	2.02 KB

Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendReceive`	net6.0	1.43μs	2.65ns	10.3ns	0.0158	1.14 KB
master	`SendReceive`	netcoreapp3.1	1.74μs	1.13ns	4.39ns	0.0157	1.14 KB
master	`SendReceive`	net472	1.98μs	1.55ns	5.99ns	0.183	1.16 KB
#6635	`SendReceive`	net6.0	1.32μs	0.878ns	3.4ns	0.0158	1.14 KB
#6635	`SendReceive`	netcoreapp3.1	1.73μs	0.778ns	3.01ns	0.0155	1.14 KB
#6635	`SendReceive`	net472	1.98μs	0.508ns	1.97ns	0.183	1.16 KB

Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	2.82μs	1.15ns	4.46ns	0.0226	1.6 KB
master	`EnrichedLog`	netcoreapp3.1	3.96μs	1.32ns	5.11ns	0.0218	1.65 KB
master	`EnrichedLog`	net472	4.45μs	11.6ns	44.9ns	0.323	2.04 KB
#6635	`EnrichedLog`	net6.0	2.81μs	1.2ns	4.65ns	0.0224	1.6 KB
#6635	`EnrichedLog`	netcoreapp3.1	3.98μs	1.63ns	6.11ns	0.022	1.65 KB
#6635	`EnrichedLog`	net472	4.41μs	9.3ns	36ns	0.322	2.04 KB

Benchmarks.Trace.SpanBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #6635

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net6.0	1.162	401.55	466.79

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`StartFinishSpan`	net6.0	401ns	0.376ns	1.46ns	0.00817	576 B
master	`StartFinishSpan`	netcoreapp3.1	554ns	0.986ns	3.82ns	0.00783	576 B
master	`StartFinishSpan`	net472	630ns	1.05ns	4.07ns	0.0917	578 B
master	`StartFinishScope`	net6.0	558ns	0.645ns	2.41ns	0.0096	696 B
master	`StartFinishScope`	netcoreapp3.1	674ns	1.26ns	4.87ns	0.00927	696 B
master	`StartFinishScope`	net472	873ns	1.04ns	3.88ns	0.105	658 B
#6635	`StartFinishSpan`	net6.0	467ns	0.72ns	2.79ns	0.00804	576 B
#6635	`StartFinishSpan`	netcoreapp3.1	538ns	0.801ns	3.1ns	0.00789	576 B
#6635	`StartFinishSpan`	net472	595ns	1.7ns	6.58ns	0.0917	578 B
#6635	`StartFinishScope`	net6.0	522ns	0.774ns	3ns	0.00986	696 B
#6635	`StartFinishScope`	netcoreapp3.1	675ns	0.968ns	3.75ns	0.00922	696 B
#6635	`StartFinishScope`	net472	848ns	1.31ns	5.06ns	0.104	658 B

Benchmarks.Trace.TraceAnnotationsBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunOnMethodBegin`	net6.0	668ns	0.931ns	3.61ns	0.00974	696 B
master	`RunOnMethodBegin`	netcoreapp3.1	928ns	1.55ns	6ns	0.00929	696 B
master	`RunOnMethodBegin`	net472	1.04μs	1.64ns	6.36ns	0.105	658 B
#6635	`RunOnMethodBegin`	net6.0	686ns	0.739ns	2.77ns	0.00962	696 B
#6635	`RunOnMethodBegin`	netcoreapp3.1	944ns	1.24ns	4.79ns	0.00942	696 B
#6635	`RunOnMethodBegin`	net472	985ns	1.94ns	7.51ns	0.105	658 B

e-n-0

Good job! 😄 thanks

kevingosse

Approving but I didn't check the native part

gleocadie

few ideas, otherwise LGTM

tracer/src/Datadog.Tracer.Native/iast/dataflow.cpp

gleocadie · 2025-02-07T12:30:17Z

tracer/src/Datadog.Tracer.Native/iast/dataflow.cpp

+            int part = -1;
+            SecurityControlType securityControlType = SecurityControlType::Unknown;
+            if ((int) parts.size() > ++part) // Security control kind


you could int part = 0 and avoid the ++-pre-increment

tracer/src/Datadog.Tracer.Native/iast/dataflow.cpp

Rebase fix

daniel-romano-DD added the area:asm-iast label Feb 5, 2025

daniel-romano-DD marked this pull request as ready for review February 6, 2025 23:41

daniel-romano-DD requested review from a team as code owners February 6, 2025 23:41

e-n-0 approved these changes Feb 7, 2025

View reviewed changes

kevingosse approved these changes Feb 7, 2025

View reviewed changes

gleocadie approved these changes Feb 7, 2025

View reviewed changes

daniel-romano-DD force-pushed the dani/iast/security_controls branch 2 times, most recently from e2b30a6 to f49f413 Compare February 8, 2025 05:51

daniel-romano-DD added 10 commits February 10, 2025 13:06

Metrics and managed functionality

ee37093

Reworked metrics

0586a1c

Initial managed and native working Implementation

bac2a4d

Support for validators with multiple parameters

17e9fc9

Update local runsettings generators

7aab55c

Add instrumented unite tests config

b85112b

Updated metrics json

6efbc4f

Fixed typo

0630878

PR comments

7010e61

Rebase fix

Rebase fix

0bb8138

daniel-romano-DD force-pushed the dani/iast/security_controls branch from f49f413 to 0bb8138 Compare February 10, 2025 12:20

daniel-romano-DD merged commit bb7fbb0 into master Feb 10, 2025
140 of 144 checks passed

daniel-romano-DD deleted the dani/iast/security_controls branch February 10, 2025 18:45

github-actions bot added this to the vNext-v3 milestone Feb 10, 2025

andrewlock added the type:new-feature label Feb 11, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[IAST] Security Controls #6635

[IAST] Security Controls #6635

daniel-romano-DD commented Feb 5, 2025 •

edited

Loading

datadog-ddstaging bot commented Feb 5, 2025 •

edited

Loading

andrewlock commented Feb 5, 2025 •

edited

Loading

andrewlock commented Feb 5, 2025 •

edited

Loading

Faster 🎉 in #6635

Raw results

Raw results

Raw results

More allocations ⚠️ in #6635

Fewer allocations 🎉 in #6635

Raw results

andrewlock commented Feb 5, 2025 •

edited

Loading

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Faster 🎉 in #6635

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Slower ⚠️ in #6635

Raw results

Raw results

e-n-0 left a comment

kevingosse left a comment

gleocadie left a comment

gleocadie Feb 7, 2025

[IAST] Security Controls #6635

[IAST] Security Controls #6635

Conversation

daniel-romano-DD commented Feb 5, 2025 • edited Loading

Summary of changes

Reason for change

Implementation details

Test coverage

Other details

datadog-ddstaging bot commented Feb 5, 2025 • edited Loading

Datadog Report

New Flaky Tests (1)

andrewlock commented Feb 5, 2025 • edited Loading

Execution-Time Benchmarks Report ⏱️

andrewlock commented Feb 5, 2025 • edited Loading

Benchmarks Report for appsec 🐌

Benchmark details

Faster 🎉 in #6635

Raw results

Raw results

Raw results

More allocations ⚠️ in #6635

Fewer allocations 🎉 in #6635

Raw results

andrewlock commented Feb 5, 2025 • edited Loading

Benchmarks Report for tracer 🐌

Benchmark details

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Faster 🎉 in #6635

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Slower ⚠️ in #6635

Raw results

Raw results

e-n-0 left a comment

Choose a reason for hiding this comment

kevingosse left a comment

Choose a reason for hiding this comment

gleocadie left a comment

Choose a reason for hiding this comment

gleocadie Feb 7, 2025

Choose a reason for hiding this comment

daniel-romano-DD commented Feb 5, 2025 •

edited

Loading

datadog-ddstaging bot commented Feb 5, 2025 •

edited

Loading

andrewlock commented Feb 5, 2025 •

edited

Loading

andrewlock commented Feb 5, 2025 •

edited

Loading

andrewlock commented Feb 5, 2025 •

edited

Loading