[ASM] RASP: Command injection vulnerability implementation #6323

NachoEchevarria · 2024-11-20T09:35:55Z

Summary of changes

This PR contains the implementation of the RASP command injection vulnerability. Previously, the shell injection vulnerability was implemented, which is similar but only occurs the flag UseShellExecute is set to false in method process.start().

The definition of this new vulnerability can be found here: https://docs.google.com/document/d/1DDWy3frMXDTAbk-BfnZ1FdRwuPx6Pl7AWyR4zjqRFZw/edit?tab=t.0#heading=h.giijrtyn1fdx

Reason for change

It's required for RASP.

Implementation details

Test coverage

Other details

github-actions · 2024-11-20T09:40:46Z

Snapshots difference summary

The following differences have been observed in committed snapshots. It is meant to help the reviewer.
The diff is simplistic, so please check some files anyway while we improve it.

8 occurrences of :

-      _dd.appsec.json: {"triggers":[{"rule":{"id":"rasp-932-100","name":"Shell injection exploit","tags":{"category":"vulnerability_trigger","type":"command_injection"}},"rule_matches":[{"operator":"shi_detector","operator_value":"","parameters":[{"address":null,"highlight":[";evilCommand"],"key_path":null,"value":null}]}],"span_id": XXX}]},
+      _dd.appsec.json: {"triggers":[{"rule":{"id":"rasp-932-100","name":"Shell command injection exploit","tags":{"category":"vulnerability_trigger","type":"command_injection"}},"rule_matches":[{"operator":"shi_detector","operator_value":"","parameters":[{"address":null,"highlight":[";evilCommand"],"key_path":null,"value":null}]}],"span_id": XXX}]},

datadog-ddstaging · 2024-11-20T09:58:27Z

Datadog Report

Branch report: nacho/CommandInjection
Commit report: 82711d6
Test service: dd-trace-dotnet

✅ 0 Failed, 445986 Passed, 2713 Skipped, 19h 54m 39.34s Total Time

andrewlock · 2024-11-20T10:23:44Z

Execution-Time Benchmarks Report ⏱️

Execution-time results for samples comparing the following branches/commits:

Execution-time benchmarks measure the whole time it takes to execute a program. And are intended to measure the one-off costs. Cases where the execution time results for the PR are worse than latest master results are shown in red. The following thresholds were used for comparing the execution times:

Welch test with statistical test for significance of 5%
Only results indicating a difference greater than 5% and 5 ms are considered.

Note that these results are based on a single point-in-time result for each branch. For full results, see the dashboard.

Graphs show the p99 interval based on the mean and StdDev of the test run, as well as the mean value of the run (shown as a diamond below the graph).

gantt
    title Execution time (ms) FakeDbCommand (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6323) - mean (72ms)  : 64, 79
     .   : milestone, 72,
    master - mean (71ms)  : 64, 78
     .   : milestone, 71,

    section CallTarget+Inlining+NGEN
    This PR (6323) - mean (1,108ms)  : 1080, 1135
     .   : milestone, 1108,
    master - mean (1,109ms)  : 1083, 1135
     .   : milestone, 1109,

gantt
    title Execution time (ms) FakeDbCommand (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6323) - mean (108ms)  : 107, 110
     .   : milestone, 108,
    master - mean (109ms)  : 106, 112
     .   : milestone, 109,

    section CallTarget+Inlining+NGEN
    This PR (6323) - mean (765ms)  : 748, 781
     .   : milestone, 765,
    master - mean (772ms)  : 752, 791
     .   : milestone, 772,

gantt
    title Execution time (ms) FakeDbCommand (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6323) - mean (92ms)  : 90, 94
     .   : milestone, 92,
    master - mean (92ms)  : 91, 94
     .   : milestone, 92,

    section CallTarget+Inlining+NGEN
    This PR (6323) - mean (719ms)  : 707, 732
     .   : milestone, 719,
    master - mean (726ms)  : 711, 741
     .   : milestone, 726,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Framework 4.6.2) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6323) - mean (191ms)  : 186, 196
     .   : milestone, 191,
    master - mean (192ms)  : 186, 198
     .   : milestone, 192,

    section CallTarget+Inlining+NGEN
    This PR (6323) - mean (1,209ms)  : 1189, 1228
     .   : milestone, 1209,
    master - mean (1,214ms)  : 1192, 1237
     .   : milestone, 1214,

gantt
    title Execution time (ms) HttpMessageHandler (.NET Core 3.1) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6323) - mean (276ms)  : 272, 279
     .   : milestone, 276,
    master - mean (278ms)  : 272, 284
     .   : milestone, 278,

    section CallTarget+Inlining+NGEN
    This PR (6323) - mean (943ms)  : 925, 961
     .   : milestone, 943,
    master - mean (949ms)  : 933, 965
     .   : milestone, 949,

gantt
    title Execution time (ms) HttpMessageHandler (.NET 6) 
    dateFormat  X
    axisFormat %s
    todayMarker off
    section Baseline
    This PR (6323) - mean (266ms)  : 262, 271
     .   : milestone, 266,
    master - mean (266ms)  : 262, 270
     .   : milestone, 266,

    section CallTarget+Inlining+NGEN
    This PR (6323) - mean (933ms)  : 914, 952
     .   : milestone, 933,
    master - mean (931ms)  : 914, 948
     .   : milestone, 931,

andrewlock · 2024-11-20T11:50:34Z

Benchmarks Report for tracer 🐌

Benchmarks for #6323 compared to master:

4 benchmarks are faster, with geometric mean 1.142
2 benchmarks are slower, with geometric mean 1.230
1 benchmarks have fewer allocations
1 benchmarks have more allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.ActivityBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`StartStopWithChild`	net6.0	7.96μs	43.9ns	267ns	0.012	0.00398	0	5.61 KB
master	`StartStopWithChild`	netcoreapp3.1	10.1μs	52.8ns	347ns	0.0153	0.00511	0	5.8 KB
master	`StartStopWithChild`	net472	16.1μs	52.2ns	202ns	1.04	0.307	0.0995	6.21 KB
#6323	`StartStopWithChild`	net6.0	8.12μs	43.1ns	236ns	0.0196	0.00783	0	5.61 KB
#6323	`StartStopWithChild`	netcoreapp3.1	10μs	57ns	411ns	0.019	0.00951	0	5.8 KB
#6323	`StartStopWithChild`	net472	16.2μs	63.2ns	245ns	1.04	0.307	0.105	6.21 KB

Benchmarks.Trace.AgentWriterBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	482μs	390ns	1.41μs	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	656μs	368ns	1.38μs	0	2.7 KB
master	`WriteAndFlushEnrichedTraces`	net472	846μs	643ns	2.49μs	0.425	3.3 KB
#6323	`WriteAndFlushEnrichedTraces`	net6.0	516μs	299ns	1.12μs	0	2.7 KB
#6323	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	666μs	243ns	909ns	0	2.7 KB
#6323	`WriteAndFlushEnrichedTraces`	net472	855μs	455ns	1.7μs	0.425	3.3 KB

Benchmarks.Trace.AspNetCoreBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendRequest`	net6.0	154μs	905ns	8.68μs	0.152	14.47 KB
master	`SendRequest`	netcoreapp3.1	173μs	1.02μs	9.81μs	0.174	17.27 KB
master	`SendRequest`	net472	0.00198ns	0.000761ns	0.00285ns	0	0 b
#6323	`SendRequest`	net6.0	152μs	865ns	6.59μs	0.139	14.47 KB
#6323	`SendRequest`	netcoreapp3.1	175μs	1.03μs	10.2μs	0.162	17.27 KB
#6323	`SendRequest`	net472	0.000647ns	0.000417ns	0.00156ns	0	0 b

Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark - Same speed ✔️ More allocations ⚠️

More allocations ⚠️ in #6323

Benchmark	Base Allocated	Diff Allocated	Change	Change %
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces‑net6.0	41.66 KB	41.9 KB	241 B	0.58%

Fewer allocations 🎉 in #6323

Benchmark	Base Allocated	Diff Allocated	Change	Change %
Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces‑netcoreapp3.1	41.86 KB	41.59 KB	-271 B	-0.65%

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Gen 2	Allocated
master	`WriteAndFlushEnrichedTraces`	net6.0	586μs	3.31μs	21.7μs	0.573	0	0	41.66 KB
master	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	688μs	3.38μs	17.5μs	0.34	0	0	41.86 KB
master	`WriteAndFlushEnrichedTraces`	net472	862μs	3.26μs	12.2μs	8.08	2.55	0.425	53.29 KB
#6323	`WriteAndFlushEnrichedTraces`	net6.0	586μs	3.01μs	14.1μs	0.546	0	0	41.9 KB
#6323	`WriteAndFlushEnrichedTraces`	netcoreapp3.1	684μs	3.41μs	14.5μs	0.332	0	0	41.59 KB
#6323	`WriteAndFlushEnrichedTraces`	net472	898μs	3.78μs	14.7μs	8.3	2.62	0.437	53.28 KB

Benchmarks.Trace.DbCommandBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`ExecuteNonQuery`	net6.0	1.29μs	1.18ns	4.58ns	0.0142	0	1.02 KB
master	`ExecuteNonQuery`	netcoreapp3.1	1.75μs	1.4ns	5.44ns	0.014	0	1.02 KB
master	`ExecuteNonQuery`	net472	2.03μs	1.28ns	4.62ns	0.156	0.00102	987 B
#6323	`ExecuteNonQuery`	net6.0	1.28μs	1.22ns	4.58ns	0.0142	0	1.02 KB
#6323	`ExecuteNonQuery`	netcoreapp3.1	1.8μs	2.6ns	10.1ns	0.0135	0	1.02 KB
#6323	`ExecuteNonQuery`	net472	2.07μs	1.29ns	4.82ns	0.156	0.00105	987 B

Benchmarks.Trace.ElasticsearchBenchmark - Faster 🎉 Same allocations ✔️

Faster 🎉 in #6323

Benchmark	base/diff	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.ElasticsearchBenchmark.CallElasticsearchAsync‑net6.0	1.158	1,385.34	1,196.68

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`CallElasticsearch`	net6.0	1.34μs	0.663ns	2.48ns	0.0135	976 B
master	`CallElasticsearch`	netcoreapp3.1	1.65μs	0.742ns	2.78ns	0.0131	976 B
master	`CallElasticsearch`	net472	2.62μs	1.31ns	5.09ns	0.158	995 B
master	`CallElasticsearchAsync`	net6.0	1.38μs	0.896ns	3.35ns	0.0131	952 B
master	`CallElasticsearchAsync`	netcoreapp3.1	1.72μs	0.655ns	2.36ns	0.0138	1.02 KB
master	`CallElasticsearchAsync`	net472	2.68μs	0.647ns	2.42ns	0.166	1.05 KB
#6323	`CallElasticsearch`	net6.0	1.29μs	0.676ns	2.53ns	0.0135	976 B
#6323	`CallElasticsearch`	netcoreapp3.1	1.6μs	0.678ns	2.45ns	0.013	976 B
#6323	`CallElasticsearch`	net472	2.57μs	6.15ns	23.8ns	0.158	995 B
#6323	`CallElasticsearchAsync`	net6.0	1.2μs	0.574ns	2.22ns	0.0132	952 B
#6323	`CallElasticsearchAsync`	netcoreapp3.1	1.65μs	0.804ns	3.01ns	0.014	1.02 KB
#6323	`CallElasticsearchAsync`	net472	2.64μs	2.85ns	11ns	0.167	1.05 KB

Benchmarks.Trace.GraphQLBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`ExecuteAsync`	net6.0	1.26μs	0.543ns	2.1ns	0.0133	952 B
master	`ExecuteAsync`	netcoreapp3.1	1.66μs	1.3ns	5.05ns	0.0124	952 B
master	`ExecuteAsync`	net472	1.84μs	0.301ns	1.13ns	0.145	915 B
#6323	`ExecuteAsync`	net6.0	1.38μs	0.565ns	2.11ns	0.0131	952 B
#6323	`ExecuteAsync`	netcoreapp3.1	1.57μs	1.96ns	7.58ns	0.0124	952 B
#6323	`ExecuteAsync`	net472	1.81μs	0.515ns	1.99ns	0.145	915 B

Benchmarks.Trace.HttpClientBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendAsync`	net6.0	4.31μs	1.21ns	4.69ns	0.0309	2.31 KB
master	`SendAsync`	netcoreapp3.1	5.29μs	2.35ns	9.09ns	0.0372	2.85 KB
master	`SendAsync`	net472	7.39μs	1.92ns	7.43ns	0.496	3.12 KB
#6323	`SendAsync`	net6.0	4.46μs	1.93ns	7.49ns	0.0312	2.31 KB
#6323	`SendAsync`	netcoreapp3.1	5.3μs	2.15ns	8.04ns	0.037	2.85 KB
#6323	`SendAsync`	net472	7.29μs	1.16ns	4.2ns	0.494	3.12 KB

Benchmarks.Trace.ILoggerBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	1.53μs	3.18ns	12.3ns	0.023	1.64 KB
master	`EnrichedLog`	netcoreapp3.1	2.16μs	1.2ns	4.49ns	0.0228	1.64 KB
master	`EnrichedLog`	net472	2.49μs	1.29ns	4.99ns	0.249	1.57 KB
#6323	`EnrichedLog`	net6.0	1.45μs	0.772ns	2.89ns	0.0227	1.64 KB
#6323	`EnrichedLog`	netcoreapp3.1	2.33μs	1.08ns	4.2ns	0.0221	1.64 KB
#6323	`EnrichedLog`	net472	2.64μs	1.51ns	5.67ns	0.249	1.57 KB

Benchmarks.Trace.Log4netBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EnrichedLog`	net6.0	121μs	108ns	418ns	0	0	4.28 KB
master	`EnrichedLog`	netcoreapp3.1	124μs	114ns	442ns	0.0636	0	4.28 KB
master	`EnrichedLog`	net472	153μs	112ns	434ns	0.686	0.229	4.46 KB
#6323	`EnrichedLog`	net6.0	120μs	116ns	436ns	0.0607	0	4.28 KB
#6323	`EnrichedLog`	netcoreapp3.1	124μs	251ns	972ns	0.0622	0	4.28 KB
#6323	`EnrichedLog`	net472	153μs	197ns	763ns	0.683	0.228	4.46 KB

Benchmarks.Trace.NLogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	3.09μs	1.09ns	4.21ns	0.0309	2.2 KB
master	`EnrichedLog`	netcoreapp3.1	4.12μs	1.34ns	5.18ns	0.029	2.2 KB
master	`EnrichedLog`	net472	5.04μs	1.16ns	4.32ns	0.319	2.02 KB
#6323	`EnrichedLog`	net6.0	3.02μs	0.987ns	3.82ns	0.0301	2.2 KB
#6323	`EnrichedLog`	netcoreapp3.1	4.22μs	1.82ns	6.3ns	0.0296	2.2 KB
#6323	`EnrichedLog`	net472	4.95μs	0.92ns	3.44ns	0.32	2.02 KB

Benchmarks.Trace.RedisBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`SendReceive`	net6.0	1.32μs	1.04ns	4.03ns	0.016	1.14 KB
master	`SendReceive`	netcoreapp3.1	1.73μs	0.644ns	2.49ns	0.015	1.14 KB
master	`SendReceive`	net472	2.13μs	1.32ns	4.93ns	0.183	1.16 KB
#6323	`SendReceive`	net6.0	1.35μs	0.97ns	3.76ns	0.0162	1.14 KB
#6323	`SendReceive`	netcoreapp3.1	1.73μs	2.06ns	7.7ns	0.0151	1.14 KB
#6323	`SendReceive`	net472	2.1μs	0.573ns	2.07ns	0.183	1.16 KB

Benchmarks.Trace.SerilogBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`EnrichedLog`	net6.0	2.65μs	0.864ns	3.23ns	0.0225	1.6 KB
master	`EnrichedLog`	netcoreapp3.1	3.88μs	1.75ns	6.55ns	0.0213	1.65 KB
master	`EnrichedLog`	net472	4.37μs	1.01ns	3.77ns	0.324	2.04 KB
#6323	`EnrichedLog`	net6.0	2.84μs	1.34ns	5.2ns	0.0228	1.6 KB
#6323	`EnrichedLog`	netcoreapp3.1	3.82μs	3.11ns	12ns	0.0209	1.65 KB
#6323	`EnrichedLog`	net472	4.53μs	2.89ns	10.4ns	0.322	2.04 KB

Benchmarks.Trace.SpanBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #6323

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net472	1.166	574.57	669.96

Faster 🎉 in #6323

Benchmark	base/diff	Base Median (ns)	Diff Median (ns)
Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑net6.0	1.157	450.95	389.69
Benchmarks.Trace.SpanBenchmark.StartFinishScope‑net6.0	1.129	545.85	483.48
Benchmarks.Trace.SpanBenchmark.StartFinishSpan‑netcoreapp3.1	1.125	629.60	559.80

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`StartFinishSpan`	net6.0	450ns	0.727ns	2.82ns	0.00817	576 B
master	`StartFinishSpan`	netcoreapp3.1	629ns	1.04ns	4.03ns	0.0075	576 B
master	`StartFinishSpan`	net472	574ns	0.796ns	3.08ns	0.0918	578 B
master	`StartFinishScope`	net6.0	547ns	1.03ns	4ns	0.00969	696 B
master	`StartFinishScope`	netcoreapp3.1	686ns	0.962ns	3.72ns	0.00925	696 B
master	`StartFinishScope`	net472	860ns	2.17ns	8.4ns	0.105	658 B
#6323	`StartFinishSpan`	net6.0	390ns	0.456ns	1.77ns	0.00817	576 B
#6323	`StartFinishSpan`	netcoreapp3.1	560ns	0.616ns	2.38ns	0.00778	576 B
#6323	`StartFinishSpan`	net472	670ns	0.816ns	3.16ns	0.0918	578 B
#6323	`StartFinishScope`	net6.0	483ns	0.818ns	3.17ns	0.00973	696 B
#6323	`StartFinishScope`	netcoreapp3.1	764ns	1.01ns	3.91ns	0.00925	696 B
#6323	`StartFinishScope`	net472	945ns	1.48ns	5.72ns	0.104	658 B

Benchmarks.Trace.TraceAnnotationsBenchmark - Slower ⚠️ Same allocations ✔️

Slower ⚠️ in #6323

Benchmark	diff/base	Base Median (ns)	Diff Median (ns)	Modality
Benchmarks.Trace.TraceAnnotationsBenchmark.RunOnMethodBegin‑net6.0	1.298	577.32	749.31

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunOnMethodBegin`	net6.0	577ns	0.762ns	2.95ns	0.00983	696 B
master	`RunOnMethodBegin`	netcoreapp3.1	956ns	0.864ns	3.23ns	0.00933	696 B
master	`RunOnMethodBegin`	net472	1.15μs	1.43ns	5.54ns	0.104	658 B
#6323	`RunOnMethodBegin`	net6.0	749ns	1.02ns	3.96ns	0.00965	696 B
#6323	`RunOnMethodBegin`	netcoreapp3.1	1.04μs	1.09ns	4.21ns	0.00935	696 B
#6323	`RunOnMethodBegin`	net472	1.09μs	1.8ns	6.98ns	0.104	658 B

NachoEchevarria · 2024-11-22T12:16:23Z

tracer/test/Datadog.Trace.Tests/Telemetry/Metrics/common_metrics.json

@@ -728,7 +728,8 @@
    "rasp.rule.eval": {
      "tags": [
        "waf_version",
-        "rule_type"


The values has been updated in the dd-go repo common_metrics file as well

andrewlock · 2024-11-22T13:15:05Z

Benchmarks Report for appsec 🐌

Benchmarks for #6323 compared to master:

All benchmarks have the same speed
2 benchmarks have fewer allocations

The following thresholds were used for comparing the benchmark speeds:

Mann–Whitney U test with statistical test for significance of 5%
Only results indicating a difference greater than 10% and 0.3 ns are considered.

Allocation changes below 0.5% are ignored.

Benchmark details

Benchmarks.Trace.Asm.AppSecBodyBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`AllCycleSimpleBody`	net6.0	217μs	132ns	512ns	2.48	0	176.82 KB
master	`AllCycleSimpleBody`	netcoreapp3.1	319μs	176ns	657ns	2.39	0	184.27 KB
master	`AllCycleSimpleBody`	net472	282μs	329ns	1.27μs	33.4	2.53	210.04 KB
master	`AllCycleMoreComplexBody`	net6.0	223μs	143ns	535ns	2.49	0	180.33 KB
master	`AllCycleMoreComplexBody`	netcoreapp3.1	328μs	162ns	628ns	2.47	0	187.68 KB
master	`AllCycleMoreComplexBody`	net472	291μs	485ns	1.82μs	33.9	2.6	213.56 KB
master	`ObjectExtractorSimpleBody`	net6.0	147ns	0.145ns	0.563ns	0.00394	0	280 B
master	`ObjectExtractorSimpleBody`	netcoreapp3.1	200ns	0.266ns	1.03ns	0.00368	0	272 B
master	`ObjectExtractorSimpleBody`	net472	215ns	0.197ns	0.763ns	0.0445	0	281 B
master	`ObjectExtractorMoreComplexBody`	net6.0	3.07μs	1.48ns	5.35ns	0.0527	0	3.78 KB
master	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	4.08μs	1.57ns	5.88ns	0.051	0	3.69 KB
master	`ObjectExtractorMoreComplexBody`	net472	4.75μs	3.01ns	11.7ns	0.602	0.00474	3.8 KB
#6323	`AllCycleSimpleBody`	net6.0	217μs	123ns	462ns	2.51	0	176.82 KB
#6323	`AllCycleSimpleBody`	netcoreapp3.1	319μs	279ns	1.04μs	2.41	0	184.26 KB
#6323	`AllCycleSimpleBody`	net472	285μs	422ns	1.64μs	33.3	2.57	210.04 KB
#6323	`AllCycleMoreComplexBody`	net6.0	225μs	181ns	678ns	2.46	0	180.33 KB
#6323	`AllCycleMoreComplexBody`	netcoreapp3.1	315μs	299ns	1.16μs	2.57	0	187.68 KB
#6323	`AllCycleMoreComplexBody`	net472	296μs	512ns	1.98μs	33.9	2.51	213.56 KB
#6323	`ObjectExtractorSimpleBody`	net6.0	141ns	0.0805ns	0.301ns	0.00394	0	280 B
#6323	`ObjectExtractorSimpleBody`	netcoreapp3.1	210ns	1.08ns	4.82ns	0.00376	0	272 B
#6323	`ObjectExtractorSimpleBody`	net472	217ns	0.598ns	2.32ns	0.0446	0	281 B
#6323	`ObjectExtractorMoreComplexBody`	net6.0	3.11μs	3.03ns	11.3ns	0.0543	0	3.78 KB
#6323	`ObjectExtractorMoreComplexBody`	netcoreapp3.1	3.92μs	5.68ns	21.3ns	0.0505	0	3.69 KB
#6323	`ObjectExtractorMoreComplexBody`	net472	4.75μs	7.58ns	28.4ns	0.601	0.00471	3.8 KB

Benchmarks.Trace.Asm.AppSecEncoderBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Gen 1	Allocated
master	`EncodeArgs`	net6.0	37.4μs	13.8ns	51.8ns	0.451	0	32.4 KB
master	`EncodeArgs`	netcoreapp3.1	54.7μs	38.7ns	150ns	0.435	0	32.4 KB
master	`EncodeArgs`	net472	69.2μs	70.9ns	275ns	5.14	0.0677	32.5 KB
master	`EncodeLegacyArgs`	net6.0	71.8μs	130ns	502ns	0	0	2.14 KB
master	`EncodeLegacyArgs`	netcoreapp3.1	103μs	51.4ns	192ns	0	0	2.14 KB
master	`EncodeLegacyArgs`	net472	157μs	71.7ns	278ns	0.314	0	2.15 KB
#6323	`EncodeArgs`	net6.0	37.5μs	17ns	61.1ns	0.452	0	32.4 KB
#6323	`EncodeArgs`	netcoreapp3.1	54.7μs	16ns	59.7ns	0.435	0	32.4 KB
#6323	`EncodeArgs`	net472	68.8μs	66.4ns	249ns	5.13	0.0694	32.5 KB
#6323	`EncodeLegacyArgs`	net6.0	70μs	153ns	593ns	0.0349	0	2.14 KB
#6323	`EncodeLegacyArgs`	netcoreapp3.1	104μs	94.1ns	352ns	0	0	2.14 KB
#6323	`EncodeLegacyArgs`	net472	156μs	60.9ns	236ns	0.312	0	2.15 KB

Benchmarks.Trace.Asm.AppSecWafBenchmark - Same speed ✔️ Same allocations ✔️

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Gen 0	Allocated
master	`RunWafRealisticBenchmark`	net6.0	182μs	145ns	561ns	0	2.44 KB
master	`RunWafRealisticBenchmark`	netcoreapp3.1	196μs	358ns	1.39μs	0	2.39 KB
master	`RunWafRealisticBenchmark`	net472	207μs	57.2ns	214ns	0.31	2.46 KB
master	`RunWafRealisticBenchmarkWithAttack`	net6.0	121μs	90.6ns	339ns	0	1.47 KB
master	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	129μs	213ns	824ns	0	1.46 KB
master	`RunWafRealisticBenchmarkWithAttack`	net472	140μs	70.6ns	273ns	0.211	1.49 KB
#6323	`RunWafRealisticBenchmark`	net6.0	183μs	137ns	512ns	0	2.44 KB
#6323	`RunWafRealisticBenchmark`	netcoreapp3.1	195μs	193ns	723ns	0	2.39 KB
#6323	`RunWafRealisticBenchmark`	net472	208μs	127ns	494ns	0.309	2.46 KB
#6323	`RunWafRealisticBenchmarkWithAttack`	net6.0	122μs	102ns	395ns	0	1.47 KB
#6323	`RunWafRealisticBenchmarkWithAttack`	netcoreapp3.1	130μs	172ns	665ns	0	1.46 KB
#6323	`RunWafRealisticBenchmarkWithAttack`	net472	140μs	124ns	482ns	0.209	1.49 KB

Benchmarks.Trace.Iast.StringAspectsBenchmark - Same speed ✔️ Fewer allocations 🎉

Fewer allocations 🎉 in #6323

Benchmark	Base Allocated	Diff Allocated	Change	Change %
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑net6.0	256.25 KB	254.56 KB	-1.69 KB	-0.66%
Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark‑netcoreapp3.1	263.55 KB	252.85 KB	-10.7 KB	-4.06%

Raw results

Branch	Method	Toolchain	Mean	StdError	StdDev	Allocated
master	`StringConcatBenchmark`	net6.0	58.5μs	750ns	7.39μs	43.44 KB
master	`StringConcatBenchmark`	netcoreapp3.1	61.6μs	799ns	7.91μs	42.64 KB
master	`StringConcatBenchmark`	net472	37.9μs	150ns	542ns	59.36 KB
master	`StringConcatAspectBenchmark`	net6.0	322μs	1.85μs	13.7μs	256.25 KB
master	`StringConcatAspectBenchmark`	netcoreapp3.1	365μs	2.07μs	18.7μs	263.55 KB
master	`StringConcatAspectBenchmark`	net472	289μs	5.53μs	53.4μs	278.53 KB
#6323	`StringConcatBenchmark`	net6.0	63μs	764ns	7.64μs	43.44 KB
#6323	`StringConcatBenchmark`	netcoreapp3.1	56.7μs	308ns	2.28μs	42.64 KB
#6323	`StringConcatBenchmark`	net472	38.2μs	122ns	458ns	59.38 KB
#6323	`StringConcatAspectBenchmark`	net6.0	316μs	1.8μs	13.3μs	254.56 KB
#6323	`StringConcatAspectBenchmark`	netcoreapp3.1	342μs	1.83μs	14μs	252.85 KB
#6323	`StringConcatAspectBenchmark`	net472	298μs	6.72μs	65.2μs	278.53 KB

NachoEchevarria added 10 commits November 20, 2024 10:38

Update WAF version

760d0e0

Remove not needed

680369e

Update ruleset

abbed4b

Fix rules number in smoke tests. Remove not needed test.

4a1964e

Fix unit test

b4e7dc3

Update rule number in snapshots

b9c37ea

Add RASP command injection unit tests, capability and rulesets

102ba25

Command injection vulnerability implementation

77c9907

Update telemetry

c5c2b53

Integration tests

52bba01

NachoEchevarria force-pushed the nacho/CommandInjection branch from 775b4f6 to 52bba01 Compare November 20, 2024 09:39

NachoEchevarria and others added 4 commits November 20, 2024 14:42

Metric tests

c20e404

Merge branch 'master' into nacho/CommandInjection

10cf4a5

remove windows only unit test

6d6e21c

Add capability support

d0ae8eb

NachoEchevarria commented Nov 22, 2024

View reviewed changes

Undo change in tests

82711d6

NachoEchevarria changed the title ~~Nacho/command injection~~ [ASM] RASP: Command injection vulnerability implementation Nov 22, 2024

NachoEchevarria added the area:asm label Nov 22, 2024

NachoEchevarria marked this pull request as ready for review November 22, 2024 13:52

NachoEchevarria requested review from a team as code owners November 22, 2024 13:52

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ASM] RASP: Command injection vulnerability implementation #6323

[ASM] RASP: Command injection vulnerability implementation #6323

NachoEchevarria commented Nov 20, 2024 •

edited

Loading

github-actions bot commented Nov 20, 2024 •

edited

Loading

datadog-ddstaging bot commented Nov 20, 2024 •

edited

Loading

andrewlock commented Nov 20, 2024 •

edited

Loading

andrewlock commented Nov 20, 2024 •

edited

Loading

Raw results

Raw results

Raw results

More allocations ⚠️ in #6323

Fewer allocations 🎉 in #6323

Raw results

Raw results

Faster 🎉 in #6323

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Slower ⚠️ in #6323

Faster 🎉 in #6323

Raw results

Slower ⚠️ in #6323

Raw results

NachoEchevarria Nov 22, 2024

andrewlock commented Nov 22, 2024

Raw results

Raw results

Raw results

Fewer allocations 🎉 in #6323

Raw results

[ASM] RASP: Command injection vulnerability implementation #6323

Are you sure you want to change the base?

[ASM] RASP: Command injection vulnerability implementation #6323

Conversation

NachoEchevarria commented Nov 20, 2024 • edited Loading

Summary of changes

Reason for change

Implementation details

Test coverage

Other details

github-actions bot commented Nov 20, 2024 • edited Loading

Snapshots difference summary

datadog-ddstaging bot commented Nov 20, 2024 • edited Loading

Datadog Report

andrewlock commented Nov 20, 2024 • edited Loading

Execution-Time Benchmarks Report ⏱️

andrewlock commented Nov 20, 2024 • edited Loading

Benchmarks Report for tracer 🐌

Benchmark details

Raw results

Raw results

Raw results

More allocations ⚠️ in #6323

Fewer allocations 🎉 in #6323

Raw results

Raw results

Faster 🎉 in #6323

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Raw results

Slower ⚠️ in #6323

Faster 🎉 in #6323

Raw results

Slower ⚠️ in #6323

Raw results

NachoEchevarria Nov 22, 2024

Choose a reason for hiding this comment

andrewlock commented Nov 22, 2024

Benchmarks Report for appsec 🐌

Benchmark details

Raw results

Raw results

Raw results

Fewer allocations 🎉 in #6323

Raw results

NachoEchevarria commented Nov 20, 2024 •

edited

Loading

github-actions bot commented Nov 20, 2024 •

edited

Loading

datadog-ddstaging bot commented Nov 20, 2024 •

edited

Loading

andrewlock commented Nov 20, 2024 •

edited

Loading

andrewlock commented Nov 20, 2024 •

edited

Loading