-
Notifications
You must be signed in to change notification settings - Fork 283
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Stacktrace leak protection for Tomcat 7 #5740
Merged
ValentinZakharov
merged 16 commits into
master
from
vzakharov/stacktrace_leak_protection
Nov 3, 2023
Merged
Stacktrace leak protection for Tomcat 7 #5740
ValentinZakharov
merged 16 commits into
master
from
vzakharov/stacktrace_leak_protection
Nov 3, 2023
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 54 cases. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.23.0-SNAPSHOT~2bf64bda4e, baseline=1.23.0-SNAPSHOT~23bbe149f2
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.042 s) : 0, 1042153
Total [baseline] (8.759 s) : 0, 8758929
Agent [candidate] (1.036 s) : 0, 1036222
Total [candidate] (8.789 s) : 0, 8788964
section iast
Agent [baseline] (1.142 s) : 0, 1142273
Total [baseline] (9.352 s) : 0, 9351731
Agent [candidate] (1.15 s) : 0, 1149617
Total [candidate] (9.283 s) : 0, 9282956
section iast_TELEMETRY_OFF
Agent [baseline] (1.146 s) : 0, 1146217
Total [baseline] (9.299 s) : 0, 9299492
Agent [candidate] (1.148 s) : 0, 1148490
Total [candidate] (9.274 s) : 0, 9274203
gantt
title insecure-bank - break down per module: candidate=1.23.0-SNAPSHOT~2bf64bda4e, baseline=1.23.0-SNAPSHOT~23bbe149f2
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (650.361 ms) : 0, 650361
BytebuddyAgent [candidate] (646.172 ms) : 0, 646172
GlobalTracer [baseline] (295.993 ms) : 0, 295993
GlobalTracer [candidate] (294.211 ms) : 0, 294211
AppSec [baseline] (48.968 ms) : 0, 48968
AppSec [candidate] (49.049 ms) : 0, 49049
Remote Config [baseline] (705.405 µs) : 0, 705
Remote Config [candidate] (698.883 µs) : 0, 699
Telemetry [baseline] (11.421 ms) : 0, 11421
Telemetry [candidate] (11.467 ms) : 0, 11467
section iast
BytebuddyAgent [baseline] (761.677 ms) : 0, 761677
BytebuddyAgent [candidate] (764.259 ms) : 0, 764259
GlobalTracer [baseline] (272.737 ms) : 0, 272737
GlobalTracer [candidate] (274.058 ms) : 0, 274058
AppSec [baseline] (46.206 ms) : 0, 46206
AppSec [candidate] (46.514 ms) : 0, 46514
Remote Config [baseline] (558.439 µs) : 0, 558
Remote Config [candidate] (574.256 µs) : 0, 574
Telemetry [baseline] (10.46 ms) : 0, 10460
Telemetry [candidate] (11.042 ms) : 0, 11042
IAST [baseline] (16.322 ms) : 0, 16322
IAST [candidate] (18.773 ms) : 0, 18773
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (762.805 ms) : 0, 762805
BytebuddyAgent [candidate] (762.844 ms) : 0, 762844
GlobalTracer [baseline] (273.91 ms) : 0, 273910
GlobalTracer [candidate] (274.072 ms) : 0, 274072
AppSec [baseline] (46.782 ms) : 0, 46782
AppSec [candidate] (46.406 ms) : 0, 46406
Remote Config [baseline] (559.193 µs) : 0, 559
Remote Config [candidate] (574.315 µs) : 0, 574
Telemetry [baseline] (10.366 ms) : 0, 10366
Telemetry [candidate] (11.898 ms) : 0, 11898
IAST [baseline] (17.074 ms) : 0, 17074
IAST [candidate] (18.108 ms) : 0, 18108
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.23.0-SNAPSHOT~2bf64bda4e, baseline=1.23.0-SNAPSHOT~23bbe149f2
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.039 s) : 0, 1039309
Total [baseline] (9.285 s) : 0, 9284903
Agent [candidate] (1.034 s) : 0, 1033523
Total [candidate] (9.323 s) : 0, 9322836
section appsec
Agent [baseline] (1.118 s) : 0, 1117865
Total [baseline] (9.418 s) : 0, 9417675
Agent [candidate] (1.118 s) : 0, 1118467
Total [candidate] (9.388 s) : 0, 9387929
section iast
Agent [baseline] (1.153 s) : 0, 1152890
Total [baseline] (9.602 s) : 0, 9602242
Agent [candidate] (1.149 s) : 0, 1148922
Total [candidate] (9.552 s) : 0, 9551808
section profiling
Agent [baseline] (1.223 s) : 0, 1223057
Total [baseline] (9.595 s) : 0, 9594658
Agent [candidate] (1.222 s) : 0, 1221890
Total [candidate] (9.581 s) : 0, 9580561
gantt
title petclinic - break down per module: candidate=1.23.0-SNAPSHOT~2bf64bda4e, baseline=1.23.0-SNAPSHOT~23bbe149f2
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (649.684 ms) : 0, 649684
BytebuddyAgent [candidate] (644.745 ms) : 0, 644745
GlobalTracer [baseline] (293.865 ms) : 0, 293865
GlobalTracer [candidate] (294.248 ms) : 0, 294248
AppSec [baseline] (48.969 ms) : 0, 48969
AppSec [candidate] (48.457 ms) : 0, 48457
Remote Config [baseline] (690.311 µs) : 0, 690
Remote Config [candidate] (692.279 µs) : 0, 692
Telemetry [baseline] (11.356 ms) : 0, 11356
Telemetry [candidate] (11.165 ms) : 0, 11165
section appsec
BytebuddyAgent [baseline] (644.833 ms) : 0, 644833
BytebuddyAgent [candidate] (644.016 ms) : 0, 644016
GlobalTracer [baseline] (293.122 ms) : 0, 293122
GlobalTracer [candidate] (294.031 ms) : 0, 294031
AppSec [baseline] (138.038 ms) : 0, 138038
AppSec [candidate] (138.589 ms) : 0, 138589
Remote Config [baseline] (641.896 µs) : 0, 642
Remote Config [candidate] (644.874 µs) : 0, 645
Telemetry [baseline] (6.872 ms) : 0, 6872
Telemetry [candidate] (6.847 ms) : 0, 6847
section iast
BytebuddyAgent [baseline] (768.338 ms) : 0, 768338
BytebuddyAgent [candidate] (762.885 ms) : 0, 762885
GlobalTracer [baseline] (273.229 ms) : 0, 273229
GlobalTracer [candidate] (274.053 ms) : 0, 274053
AppSec [baseline] (46.452 ms) : 0, 46452
AppSec [candidate] (46.761 ms) : 0, 46761
Remote Config [baseline] (565.838 µs) : 0, 566
Remote Config [candidate] (608.759 µs) : 0, 609
Telemetry [baseline] (12.605 ms) : 0, 12605
Telemetry [candidate] (13.368 ms) : 0, 13368
IAST [baseline] (17.149 ms) : 0, 17149
IAST [candidate] (16.909 ms) : 0, 16909
section profiling
BytebuddyAgent [baseline] (658.643 ms) : 0, 658643
BytebuddyAgent [candidate] (657.843 ms) : 0, 657843
GlobalTracer [baseline] (359.957 ms) : 0, 359957
GlobalTracer [candidate] (359.469 ms) : 0, 359469
AppSec [baseline] (49.502 ms) : 0, 49502
AppSec [candidate] (49.296 ms) : 0, 49296
Remote Config [baseline] (642.209 µs) : 0, 642
Remote Config [candidate] (649.132 µs) : 0, 649
Telemetry [baseline] (11.319 ms) : 0, 11319
Telemetry [candidate] (11.402 ms) : 0, 11402
ProfilingAgent [baseline] (88.52 ms) : 0, 88520
ProfilingAgent [candidate] (88.878 ms) : 0, 88878
Profiling [baseline] (88.543 ms) : 0, 88543
Profiling [candidate] (88.901 ms) : 0, 88901
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 22 cases. Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.23.0-SNAPSHOT~2bf64bda4e, baseline=1.23.0-SNAPSHOT~23bbe149f2
dateFormat X
axisFormat %s
section baseline
no_agent (363.19 µs) : 341, 385
. : milestone, 363,
iast (461.3 µs) : 440, 482
. : milestone, 461,
iast_FULL (519.23 µs) : 499, 540
. : milestone, 519,
iast_INACTIVE (424.944 µs) : 404, 446
. : milestone, 425,
iast_TELEMETRY_OFF (448.852 µs) : 428, 469
. : milestone, 449,
tracing (426.548 µs) : 405, 448
. : milestone, 427,
section candidate
no_agent (356.289 µs) : 335, 377
. : milestone, 356,
iast (452.601 µs) : 432, 473
. : milestone, 453,
iast_FULL (516.266 µs) : 496, 537
. : milestone, 516,
iast_INACTIVE (424.399 µs) : 404, 445
. : milestone, 424,
iast_TELEMETRY_OFF (453.681 µs) : 433, 475
. : milestone, 454,
tracing (432.493 µs) : 411, 454
. : milestone, 432,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.23.0-SNAPSHOT~2bf64bda4e, baseline=1.23.0-SNAPSHOT~23bbe149f2
dateFormat X
axisFormat %s
section baseline
no_agent (1.329 ms) : 1309, 1349
. : milestone, 1329,
appsec (1.705 ms) : 1680, 1729
. : milestone, 1705,
iast (1.466 ms) : 1442, 1489
. : milestone, 1466,
profiling (1.504 ms) : 1477, 1531
. : milestone, 1504,
tracing (1.469 ms) : 1445, 1494
. : milestone, 1469,
section candidate
no_agent (1.343 ms) : 1324, 1363
. : milestone, 1343,
appsec (1.688 ms) : 1663, 1713
. : milestone, 1688,
iast (1.467 ms) : 1443, 1491
. : milestone, 1467,
profiling (1.453 ms) : 1427, 1478
. : milestone, 1453,
tracing (1.426 ms) : 1402, 1451
. : milestone, 1426,
|
cataphract
requested changes
Aug 21, 2023
...c-7/src/main/java/datadog/trace/instrumentation/tomcat7/ErrorReportValueInstrumentation.java
Outdated
Show resolved
Hide resolved
dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/StacktraceLeakModuleImpl.java
Outdated
Show resolved
Hide resolved
7e8787c
to
f9901fa
Compare
...cat-appsec-7/src/main/java/datadog/trace/instrumentation/tomcat7/ErrorReportValueAdvice.java
Outdated
Show resolved
Hide resolved
f9901fa
to
5e1a4c6
Compare
e98801a
to
c8202e0
Compare
smola
approved these changes
Oct 19, 2023
1399479
to
87d4422
Compare
0df6bbf
to
58de69f
Compare
cataphract
approved these changes
Nov 2, 2023
dd-java-agent/agent-iast/src/test/groovy/com/datadog/iast/sink/StacktraceLeakModuleTest.groovy
Outdated
Show resolved
Hide resolved
manuel-alvarez-alvarez
approved these changes
Nov 2, 2023
dd-java-agent/agent-iast/src/test/groovy/com/datadog/iast/sink/StacktraceLeakModuleTest.groovy
Outdated
Show resolved
Hide resolved
dd-java-agent/agent-iast/src/main/java/com/datadog/iast/sink/StacktraceLeakModuleImpl.java
Show resolved
Hide resolved
1e33657
to
4af1908
Compare
4af1908
to
3db28f3
Compare
smola
approved these changes
Nov 3, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Added mechanism, to detect and suppress Stecktrace leaks (disabled by default).
Implemented error handler instrumentation in Tomcat 7 to catch exceptions before they could be populated to client.
To make it works - the IAST should be enabled
-Ddd.iast.enabled=true
Suppression can be enabled with the option
-Ddd.iast.stacktrace-leak.suppress=true
Motivation
The feature solves the “Stacktrace Exposure” problem. Currently still exist many web servers and frameworks that are returning exception details in response, revealing critical details about application internals to potential attacker. A classical example - you can perform SQLi attack by sending sequence of malicious requests, each time using exception message to validate SQL injection results. The solution provides both features: detection and prevention (displays ASM blocking page instead of stacktrace) disabled by default.
Additional Notes
This is an Innovation week project.
Since it's experimental feature, it's currently implemented for Tomcat 7+ only.
JIRA: APPSEC-11758