Match tainted objects with sources when checking unbounded vulnerabilities #6122
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
manuel-alvarez-alvarez
added
the
comp: asm iast
manuel-alvarez-alvarez
force-pushed
the
malvarez/iast-precise-reporting-with-objects
branch
from
ed724b7
to
1c623ca
Compare
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 45 metrics, 9 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.26.0-SNAPSHOT~f52c7363f9, baseline=1.26.0-SNAPSHOT~b1ae59a318
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.044 s) : 0, 1043965
Total [baseline] (8.72 s) : 0, 8719602
Agent [candidate] (1.051 s) : 0, 1050795
Total [candidate] (8.738 s) : 0, 8738123
section iast
Agent [baseline] (1.161 s) : 0, 1160888
Total [baseline] (9.289 s) : 0, 9288769
Agent [candidate] (1.159 s) : 0, 1159066
Total [candidate] (9.248 s) : 0, 9248199
section iast_TELEMETRY_OFF
Agent [baseline] (1.153 s) : 0, 1152793
Total [baseline] (9.279 s) : 0, 9278880
Agent [candidate] (1.155 s) : 0, 1154934
Total [candidate] (9.23 s) : 0, 9229809
gantt
title insecure-bank - break down per module: candidate=1.26.0-SNAPSHOT~f52c7363f9, baseline=1.26.0-SNAPSHOT~b1ae59a318
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (645.884 ms) : 0, 645884
BytebuddyAgent [candidate] (650.774 ms) : 0, 650774
GlobalTracer [baseline] (307.17 ms) : 0, 307170
GlobalTracer [candidate] (308.729 ms) : 0, 308729
AppSec [baseline] (48.763 ms) : 0, 48763
AppSec [candidate] (49.033 ms) : 0, 49033
Remote Config [baseline] (669.006 µs) : 0, 669
Remote Config [candidate] (677.208 µs) : 0, 677
Telemetry [baseline] (7.073 ms) : 0, 7073
Telemetry [candidate] (7.149 ms) : 0, 7149
section iast
BytebuddyAgent [baseline] (767.03 ms) : 0, 767030
BytebuddyAgent [candidate] (766.767 ms) : 0, 766767
GlobalTracer [baseline] (284.939 ms) : 0, 284939
GlobalTracer [candidate] (285.144 ms) : 0, 285144
AppSec [baseline] (46.347 ms) : 0, 46347
AppSec [candidate] (46.227 ms) : 0, 46227
IAST [baseline] (19.447 ms) : 0, 19447
IAST [candidate] (18.653 ms) : 0, 18653
Remote Config [baseline] (612.278 µs) : 0, 612
Remote Config [candidate] (602.987 µs) : 0, 603
Telemetry [baseline] (8.122 ms) : 0, 8122
Telemetry [candidate] (7.331 ms) : 0, 7331
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (759.117 ms) : 0, 759117
BytebuddyAgent [candidate] (761.812 ms) : 0, 761812
GlobalTracer [baseline] (285.171 ms) : 0, 285171
GlobalTracer [candidate] (286.394 ms) : 0, 286394
AppSec [baseline] (46.312 ms) : 0, 46312
AppSec [candidate] (46.094 ms) : 0, 46094
IAST [baseline] (19.263 ms) : 0, 19263
IAST [candidate] (16.252 ms) : 0, 16252
Remote Config [baseline] (609.537 µs) : 0, 610
Remote Config [candidate] (588.284 µs) : 0, 588
Telemetry [baseline] (8.02 ms) : 0, 8020
Telemetry [candidate] (9.433 ms) : 0, 9433
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.26.0-SNAPSHOT~f52c7363f9, baseline=1.26.0-SNAPSHOT~b1ae59a318
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.047 s) : 0, 1046794
Total [baseline] (9.368 s) : 0, 9368305
Agent [candidate] (1.044 s) : 0, 1044216
Total [candidate] (9.315 s) : 0, 9315422
section appsec
Agent [baseline] (1.138 s) : 0, 1137920
Total [baseline] (9.514 s) : 0, 9513916
Agent [candidate] (1.141 s) : 0, 1141257
Total [candidate] (9.441 s) : 0, 9440591
section iast
Agent [baseline] (1.161 s) : 0, 1161316
Total [baseline] (9.619 s) : 0, 9619483
Agent [candidate] (1.166 s) : 0, 1166275
Total [candidate] (9.556 s) : 0, 9556461
section profiling
Agent [baseline] (1.233 s) : 0, 1232644
Total [baseline] (9.588 s) : 0, 9588229
Agent [candidate] (1.242 s) : 0, 1241865
Total [candidate] (9.677 s) : 0, 9676958
gantt
title petclinic - break down per module: candidate=1.26.0-SNAPSHOT~f52c7363f9, baseline=1.26.0-SNAPSHOT~b1ae59a318
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (647.009 ms) : 0, 647009
BytebuddyAgent [candidate] (645.83 ms) : 0, 645830
GlobalTracer [baseline] (309.124 ms) : 0, 309124
GlobalTracer [candidate] (307.612 ms) : 0, 307612
AppSec [baseline] (48.565 ms) : 0, 48565
AppSec [candidate] (48.79 ms) : 0, 48790
Remote Config [baseline] (672.984 µs) : 0, 673
Remote Config [candidate] (664.524 µs) : 0, 665
Telemetry [baseline] (7.044 ms) : 0, 7044
Telemetry [candidate] (7.061 ms) : 0, 7061
section appsec
BytebuddyAgent [baseline] (649.95 ms) : 0, 649950
BytebuddyAgent [candidate] (651.876 ms) : 0, 651876
GlobalTracer [baseline] (308.453 ms) : 0, 308453
GlobalTracer [candidate] (309.812 ms) : 0, 309812
AppSec [baseline] (137.428 ms) : 0, 137428
AppSec [candidate] (137.428 ms) : 0, 137428
Remote Config [baseline] (648.487 µs) : 0, 648
Remote Config [candidate] (680.498 µs) : 0, 680
Telemetry [baseline] (6.916 ms) : 0, 6916
Telemetry [candidate] (6.896 ms) : 0, 6896
section iast
BytebuddyAgent [baseline] (768.002 ms) : 0, 768002
BytebuddyAgent [candidate] (768.812 ms) : 0, 768812
GlobalTracer [baseline] (285.916 ms) : 0, 285916
GlobalTracer [candidate] (287.6 ms) : 0, 287600
AppSec [baseline] (46.436 ms) : 0, 46436
AppSec [candidate] (47.011 ms) : 0, 47011
IAST [baseline] (17.23 ms) : 0, 17230
IAST [candidate] (20.459 ms) : 0, 20459
Remote Config [baseline] (608.264 µs) : 0, 608
Remote Config [candidate] (609.32 µs) : 0, 609
Telemetry [baseline] (8.833 ms) : 0, 8833
Telemetry [candidate] (7.395 ms) : 0, 7395
section profiling
BytebuddyAgent [baseline] (656.067 ms) : 0, 656067
BytebuddyAgent [candidate] (661.982 ms) : 0, 661982
GlobalTracer [baseline] (377.461 ms) : 0, 377461
GlobalTracer [candidate] (378.973 ms) : 0, 378973
AppSec [baseline] (48.4 ms) : 0, 48400
AppSec [candidate] (49.029 ms) : 0, 49029
Remote Config [baseline] (693.442 µs) : 0, 693
Remote Config [candidate] (676.519 µs) : 0, 677
Telemetry [baseline] (7.373 ms) : 0, 7373
Telemetry [candidate] (7.442 ms) : 0, 7442
ProfilingAgent [baseline] (88.487 ms) : 0, 88487
ProfilingAgent [candidate] (89.105 ms) : 0, 89105
Profiling [baseline] (88.512 ms) : 0, 88512
Profiling [candidate] (89.13 ms) : 0, 89130
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 8 metrics, 14 unstable metrics. Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.26.0-SNAPSHOT~f52c7363f9, baseline=1.26.0-SNAPSHOT~b1ae59a318
dateFormat X
axisFormat %s
section baseline
no_agent (366.751 µs) : 347, 387
. : milestone, 367,
iast (476.101 µs) : 455, 497
. : milestone, 476,
iast_FULL (537.268 µs) : 517, 558
. : milestone, 537,
iast_INACTIVE (451.64 µs) : 430, 473
. : milestone, 452,
iast_TELEMETRY_OFF (471.84 µs) : 451, 493
. : milestone, 472,
tracing (437.398 µs) : 417, 458
. : milestone, 437,
section candidate
no_agent (363.136 µs) : 343, 383
. : milestone, 363,
iast (471.281 µs) : 450, 492
. : milestone, 471,
iast_FULL (534.543 µs) : 514, 555
. : milestone, 535,
iast_INACTIVE (443.145 µs) : 422, 464
. : milestone, 443,
iast_TELEMETRY_OFF (466.146 µs) : 446, 487
. : milestone, 466,
tracing (439.19 µs) : 419, 460
. : milestone, 439,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.26.0-SNAPSHOT~f52c7363f9, baseline=1.26.0-SNAPSHOT~b1ae59a318
dateFormat X
axisFormat %s
section baseline
no_agent (1.354 ms) : 1336, 1373
. : milestone, 1354,
appsec (1.75 ms) : 1726, 1775
. : milestone, 1750,
iast (1.525 ms) : 1501, 1550
. : milestone, 1525,
profiling (1.505 ms) : 1479, 1530
. : milestone, 1505,
tracing (1.489 ms) : 1465, 1514
. : milestone, 1489,
section candidate
no_agent (1.359 ms) : 1340, 1378
. : milestone, 1359,
appsec (1.759 ms) : 1734, 1784
. : milestone, 1759,
iast (1.541 ms) : 1517, 1565
. : milestone, 1541,
profiling (1.534 ms) : 1509, 1559
. : milestone, 1534,
tracing (1.471 ms) : 1446, 1496
. : milestone, 1471,
|
manuel-alvarez-alvarez
force-pushed
the
malvarez/iast-precise-reporting-with-objects
branch
2 times, most recently
from
3404e3e
to
fb9c957
Compare
jandro996
approved these changes
Nov 3, 2023
jandro996
reviewed
Nov 3, 2023
| return false; | ||
| } | ||
| final Range range = ranges[0]; | ||
| return range.getStart() == 0 && range.getLength() == Integer.MAX_VALUE; |
There was a problem hiding this comment.
Probably it will be a super corner case, but it will be possible that the range start is != 0 and the length will be a negative number
I know that this is not possible from a new source point of view but, maybe dealing with the redaction or propagation...
There was a problem hiding this comment.
This PR only tries to deal with ranges created by forObject:
public static Range[] forObject(final @Nonnull Source source, final int mark) {
return new Range[] {new Range(0, Integer.MAX_VALUE, source, mark)};
}
public static boolean isUnbound(@Nonnull final Range[] ranges) {
if (ranges.length != 1) {
return false;
}
final Range range = ranges[0];
return range.getStart() == 0 && range.getLength() == Integer.MAX_VALUE;
}For other corner cases I'm not sure if we should try to do the matching
manuel-alvarez-alvarez
force-pushed
the
malvarez/iast-precise-reporting-with-objects
branch
from
fb9c957
to
bf1d27a
Compare
manuel-alvarez-alvarez
force-pushed
the
malvarez/iast-precise-reporting-with-objects
branch
2 times, most recently
from
8e30928
to
2cf53f0
Compare
| if (ranges.length != 1) { | ||
| return null; | ||
| } | ||
| final Range range = ranges[0]; |
There was a problem hiding this comment.
Shouldn't we iterate over all ranges instead of checking only the first one?
There was a problem hiding this comment.
Sorry for the delay in the response, this PR only covers the case of unbounded tainted values that are created via:
public static Range[] forObject(final @Nonnull Source source, final int mark) {
return new Range[] {new Range(0, Integer.MAX_VALUE, source, mark)};
}There should not be other cases unless we have a bug of course.
manuel-alvarez-alvarez
force-pushed
the
malvarez/iast-precise-reporting-with-objects
branch
2 times, most recently
from
944d779
to
0848a55
Compare
…es with unbounded objects
manuel-alvarez-alvarez
force-pushed
the
malvarez/iast-precise-reporting-with-objects
branch
from
0848a55
to
f52c736
Compare
ValentinZakharov
approved these changes
Dec 11, 2023
manuel-alvarez-alvarez
deleted the
malvarez/iast-precise-reporting-with-objects
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
When reporting a vulnerability where the source tainted value has a single unbounded range (happens when we lose propagation over objects like
URL,URI, ...), try to match the original source value with the final representation of the tainted object to do a better reporting,.Motivation
From a customer standpoint sometimes is difficult to correlate the vulnerability with its original source in the cases that we lose exact propagation (for instance when creating URLs).
Additional Notes
Jira ticket: APPSEC-11922