[asm] IAST security controls #5117

iunanua · 2025-01-16T08:19:56Z

What does this PR do?

IAST security controls implementation

ST DataDog/system-tests#3872

Motivation

Plugin Checklist

Additional Notes

github-actions · 2025-01-16T08:20:45Z

Overall package size

Self size: 8.57 MB
Deduped: 94.8 MB
No deduping: 95.32 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | @datadog/libdatadog | 0.4.0 | 29.44 MB | 29.44 MB | | @datadog/native-appsec | 8.4.0 | 19.25 MB | 19.26 MB | | @datadog/native-iast-taint-tracking | 3.3.0 | 13.77 MB | 13.78 MB | | @datadog/pprof | 5.4.1 | 9.76 MB | 10.13 MB | | protobufjs | 7.2.5 | 2.77 MB | 5.16 MB | | @datadog/native-iast-rewriter | 2.6.1 | 2.59 MB | 2.73 MB | | @opentelemetry/core | 1.14.0 | 872.87 kB | 1.47 MB | | @datadog/native-metrics | 3.1.0 | 1.06 MB | 1.46 MB | | @opentelemetry/api | 1.8.0 | 1.21 MB | 1.21 MB | | import-in-the-middle | 1.11.2 | 112.74 kB | 826.22 kB | | source-map | 0.7.4 | 226 kB | 226 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | lru-cache | 7.18.3 | 133.92 kB | 133.92 kB | | pprof-format | 2.1.0 | 111.69 kB | 111.69 kB | | @datadog/sketches-js | 2.1.0 | 109.9 kB | 109.9 kB | | semver | 7.6.3 | 95.82 kB | 95.82 kB | | lodash.sortby | 4.7.0 | 75.76 kB | 75.76 kB | | ignore | 5.3.1 | 51.46 kB | 51.46 kB | | shell-quote | 1.8.1 | 44.96 kB | 44.96 kB | | istanbul-lib-coverage | 3.2.0 | 29.34 kB | 29.34 kB | | rfdc | 1.3.1 | 25.21 kB | 25.21 kB | | @isaacs/ttlcache | 1.4.1 | 25.2 kB | 25.2 kB | | tlhunter-sorted-set | 0.1.0 | 24.94 kB | 24.94 kB | | limiter | 1.1.5 | 23.17 kB | 23.17 kB | | dc-polyfill | 0.1.4 | 23.1 kB | 23.1 kB | | retry | 0.13.1 | 18.85 kB | 18.85 kB | | jest-docblock | 29.7.0 | 8.99 kB | 12.76 kB | | crypto-randomuuid | 1.0.0 | 11.18 kB | 11.18 kB | | ttl-set | 1.0.0 | 4.61 kB | 9.69 kB | | path-to-regexp | 0.1.12 | 6.6 kB | 6.6 kB | | koalas | 1.0.2 | 6.47 kB | 6.47 kB | | module-details-from-path | 1.0.3 | 4.47 kB | 4.47 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

pr-commenter · 2025-01-16T08:31:17Z

Benchmarks

Benchmark execution time: 2025-01-24 09:45:58

Comparing candidate commit 3f57dea in PR branch igor/iast-security-controls with baseline commit 30efc06 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 908 metrics, 25 unstable metrics.

…ginManager in the tests

codecov · 2025-01-16T10:32:41Z

Codecov Report

Attention: Patch coverage is 35.03185% with 102 lines in your changes missing coverage. Please review.

Project coverage is 70.28%. Comparing base (858b2a1) to head (4e4d69e).
Report is 18 commits behind head on master.

Files with missing lines	Patch %	Lines
...d-trace/src/appsec/iast/security-controls/index.js	16.66%	65 Missing ⚠️
...-trace/src/appsec/iast/security-controls/parser.js	20.45%	35 Missing ⚠️
...iast/analyzers/nosql-injection-mongodb-analyzer.js	60.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #5117      +/-   ##
==========================================
- Coverage   71.53%   70.28%   -1.26%     
==========================================
  Files         299      162     -137     
  Lines       13753     5387    -8366     
==========================================
- Hits         9838     3786    -6052     
+ Misses       3915     1601    -2314

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

uurien · 2025-01-24T14:53:39Z

packages/dd-trace/src/appsec/iast/analyzers/vulnerability-analyzer.js

@@ -25,6 +28,11 @@ class Analyzer extends SinkIastPlugin {
    return false
  }

+  _isRangeSecure (range) {


Does checking the secure marks out of injection-analizer make sense?

uurien · 2025-01-24T14:55:10Z

packages/dd-trace/src/appsec/iast/analyzers/injection-analyzer.js

+      ranges = this._filterSecureRanges(ranges)
+      if (!ranges?.length) {
+        this._incrementSuppressedMetric(iastContext)
+      }


Suggested change

}

}

uurien · 2025-01-24T15:39:05Z

packages/dd-trace/src/appsec/iast/analyzers/sql-injection-analyzer.js

@@ -83,8 +83,8 @@ class SqlInjectionAnalyzer extends InjectionAnalyzer {
    }
  }

-  _areRangesVulnerable () {
-    return true
+  _areRangesVulnerable (ranges) {


we have this method implemented in more analyzers, like code injection analyzer. I think that this change is necessary for all of them.

uurien · 2025-01-24T15:59:36Z

packages/dd-trace/src/appsec/iast/security-controls/index.js

+
+  controls = parse(iastConfig.securityControlsConfiguration)
+  if (controls?.size > 0) {
+    hooks = new Set()


If a module is required for one use and is not used anymore, we don't want to be who are blocking the GC to delete it.

Suggested change

hooks = new Set()

hooks = new WeakSet()

uurien · 2025-01-24T16:06:13Z

packages/dd-trace/src/appsec/iast/security-controls/parser.js

+  const fields = control.split(SECURITY_CONTROL_FIELD_DELIMITER)
+
+  if (fields.length < 3 || fields.length > 5) {
+    // TODO: do we want telemetry log for these cases?


I don't think so, but we could log an error rather than warn to be aware when the customer is using it incorrectly.

uurien · 2025-01-24T16:09:59Z

packages/dd-trace/src/appsec/iast/security-controls/parser.js

+function parse (securityControlsConfiguration) {
+  const controls = new Map()
+
+  securityControlsConfiguration?.replace(/\s/g, '')


too simple regex I think, what if a directory in the list has an space?

uurien · 2025-01-24T16:14:26Z

packages/dd-trace/src/appsec/iast/security-controls/parser.js

+
+  parameters = getParameters(parameters)
+
+  // TODO: check if file is a valid path?


unnecessary fs access I think.

uurien · 2025-01-24T16:20:24Z

packages/dd-trace/src/appsec/iast/taint-tracking/secure-marks-generator.js

@@ -3,7 +3,7 @@
 let next = 0

 function getNextSecureMark () {
-  return 1 << next++
+  return (1 << next++) >>> 0


uurien · 2025-01-24T16:22:36Z

packages/dd-trace/src/config.js

@@ -788,6 +790,7 @@ class Config {
      this._setValue(env, 'iast.requestSampling', iastRequestSampling)
    }
    this._envUnprocessed['iast.requestSampling'] = DD_IAST_REQUEST_SAMPLING
+    this._setString(env, 'iast.securityControlsConfiguration', DD_IAST_SECURITY_CONTROLS_CONFIGURATION)


you are not giving an option to configure it programatically, intentionally or you just forgot it?

uurien · 2025-01-24T16:29:17Z

packages/dd-trace/src/appsec/iast/taint-tracking/secure-marks.js

+let [asterisk, ...rest] = Object.values(marks)
+rest.forEach(mark => { asterisk |= mark })


I should have to read this code multiple times to understand it...

Here suggestions that I think are more readable.

Suggested change

let [asterisk, ...rest] = Object.values(marks)

rest.forEach(mark => { asterisk |= mark })

let asterisk = 0x0

Object.values(marks).forEach(mark => { asterisk |= mark })

Or

Suggested change

let [asterisk, ...rest] = Object.values(marks)

rest.forEach(mark => { asterisk |= mark })

const asterisk = Object.values(marks).reduce((total, current) => total | current, 0x0)

iunanua added 7 commits January 10, 2025 17:43

Security controls parser and secure marks for vulnerabilities

d5a52ea

Use new NOSQL_MONGODB_INJECTION_MARK in nosql-injection-mongodb-analyzer

c4c398c

Config

9a1229c

first hooks

dce2f18

wrap object properties and more tests

ac1d502

Use dd-trace:moduleLoad(Start|End) channels

4cc7895

iterate object strings and more tests

6fe83f6

iunanua added semver-minor asm-iast labels Jan 16, 2025

fix parameter index, include createNewTainted flag and do not use Plu…

4e4d69e

…ginManager in the tests

iunanua added 17 commits January 16, 2025 11:41

Fix parameter index and include a test with incorrect index

90b9ff8

Avoid to hook multiple times the same module and config tests

2d86aee

sql_injection_mark test

5ed8aa2

vulnerable ranges tests

57548b0

fix windows paths

610e216

Merge branch 'master' into igor/iast-security-controls

ca0bbe5

Upgrade taint-tracking to 3.3.0

b4a217e

Fix * secure mark

0b0c292

add createNewTainted flag to addSecureMark

af61bf9

Use existing _isRangeSecure

fb1de25

supressed vulnerabilities metric

384d526

increment supressed vulnerability metric

fce89df

typo

c324c58

handle esm default export and filenames starting with file://

767d2db

esm integration tests

082ac75

clean up

4b948ad

secure-marks tests

d9c1393

iunanua added 5 commits January 23, 2025 17:41

Merge branch 'master' into igor/iast-security-controls

1fdaf86

fix secure-marks generator test

3b697d1

fix config test

07dcc02

empty

5556875

check for repeated marks

3f57dea

uurien reviewed Jan 24, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[asm] IAST security controls #5117

[asm] IAST security controls #5117

iunanua commented Jan 16, 2025 •

edited

Loading

github-actions bot commented Jan 16, 2025 •

edited

Loading

pr-commenter bot commented Jan 16, 2025 •

edited

Loading

codecov bot commented Jan 16, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025

uurien Jan 24, 2025


		parameters = getParameters(parameters)

		// TODO: check if file is a valid path?

		let [asterisk, ...rest] = Object.values(marks)
		rest.forEach(mark => { asterisk \|= mark })

	let [asterisk, ...rest] = Object.values(marks)
	rest.forEach(mark => { asterisk \|= mark })
	const asterisk = Object.values(marks).reduce((total, current) => total \| current, 0x0)

[asm] IAST security controls #5117

Are you sure you want to change the base?

[asm] IAST security controls #5117

Conversation

iunanua commented Jan 16, 2025 • edited Loading

What does this PR do?

Motivation

Plugin Checklist

Additional Notes

github-actions bot commented Jan 16, 2025 • edited Loading

Overall package size

pr-commenter bot commented Jan 16, 2025 • edited Loading

Benchmarks

codecov bot commented Jan 16, 2025

Codecov Report

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

iunanua commented Jan 16, 2025 •

edited

Loading

github-actions bot commented Jan 16, 2025 •

edited

Loading

pr-commenter bot commented Jan 16, 2025 •

edited

Loading