Increase IAST propagation to StringBuilder append #8010

Mariovido · 2024-11-25T10:21:06Z

What Does This Do

This adds the instrumentation to propagate the taint values through the following methods of StringBuilder:

append(CharSequence, int, int)
append(StringBuffer)

Motivation

Increase propagation of StringBuilder methods.

Additional Notes

Contributor Checklist

Format the title according the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any usefull labels
Squash your commits prior merging or merge using GitHub's Squash and merge
Don't use close, fix or any linking keywords when referencing an issue.
Use solves instead, and assign the PR milestone to the issue
Update the public documentation in case of new configuration flag or behavior

Jira ticket: APPSEC-55358

…rinbBuilder.append with buffer

pr-commenter · 2024-11-25T10:54:30Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mario.vidal/taint_tracking_string_builder_append
git_commit_date	1732529492	1732529612
git_commit_sha	`b055376`	`ad752ec`
release_version	1.43.0-SNAPSHOT~b0553764bc	1.43.0-SNAPSHOT~ad752ecd40

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1732532024	1732532024
ci_job_id	718533341	718533341
ci_pipeline_id	49836492	49836492
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
module	Agent	Agent
parent	None	None
variant	iast	iast

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 52 metrics, 10 unstable metrics.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:startup:petclinic:profiling:GlobalTracer	better [-37.446ms; -31.964ms] or [-8.584%; -7.327%]	401.521ms	436.226ms

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.43.0-SNAPSHOT~ad752ecd40, baseline=1.43.0-SNAPSHOT~b0553764bc

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.094 s) : 0, 1093910
Total [baseline] (10.449 s) : 0, 10448675
Agent [candidate] (1.097 s) : 0, 1097248
Total [candidate] (10.471 s) : 0, 10471290
section appsec
Agent [baseline] (1.224 s) : 0, 1224166
Total [baseline] (10.71 s) : 0, 10709506
Agent [candidate] (1.227 s) : 0, 1227445
Total [candidate] (10.764 s) : 0, 10763550
section iast
Agent [baseline] (1.22 s) : 0, 1220441
Total [baseline] (11.046 s) : 0, 11045573
Agent [candidate] (1.218 s) : 0, 1217882
Total [candidate] (10.923 s) : 0, 10922997
section profiling
Agent [baseline] (1.319 s) : 0, 1318550
Total [baseline] (10.857 s) : 0, 10856751
Agent [candidate] (1.289 s) : 0, 1288851
Total [candidate] (10.782 s) : 0, 10782351

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.094 s	-
Agent	appsec	1.224 s	130.256 ms (11.9%)
Agent	iast	1.22 s	126.531 ms (11.6%)
Agent	profiling	1.319 s	224.64 ms (20.5%)
Total	tracing	10.449 s	-
Total	appsec	10.71 s	260.831 ms (2.5%)
Total	iast	11.046 s	596.898 ms (5.7%)
Total	profiling	10.857 s	408.076 ms (3.9%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.097 s	-
Agent	appsec	1.227 s	130.197 ms (11.9%)
Agent	iast	1.218 s	120.634 ms (11.0%)
Agent	profiling	1.289 s	191.603 ms (17.5%)
Total	tracing	10.471 s	-
Total	appsec	10.764 s	292.26 ms (2.8%)
Total	iast	10.923 s	451.708 ms (4.3%)
Total	profiling	10.782 s	311.061 ms (3.0%)

gantt
    title petclinic - break down per module: candidate=1.43.0-SNAPSHOT~ad752ecd40, baseline=1.43.0-SNAPSHOT~b0553764bc

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (693.42 ms) : 0, 693420
BytebuddyAgent [candidate] (697.798 ms) : 0, 697798
GlobalTracer [baseline] (319.545 ms) : 0, 319545
GlobalTracer [candidate] (319.812 ms) : 0, 319812
AppSec [baseline] (55.094 ms) : 0, 55094
AppSec [candidate] (54.954 ms) : 0, 54954
Remote Config [baseline] (688.852 µs) : 0, 689
Remote Config [candidate] (687.165 µs) : 0, 687
Telemetry [baseline] (11.387 ms) : 0, 11387
Telemetry [candidate] (10.132 ms) : 0, 10132
section appsec
BytebuddyAgent [baseline] (710.277 ms) : 0, 710277
BytebuddyAgent [candidate] (710.615 ms) : 0, 710615
GlobalTracer [baseline] (314.882 ms) : 0, 314882
GlobalTracer [candidate] (316.584 ms) : 0, 316584
AppSec [baseline] (166.15 ms) : 0, 166150
AppSec [candidate] (166.966 ms) : 0, 166966
Remote Config [baseline] (642.576 µs) : 0, 643
Remote Config [candidate] (640.073 µs) : 0, 640
Telemetry [baseline] (8.26 ms) : 0, 8260
Telemetry [candidate] (8.906 ms) : 0, 8906
IAST [baseline] (20.524 ms) : 0, 20524
IAST [candidate] (19.969 ms) : 0, 19969
section iast
BytebuddyAgent [baseline] (812.299 ms) : 0, 812299
BytebuddyAgent [candidate] (810.363 ms) : 0, 810363
GlobalTracer [baseline] (307.278 ms) : 0, 307278
GlobalTracer [candidate] (306.863 ms) : 0, 306863
AppSec [baseline] (58.328 ms) : 0, 58328
AppSec [candidate] (57.452 ms) : 0, 57452
Remote Config [baseline] (615.859 µs) : 0, 616
Remote Config [candidate] (597.52 µs) : 0, 598
Telemetry [baseline] (7.454 ms) : 0, 7454
Telemetry [candidate] (7.389 ms) : 0, 7389
IAST [baseline] (20.732 ms) : 0, 20732
IAST [candidate] (21.435 ms) : 0, 21435
section profiling
BytebuddyAgent [baseline] (687.356 ms) : 0, 687356
BytebuddyAgent [candidate] (687.481 ms) : 0, 687481
GlobalTracer [baseline] (436.226 ms) : 0, 436226
GlobalTracer [candidate] (401.521 ms) : 0, 401521
AppSec [baseline] (53.933 ms) : 0, 53933
AppSec [candidate] (55.369 ms) : 0, 55369
Remote Config [baseline] (676.542 µs) : 0, 677
Remote Config [candidate] (681.151 µs) : 0, 681
Telemetry [baseline] (7.789 ms) : 0, 7789
Telemetry [candidate] (10.718 ms) : 0, 10718
ProfilingAgent [baseline] (93.44 ms) : 0, 93440
ProfilingAgent [candidate] (93.899 ms) : 0, 93899
Profiling [baseline] (93.463 ms) : 0, 93463
Profiling [candidate] (93.922 ms) : 0, 93922

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.43.0-SNAPSHOT~ad752ecd40, baseline=1.43.0-SNAPSHOT~b0553764bc

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.092 s) : 0, 1092217
Total [baseline] (8.669 s) : 0, 8668589
Agent [candidate] (1.091 s) : 0, 1090973
Total [candidate] (8.646 s) : 0, 8646030
section iast
Agent [baseline] (1.226 s) : 0, 1225711
Total [baseline] (9.189 s) : 0, 9189162
Agent [candidate] (1.217 s) : 0, 1217167
Total [candidate] (9.216 s) : 0, 9216080
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.22 s) : 0, 1219532
Total [baseline] (9.201 s) : 0, 9200990
Agent [candidate] (1.217 s) : 0, 1216777
Total [candidate] (9.156 s) : 0, 9156320
section iast_TELEMETRY_OFF
Agent [baseline] (1.213 s) : 0, 1213057
Total [baseline] (9.179 s) : 0, 9179480
Agent [candidate] (1.228 s) : 0, 1227610
Total [candidate] (9.224 s) : 0, 9224181

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.092 s	-
Agent	iast	1.226 s	133.494 ms (12.2%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.22 s	127.315 ms (11.7%)
Agent	iast_TELEMETRY_OFF	1.213 s	120.84 ms (11.1%)
Total	tracing	8.669 s	-
Total	iast	9.189 s	520.573 ms (6.0%)
Total	iast_HARDCODED_SECRET_DISABLED	9.201 s	532.401 ms (6.1%)
Total	iast_TELEMETRY_OFF	9.179 s	510.89 ms (5.9%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.091 s	-
Agent	iast	1.217 s	126.194 ms (11.6%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.217 s	125.804 ms (11.5%)
Agent	iast_TELEMETRY_OFF	1.228 s	136.637 ms (12.5%)
Total	tracing	8.646 s	-
Total	iast	9.216 s	570.049 ms (6.6%)
Total	iast_HARDCODED_SECRET_DISABLED	9.156 s	510.29 ms (5.9%)
Total	iast_TELEMETRY_OFF	9.224 s	578.15 ms (6.7%)

gantt
    title insecure-bank - break down per module: candidate=1.43.0-SNAPSHOT~ad752ecd40, baseline=1.43.0-SNAPSHOT~b0553764bc

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (694.131 ms) : 0, 694131
BytebuddyAgent [candidate] (693.763 ms) : 0, 693763
GlobalTracer [baseline] (318.191 ms) : 0, 318191
GlobalTracer [candidate] (318.035 ms) : 0, 318035
AppSec [baseline] (54.753 ms) : 0, 54753
AppSec [candidate] (54.678 ms) : 0, 54678
Remote Config [baseline] (688.05 µs) : 0, 688
Remote Config [candidate] (680.487 µs) : 0, 680
Telemetry [baseline] (10.714 ms) : 0, 10714
Telemetry [candidate] (10.099 ms) : 0, 10099
section iast
BytebuddyAgent [baseline] (816.292 ms) : 0, 816292
BytebuddyAgent [candidate] (809.293 ms) : 0, 809293
GlobalTracer [baseline] (308.541 ms) : 0, 308541
GlobalTracer [candidate] (306.319 ms) : 0, 306319
AppSec [baseline] (58.17 ms) : 0, 58170
AppSec [candidate] (58.532 ms) : 0, 58532
Remote Config [baseline] (628.76 µs) : 0, 629
Remote Config [candidate] (633.499 µs) : 0, 633
Telemetry [baseline] (7.514 ms) : 0, 7514
Telemetry [candidate] (7.622 ms) : 0, 7622
IAST [baseline] (20.724 ms) : 0, 20724
IAST [candidate] (21.064 ms) : 0, 21064
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (811.586 ms) : 0, 811586
BytebuddyAgent [candidate] (809.023 ms) : 0, 809023
GlobalTracer [baseline] (307.251 ms) : 0, 307251
GlobalTracer [candidate] (307.472 ms) : 0, 307472
AppSec [baseline] (57.029 ms) : 0, 57029
AppSec [candidate] (57.648 ms) : 0, 57648
Remote Config [baseline] (623.139 µs) : 0, 623
Remote Config [candidate] (622.803 µs) : 0, 623
Telemetry [baseline] (7.487 ms) : 0, 7487
Telemetry [candidate] (7.529 ms) : 0, 7529
IAST [baseline] (21.796 ms) : 0, 21796
IAST [candidate] (20.759 ms) : 0, 20759
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (805.921 ms) : 0, 805921
BytebuddyAgent [candidate] (816.927 ms) : 0, 816927
GlobalTracer [baseline] (306.606 ms) : 0, 306606
GlobalTracer [candidate] (309.537 ms) : 0, 309537
AppSec [baseline] (58.346 ms) : 0, 58346
AppSec [candidate] (57.028 ms) : 0, 57028
Remote Config [baseline] (642.784 µs) : 0, 643
Remote Config [candidate] (613.958 µs) : 0, 614
Telemetry [baseline] (7.423 ms) : 0, 7423
Telemetry [candidate] (7.371 ms) : 0, 7371
IAST [baseline] (20.462 ms) : 0, 20462
IAST [candidate] (22.221 ms) : 0, 22221

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
end_time	2024-11-25T10:35:43	2024-11-25T10:42:42
git_branch	master	mario.vidal/taint_tracking_string_builder_append
git_commit_date	1732529492	1732529612
git_commit_sha	`b055376`	`ad752ec`
release_version	1.43.0-SNAPSHOT~b0553764bc	1.43.0-SNAPSHOT~ad752ecd40
start_time	2024-11-25T10:35:30	2024-11-25T10:42:29

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1732531717	1732531717
ci_job_id	718569340	718569340
ci_pipeline_id	49836492	49836492
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 16 unstable metrics.

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.43.0-SNAPSHOT~ad752ecd40, baseline=1.43.0-SNAPSHOT~b0553764bc
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.379 ms) : 1360, 1399
.   : milestone, 1379,
appsec (1.746 ms) : 1721, 1771
.   : milestone, 1746,
appsec_no_iast (1.743 ms) : 1718, 1769
.   : milestone, 1743,
iast (1.496 ms) : 1473, 1519
.   : milestone, 1496,
profiling (1.529 ms) : 1505, 1552
.   : milestone, 1529,
tracing (1.48 ms) : 1455, 1504
.   : milestone, 1480,
section candidate
no_agent (1.365 ms) : 1345, 1385
.   : milestone, 1365,
appsec (1.779 ms) : 1754, 1803
.   : milestone, 1779,
appsec_no_iast (1.739 ms) : 1713, 1764
.   : milestone, 1739,
iast (1.51 ms) : 1488, 1532
.   : milestone, 1510,
profiling (1.551 ms) : 1526, 1576
.   : milestone, 1551,
tracing (1.498 ms) : 1473, 1523
.   : milestone, 1498,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.379 ms [1.36 ms, 1.399 ms]	-
appsec	1.746 ms [1.721 ms, 1.771 ms]	366.602 µs (26.6%)
appsec_no_iast	1.743 ms [1.718 ms, 1.769 ms]	364.152 µs (26.4%)
iast	1.496 ms [1.473 ms, 1.519 ms]	117.052 µs (8.5%)
profiling	1.529 ms [1.505 ms, 1.552 ms]	149.399 µs (10.8%)
tracing	1.48 ms [1.455 ms, 1.504 ms]	100.383 µs (7.3%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.365 ms [1.345 ms, 1.385 ms]	-
appsec	1.779 ms [1.754 ms, 1.803 ms]	413.859 µs (30.3%)
appsec_no_iast	1.739 ms [1.713 ms, 1.764 ms]	373.984 µs (27.4%)
iast	1.51 ms [1.488 ms, 1.532 ms]	145.012 µs (10.6%)
profiling	1.551 ms [1.526 ms, 1.576 ms]	186.159 µs (13.6%)
tracing	1.498 ms [1.473 ms, 1.523 ms]	133.368 µs (9.8%)

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.43.0-SNAPSHOT~ad752ecd40, baseline=1.43.0-SNAPSHOT~b0553764bc
    dateFormat X
    axisFormat %s
section baseline
no_agent (390.838 µs) : 371, 411
.   : milestone, 391,
iast (490.737 µs) : 469, 512
.   : milestone, 491,
iast_FULL (657.11 µs) : 636, 679
.   : milestone, 657,
iast_GLOBAL (522.066 µs) : 501, 543
.   : milestone, 522,
iast_HARDCODED_SECRET_DISABLED (493.388 µs) : 472, 515
.   : milestone, 493,
iast_INACTIVE (456.39 µs) : 435, 478
.   : milestone, 456,
iast_TELEMETRY_OFF (488.829 µs) : 467, 511
.   : milestone, 489,
tracing (455.251 µs) : 434, 476
.   : milestone, 455,
section candidate
no_agent (375.495 µs) : 355, 396
.   : milestone, 375,
iast (497.435 µs) : 476, 519
.   : milestone, 497,
iast_FULL (657.326 µs) : 636, 679
.   : milestone, 657,
iast_GLOBAL (532.82 µs) : 510, 555
.   : milestone, 533,
iast_HARDCODED_SECRET_DISABLED (493.092 µs) : 472, 514
.   : milestone, 493,
iast_INACTIVE (454.109 µs) : 433, 475
.   : milestone, 454,
iast_TELEMETRY_OFF (484.866 µs) : 464, 506
.   : milestone, 485,
tracing (456.724 µs) : 436, 478
.   : milestone, 457,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	390.838 µs [371.039 µs, 410.638 µs]	-
iast	490.737 µs [469.312 µs, 512.163 µs]	99.899 µs (25.6%)
iast_FULL	657.11 µs [635.696 µs, 678.523 µs]	266.271 µs (68.1%)
iast_GLOBAL	522.066 µs [500.85 µs, 543.281 µs]	131.227 µs (33.6%)
iast_HARDCODED_SECRET_DISABLED	493.388 µs [471.832 µs, 514.944 µs]	102.55 µs (26.2%)
iast_INACTIVE	456.39 µs [434.791 µs, 477.989 µs]	65.552 µs (16.8%)
iast_TELEMETRY_OFF	488.829 µs [466.986 µs, 510.672 µs]	97.991 µs (25.1%)
tracing	455.251 µs [434.446 µs, 476.057 µs]	64.413 µs (16.5%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	375.495 µs [355.268 µs, 395.722 µs]	-
iast	497.435 µs [475.737 µs, 519.132 µs]	121.94 µs (32.5%)
iast_FULL	657.326 µs [635.778 µs, 678.873 µs]	281.831 µs (75.1%)
iast_GLOBAL	532.82 µs [510.328 µs, 555.311 µs]	157.325 µs (41.9%)
iast_HARDCODED_SECRET_DISABLED	493.092 µs [471.817 µs, 514.367 µs]	117.597 µs (31.3%)
iast_INACTIVE	454.109 µs [433.298 µs, 474.92 µs]	78.615 µs (20.9%)
iast_TELEMETRY_OFF	484.866 µs [463.602 µs, 506.13 µs]	109.371 µs (29.1%)
tracing	456.724 µs [435.62 µs, 477.828 µs]	81.229 µs (21.6%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mario.vidal/taint_tracking_string_builder_append
git_commit_date	1732529492	1732529612
git_commit_sha	`b055376`	`ad752ec`
release_version	1.43.0-SNAPSHOT~b0553764bc	1.43.0-SNAPSHOT~ad752ecd40

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1732531675	1732531675
ci_job_id	718533343	718533343
ci_pipeline_id	49836492	49836492
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.43.0-SNAPSHOT~ad752ecd40, baseline=1.43.0-SNAPSHOT~b0553764bc
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.314 s) : 15314000, 15314000
.   : milestone, 15314000,
appsec (14.927 s) : 14927000, 14927000
.   : milestone, 14927000,
iast (18.762 s) : 18762000, 18762000
.   : milestone, 18762000,
iast_GLOBAL (18.055 s) : 18055000, 18055000
.   : milestone, 18055000,
profiling (15.06 s) : 15060000, 15060000
.   : milestone, 15060000,
tracing (14.946 s) : 14946000, 14946000
.   : milestone, 14946000,
section candidate
no_agent (15.436 s) : 15436000, 15436000
.   : milestone, 15436000,
appsec (14.835 s) : 14835000, 14835000
.   : milestone, 14835000,
iast (18.801 s) : 18801000, 18801000
.   : milestone, 18801000,
iast_GLOBAL (18.334 s) : 18334000, 18334000
.   : milestone, 18334000,
profiling (15.579 s) : 15579000, 15579000
.   : milestone, 15579000,
tracing (15.205 s) : 15205000, 15205000
.   : milestone, 15205000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.314 s [15.314 s, 15.314 s]	-
appsec	14.927 s [14.927 s, 14.927 s]	-387.0 ms (-2.5%)
iast	18.762 s [18.762 s, 18.762 s]	3.448 s (22.5%)
iast_GLOBAL	18.055 s [18.055 s, 18.055 s]	2.741 s (17.9%)
profiling	15.06 s [15.06 s, 15.06 s]	-254.0 ms (-1.7%)
tracing	14.946 s [14.946 s, 14.946 s]	-368.0 ms (-2.4%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.436 s [15.436 s, 15.436 s]	-
appsec	14.835 s [14.835 s, 14.835 s]	-601.0 ms (-3.9%)
iast	18.801 s [18.801 s, 18.801 s]	3.365 s (21.8%)
iast_GLOBAL	18.334 s [18.334 s, 18.334 s]	2.898 s (18.8%)
profiling	15.579 s [15.579 s, 15.579 s]	143.0 ms (0.9%)
tracing	15.205 s [15.205 s, 15.205 s]	-231.0 ms (-1.5%)

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.43.0-SNAPSHOT~ad752ecd40, baseline=1.43.0-SNAPSHOT~b0553764bc
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.475 ms) : 1463, 1486
.   : milestone, 1475,
appsec (2.354 ms) : 2312, 2395
.   : milestone, 2354,
iast (2.095 ms) : 2042, 2148
.   : milestone, 2095,
iast_GLOBAL (2.146 ms) : 2094, 2199
.   : milestone, 2146,
profiling (1.961 ms) : 1919, 2003
.   : milestone, 1961,
tracing (1.931 ms) : 1891, 1972
.   : milestone, 1931,
section candidate
no_agent (1.472 ms) : 1461, 1484
.   : milestone, 1472,
appsec (2.349 ms) : 2308, 2390
.   : milestone, 2349,
iast (2.091 ms) : 2039, 2144
.   : milestone, 2091,
iast_GLOBAL (2.137 ms) : 2084, 2189
.   : milestone, 2137,
profiling (1.949 ms) : 1907, 1991
.   : milestone, 1949,
tracing (1.928 ms) : 1888, 1968
.   : milestone, 1928,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.475 ms [1.463 ms, 1.486 ms]	-
appsec	2.354 ms [2.312 ms, 2.395 ms]	879.045 µs (59.6%)
iast	2.095 ms [2.042 ms, 2.148 ms]	620.064 µs (42.0%)
iast_GLOBAL	2.146 ms [2.094 ms, 2.199 ms]	671.657 µs (45.5%)
profiling	1.961 ms [1.919 ms, 2.003 ms]	486.124 µs (33.0%)
tracing	1.931 ms [1.891 ms, 1.972 ms]	456.732 µs (31.0%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.472 ms [1.461 ms, 1.484 ms]	-
appsec	2.349 ms [2.308 ms, 2.39 ms]	876.366 µs (59.5%)
iast	2.091 ms [2.039 ms, 2.144 ms]	619.335 µs (42.1%)
iast_GLOBAL	2.137 ms [2.084 ms, 2.189 ms]	664.497 µs (45.1%)
profiling	1.949 ms [1.907 ms, 1.991 ms]	476.695 µs (32.4%)
tracing	1.928 ms [1.888 ms, 1.968 ms]	455.647 µs (31.0%)

Add support for StringBuilder.append with start and end and append St…

ad752ec

…rinbBuilder.append with buffer

Mariovido added type: enhancement comp: asm iast Application Security Management (IAST) inst: java Core Java language instrumentation labels Nov 25, 2024

smola removed the inst: java Core Java language instrumentation label Nov 25, 2024

smola changed the title ~~Increase propagation to StringBuilder append~~ Increase IAST propagation to StringBuilder append Nov 25, 2024

Mariovido marked this pull request as ready for review November 25, 2024 11:23

Mariovido requested review from a team as code owners November 25, 2024 11:23

Mariovido requested review from smola and ValentinZakharov November 25, 2024 11:23

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Increase IAST propagation to StringBuilder append #8010

Increase IAST propagation to StringBuilder append #8010

Mariovido commented Nov 25, 2024 •

edited

Loading

pr-commenter bot commented Nov 25, 2024

Increase IAST propagation to StringBuilder append #8010

Are you sure you want to change the base?

Increase IAST propagation to StringBuilder append #8010

Conversation

Mariovido commented Nov 25, 2024 • edited Loading

What Does This Do

Motivation

Additional Notes

Contributor Checklist

pr-commenter bot commented Nov 25, 2024

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Mariovido commented Nov 25, 2024 •

edited

Loading