Propagation of translateEscapes of String class by sezen-datadog · Pull Request #8186 · DataDog/dd-trace-java

sezen-datadog · 2025-01-13T10:17:23Z

What Does This Do

Taints translateEscapes string

Motivation

This is a feature added to String class operations in Java 15 so we add a propagation for this method

Additional Notes

Contributor Checklist

Jira ticket: APPSEC-55380

github-actions · 2025-01-13T10:17:37Z

Hi! 👋 Thanks for your pull request! 🎉

To help us review it, please make sure to:

Add at least one type, and one component or instrumentation label to the pull request

If you need help, please check our contributing guidelines.

pr-commenter · 2025-01-13T10:56:15Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	sezen.leblay/APPSEC-55380-translateEscapes-propagation
git_commit_date	1737017707	1737017620
git_commit_sha	`9b06903`	`44f3db9`
release_version	1.46.0-SNAPSHOT~9b06903e18	1.46.0-SNAPSHOT~44f3db9c3a

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1737020130	1737020130
ci_job_id	768520198	768520198
ci_pipeline_id	53154263	53154263
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
module	Agent	Agent
parent	None	None
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 60 metrics, 3 unstable metrics.

Startup time reports for insecure-bank

gantt
title insecure-bank - global startup overhead: candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.058 s) : 0, 1057899
Total [baseline] (8.668 s) : 0, 8668464
Agent [candidate] (1.053 s) : 0, 1052559
Total [candidate] (8.618 s) : 0, 8617868
section iast
Agent [baseline] (1.183 s) : 0, 1182531
Total [baseline] (9.18 s) : 0, 9179899
Agent [candidate] (1.182 s) : 0, 1182080
Total [candidate] (9.192 s) : 0, 9191971
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.18 s) : 0, 1179823
Total [baseline] (9.148 s) : 0, 9147698
Agent [candidate] (1.181 s) : 0, 1181225
Total [candidate] (9.163 s) : 0, 9163381
section iast_TELEMETRY_OFF
Agent [baseline] (1.184 s) : 0, 1184008
Total [baseline] (9.198 s) : 0, 9197734
Agent [candidate] (1.179 s) : 0, 1178905
Total [candidate] (9.166 s) : 0, 9165519

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.058 s	-
Agent	iast	1.183 s	124.633 ms (11.8%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.18 s	121.924 ms (11.5%)
Agent	iast_TELEMETRY_OFF	1.184 s	126.109 ms (11.9%)
Total	tracing	8.668 s	-
Total	iast	9.18 s	511.435 ms (5.9%)
Total	iast_HARDCODED_SECRET_DISABLED	9.148 s	479.234 ms (5.5%)
Total	iast_TELEMETRY_OFF	9.198 s	529.27 ms (6.1%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.053 s	-
Agent	iast	1.182 s	129.521 ms (12.3%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.181 s	128.667 ms (12.2%)
Agent	iast_TELEMETRY_OFF	1.179 s	126.346 ms (12.0%)
Total	tracing	8.618 s	-
Total	iast	9.192 s	574.103 ms (6.7%)
Total	iast_HARDCODED_SECRET_DISABLED	9.163 s	545.513 ms (6.3%)
Total	iast_TELEMETRY_OFF	9.166 s	547.651 ms (6.4%)

gantt
title insecure-bank - break down per module: candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (714.586 ms) : 0, 714586
BytebuddyAgent [candidate] (714.461 ms) : 0, 714461
GlobalTracer [baseline] (256.269 ms) : 0, 256269
GlobalTracer [candidate] (255.58 ms) : 0, 255580
AppSec [baseline] (56.997 ms) : 0, 56997
AppSec [candidate] (55.925 ms) : 0, 55925
Remote Config [baseline] (715.232 µs) : 0, 715
Remote Config [candidate] (723.661 µs) : 0, 724
Telemetry [baseline] (14.328 ms) : 0, 14328
Telemetry [candidate] (10.797 ms) : 0, 10797
section iast
BytebuddyAgent [baseline] (832.313 ms) : 0, 832313
BytebuddyAgent [candidate] (831.404 ms) : 0, 831404
GlobalTracer [baseline] (246.298 ms) : 0, 246298
GlobalTracer [candidate] (246.474 ms) : 0, 246474
AppSec [baseline] (57.903 ms) : 0, 57903
AppSec [candidate] (57.971 ms) : 0, 57971
IAST [baseline] (21.601 ms) : 0, 21601
IAST [candidate] (21.618 ms) : 0, 21618
Remote Config [baseline] (667.024 µs) : 0, 667
Remote Config [candidate] (692.242 µs) : 0, 692
Telemetry [baseline] (8.78 ms) : 0, 8780
Telemetry [candidate] (8.928 ms) : 0, 8928
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (829.77 ms) : 0, 829770
BytebuddyAgent [candidate] (830.541 ms) : 0, 830541
GlobalTracer [baseline] (246.14 ms) : 0, 246140
GlobalTracer [candidate] (246.329 ms) : 0, 246329
AppSec [baseline] (58.194 ms) : 0, 58194
AppSec [candidate] (58.427 ms) : 0, 58427
IAST [baseline] (21.363 ms) : 0, 21363
IAST [candidate] (21.494 ms) : 0, 21494
Remote Config [baseline] (660.563 µs) : 0, 661
Remote Config [candidate] (667.983 µs) : 0, 668
Telemetry [baseline] (8.729 ms) : 0, 8729
Telemetry [candidate] (8.798 ms) : 0, 8798
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (833.259 ms) : 0, 833259
BytebuddyAgent [candidate] (829.239 ms) : 0, 829239
GlobalTracer [baseline] (247.509 ms) : 0, 247509
GlobalTracer [candidate] (246.76 ms) : 0, 246760
AppSec [baseline] (58.074 ms) : 0, 58074
AppSec [candidate] (57.726 ms) : 0, 57726
IAST [baseline] (20.845 ms) : 0, 20845
IAST [candidate] (20.843 ms) : 0, 20843
Remote Config [baseline] (654.445 µs) : 0, 654
Remote Config [candidate] (662.298 µs) : 0, 662
Telemetry [baseline] (8.65 ms) : 0, 8650
Telemetry [candidate] (8.623 ms) : 0, 8623

Startup time reports for petclinic

gantt
title petclinic - global startup overhead: candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.06 s) : 0, 1059625
Total [baseline] (10.429 s) : 0, 10428629
Agent [candidate] (1.053 s) : 0, 1052741
Total [candidate] (10.433 s) : 0, 10432796
section appsec
Agent [baseline] (1.188 s) : 0, 1187757
Total [baseline] (10.72 s) : 0, 10720082
Agent [candidate] (1.189 s) : 0, 1188567
Total [candidate] (10.701 s) : 0, 10700827
section iast
Agent [baseline] (1.198 s) : 0, 1197645
Total [baseline] (10.959 s) : 0, 10958855
Agent [candidate] (1.183 s) : 0, 1182830
Total [candidate] (11.001 s) : 0, 11000770
section profiling
Agent [baseline] (1.252 s) : 0, 1252429
Total [baseline] (10.765 s) : 0, 10765017
Agent [candidate] (1.263 s) : 0, 1263297
Total [candidate] (10.947 s) : 0, 10946878

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.06 s	-
Agent	appsec	1.188 s	128.132 ms (12.1%)
Agent	iast	1.198 s	138.02 ms (13.0%)
Agent	profiling	1.252 s	192.803 ms (18.2%)
Total	tracing	10.429 s	-
Total	appsec	10.72 s	291.453 ms (2.8%)
Total	iast	10.959 s	530.226 ms (5.1%)
Total	profiling	10.765 s	336.388 ms (3.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.053 s	-
Agent	appsec	1.189 s	135.826 ms (12.9%)
Agent	iast	1.183 s	130.089 ms (12.4%)
Agent	profiling	1.263 s	210.556 ms (20.0%)
Total	tracing	10.433 s	-
Total	appsec	10.701 s	268.031 ms (2.6%)
Total	iast	11.001 s	567.974 ms (5.4%)
Total	profiling	10.947 s	514.082 ms (4.9%)

gantt
title petclinic - break down per module: candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (716.914 ms) : 0, 716914
BytebuddyAgent [candidate] (712.42 ms) : 0, 712420
GlobalTracer [baseline] (256.602 ms) : 0, 256602
GlobalTracer [candidate] (255.227 ms) : 0, 255227
AppSec [baseline] (56.842 ms) : 0, 56842
AppSec [candidate] (55.766 ms) : 0, 55766
Remote Config [baseline] (731.586 µs) : 0, 732
Remote Config [candidate] (716.911 µs) : 0, 717
Telemetry [baseline] (13.485 ms) : 0, 13485
Telemetry [candidate] (13.661 ms) : 0, 13661
section appsec
BytebuddyAgent [baseline] (730.292 ms) : 0, 730292
BytebuddyAgent [candidate] (731.036 ms) : 0, 731036
GlobalTracer [baseline] (253.259 ms) : 0, 253259
GlobalTracer [candidate] (252.875 ms) : 0, 252875
AppSec [baseline] (170.679 ms) : 0, 170679
AppSec [candidate] (171.02 ms) : 0, 171020
Remote Config [baseline] (657.581 µs) : 0, 658
Remote Config [candidate] (670.777 µs) : 0, 671
Telemetry [baseline] (8.206 ms) : 0, 8206
Telemetry [candidate] (8.221 ms) : 0, 8221
IAST [baseline] (19.42 ms) : 0, 19420
IAST [candidate] (19.423 ms) : 0, 19423
section iast
BytebuddyAgent [baseline] (843.272 ms) : 0, 843272
BytebuddyAgent [candidate] (832.029 ms) : 0, 832029
GlobalTracer [baseline] (249.334 ms) : 0, 249334
GlobalTracer [candidate] (246.747 ms) : 0, 246747
AppSec [baseline] (58.488 ms) : 0, 58488
AppSec [candidate] (57.881 ms) : 0, 57881
Remote Config [baseline] (698.885 µs) : 0, 699
Remote Config [candidate] (655.999 µs) : 0, 656
Telemetry [baseline] (8.92 ms) : 0, 8920
Telemetry [candidate] (8.88 ms) : 0, 8880
IAST [baseline] (21.826 ms) : 0, 21826
IAST [candidate] (21.641 ms) : 0, 21641
section profiling
BytebuddyAgent [baseline] (702.657 ms) : 0, 702657
BytebuddyAgent [candidate] (708.609 ms) : 0, 708609
GlobalTracer [baseline] (349.166 ms) : 0, 349166
GlobalTracer [candidate] (352.053 ms) : 0, 352053
AppSec [baseline] (54.289 ms) : 0, 54289
AppSec [candidate] (54.789 ms) : 0, 54789
Remote Config [baseline] (652.803 µs) : 0, 653
Remote Config [candidate] (657.404 µs) : 0, 657
Telemetry [baseline] (8.805 ms) : 0, 8805
Telemetry [candidate] (8.947 ms) : 0, 8947
ProfilingAgent [baseline] (94.911 ms) : 0, 94911
ProfilingAgent [candidate] (96.012 ms) : 0, 96012
Profiling [baseline] (94.935 ms) : 0, 94935
Profiling [candidate] (96.036 ms) : 0, 96036

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
end_time	2025-01-16T09:05:32	2025-01-16T09:12:35
git_branch	master	sezen.leblay/APPSEC-55380-translateEscapes-propagation
git_commit_date	1737017707	1737017620
git_commit_sha	`9b06903`	`44f3db9`
release_version	1.46.0-SNAPSHOT~9b06903e18	1.46.0-SNAPSHOT~44f3db9c3a
start_time	2025-01-16T09:05:18	2025-01-16T09:12:21

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1737019110	1737019110
ci_job_id	768520199	768520199
ci_pipeline_id	53154263	53154263
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
variant	iast	iast

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 10 metrics, 17 unstable metrics.

scenario	Δ mean http_req_duration	Δ mean throughput	candidate mean http_req_duration	candidate mean throughput	baseline mean http_req_duration	baseline mean throughput
scenario:load:insecure-bank:iast_FULL	better [-105.728µs; -59.081µs] or [-14.329%; -8.007%]	unstable [-1064.157op/s; +1695.736op/s] or [-17.736%; +28.262%]	655.465µs	6315.789op/s	737.869µs	6000.000op/s

Request duration reports for insecure-bank

gantt
title insecure-bank - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
dateFormat X
axisFormat %s
section baseline
no_agent (386.278 µs) : 366, 406
. : milestone, 386,
iast (510.915 µs) : 489, 533
. : milestone, 511,
iast_FULL (737.869 µs) : 716, 760
. : milestone, 738,
iast_GLOBAL (550.058 µs) : 529, 572
. : milestone, 550,
iast_HARDCODED_SECRET_DISABLED (507.495 µs) : 486, 529
. : milestone, 507,
iast_INACTIVE (460.294 µs) : 439, 482
. : milestone, 460,
iast_TELEMETRY_OFF (492.965 µs) : 471, 515
. : milestone, 493,
tracing (449.675 µs) : 429, 471
. : milestone, 450,
section candidate
no_agent (377.126 µs) : 356, 398
. : milestone, 377,
iast (492.837 µs) : 471, 514
. : milestone, 493,
iast_FULL (655.465 µs) : 634, 677
. : milestone, 655,
iast_GLOBAL (521.237 µs) : 499, 543
. : milestone, 521,
iast_HARDCODED_SECRET_DISABLED (501.464 µs) : 480, 523
. : milestone, 501,
iast_INACTIVE (463.084 µs) : 440, 486
. : milestone, 463,
iast_TELEMETRY_OFF (481.471 µs) : 460, 503
. : milestone, 481,
tracing (450.256 µs) : 429, 471
. : milestone, 450,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	386.278 µs [366.405 µs, 406.151 µs]	-
iast	510.915 µs [488.701 µs, 533.129 µs]	124.637 µs (32.3%)
iast_FULL	737.869 µs [716.076 µs, 759.662 µs]	351.591 µs (91.0%)
iast_GLOBAL	550.058 µs [528.526 µs, 571.59 µs]	163.78 µs (42.4%)
iast_HARDCODED_SECRET_DISABLED	507.495 µs [485.836 µs, 529.153 µs]	121.216 µs (31.4%)
iast_INACTIVE	460.294 µs [439.048 µs, 481.539 µs]	74.016 µs (19.2%)
iast_TELEMETRY_OFF	492.965 µs [471.133 µs, 514.796 µs]	106.686 µs (27.6%)
tracing	449.675 µs [428.596 µs, 470.754 µs]	63.397 µs (16.4%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	377.126 µs [355.793 µs, 398.459 µs]	-
iast	492.837 µs [471.277 µs, 514.397 µs]	115.712 µs (30.7%)
iast_FULL	655.465 µs [633.91 µs, 677.02 µs]	278.339 µs (73.8%)
iast_GLOBAL	521.237 µs [499.216 µs, 543.258 µs]	144.111 µs (38.2%)
iast_HARDCODED_SECRET_DISABLED	501.464 µs [479.557 µs, 523.371 µs]	124.338 µs (33.0%)
iast_INACTIVE	463.084 µs [440.194 µs, 485.973 µs]	85.958 µs (22.8%)
iast_TELEMETRY_OFF	481.471 µs [460.193 µs, 502.748 µs]	104.345 µs (27.7%)
tracing	450.256 µs [429.051 µs, 471.462 µs]	73.131 µs (19.4%)

Request duration reports for petclinic

gantt
title petclinic - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
dateFormat X
axisFormat %s
section baseline
no_agent (1.342 ms) : 1323, 1362
. : milestone, 1342,
appsec (1.752 ms) : 1728, 1776
. : milestone, 1752,
appsec_no_iast (1.748 ms) : 1724, 1772
. : milestone, 1748,
iast (1.506 ms) : 1481, 1530
. : milestone, 1506,
profiling (1.551 ms) : 1526, 1575
. : milestone, 1551,
tracing (1.489 ms) : 1465, 1514
. : milestone, 1489,
section candidate
no_agent (1.36 ms) : 1340, 1379
. : milestone, 1360,
appsec (1.741 ms) : 1717, 1765
. : milestone, 1741,
appsec_no_iast (1.743 ms) : 1720, 1766
. : milestone, 1743,
iast (1.509 ms) : 1486, 1533
. : milestone, 1509,
profiling (1.554 ms) : 1527, 1580
. : milestone, 1554,
tracing (1.488 ms) : 1464, 1512
. : milestone, 1488,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.342 ms [1.323 ms, 1.362 ms]	-
appsec	1.752 ms [1.728 ms, 1.776 ms]	409.929 µs (30.5%)
appsec_no_iast	1.748 ms [1.724 ms, 1.772 ms]	406.067 µs (30.3%)
iast	1.506 ms [1.481 ms, 1.53 ms]	163.609 µs (12.2%)
profiling	1.551 ms [1.526 ms, 1.575 ms]	208.48 µs (15.5%)
tracing	1.489 ms [1.465 ms, 1.514 ms]	147.268 µs (11.0%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.36 ms [1.34 ms, 1.379 ms]	-
appsec	1.741 ms [1.717 ms, 1.765 ms]	381.135 µs (28.0%)
appsec_no_iast	1.743 ms [1.72 ms, 1.766 ms]	383.422 µs (28.2%)
iast	1.509 ms [1.486 ms, 1.533 ms]	149.615 µs (11.0%)
profiling	1.554 ms [1.527 ms, 1.58 ms]	193.898 µs (14.3%)
tracing	1.488 ms [1.464 ms, 1.512 ms]	128.29 µs (9.4%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	sezen.leblay/APPSEC-55380-translateEscapes-propagation
git_commit_date	1737017707	1737017620
git_commit_sha	`9b06903`	`44f3db9`
release_version	1.46.0-SNAPSHOT~9b06903e18	1.46.0-SNAPSHOT~44f3db9c3a

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1737019640	1737019640
ci_job_id	768520200	768520200
ci_pipeline_id	53154263	53154263
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
variant	appsec	appsec

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 0 unstable metrics.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:dacapo:tomcat:appsec	better [-1.371ms; -1.042ms] or [-38.437%; -29.194%]	2.361ms	3.568ms

Execution time for tomcat

gantt
title tomcat - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
dateFormat X
axisFormat %s
section baseline
no_agent (1.468 ms) : 1457, 1480
. : milestone, 1468,
appsec (3.568 ms) : 3355, 3780
. : milestone, 3568,
iast (2.096 ms) : 2042, 2150
. : milestone, 2096,
iast_GLOBAL (2.15 ms) : 2095, 2205
. : milestone, 2150,
profiling (1.973 ms) : 1928, 2018
. : milestone, 1973,
tracing (1.937 ms) : 1895, 1979
. : milestone, 1937,
section candidate
no_agent (1.467 ms) : 1456, 1479
. : milestone, 1467,
appsec (2.361 ms) : 2318, 2404
. : milestone, 2361,
iast (2.106 ms) : 2052, 2160
. : milestone, 2106,
iast_GLOBAL (2.153 ms) : 2097, 2208
. : milestone, 2153,
profiling (1.971 ms) : 1928, 2015
. : milestone, 1971,
tracing (1.945 ms) : 1903, 1987
. : milestone, 1945,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.468 ms [1.457 ms, 1.48 ms]	-
appsec	3.568 ms [3.355 ms, 3.78 ms]	2.099 ms (143.0%)
iast	2.096 ms [2.042 ms, 2.15 ms]	627.827 µs (42.8%)
iast_GLOBAL	2.15 ms [2.095 ms, 2.205 ms]	681.753 µs (46.4%)
profiling	1.973 ms [1.928 ms, 2.018 ms]	504.626 µs (34.4%)
tracing	1.937 ms [1.895 ms, 1.979 ms]	468.676 µs (31.9%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.467 ms [1.456 ms, 1.479 ms]	-
appsec	2.361 ms [2.318 ms, 2.404 ms]	893.831 µs (60.9%)
iast	2.106 ms [2.052 ms, 2.16 ms]	638.614 µs (43.5%)
iast_GLOBAL	2.153 ms [2.097 ms, 2.208 ms]	685.235 µs (46.7%)
profiling	1.971 ms [1.928 ms, 2.015 ms]	504.051 µs (34.4%)
tracing	1.945 ms [1.903 ms, 1.987 ms]	477.963 µs (32.6%)

Execution time for biojava

gantt
title biojava - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
dateFormat X
axisFormat %s
section baseline
no_agent (15.218 s) : 15218000, 15218000
. : milestone, 15218000,
appsec (15.07 s) : 15070000, 15070000
. : milestone, 15070000,
iast (18.943 s) : 18943000, 18943000
. : milestone, 18943000,
iast_GLOBAL (18.095 s) : 18095000, 18095000
. : milestone, 18095000,
profiling (15.074 s) : 15074000, 15074000
. : milestone, 15074000,
tracing (15.208 s) : 15208000, 15208000
. : milestone, 15208000,
section candidate
no_agent (14.876 s) : 14876000, 14876000
. : milestone, 14876000,
appsec (15.2 s) : 15200000, 15200000
. : milestone, 15200000,
iast (18.861 s) : 18861000, 18861000
. : milestone, 18861000,
iast_GLOBAL (17.964 s) : 17964000, 17964000
. : milestone, 17964000,
profiling (14.935 s) : 14935000, 14935000
. : milestone, 14935000,
tracing (15.01 s) : 15010000, 15010000
. : milestone, 15010000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.218 s [15.218 s, 15.218 s]	-
appsec	15.07 s [15.07 s, 15.07 s]	-148.0 ms (-1.0%)
iast	18.943 s [18.943 s, 18.943 s]	3.725 s (24.5%)
iast_GLOBAL	18.095 s [18.095 s, 18.095 s]	2.877 s (18.9%)
profiling	15.074 s [15.074 s, 15.074 s]	-144.0 ms (-0.9%)
tracing	15.208 s [15.208 s, 15.208 s]	-10.0 ms (-0.1%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	14.876 s [14.876 s, 14.876 s]	-
appsec	15.2 s [15.2 s, 15.2 s]	324.0 ms (2.2%)
iast	18.861 s [18.861 s, 18.861 s]	3.985 s (26.8%)
iast_GLOBAL	17.964 s [17.964 s, 17.964 s]	3.088 s (20.8%)
profiling	14.935 s [14.935 s, 14.935 s]	59.0 ms (0.4%)
tracing	15.01 s [15.01 s, 15.01 s]	134.0 ms (0.9%)

* Use env-entry to add tags per webapp deployment * fix gradle file * Migrate to hasmethodadvice * exclude classes from coverage * codenarc * add more repos * jacoco * Update internal-api/src/main/java/datadog/trace/api/ClassloaderConfigurationOverrides.java Co-authored-by: Bruce Bujon <PerfectSlayer@users.noreply.github.com> * review * use our named * more coverage * Update internal-api/src/main/java/datadog/trace/api/ClassloaderConfigurationOverrides.java Co-authored-by: Stuart McCulloch <stuart.mcculloch@datadoghq.com> * Update internal-api/src/main/java/datadog/trace/api/ClassloaderConfigurationOverrides.java Co-authored-by: Stuart McCulloch <stuart.mcculloch@datadoghq.com> * review * add jmh * optimize * widen muzzle excludes * exclude lazy from branch coverage * clean * Do not set contextual service name if jee-split-by-deployment is not enabled --------- Co-authored-by: Bruce Bujon <PerfectSlayer@users.noreply.github.com> Co-authored-by: Stuart McCulloch <stuart.mcculloch@datadoghq.com>

…-propagation

manuel-alvarez-alvarez · 2025-01-13T13:08:48Z

+ if (rangesSelf.length == 0) {
+ return; // original string is not tainted
+ }
+ final Range[] newRanges = Ranges.forSubstring(0, result.length(), rangesSelf);


AFAIK the translateEscapes never changes the length of the original string (it's a 1to1 mapping). So I think it will be safe to just reuse original ranges array (rangesSelf)

…-propagation

Mariovido

You have some jobs in the pipeline failing, they must be green before merging :)

…-propagation

Mariovido

LGTM

manuel-alvarez-alvarez · 2025-01-15T14:20:44Z

+ given:
+ final taintedObjects = ctx.getTaintedObjects()
+ def self = addFromTaintFormat(taintedObjects, testString)
+ def result = self


Suggested change
def result = self
def result = self.translateEscapes()

manuel-alvarez-alvarez · 2025-01-15T14:22:12Z

+ return; // original string is not tainted
+ }
+ final Range[] rangesSelf = taintedSelf.getRanges();
+ if (rangesSelf.length == 0) {


Did you copy this from another method?, we shouldn't have tainted values without ranges (if it does not have ranges then it's not tainted 😓)

yes i did 😅

ValentinZakharov · 2025-01-15T16:57:30Z

+import datadog.smoketest.AbstractIast17SpringBootTest
+
+class IastSpringBootSmokeTest extends AbstractIast17SpringBootTest {
+}


Do we need empty test class?

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.cloud:google-cloud-datastore](https://github.com/googleapis/java-datastore) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.25.4` -> `2.26.0` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.45.2` -> `1.46.0` | | [com.datadoghq:dd-trace-ot](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.45.2` -> `1.46.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | --- ### Release Notes <details> <summary>googleapis/java-datastore (com.google.cloud:google-cloud-datastore)</summary> ### [`v2.26.0`](https://github.com/googleapis/java-datastore/blob/HEAD/CHANGELOG.md#2260-2025-01-29) ##### Features - Add firestoreInDatastoreMode for datastore emulator ([#1698](googleapis/java-datastore#1698)) ([50f106d](googleapis/java-datastore@50f106d)) ##### Dependencies - Update dependency com.google.cloud:sdk-platform-java-config to v3.42.0 ([#1725](googleapis/java-datastore#1725)) ([1cbaf22](googleapis/java-datastore@1cbaf22)) </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.46.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.46.0): 1.46.0 ##### Breaking Changes > \[!WARNING] > jnr-unixsocket is now an external dependency of dd-trace-ot and must be included when deploying dd-trace-ot. > \[!NOTE] > The API `TracerScope.setAsync(boolean)`, used to manually control asynchronous span propagation, does no more apply to the scope instance but to the active span scope. ##### Components ##### Application Security Management (IAST) - 🐛 Fix String.replace instrumentation for IAST ([#8281](DataDog/dd-trace-java#8281) - [@Mariovido](https://github.com/Mariovido)) - ✨ Apply the standard nomenclature to the stacktrace configs ([#8244](DataDog/dd-trace-java#8244) - [@jandro996](https://github.com/jandro996)) - 🐛 Exclude false positive weak randomness ([#8232](DataDog/dd-trace-java#8232) - [@jandro996](https://github.com/jandro996)) - ✨ Propagation of translateEscapes of String class ([#8186](DataDog/dd-trace-java#8186) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Add security control metrics ([#8175](DataDog/dd-trace-java#8175) - [@jandro996](https://github.com/jandro996)) - ✨ Increase IAST propagation to StringBuffer setLength ([#8128](DataDog/dd-trace-java#8128) - [@Mariovido](https://github.com/Mariovido)) - ✨ Add IAST taint tracking for DB values ([#8072](DataDog/dd-trace-java#8072) - [@Mariovido](https://github.com/Mariovido)) ##### Application Security Management (WAF) - 🐛 Prevents a NPE when there is no subscriber for user events ([#8258](DataDog/dd-trace-java#8258) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Apply the standard nomenclature to the stacktrace configs ([#8244](DataDog/dd-trace-java#8244) - [@jandro996](https://github.com/jandro996)) - 🐛 Ensure cached subscriptions are cleared on reconfiguration via RC ([#8229](DataDog/dd-trace-java#8229) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Add support for session tracking in Vertx ([#8167](DataDog/dd-trace-java#8167) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Create span tag: \_dd.appsec.rasp.timeout ([#8269](DataDog/dd-trace-java#8269) - [@Mariovido](https://github.com/Mariovido)) ##### Build & Tooling - 🐛 Ensure shaded helpers have unique names when injected into class-loaders ([#8192](DataDog/dd-trace-java#8192) - [@mcculls](https://github.com/mcculls)) ##### Configuration at Runtime - 🐛 Remove filtering of `DD_SERVICE` and `DD_ENV` from the tracer ([#8176](DataDog/dd-trace-java#8176) - [@mhlidd](https://github.com/mhlidd)) ##### Continuous Integration Visibility - 🧹 Generalize TestRetryPolicy to TestExecutionPolicy ([#8302](DataDog/dd-trace-java#8302) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Parallelize CI Visibility settings requests ([#8299](DataDog/dd-trace-java#8299) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Generalize test retry logic ([#8289](DataDog/dd-trace-java#8289) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Generalize tests skipping logic ([#8288](DataDog/dd-trace-java#8288) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Remove skip and shouldBeSkipped methods from TestEventsHandler in favor of isSkippable ([#8286](DataDog/dd-trace-java#8286) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨⚡ Optimize Git repository information computation ([#8270](DataDog/dd-trace-java#8270) - [@dougqh](https://github.com/dougqh)) - ✨ Always request known tests from the backend ([#8268](DataDog/dd-trace-java#8268) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Fix NPE when trying to get retry analyzer in Test NG ([#8253](DataDog/dd-trace-java#8253) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Set test framework and test framework version tags atomically ([#8252](DataDog/dd-trace-java#8252) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add debug logging to Android Gradle module layout logic ([#8251](DataDog/dd-trace-java#8251) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix source and destination folders computation for Android Gradle projects ([#8190](DataDog/dd-trace-java#8190) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add basic Scala Weaver sbt support ([#8189](DataDog/dd-trace-java#8189) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement impacted tests detection ([#8188](DataDog/dd-trace-java#8188) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) ##### Data Streams Monitoring - ✨ Change hash computation for protobuf to better represent impacting changes + save proto number in schema ([#8201](DataDog/dd-trace-java#8201) - [@vandonr](https://github.com/vandonr)) ##### Database Monitoring - Add peer service tag in dbm sql commenter ([#7913](DataDog/dd-trace-java#7913) - [@jordan-wong](https://github.com/jordan-wong)) ##### Dynamic Instrumentation - ✨ Add support for SymDB to scan directories ([#8306](DataDog/dd-trace-java#8306) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add SymDB report for any jar scanning failures ([#8300](DataDog/dd-trace-java#8300) - [@jpbempel](https://github.com/jpbempel)) - ✨ Use two budgets depending on type ([#8283](DataDog/dd-trace-java#8283) - [@evanchooly](https://github.com/evanchooly)) - ✨ Institute a 10 snapshot per probe per trace budget ([#8277](DataDog/dd-trace-java#8277) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Avoid double snapshots for Exception Replay ([#8273](DataDog/dd-trace-java#8273) - [@jpbempel](https://github.com/jpbempel)) - ✨ Simplify code origins. Separate out snapshot generation. ([#8263](DataDog/dd-trace-java#8263) - [@evanchooly](https://github.com/evanchooly)) - ✨ Add Exception probe custom instrumentation ([#8230](DataDog/dd-trace-java#8230) - [@jpbempel](https://github.com/jpbempel)) - ✨ Enhance log probes to honor debug session tags ([#8215](DataDog/dd-trace-java#8215) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Don't redact env tokens from debugger probe snapshots ([#8211](DataDog/dd-trace-java#8211) - [@watson](https://github.com/watson)) - ✨⚡ Move Trace/SpanId capture at commit time ([#8184](DataDog/dd-trace-java#8184) - [@jpbempel](https://github.com/jpbempel)) - 🐛 Capture values at entry for method probe ([#8169](DataDog/dd-trace-java#8169) - [@jpbempel](https://github.com/jpbempel)) ##### JMX fetch - 🐛 Mute JMXFetch Shutdown in progress error ([#8068](DataDog/dd-trace-java#8068) - [@ygree](https://github.com/ygree)) ##### OpenTracing - ⚠️🧹 Make jnr-unixsocket an explicit dependency of dd-trace-ot ([#8307](DataDog/dd-trace-java#8307) - [@mcculls](https://github.com/mcculls)) ##### Profiling - 🐛 Avoid unsupported API call for creating folders on windows ([#8304](DataDog/dd-trace-java#8304) - [@jbachorik](https://github.com/jbachorik)) - ✨ Tag profiles for serverless ([#8279](DataDog/dd-trace-java#8279) - [@jbachorik](https://github.com/jbachorik)) - ✨ add queue type and length to queue events ([#8242](DataDog/dd-trace-java#8242) - [@richardstartin](https://github.com/richardstartin)) - 🐛 TempLocationManager Fixes and Improvements ([#8191](DataDog/dd-trace-java#8191) - [@jbachorik](https://github.com/jbachorik)) - ✨ Bump ddprof to 1.18.0 ([#8173](DataDog/dd-trace-java#8173) - [@jbachorik](https://github.com/jbachorik)) - ✨ Report profiler initialization and configuration errors to telemetry ([#8171](DataDog/dd-trace-java#8171) - [@jbachorik](https://github.com/jbachorik)) ##### Telemetry - ✨ Add pending traces report in tracer flares ([#8053](DataDog/dd-trace-java#8053) - [@mhlidd](https://github.com/mhlidd)) ##### Testing - ✨ Test http server requests in parallel ([#8222](DataDog/dd-trace-java#8222) - [@amarziali](https://github.com/amarziali)) ##### Trace context propagation - ✨ Add non default propagator registration ([#8310](DataDog/dd-trace-java#8310) - [@PerfectSlayer](https://github.com/PerfectSlayer)) ##### Tracer core - ✨ Probe for existence of IBMSASL or ACCP security providers ([#8276](DataDog/dd-trace-java#8276) - [@mcculls](https://github.com/mcculls)) - ✨⚡ Overhead improvement to agent feedback based sampling ([#8265](DataDog/dd-trace-java#8265) - [@dougqh](https://github.com/dougqh)) - 🧹 Move async propagation API from scope to tracer ([#8231](DataDog/dd-trace-java#8231) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Introduce context propagation API ([#8161](DataDog/dd-trace-java#8161) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨🧪 Use env-entry to add tags per webapp deployment ([#8138](DataDog/dd-trace-java#8138) - [@amarziali](https://github.com/amarziali)) - ✨ Introduce context helpers API ([#8134](DataDog/dd-trace-java#8134) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Support IPv6 values for `DD_AGENT_HOST` and `DD_TRACE_AGENT_URL` ([#7984](DataDog/dd-trace-java#7984) - [@mhlidd](https://github.com/mhlidd)) ##### Instrumentations ##### Apache HttpComponents - 🐛 Properly finish spans and support latest apache httpclient5 ([#8272](DataDog/dd-trace-java#8272) - [@amarziali](https://github.com/amarziali)) ##### AWS Lambda instrumentation - 🐛 Properly capture lambda payloads for all handler types. ([#8264](DataDog/dd-trace-java#8264) - [@purple4reina](https://github.com/purple4reina)) ##### AWS S3 instrumentation - 💡 Create S3 instrumentation + add span pointers ([#8075](DataDog/dd-trace-java#8075) - [@nhulston](https://github.com/nhulston)) ##### AWS SDK instrumentation - 🐛 Revert "Add avoid double instrumenting lambda non-streaming handlers." ([#8247](DataDog/dd-trace-java#8247) - [@nhulston](https://github.com/nhulston)) ##### Cassandra - ✨ Allow extracting keyspace from statement result ([#8239](DataDog/dd-trace-java#8239) - [@amarziali](https://github.com/amarziali)) ##### Core Java language instrumentation - ✨ Propagation of translateEscapes of String class ([#8186](DataDog/dd-trace-java#8186) - [@sezen-datadog](https://github.com/sezen-datadog)) ##### Eclipse Vert.x instrumentation - 🐛 Fix vertx worker propagation and error handling ([#8237](DataDog/dd-trace-java#8237) - [@amarziali](https://github.com/amarziali)) - ✨ Support vertx 5 ([#8220](DataDog/dd-trace-java#8220) - [@amarziali](https://github.com/amarziali)) - ✨ Add support for session tracking in Vertx ([#8167](DataDog/dd-trace-java#8167) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) ##### Kafka instrumentation - 🐛 Prevent possible NPE calculating Kafka record header size ([#8292](DataDog/dd-trace-java#8292) - [@ygree](https://github.com/ygree)) ##### Mule instrumentation - 🐛 Fix crash using Mule with JPMS ([#8187](DataDog/dd-trace-java#8187) - [@amarziali](https://github.com/amarziali)) ##### Protocol Buffer instrumentation - ✨ Change hash computation for protobuf to better represent impacting changes + save proto number in schema ([#8201](DataDog/dd-trace-java#8201) - [@vandonr](https://github.com/vandonr)) ##### Spring instrumentation - 🐛 Preserve getQualifier from spring scheduling runnables ([#8293](DataDog/dd-trace-java#8293) - [@amarziali](https://github.com/amarziali)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: bb09d47e4eed77a003f630273b4d0a84003eb899

sezen-datadog added 7 commits January 10, 2025 11:40

APPSEC-55380 String taint tracking: translateEscapes
fdda8e1

TU correction
edbd4c1

non null correction
91f4b56

builds
d794020

add module to StringCallSiteTest
1d28044

add module to StringCallSiteTest
e16856d

smoke test
fe5078c

sezen-datadog requested review from a team as code owners January 13, 2025 10:17

sezen-datadog requested review from ValentinZakharov and smola January 13, 2025 10:17

sezen-datadog requested review from Mariovido and manuel-alvarez-alvarez January 13, 2025 10:18

smola marked this pull request as draft January 13, 2025 10:19

sezen-datadog changed the title ~~DRAFT APPSEC-55380 Propagation of translateEscapes of String class~~ Propagation of translateEscapes of String classJan 13, 2025

settings correction
33d3163

sezen-datadogand others added 5 commits January 13, 2025 12:14

test unicode added
94fb227

fix github issue creation (#8179)
00c8cd0

Skip jacoco coverage for internal class (#8183)
542f3b8

Merge branch 'master' into sezen.leblay/APPSEC-55380-translateEscapes…
19bafcb
…-propagation

manuel-alvarez-alvarez reviewed Jan 13, 2025
View reviewed changes

sezen-datadog added 2 commits January 13, 2025 14:57

smoke test spring boot for jv17
3c388a5

whoops
70db9f3

smola added the comp: asm iast Application Security Management (IAST) label Jan 13, 2025

unit test
1037009

sezen-datadog marked this pull request as ready for review January 13, 2025 16:00

sezen-datadog added the type: feature Enhancements and improvements label Jan 14, 2025

Merge branch 'master' into sezen.leblay/APPSEC-55380-translateEscapes…
977bff8
…-propagation

Mariovido reviewed Jan 14, 2025
View reviewed changes

Comment thread...g-15/src/test/groovy/datadog/trace/instrumentation/java/lang/jdk15/StringCallSiteTest.groovy Outdated

Mariovido suggested changes Jan 14, 2025
View reviewed changes

sezen-datadog added 3 commits January 14, 2025 10:24

unit test suppression of equal
ca67979

mario's idea for j17 tests
b8c0685

mario's idea for j17 tests
30c46d4

sezen-datadog marked this pull request as draft January 14, 2025 13:30

sezen-datadog added 2 commits January 14, 2025 15:25

a few more tests
378bd84

Merge branch 'master' into sezen.leblay/APPSEC-55380-translateEscapes…
65ee3e0
…-propagation

sezen-datadog marked this pull request as ready for review January 15, 2025 10:11

Mariovido reviewed Jan 15, 2025
View reviewed changes

Comment thread...l/iast-util-17/src/testFixtures/groovy/datadog/smoketest/AbstractIast17SpringBootTest.groovy Outdated

Mariovido reviewed Jan 15, 2025
View reviewed changes

Comment thread...g-15/src/test/groovy/datadog/trace/instrumentation/java/lang/jdk15/StringCallSiteTest.groovy Outdated

Mariovido approved these changes Jan 15, 2025
View reviewed changes

sezen-datadog added 2 commits January 15, 2025 14:38

fix formatting
13965a7

fix formatting
4956aeb

manuel-alvarez-alvarez reviewed Jan 15, 2025
View reviewed changes

pr comments
6013e2a

ValentinZakharov reviewed Jan 15, 2025
View reviewed changes

sezen-datadog added 2 commits January 16, 2025 09:45

revert StringModuleTest.groovy
28db26f

add ignore to string translate escapes test if version less than 15
44f3db9

sezen-datadog added comp: api Tracer public API and removed comp: api Tracer public API labels Jan 16, 2025

manuel-alvarez-alvarez approved these changes Jan 16, 2025
View reviewed changes

sezen-datadog merged commit 679f9e2 into masterJan 16, 2025

sezen-datadog deleted the sezen.leblay/APPSEC-55380-translateEscapes-propagation branch January 16, 2025 15:12

github-actionsBot added this to the 1.46.0 milestone Jan 16, 2025

Navigation Menu

Uh oh!

Propagation of translateEscapes of String class - #8186

Propagation of translateEscapes of String class#8186
sezen-datadog merged 27 commits into
masterfrom
sezen.leblay/APPSEC-55380-translateEscapes-propagation

sezen-datadog commented Jan 13, 2025•
edited
Loading

Uh oh!

github-actionsBot commented Jan 13, 2025•
edited
Loading

Uh oh!

pr-commenterBot commented Jan 13, 2025•
edited
Loading

Uh oh!

manuel-alvarez-alvarezJan 13, 2025

Uh oh!

Uh oh!

Mariovido left a comment

Uh oh!

Uh oh!

Uh oh!

Mariovido left a comment

Uh oh!

manuel-alvarez-alvarezJan 15, 2025

Uh oh!

manuel-alvarez-alvarezJan 15, 2025

Uh oh!

sezen-datadogJan 15, 2025

Uh oh!

ValentinZakharovJan 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Uh oh!

Conversation

sezen-datadog commented Jan 13, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

github-actionsBot commented Jan 13, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pr-commenterBot commented Jan 13, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

manuel-alvarez-alvarezJan 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mariovido left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Mariovido left a comment

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarezJan 15, 2025

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarezJan 15, 2025

Choose a reason for hiding this comment

Uh oh!

sezen-datadogJan 15, 2025

Choose a reason for hiding this comment

Uh oh!

ValentinZakharovJan 15, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

sezen-datadog commented Jan 13, 2025•
edited
Loading

github-actionsBot commented Jan 13, 2025•
edited
Loading

pr-commenterBot commented Jan 13, 2025•
edited
Loading