Uh oh!
There was an error while loading. Please reload this page.
🍒 8885, 8952 - Optimize IAST Vulnerability Detection... - #9241
Closed
sarahchen6 wants to merge 2 commits into
Closed
🍒 8885, 8952 - Optimize IAST Vulnerability Detection...#9241sarahchen6 wants to merge 2 commits into
sarahchen6 wants to merge 2 commits into
Conversation
What Does This Do Implements the new algorithm for detecting IAST vulnerabilities, where vulnerabilities that were already explored in previous runs for a given endpoint are skipped, ensuring that all remaining ones are eventually explored. This addresses the current limitation where only the first matching vulnerabilities are consistently reported, causing others to remain hidden. Changes to OverheadContext The OverheadContext class has been extended to support three separate tracking maps: globalMap Used to track vulnerability detection counts per endpoint across all requests. Keys are strings combining the request method and route (GET /login, POST /submit, etc.). Values are maps from vulnerabilityType → int (count of occurrences). Capped at 4,096 entries using a clear‐on‐overflow strategy, to ensure bounded memory usage. Oldest entries are cleared once the limit is reached. copyMap Created per request to copy the global counts at the start of the request, ensuring a consistent baseline to compare against throughout the lifecycle of the request. requestMap Tracks vulnerability type counts within the request. An additional field, isGlobal, has been added to indicate whether the context is global or request-scoped. If isGlobal is true, the maps are not used, and quota checks proceed using the global strategy only. A new method, resetMaps(), has been added to update globalMap when the request ends and vulnerability data has been reported. Two scenarios are supported: Case 1: Budget not fully used → The entry for the endpoint in globalMap is cleared, since the request stayed within budget. Case 2: Budget fully used → The counts from requestMap are compared to those in copyMap. For each vulnerability type, if the value in requestMap is greater, it is used to update the corresponding entry in globalMap. Changes to OverheadController The method consumeQuota() has been extended to receive a vulnerabilityType and modified to support the new logic: If an OverheadContext is present and not global, and there is remaining quota and a valid span, the controller now invokes a new method maybeSkipVulnerability() to determine whether quota should actually be consumed or not, based on endpoint-specific history. It's better to check the Algorithm execution example flow diagram to understand how this should work Changes to IastRequestContext In releaseRequestContext(), the request now calls resetMaps() on the associated OverheadContext, ensuring globalMap is updated at the end of each request. Motivation [RFC-1029] Optimizing IAST Vulnerability Detection implementation Additional Notes java tracer needs to implement also [RFC-1029-A1] Solution for dynamic http routes (cherry picked from commit 99ecab7)
BenchmarksStartupParameters
See matching parameters
SummaryFound 9 performance improvements and 4 performance regressions! Performance is the same for 24 metrics, 16 unstable metrics.
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.51.0-SNAPSHOT~c7b14171e2, baseline=1.51.1-SNAPSHOT~b94ca598bb
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.045 s) : 0, 1045149
Total [baseline] (10.718 s) : 0, 10718219
Agent [candidate] (1.036 s) : 0, 1035976
Total [candidate] (10.738 s) : 0, 10737617
section appsec
Agent [baseline] (1.227 s) : 0, 1227069
Total [baseline] (10.835 s) : 0, 10835231
Agent [candidate] (1.183 s) : 0, 1182673
Total [candidate] (10.822 s) : 0, 10821662
section iast
Agent [baseline] (1.174 s) : 0, 1174200
Total [baseline] (10.871 s) : 0, 10871109
Agent [candidate] (1.156 s) : 0, 1155613
Total [candidate] (10.94 s) : 0, 10940183
section profiling
Agent [baseline] (1.191 s) : 0, 1190659
Total [baseline] (10.812 s) : 0, 10812471
Agent [candidate] (1.276 s) : 0, 1275865
Total [candidate] (11.006 s) : 0, 11006233
gantt
title petclinic - break down per module: candidate=1.51.0-SNAPSHOT~c7b14171e2, baseline=1.51.1-SNAPSHOT~b94ca598bb
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (731.419 ms) : 0, 731419
BytebuddyAgent [candidate] (694.038 ms) : 0, 694038
GlobalTracer [baseline] (241.706 ms) : 0, 241706
GlobalTracer [candidate] (244.687 ms) : 0, 244687
AppSec [baseline] (30.41 ms) : 0, 30410
AppSec [candidate] (57.18 ms) : 0, 57180
Debugger [baseline] (5.978 ms) : 0, 5978
Debugger [candidate] (7.791 ms) : 0, 7791
Remote Config [baseline] (649.344 µs) : 0, 649
Remote Config [candidate] (688.191 µs) : 0, 688
Telemetry [baseline] (12.54 ms) : 0, 12540
Telemetry [candidate] (10.486 ms) : 0, 10486
crashtracking [baseline] (1.43 ms) : 0, 1430
section appsec
BytebuddyAgent [baseline] (758.066 ms) : 0, 758066
BytebuddyAgent [candidate] (711.166 ms) : 0, 711166
GlobalTracer [baseline] (235.976 ms) : 0, 235976
GlobalTracer [candidate] (236.743 ms) : 0, 236743
IAST [baseline] (23.732 ms) : 0, 23732
IAST [candidate] (23.218 ms) : 0, 23218
AppSec [baseline] (169.463 ms) : 0, 169463
AppSec [candidate] (176.756 ms) : 0, 176756
Debugger [baseline] (8.005 ms) : 0, 8005
Debugger [candidate] (5.941 ms) : 0, 5941
Remote Config [baseline] (629.587 µs) : 0, 630
Remote Config [candidate] (615.958 µs) : 0, 616
Telemetry [baseline] (8.371 ms) : 0, 8371
Telemetry [candidate] (7.322 ms) : 0, 7322
crashtracking [baseline] (1.437 ms) : 0, 1437
section iast
BytebuddyAgent [baseline] (846.952 ms) : 0, 846952
BytebuddyAgent [candidate] (806.986 ms) : 0, 806986
GlobalTracer [baseline] (231.946 ms) : 0, 231946
GlobalTracer [candidate] (232.343 ms) : 0, 232343
IAST [baseline] (28.409 ms) : 0, 28409
IAST [candidate] (29.818 ms) : 0, 29818
AppSec [baseline] (27.366 ms) : 0, 27366
AppSec [candidate] (50.807 ms) : 0, 50807
Debugger [baseline] (8.335 ms) : 0, 8335
Debugger [candidate] (5.962 ms) : 0, 5962
Remote Config [baseline] (580.966 µs) : 0, 581
Remote Config [candidate] (637.845 µs) : 0, 638
Telemetry [baseline] (8.121 ms) : 0, 8121
Telemetry [candidate] (8.215 ms) : 0, 8215
crashtracking [baseline] (1.433 ms) : 0, 1433
section profiling
BytebuddyAgent [baseline] (758.813 ms) : 0, 758813
BytebuddyAgent [candidate] (679.583 ms) : 0, 679583
GlobalTracer [baseline] (220.911 ms) : 0, 220911
GlobalTracer [candidate] (363.212 ms) : 0, 363212
AppSec [baseline] (30.137 ms) : 0, 30137
AppSec [candidate] (61.972 ms) : 0, 61972
Debugger [baseline] (6.206 ms) : 0, 6206
Debugger [candidate] (6.181 ms) : 0, 6181
Remote Config [baseline] (697.525 µs) : 0, 698
Remote Config [candidate] (700.582 µs) : 0, 701
Telemetry [baseline] (15.77 ms) : 0, 15770
Telemetry [candidate] (8.279 ms) : 0, 8279
crashtracking [baseline] (1.402 ms) : 0, 1402
ProfilingAgent [baseline] (108.078 ms) : 0, 108078
ProfilingAgent [candidate] (107.178 ms) : 0, 107178
Profiling [baseline] (108.102 ms) : 0, 108102
Profiling [candidate] (107.202 ms) : 0, 107202
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.51.0-SNAPSHOT~c7b14171e2, baseline=1.51.1-SNAPSHOT~b94ca598bb
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.044 s) : 0, 1044475
Total [baseline] (8.613 s) : 0, 8613317
Agent [candidate] (1.026 s) : 0, 1026312
Total [candidate] (8.573 s) : 0, 8573188
section iast
Agent [baseline] (1.179 s) : 0, 1179426
Total [baseline] (9.33 s) : 0, 9330057
Agent [candidate] (1.163 s) : 0, 1163010
Total [candidate] (9.259 s) : 0, 9258658
gantt
title insecure-bank - break down per module: candidate=1.51.0-SNAPSHOT~c7b14171e2, baseline=1.51.1-SNAPSHOT~b94ca598bb
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (731.897 ms) : 0, 731897
BytebuddyAgent [candidate] (686.873 ms) : 0, 686873
GlobalTracer [baseline] (242.369 ms) : 0, 242369
GlobalTracer [candidate] (242.937 ms) : 0, 242937
AppSec [baseline] (30.403 ms) : 0, 30403
AppSec [candidate] (58.92 ms) : 0, 58920
Debugger [baseline] (6.011 ms) : 0, 6011
Debugger [candidate] (7.015 ms) : 0, 7015
Remote Config [baseline] (659.049 µs) : 0, 659
Remote Config [candidate] (667.289 µs) : 0, 667
Telemetry [baseline] (10.693 ms) : 0, 10693
Telemetry [candidate] (8.997 ms) : 0, 8997
crashtracking [baseline] (1.441 ms) : 0, 1441
section iast
BytebuddyAgent [baseline] (850.278 ms) : 0, 850278
BytebuddyAgent [candidate] (812.854 ms) : 0, 812854
GlobalTracer [baseline] (233.633 ms) : 0, 233633
GlobalTracer [candidate] (233.315 ms) : 0, 233315
IAST [baseline] (27.638 ms) : 0, 27638
IAST [candidate] (28.557 ms) : 0, 28557
AppSec [baseline] (30.037 ms) : 0, 30037
AppSec [candidate] (52.624 ms) : 0, 52624
Debugger [baseline] (6.632 ms) : 0, 6632
Debugger [candidate] (5.978 ms) : 0, 5978
Remote Config [baseline] (590.85 µs) : 0, 591
Remote Config [candidate] (606.337 µs) : 0, 606
Telemetry [baseline] (8.158 ms) : 0, 8158
Telemetry [candidate] (8.166 ms) : 0, 8166
crashtracking [baseline] (1.428 ms) : 0, 1428
LoadParameters
See matching parameters
SummaryFound 4 performance improvements and 1 performance regressions! Performance is the same for 7 metrics, 12 unstable metrics.
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.51.0-SNAPSHOT~c7b14171e2, baseline=1.51.1-SNAPSHOT~b94ca598bb
dateFormat X
axisFormat %s
section baseline
no_agent (4.269 ms) : 4220, 4317
. : milestone, 4269,
iast (9.165 ms) : 9015, 9315
. : milestone, 9165,
iast_FULL (13.831 ms) : 13559, 14103
. : milestone, 13831,
iast_GLOBAL (10.365 ms) : 10181, 10548
. : milestone, 10365,
profiling (8.705 ms) : 8564, 8846
. : milestone, 8705,
tracing (7.378 ms) : 7274, 7483
. : milestone, 7378,
section candidate
no_agent (4.279 ms) : 4225, 4333
. : milestone, 4279,
iast (9.354 ms) : 9201, 9506
. : milestone, 9354,
iast_FULL (13.558 ms) : 13288, 13828
. : milestone, 13558,
iast_GLOBAL (10.239 ms) : 10060, 10418
. : milestone, 10239,
profiling (8.817 ms) : 8682, 8952
. : milestone, 8817,
tracing (7.722 ms) : 7604, 7839
. : milestone, 7722,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.51.0-SNAPSHOT~c7b14171e2, baseline=1.51.1-SNAPSHOT~b94ca598bb
dateFormat X
axisFormat %s
section baseline
no_agent (37.7 ms) : 37399, 38000
. : milestone, 37700,
appsec (50.212 ms) : 49763, 50662
. : milestone, 50212,
code_origins (45.271 ms) : 44875, 45668
. : milestone, 45271,
iast (46.128 ms) : 45743, 46513
. : milestone, 46128,
profiling (49.323 ms) : 48845, 49802
. : milestone, 49323,
tracing (45.436 ms) : 45056, 45817
. : milestone, 45436,
section candidate
no_agent (37.264 ms) : 36960, 37568
. : milestone, 37264,
appsec (47.833 ms) : 47419, 48247
. : milestone, 47833,
code_origins (44.301 ms) : 43934, 44667
. : milestone, 44301,
iast (44.422 ms) : 44018, 44826
. : milestone, 44422,
profiling (47.203 ms) : 46785, 47621
. : milestone, 47203,
tracing (43.733 ms) : 43378, 44087
. : milestone, 43733,
DacapoParameters
See matching parameters
SummaryFound 1 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 0 unstable metrics.
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.51.0-SNAPSHOT~c7b14171e2, baseline=1.51.1-SNAPSHOT~b94ca598bb
dateFormat X
axisFormat %s
section baseline
no_agent (1.478 ms) : 1466, 1489
. : milestone, 1478,
appsec (3.64 ms) : 3426, 3853
. : milestone, 3640,
iast (2.228 ms) : 2165, 2292
. : milestone, 2228,
iast_GLOBAL (2.276 ms) : 2211, 2340
. : milestone, 2276,
profiling (2.082 ms) : 2029, 2135
. : milestone, 2082,
tracing (2.039 ms) : 1990, 2088
. : milestone, 2039,
section candidate
no_agent (1.487 ms) : 1476, 1499
. : milestone, 1487,
appsec (2.435 ms) : 2385, 2485
. : milestone, 2435,
iast (2.218 ms) : 2155, 2280
. : milestone, 2218,
iast_GLOBAL (2.256 ms) : 2193, 2319
. : milestone, 2256,
profiling (2.053 ms) : 2003, 2104
. : milestone, 2053,
tracing (2.03 ms) : 1982, 2078
. : milestone, 2030,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.51.0-SNAPSHOT~c7b14171e2, baseline=1.51.1-SNAPSHOT~b94ca598bb
dateFormat X
axisFormat %s
section baseline
no_agent (15.003 s) : 15003000, 15003000
. : milestone, 15003000,
appsec (14.854 s) : 14854000, 14854000
. : milestone, 14854000,
iast (18.864 s) : 18864000, 18864000
. : milestone, 18864000,
iast_GLOBAL (18.183 s) : 18183000, 18183000
. : milestone, 18183000,
profiling (15.319 s) : 15319000, 15319000
. : milestone, 15319000,
tracing (14.81 s) : 14810000, 14810000
. : milestone, 14810000,
section candidate
no_agent (15.274 s) : 15274000, 15274000
. : milestone, 15274000,
appsec (14.92 s) : 14920000, 14920000
. : milestone, 14920000,
iast (19.13 s) : 19130000, 19130000
. : milestone, 19130000,
iast_GLOBAL (17.846 s) : 17846000, 17846000
. : milestone, 17846000,
profiling (15.815 s) : 15815000, 15815000
. : milestone, 15815000,
tracing (14.884 s) : 14884000, 14884000
. : milestone, 14884000,
|
manuel-alvarez-alvarez
approved these changes
Jul 24, 2025
sarahchen6
commented
Jul 24, 2025
ContributorAuthor
We no longer need to proceed with the 1.50.2 release. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backports #8885 and #8952 to release/v1.50.x