Conversation
Contributor
|
Hi! 👋 Looks like you updated a Git Submodule.
|
jandro996
added
type: enhancement
…est.body.files_content Introduces a new AppSec WAF address `server.request.body.files_content` (`List<String>`) that exposes the content of each uploaded file in a multipart/form-data request. Entries correspond positionally to the existing `server.request.body.filenames` address. Content is capped at 4 096 bytes per file (ISO-8859-1) to keep memory usage bounded. Changes: - KnownAddresses: add REQUEST_FILES_CONTENT + forName() case - Events: add requestFilesContent event (ID 31); FILE_WRITTEN bumped to 32 - InstrumentationGateway: register the new BiFunction case - GatewayBridge: add onRequestFilesContent handler + DATA_DEPENDENCIES entry - CommonsFileUploadAppSecModule: after firing filenames, fire content (skipped when the filenames event already blocked the request) - Unit tests: GatewayBridgeSpecification, GatewayBridgeIGRegistrationSpecification, KnownAddressesSpecificationForkedTest - Smoke test: 'block request based on malicious file upload content' verifies end-to-end blocking via a custom WAF rule on the new address Closes APPSEC-61875
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61875-file-upload-content
branch
from
0de9320 to
37e7d09
Compare
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 58 metrics, 13 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~2076c7b858, baseline=1.62.0-SNAPSHOT~42f154d2f6
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.056 s) : 0, 1056010
Total [baseline] (8.801 s) : 0, 8800870
Agent [candidate] (1.055 s) : 0, 1054887
Total [candidate] (8.824 s) : 0, 8824192
section iast
Agent [baseline] (1.229 s) : 0, 1229264
Total [baseline] (9.567 s) : 0, 9566758
Agent [candidate] (1.225 s) : 0, 1224859
Total [candidate] (9.555 s) : 0, 9555170
gantt
title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~2076c7b858, baseline=1.62.0-SNAPSHOT~42f154d2f6
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.231 ms) : 0, 1231
crashtracking [candidate] (1.212 ms) : 0, 1212
BytebuddyAgent [baseline] (632.776 ms) : 0, 632776
BytebuddyAgent [candidate] (632.056 ms) : 0, 632056
AgentMeter [baseline] (29.666 ms) : 0, 29666
AgentMeter [candidate] (29.364 ms) : 0, 29364
GlobalTracer [baseline] (249.383 ms) : 0, 249383
GlobalTracer [candidate] (248.093 ms) : 0, 248093
AppSec [baseline] (32.604 ms) : 0, 32604
AppSec [candidate] (32.28 ms) : 0, 32280
Debugger [baseline] (59.113 ms) : 0, 59113
Debugger [candidate] (58.901 ms) : 0, 58901
Remote Config [baseline] (587.641 µs) : 0, 588
Remote Config [candidate] (591.474 µs) : 0, 591
Telemetry [baseline] (7.992 ms) : 0, 7992
Telemetry [candidate] (8.046 ms) : 0, 8046
Flare Poller [baseline] (6.569 ms) : 0, 6569
Flare Poller [candidate] (8.153 ms) : 0, 8153
section iast
crashtracking [baseline] (1.254 ms) : 0, 1254
crashtracking [candidate] (1.232 ms) : 0, 1232
BytebuddyAgent [baseline] (806.457 ms) : 0, 806457
BytebuddyAgent [candidate] (802.484 ms) : 0, 802484
AgentMeter [baseline] (11.478 ms) : 0, 11478
AgentMeter [candidate] (11.414 ms) : 0, 11414
GlobalTracer [baseline] (239.313 ms) : 0, 239313
GlobalTracer [candidate] (238.895 ms) : 0, 238895
IAST [baseline] (26.626 ms) : 0, 26626
IAST [candidate] (25.835 ms) : 0, 25835
AppSec [baseline] (29.015 ms) : 0, 29015
AppSec [candidate] (33.621 ms) : 0, 33621
Debugger [baseline] (61.347 ms) : 0, 61347
Debugger [candidate] (59.317 ms) : 0, 59317
Remote Config [baseline] (519.55 µs) : 0, 520
Remote Config [candidate] (1.73 ms) : 0, 1730
Telemetry [baseline] (13.376 ms) : 0, 13376
Telemetry [candidate] (10.562 ms) : 0, 10562
Flare Poller [baseline] (3.425 ms) : 0, 3425
Flare Poller [candidate] (3.457 ms) : 0, 3457
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~2076c7b858, baseline=1.62.0-SNAPSHOT~42f154d2f6
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.056 s) : 0, 1055642
Total [baseline] (11.054 s) : 0, 11053859
Agent [candidate] (1.064 s) : 0, 1063780
Total [candidate] (11.073 s) : 0, 11072765
section appsec
Agent [baseline] (1.249 s) : 0, 1248628
Total [baseline] (11.15 s) : 0, 11150035
Agent [candidate] (1.247 s) : 0, 1247077
Total [candidate] (11.227 s) : 0, 11226861
section iast
Agent [baseline] (1.222 s) : 0, 1222270
Total [baseline] (11.351 s) : 0, 11351259
Agent [candidate] (1.23 s) : 0, 1229792
Total [candidate] (11.214 s) : 0, 11214205
section profiling
Agent [baseline] (1.191 s) : 0, 1191111
Total [baseline] (11.184 s) : 0, 11184434
Agent [candidate] (1.187 s) : 0, 1186505
Total [candidate] (11.099 s) : 0, 11099289
gantt
title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~2076c7b858, baseline=1.62.0-SNAPSHOT~42f154d2f6
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.232 ms) : 0, 1232
crashtracking [candidate] (1.237 ms) : 0, 1237
BytebuddyAgent [baseline] (630.999 ms) : 0, 630999
BytebuddyAgent [candidate] (634.802 ms) : 0, 634802
AgentMeter [baseline] (29.325 ms) : 0, 29325
AgentMeter [candidate] (29.454 ms) : 0, 29454
GlobalTracer [baseline] (248.174 ms) : 0, 248174
GlobalTracer [candidate] (250.178 ms) : 0, 250178
AppSec [baseline] (32.181 ms) : 0, 32181
AppSec [candidate] (32.448 ms) : 0, 32448
Debugger [baseline] (59.821 ms) : 0, 59821
Debugger [candidate] (60.222 ms) : 0, 60222
Remote Config [baseline] (595.27 µs) : 0, 595
Remote Config [candidate] (596.699 µs) : 0, 597
Telemetry [baseline] (8.05 ms) : 0, 8050
Telemetry [candidate] (8.152 ms) : 0, 8152
Flare Poller [baseline] (9.088 ms) : 0, 9088
Flare Poller [candidate] (10.493 ms) : 0, 10493
section appsec
crashtracking [baseline] (1.234 ms) : 0, 1234
crashtracking [candidate] (1.216 ms) : 0, 1216
BytebuddyAgent [baseline] (661.596 ms) : 0, 661596
BytebuddyAgent [candidate] (661.117 ms) : 0, 661117
AgentMeter [baseline] (12.104 ms) : 0, 12104
AgentMeter [candidate] (12.035 ms) : 0, 12035
GlobalTracer [baseline] (249.068 ms) : 0, 249068
GlobalTracer [candidate] (248.577 ms) : 0, 248577
IAST [baseline] (24.58 ms) : 0, 24580
IAST [candidate] (24.627 ms) : 0, 24627
AppSec [baseline] (185.044 ms) : 0, 185044
AppSec [candidate] (184.686 ms) : 0, 184686
Debugger [baseline] (65.947 ms) : 0, 65947
Debugger [candidate] (65.997 ms) : 0, 65997
Remote Config [baseline] (627.366 µs) : 0, 627
Remote Config [candidate] (609.841 µs) : 0, 610
Telemetry [baseline] (8.485 ms) : 0, 8485
Telemetry [candidate] (8.381 ms) : 0, 8381
Flare Poller [baseline] (3.535 ms) : 0, 3535
Flare Poller [candidate] (3.536 ms) : 0, 3536
section iast
crashtracking [baseline] (1.234 ms) : 0, 1234
crashtracking [candidate] (1.223 ms) : 0, 1223
BytebuddyAgent [baseline] (799.969 ms) : 0, 799969
BytebuddyAgent [candidate] (804.544 ms) : 0, 804544
AgentMeter [baseline] (11.382 ms) : 0, 11382
AgentMeter [candidate] (11.464 ms) : 0, 11464
GlobalTracer [baseline] (238.643 ms) : 0, 238643
GlobalTracer [candidate] (240.44 ms) : 0, 240440
IAST [baseline] (25.742 ms) : 0, 25742
IAST [candidate] (26.7 ms) : 0, 26700
AppSec [baseline] (32.787 ms) : 0, 32787
AppSec [candidate] (31.343 ms) : 0, 31343
Debugger [baseline] (59.402 ms) : 0, 59402
Debugger [candidate] (61.575 ms) : 0, 61575
Remote Config [baseline] (550.043 µs) : 0, 550
Remote Config [candidate] (2.911 ms) : 0, 2911
Telemetry [baseline] (12.933 ms) : 0, 12933
Telemetry [candidate] (9.965 ms) : 0, 9965
Flare Poller [baseline] (3.495 ms) : 0, 3495
Flare Poller [candidate] (3.435 ms) : 0, 3435
section profiling
crashtracking [baseline] (1.188 ms) : 0, 1188
crashtracking [candidate] (1.169 ms) : 0, 1169
BytebuddyAgent [baseline] (696.235 ms) : 0, 696235
BytebuddyAgent [candidate] (692.971 ms) : 0, 692971
AgentMeter [baseline] (9.149 ms) : 0, 9149
AgentMeter [candidate] (9.128 ms) : 0, 9128
GlobalTracer [baseline] (207.797 ms) : 0, 207797
GlobalTracer [candidate] (207.633 ms) : 0, 207633
AppSec [baseline] (32.907 ms) : 0, 32907
AppSec [candidate] (32.864 ms) : 0, 32864
Debugger [baseline] (66.033 ms) : 0, 66033
Debugger [candidate] (65.793 ms) : 0, 65793
Remote Config [baseline] (578.699 µs) : 0, 579
Remote Config [candidate] (575.981 µs) : 0, 576
Telemetry [baseline] (7.812 ms) : 0, 7812
Telemetry [candidate] (7.761 ms) : 0, 7761
Flare Poller [baseline] (3.58 ms) : 0, 3580
Flare Poller [candidate] (3.541 ms) : 0, 3541
ProfilingAgent [baseline] (94.233 ms) : 0, 94233
ProfilingAgent [candidate] (93.823 ms) : 0, 93823
Profiling [baseline] (94.796 ms) : 0, 94796
Profiling [candidate] (94.393 ms) : 0, 94393
LoadParameters
See matching parameters
SummaryFound 2 performance improvements and 3 performance regressions! Performance is the same for 15 metrics, 16 unstable metrics.
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~2076c7b858, baseline=1.62.0-SNAPSHOT~42f154d2f6
dateFormat X
axisFormat %s
section baseline
no_agent (1.227 ms) : 1216, 1238
. : milestone, 1227,
iast (3.349 ms) : 3301, 3396
. : milestone, 3349,
iast_FULL (6.049 ms) : 5988, 6111
. : milestone, 6049,
iast_GLOBAL (3.675 ms) : 3620, 3730
. : milestone, 3675,
profiling (2.336 ms) : 2313, 2359
. : milestone, 2336,
tracing (2.088 ms) : 2070, 2107
. : milestone, 2088,
section candidate
no_agent (1.242 ms) : 1230, 1253
. : milestone, 1242,
iast (3.456 ms) : 3407, 3506
. : milestone, 3456,
iast_FULL (5.85 ms) : 5792, 5909
. : milestone, 5850,
iast_GLOBAL (3.75 ms) : 3681, 3818
. : milestone, 3750,
profiling (2.024 ms) : 2005, 2043
. : milestone, 2024,
tracing (1.878 ms) : 1862, 1894
. : milestone, 1878,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~2076c7b858, baseline=1.62.0-SNAPSHOT~42f154d2f6
dateFormat X
axisFormat %s
section baseline
no_agent (18.119 ms) : 17937, 18302
. : milestone, 18119,
appsec (18.876 ms) : 18681, 19070
. : milestone, 18876,
code_origins (18.19 ms) : 18007, 18373
. : milestone, 18190,
iast (18.51 ms) : 18326, 18693
. : milestone, 18510,
profiling (18.311 ms) : 18129, 18493
. : milestone, 18311,
tracing (17.884 ms) : 17707, 18061
. : milestone, 17884,
section candidate
no_agent (17.963 ms) : 17780, 18145
. : milestone, 17963,
appsec (18.608 ms) : 18422, 18794
. : milestone, 18608,
code_origins (17.881 ms) : 17705, 18056
. : milestone, 17881,
iast (18.41 ms) : 18228, 18593
. : milestone, 18410,
profiling (19.856 ms) : 19657, 20056
. : milestone, 19856,
tracing (17.853 ms) : 17674, 18031
. : milestone, 17853,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~2076c7b858, baseline=1.62.0-SNAPSHOT~42f154d2f6
dateFormat X
axisFormat %s
section baseline
no_agent (15.122 s) : 15122000, 15122000
. : milestone, 15122000,
appsec (14.77 s) : 14770000, 14770000
. : milestone, 14770000,
iast (18.08 s) : 18080000, 18080000
. : milestone, 18080000,
iast_GLOBAL (18.065 s) : 18065000, 18065000
. : milestone, 18065000,
profiling (14.907 s) : 14907000, 14907000
. : milestone, 14907000,
tracing (14.93 s) : 14930000, 14930000
. : milestone, 14930000,
section candidate
no_agent (15.025 s) : 15025000, 15025000
. : milestone, 15025000,
appsec (14.606 s) : 14606000, 14606000
. : milestone, 14606000,
iast (18.181 s) : 18181000, 18181000
. : milestone, 18181000,
iast_GLOBAL (18.085 s) : 18085000, 18085000
. : milestone, 18085000,
profiling (14.859 s) : 14859000, 14859000
. : milestone, 14859000,
tracing (15.13 s) : 15130000, 15130000
. : milestone, 15130000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~2076c7b858, baseline=1.62.0-SNAPSHOT~42f154d2f6
dateFormat X
axisFormat %s
section baseline
no_agent (1.485 ms) : 1474, 1497
. : milestone, 1485,
appsec (2.53 ms) : 2475, 2584
. : milestone, 2530,
iast (2.265 ms) : 2195, 2334
. : milestone, 2265,
iast_GLOBAL (2.308 ms) : 2239, 2376
. : milestone, 2308,
profiling (2.084 ms) : 2030, 2138
. : milestone, 2084,
tracing (2.073 ms) : 2020, 2126
. : milestone, 2073,
section candidate
no_agent (1.489 ms) : 1478, 1501
. : milestone, 1489,
appsec (2.541 ms) : 2486, 2596
. : milestone, 2541,
iast (2.268 ms) : 2199, 2337
. : milestone, 2268,
iast_GLOBAL (2.31 ms) : 2241, 2380
. : milestone, 2310,
profiling (2.103 ms) : 2048, 2158
. : milestone, 2103,
tracing (2.091 ms) : 2038, 2145
. : milestone, 2091,
|
jandro996
changed the title
jandro996
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: baf17b2c8e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61875-file-upload-content
branch
from
baf17b2 to
304846b
Compare
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61875-file-upload-content
branch
from
a36ff44 to
22d70a0
Compare
The static readContent method in ParseRequestAdvice created a self-reference in the inlined advice bytecode (invokestatic on CommonsFileUploadAppSecModule$ParseRequestAdvice) that muzzle could not resolve in the application classloader, causing the instrumentation to be silently skipped. Moves readContent to a new FileItemContentReader helper class declared via helperClassNames(), which muzzle skips and the HelperInjector injects into the application classloader at runtime.
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61875-file-upload-content
branch
from
4610028 to
2076c7b
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
server.request.body.files_contentaddress andrequestFilesContent()event in the gateway API, wired throughGatewayBridgeandInstrumentationGatewayServletFileUpload.parseRequest()instrumentation (commons-fileupload) to read up to 4096 bytes of each uploaded file's content and fire the new WAF callback; blocks with aBlockingExceptiononRequestBlockingAction; content event is skipped when the filenames event has already blocked the requestAdditional Info
request.getParts(), Jetty, Liberty) will follow in successive PRsContributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-61875
Note: Once your PR is ready to merge, add it to the merge queue by commenting
/merge./merge -ccancels the queue request./merge -f --reason "reason"skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.