Add server.request.body.filenames AppSec address for Akka HTTP, Jersey, and Grizzly#11173
Open
Add server.request.body.filenames AppSec address for Akka HTTP, Jersey, and Grizzly#11173
Conversation
jandro996
added
type: enhancement
Member
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 89592b09a8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 64 metrics, 7 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~3ee4e5e1a6, baseline=1.62.0-SNAPSHOT~081af53226
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.058 s) : 0, 1058197
Total [baseline] (11.084 s) : 0, 11084452
Agent [candidate] (1.073 s) : 0, 1073243
Total [candidate] (11.138 s) : 0, 11137557
section appsec
Agent [baseline] (1.252 s) : 0, 1251689
Total [baseline] (10.99 s) : 0, 10990138
Agent [candidate] (1.25 s) : 0, 1249682
Total [candidate] (11.13 s) : 0, 11130477
section iast
Agent [baseline] (1.227 s) : 0, 1226557
Total [baseline] (11.366 s) : 0, 11366201
Agent [candidate] (1.234 s) : 0, 1234261
Total [candidate] (11.309 s) : 0, 11309128
section profiling
Agent [baseline] (1.193 s) : 0, 1193436
Total [baseline] (11.12 s) : 0, 11119663
Agent [candidate] (1.193 s) : 0, 1192720
Total [candidate] (10.986 s) : 0, 10986037
gantt
title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~3ee4e5e1a6, baseline=1.62.0-SNAPSHOT~081af53226
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.236 ms) : 0, 1236
crashtracking [candidate] (1.261 ms) : 0, 1261
BytebuddyAgent [baseline] (632.867 ms) : 0, 632867
BytebuddyAgent [candidate] (642.504 ms) : 0, 642504
AgentMeter [baseline] (29.477 ms) : 0, 29477
AgentMeter [candidate] (30.243 ms) : 0, 30243
GlobalTracer [baseline] (248.939 ms) : 0, 248939
GlobalTracer [candidate] (252.262 ms) : 0, 252262
AppSec [baseline] (32.324 ms) : 0, 32324
AppSec [candidate] (32.805 ms) : 0, 32805
Debugger [baseline] (60.008 ms) : 0, 60008
Debugger [candidate] (60.731 ms) : 0, 60731
Remote Config [baseline] (588.485 µs) : 0, 588
Remote Config [candidate] (602.682 µs) : 0, 603
Telemetry [baseline] (8.042 ms) : 0, 8042
Telemetry [candidate] (8.135 ms) : 0, 8135
Flare Poller [baseline] (8.447 ms) : 0, 8447
Flare Poller [candidate] (8.246 ms) : 0, 8246
section appsec
crashtracking [baseline] (1.238 ms) : 0, 1238
crashtracking [candidate] (1.217 ms) : 0, 1217
BytebuddyAgent [baseline] (663.453 ms) : 0, 663453
BytebuddyAgent [candidate] (663.03 ms) : 0, 663030
AgentMeter [baseline] (12.237 ms) : 0, 12237
AgentMeter [candidate] (12.233 ms) : 0, 12233
GlobalTracer [baseline] (249.393 ms) : 0, 249393
GlobalTracer [candidate] (248.742 ms) : 0, 248742
IAST [baseline] (24.628 ms) : 0, 24628
IAST [candidate] (24.464 ms) : 0, 24464
AppSec [baseline] (185.41 ms) : 0, 185410
AppSec [candidate] (185.235 ms) : 0, 185235
Debugger [baseline] (66.241 ms) : 0, 66241
Debugger [candidate] (65.891 ms) : 0, 65891
Remote Config [baseline] (615.424 µs) : 0, 615
Remote Config [candidate] (594.456 µs) : 0, 594
Telemetry [baseline] (8.477 ms) : 0, 8477
Telemetry [candidate] (8.358 ms) : 0, 8358
Flare Poller [baseline] (3.602 ms) : 0, 3602
Flare Poller [candidate] (3.514 ms) : 0, 3514
section iast
crashtracking [baseline] (1.231 ms) : 0, 1231
crashtracking [candidate] (1.217 ms) : 0, 1217
BytebuddyAgent [baseline] (802.655 ms) : 0, 802655
BytebuddyAgent [candidate] (807.242 ms) : 0, 807242
AgentMeter [baseline] (11.567 ms) : 0, 11567
AgentMeter [candidate] (11.735 ms) : 0, 11735
GlobalTracer [baseline] (239.811 ms) : 0, 239811
GlobalTracer [candidate] (242.015 ms) : 0, 242015
IAST [baseline] (25.744 ms) : 0, 25744
IAST [candidate] (26.07 ms) : 0, 26070
AppSec [baseline] (31.188 ms) : 0, 31188
AppSec [candidate] (33.637 ms) : 0, 33637
Debugger [baseline] (64.748 ms) : 0, 64748
Debugger [candidate] (62.551 ms) : 0, 62551
Remote Config [baseline] (526.447 µs) : 0, 526
Remote Config [candidate] (527.426 µs) : 0, 527
Telemetry [baseline] (9.304 ms) : 0, 9304
Telemetry [candidate] (9.343 ms) : 0, 9343
Flare Poller [baseline] (3.597 ms) : 0, 3597
Flare Poller [candidate] (3.633 ms) : 0, 3633
section profiling
crashtracking [baseline] (1.179 ms) : 0, 1179
crashtracking [candidate] (1.179 ms) : 0, 1179
BytebuddyAgent [baseline] (697.32 ms) : 0, 697320
BytebuddyAgent [candidate] (696.845 ms) : 0, 696845
AgentMeter [baseline] (9.331 ms) : 0, 9331
AgentMeter [candidate] (9.289 ms) : 0, 9289
GlobalTracer [baseline] (208.695 ms) : 0, 208695
GlobalTracer [candidate] (208.649 ms) : 0, 208649
AppSec [baseline] (33.086 ms) : 0, 33086
AppSec [candidate] (32.957 ms) : 0, 32957
Debugger [baseline] (66.346 ms) : 0, 66346
Debugger [candidate] (65.027 ms) : 0, 65027
Remote Config [baseline] (585.217 µs) : 0, 585
Remote Config [candidate] (568.67 µs) : 0, 569
Telemetry [baseline] (7.803 ms) : 0, 7803
Telemetry [candidate] (8.627 ms) : 0, 8627
Flare Poller [baseline] (3.536 ms) : 0, 3536
Flare Poller [candidate] (3.542 ms) : 0, 3542
ProfilingAgent [baseline] (94.117 ms) : 0, 94117
ProfilingAgent [candidate] (94.774 ms) : 0, 94774
Profiling [baseline] (94.687 ms) : 0, 94687
Profiling [candidate] (95.348 ms) : 0, 95348
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~3ee4e5e1a6, baseline=1.62.0-SNAPSHOT~081af53226
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.055 s) : 0, 1054968
Total [baseline] (8.853 s) : 0, 8853354
Agent [candidate] (1.053 s) : 0, 1053280
Total [candidate] (8.828 s) : 0, 8827844
section iast
Agent [baseline] (1.226 s) : 0, 1226494
Total [baseline] (9.581 s) : 0, 9580797
Agent [candidate] (1.222 s) : 0, 1221821
Total [candidate] (9.567 s) : 0, 9567445
gantt
title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~3ee4e5e1a6, baseline=1.62.0-SNAPSHOT~081af53226
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.235 ms) : 0, 1235
crashtracking [candidate] (1.219 ms) : 0, 1219
BytebuddyAgent [baseline] (631.908 ms) : 0, 631908
BytebuddyAgent [candidate] (632.932 ms) : 0, 632932
AgentMeter [baseline] (29.421 ms) : 0, 29421
AgentMeter [candidate] (29.42 ms) : 0, 29420
GlobalTracer [baseline] (248.406 ms) : 0, 248406
GlobalTracer [candidate] (248.243 ms) : 0, 248243
AppSec [baseline] (32.39 ms) : 0, 32390
AppSec [candidate] (32.298 ms) : 0, 32298
Debugger [baseline] (59.107 ms) : 0, 59107
Debugger [candidate] (58.743 ms) : 0, 58743
Remote Config [baseline] (593.445 µs) : 0, 593
Remote Config [candidate] (583.857 µs) : 0, 584
Telemetry [baseline] (8.028 ms) : 0, 8028
Telemetry [candidate] (7.945 ms) : 0, 7945
Flare Poller [baseline] (7.58 ms) : 0, 7580
Flare Poller [candidate] (5.826 ms) : 0, 5826
section iast
crashtracking [baseline] (1.242 ms) : 0, 1242
crashtracking [candidate] (1.223 ms) : 0, 1223
BytebuddyAgent [baseline] (802.401 ms) : 0, 802401
BytebuddyAgent [candidate] (799.731 ms) : 0, 799731
AgentMeter [baseline] (11.589 ms) : 0, 11589
AgentMeter [candidate] (11.535 ms) : 0, 11535
GlobalTracer [baseline] (239.482 ms) : 0, 239482
GlobalTracer [candidate] (238.75 ms) : 0, 238750
IAST [baseline] (25.905 ms) : 0, 25905
IAST [candidate] (25.807 ms) : 0, 25807
AppSec [baseline] (32.304 ms) : 0, 32304
AppSec [candidate] (31.803 ms) : 0, 31803
Debugger [baseline] (63.902 ms) : 0, 63902
Debugger [candidate] (63.285 ms) : 0, 63285
Remote Config [baseline] (534.988 µs) : 0, 535
Remote Config [candidate] (524.968 µs) : 0, 525
Telemetry [baseline] (9.23 ms) : 0, 9230
Telemetry [candidate] (9.507 ms) : 0, 9507
Flare Poller [baseline] (3.59 ms) : 0, 3590
Flare Poller [candidate] (3.571 ms) : 0, 3571
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 19 metrics, 17 unstable metrics. Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~3ee4e5e1a6, baseline=1.62.0-SNAPSHOT~081af53226
dateFormat X
axisFormat %s
section baseline
no_agent (19.021 ms) : 18826, 19216
. : milestone, 19021,
appsec (18.823 ms) : 18631, 19014
. : milestone, 18823,
code_origins (17.714 ms) : 17536, 17891
. : milestone, 17714,
iast (17.763 ms) : 17588, 17938
. : milestone, 17763,
profiling (18.693 ms) : 18502, 18884
. : milestone, 18693,
tracing (17.789 ms) : 17614, 17964
. : milestone, 17789,
section candidate
no_agent (19.217 ms) : 19016, 19417
. : milestone, 19217,
appsec (18.422 ms) : 18235, 18608
. : milestone, 18422,
code_origins (17.793 ms) : 17621, 17965
. : milestone, 17793,
iast (17.762 ms) : 17589, 17935
. : milestone, 17762,
profiling (18.127 ms) : 17947, 18306
. : milestone, 18127,
tracing (17.878 ms) : 17701, 18055
. : milestone, 17878,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~3ee4e5e1a6, baseline=1.62.0-SNAPSHOT~081af53226
dateFormat X
axisFormat %s
section baseline
no_agent (1.25 ms) : 1239, 1262
. : milestone, 1250,
iast (3.318 ms) : 3270, 3366
. : milestone, 3318,
iast_FULL (6.027 ms) : 5966, 6088
. : milestone, 6027,
iast_GLOBAL (3.762 ms) : 3702, 3822
. : milestone, 3762,
profiling (1.971 ms) : 1955, 1987
. : milestone, 1971,
tracing (1.916 ms) : 1900, 1931
. : milestone, 1916,
section candidate
no_agent (1.241 ms) : 1229, 1253
. : milestone, 1241,
iast (3.278 ms) : 3237, 3320
. : milestone, 3278,
iast_FULL (6.016 ms) : 5955, 6077
. : milestone, 6016,
iast_GLOBAL (3.745 ms) : 3681, 3809
. : milestone, 3745,
profiling (2.093 ms) : 2074, 2112
. : milestone, 2093,
tracing (1.898 ms) : 1881, 1915
. : milestone, 1898,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~3ee4e5e1a6, baseline=1.62.0-SNAPSHOT~081af53226
dateFormat X
axisFormat %s
section baseline
no_agent (1.493 ms) : 1481, 1505
. : milestone, 1493,
appsec (2.551 ms) : 2495, 2606
. : milestone, 2551,
iast (2.281 ms) : 2211, 2350
. : milestone, 2281,
iast_GLOBAL (2.323 ms) : 2253, 2393
. : milestone, 2323,
profiling (2.102 ms) : 2047, 2158
. : milestone, 2102,
tracing (2.091 ms) : 2037, 2145
. : milestone, 2091,
section candidate
no_agent (1.488 ms) : 1476, 1499
. : milestone, 1488,
appsec (3.866 ms) : 3643, 4090
. : milestone, 3866,
iast (2.284 ms) : 2214, 2354
. : milestone, 2284,
iast_GLOBAL (2.325 ms) : 2255, 2395
. : milestone, 2325,
profiling (2.11 ms) : 2054, 2165
. : milestone, 2110,
tracing (2.096 ms) : 2042, 2150
. : milestone, 2096,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~3ee4e5e1a6, baseline=1.62.0-SNAPSHOT~081af53226
dateFormat X
axisFormat %s
section baseline
no_agent (14.799 s) : 14799000, 14799000
. : milestone, 14799000,
appsec (14.815 s) : 14815000, 14815000
. : milestone, 14815000,
iast (18.298 s) : 18298000, 18298000
. : milestone, 18298000,
iast_GLOBAL (17.811 s) : 17811000, 17811000
. : milestone, 17811000,
profiling (14.957 s) : 14957000, 14957000
. : milestone, 14957000,
tracing (14.864 s) : 14864000, 14864000
. : milestone, 14864000,
section candidate
no_agent (15.128 s) : 15128000, 15128000
. : milestone, 15128000,
appsec (14.682 s) : 14682000, 14682000
. : milestone, 14682000,
iast (18.363 s) : 18363000, 18363000
. : milestone, 18363000,
iast_GLOBAL (17.888 s) : 17888000, 17888000
. : milestone, 17888000,
profiling (14.819 s) : 14819000, 14819000
. : milestone, 14819000,
tracing (15.16 s) : 15160000, 15160000
. : milestone, 15160000,
|
…Grizzly - Akka HTTP 10.0/10.6: extract filenames in handleMultipartStrictFormData() via getFilename() on BodyPart.Strict and fire requestFilesFilenames callback. Also covers the formFieldMultiMap path via handleStrictFormData(). - Jersey 2.0/3.0 (MultiPartReaderServerSideInstrumentation): extract filenames from FormDataBodyPart.getContentDisposition().getFileName() and fire requestFilesFilenames after requestBodyProcessed. Grizzly uses this path. - Decouple requestBodyProcessed and requestFilesFilenames callbacks in Jersey and Akka handleMultipartStrictFormData: fetch both upfront, return early only if both are null. Previously an early return on requestBodyProcessed==null silently skipped filename detection, breaking deployments with filename-only WAF rules (same fix already applied to Undertow). - Merge the two iterations over strictParts in handleMultipartStrictFormData into a single loop. - Add null guard for getContentDisposition() in Jersey before calling getFileName(). - Enable testBodyFilenames() in Akka, Grizzly, Spring Boot, and Jersey3Jetty test suites.
jandro996
force-pushed
the
alejandro.gonzalez/APPSEC-61873-6-akka
branch
from
77765ec to
3ee4e5e
Compare
jandro996
changed the title
jandro996
requested review from
claponcet,
daniel-romano-DD and
manuel-alvarez-alvarez
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
Akka HTTP 10.0 / 10.6
UnmarshallerHelpers.handleMultipartStrictFormData(): extracts filenames fromMultipart.FormData.BodyPart.StrictviagetFilename()and fires therequestFilesFilenamesIG callback. Blocking is supported viaAkkaBlockResponseFunction.UnmarshallerHelpers.handleStrictFormData(): adds the same filename extraction for theformFieldMultiMappath, which goes throughStrictFormCompanionInstrumentationand never reachedhandleMultipartStrictFormData.Jersey 2.0 / 3.0 (covers Grizzly)
MultiPartReaderServerSideInstrumentation: extracts filenames fromFormDataBodyPart.getContentDisposition().getFileName()and firesrequestFilesFilenamesafterrequestBodyProcessed. Grizzly uses Jersey's multipart reader, so this path covers both frameworks.Motivation
Implements the
server.request.body.filenamesWAF address for the remaining server frameworks not yet covered: Akka HTTP and Grizzly (via Jersey's multipart reader).Jira ticket: APPSEC-61873
Additional Notes
The
requestBodyProcessed/requestFilesFilenamesdecoupling fix mirrors commit870da2ffa5which applied the same fix to Undertow. Both callbacks map to independent WAF addresses inGatewayBridge.DATA_DEPENDENCIES.Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueNote: Once your PR is ready to merge, add it to the merge queue by commenting
/merge./merge -ccancels the queue request./merge -f --reason "reason"skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.