Fix String.replace instrumentation for IAST #8281

Mariovido · 2025-01-24T14:11:26Z

What Does This Do

This fix an issue where we were having exceptions during the replace method. The change consist in normalizing the CharSequence that will act as the replacement String so it can be compile to a Pattern.
As a preventing action for future errors, more tests has been added to cover edge cases where the replacement value contains special characters.

NOTE: For the replaceAll and replaceFirst tests I have not added a case where there is a $ as it will thrown automatically and exception in the original method.

Motivation

Fix the current algorithm of replace which has a bug.

Additional Notes

This is only active when the tracer has DD_IAST_EXPERIMENTAL_PROPAGATION_ENABLED enabled. Nonetheless, is not affecting the return of the original replace.

Contributor Checklist

Format the title according the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any usefull labels
Don't use close, fix or any linking keywords when referencing an issue.
Use solves instead, and assign the PR milestone to the issue
Update the public documentation in case of new configuration flag or behavior

Jira ticket: APPSEC-56511 [APPSEC-56512]

pr-commenter · 2025-01-24T14:43:11Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mario.vidal/fix_replace
git_commit_date	1738228543	1738229021
git_commit_sha	`d3cfbcb`	`d23ea24`
release_version	1.46.0-SNAPSHOT~d3cfbcbf17	1.46.0-SNAPSHOT~d23ea24818

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1738231595	1738231595
ci_job_id	786899587	786899587
ci_pipeline_id	54415882	54415882
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-ojmsshtx-project-304-concurrent-4-jn1i0a5u 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-ojmsshtx-project-304-concurrent-4-jn1i0a5u 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 53 metrics, 10 unstable metrics.

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.46.0-SNAPSHOT~d23ea24818, baseline=1.46.0-SNAPSHOT~d3cfbcbf17

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.038 s) : 0, 1037996
Total [baseline] (8.633 s) : 0, 8632780
Agent [candidate] (1.039 s) : 0, 1038745
Total [candidate] (8.608 s) : 0, 8608301
section iast
Agent [baseline] (1.17 s) : 0, 1169638
Total [baseline] (9.218 s) : 0, 9218359
Agent [candidate] (1.168 s) : 0, 1168337
Total [candidate] (9.207 s) : 0, 9206772
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.167 s) : 0, 1167479
Total [baseline] (9.211 s) : 0, 9211127
Agent [candidate] (1.171 s) : 0, 1170682
Total [candidate] (9.203 s) : 0, 9202709
section iast_TELEMETRY_OFF
Agent [baseline] (1.17 s) : 0, 1170324
Total [baseline] (9.251 s) : 0, 9250878
Agent [candidate] (1.183 s) : 0, 1183338
Total [candidate] (9.239 s) : 0, 9238520

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.038 s	-
Agent	iast	1.17 s	131.642 ms (12.7%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.167 s	129.483 ms (12.5%)
Agent	iast_TELEMETRY_OFF	1.17 s	132.328 ms (12.7%)
Total	tracing	8.633 s	-
Total	iast	9.218 s	585.579 ms (6.8%)
Total	iast_HARDCODED_SECRET_DISABLED	9.211 s	578.347 ms (6.7%)
Total	iast_TELEMETRY_OFF	9.251 s	618.099 ms (7.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.039 s	-
Agent	iast	1.168 s	129.592 ms (12.5%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.171 s	131.938 ms (12.7%)
Agent	iast_TELEMETRY_OFF	1.183 s	144.593 ms (13.9%)
Total	tracing	8.608 s	-
Total	iast	9.207 s	598.471 ms (7.0%)
Total	iast_HARDCODED_SECRET_DISABLED	9.203 s	594.407 ms (6.9%)
Total	iast_TELEMETRY_OFF	9.239 s	630.219 ms (7.3%)

gantt
    title insecure-bank - break down per module: candidate=1.46.0-SNAPSHOT~d23ea24818, baseline=1.46.0-SNAPSHOT~d3cfbcbf17

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (714.306 ms) : 0, 714306
BytebuddyAgent [candidate] (715.161 ms) : 0, 715161
GlobalTracer [baseline] (239.734 ms) : 0, 239734
GlobalTracer [candidate] (239.272 ms) : 0, 239272
AppSec [baseline] (55.175 ms) : 0, 55175
AppSec [candidate] (56.327 ms) : 0, 56327
Remote Config [baseline] (698.867 µs) : 0, 699
Remote Config [candidate] (710.286 µs) : 0, 710
Telemetry [baseline] (12.843 ms) : 0, 12843
Telemetry [candidate] (12.079 ms) : 0, 12079
section iast
BytebuddyAgent [baseline] (833.99 ms) : 0, 833990
BytebuddyAgent [candidate] (834.156 ms) : 0, 834156
GlobalTracer [baseline] (230.94 ms) : 0, 230940
GlobalTracer [candidate] (230.367 ms) : 0, 230367
IAST [baseline] (24.954 ms) : 0, 24954
IAST [candidate] (26.973 ms) : 0, 26973
AppSec [baseline] (54.993 ms) : 0, 54993
AppSec [candidate] (52.216 ms) : 0, 52216
Remote Config [baseline] (622.096 µs) : 0, 622
Remote Config [candidate] (603.377 µs) : 0, 603
Telemetry [baseline] (8.807 ms) : 0, 8807
Telemetry [candidate] (8.67 ms) : 0, 8670
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (833.105 ms) : 0, 833105
BytebuddyAgent [candidate] (836.723 ms) : 0, 836723
GlobalTracer [baseline] (230.287 ms) : 0, 230287
GlobalTracer [candidate] (230.383 ms) : 0, 230383
IAST [baseline] (27.227 ms) : 0, 27227
IAST [candidate] (27.174 ms) : 0, 27174
AppSec [baseline] (52.302 ms) : 0, 52302
AppSec [candidate] (51.8 ms) : 0, 51800
Remote Config [baseline] (608.169 µs) : 0, 608
Remote Config [candidate] (608.581 µs) : 0, 609
Telemetry [baseline] (8.694 ms) : 0, 8694
Telemetry [candidate] (8.671 ms) : 0, 8671
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (834.646 ms) : 0, 834646
BytebuddyAgent [candidate] (843.561 ms) : 0, 843561
GlobalTracer [baseline] (231.176 ms) : 0, 231176
GlobalTracer [candidate] (234.67 ms) : 0, 234670
IAST [baseline] (27.01 ms) : 0, 27010
IAST [candidate] (24.252 ms) : 0, 24252
AppSec [baseline] (52.824 ms) : 0, 52824
AppSec [candidate] (55.949 ms) : 0, 55949
Remote Config [baseline] (623.516 µs) : 0, 624
Remote Config [candidate] (627.787 µs) : 0, 628
Telemetry [baseline] (8.619 ms) : 0, 8619
Telemetry [candidate] (8.741 ms) : 0, 8741

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.46.0-SNAPSHOT~d23ea24818, baseline=1.46.0-SNAPSHOT~d3cfbcbf17

    dateFormat X
    axi
10000
sFormat %s
section tracing
Agent [baseline] (1.037 s) : 0, 1037439
Total [baseline] (10.428 s) : 0, 10427536
Agent [candidate] (1.045 s) : 0, 1045426
Total [candidate] (10.485 s) : 0, 10484813
section appsec
Agent [baseline] (1.18 s) : 0, 1180472
Total [baseline] (10.79 s) : 0, 10790033
Agent [candidate] (1.179 s) : 0, 1178781
Total [candidate] (10.766 s) : 0, 10766321
section iast
Agent [baseline] (1.168 s) : 0, 1168056
Total [baseline] (10.933 s) : 0, 10933325
Agent [candidate] (1.168 s) : 0, 1167914
Total [candidate] (11.0 s) : 0, 10999689
section profiling
Agent [baseline] (1.261 s) : 0, 1260733
Total [baseline] (10.864 s) : 0, 10864140
Agent [candidate] (1.256 s) : 0, 1256135
Total [candidate] (10.833 s) : 0, 10833191

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.037 s	-
Agent	appsec	1.18 s	143.033 ms (13.8%)
Agent	iast	1.168 s	130.617 ms (12.6%)
Agent	profiling	1.261 s	223.294 ms (21.5%)
Total	tracing	10.428 s	-
Total	appsec	10.79 s	362.496 ms (3.5%)
Total	iast	10.933 s	505.789 ms (4.9%)
Total	profiling	10.864 s	436.604 ms (4.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.045 s	-
Agent	appsec	1.179 s	133.355 ms (12.8%)
Agent	iast	1.168 s	122.488 ms (11.7%)
Agent	profiling	1.256 s	210.709 ms (20.2%)
Total	tracing	10.485 s	-
Total	appsec	10.766 s	281.508 ms (2.7%)
Total	iast	11.0 s	514.876 ms (4.9%)
Total	profiling	10.833 s	348.378 ms (3.3%)

gantt
    title petclinic - break down per module: candidate=1.46.0-SNAPSHOT~d23ea24818, baseline=1.46.0-SNAPSHOT~d3cfbcbf17

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (714.436 ms) : 0, 714436
BytebuddyAgent [candidate] (720.601 ms) : 0, 720601
GlobalTracer [baseline] (239.457 ms) : 0, 239457
GlobalTracer [candidate] (241.458 ms) : 0, 241458
AppSec [baseline] (56.121 ms) : 0, 56121
AppSec [candidate] (55.787 ms) : 0, 55787
Remote Config [baseline] (708.197 µs) : 0, 708
Remote Config [candidate] (718.503 µs) : 0, 719
Telemetry [baseline] (11.489 ms) : 0, 11489
Telemetry [candidate] (11.511 ms) : 0, 11511
section appsec
BytebuddyAgent [baseline] (732.595 ms) : 0, 732595
BytebuddyAgent [candidate] (730.923 ms) : 0, 730923
GlobalTracer [baseline] (237.064 ms) : 0, 237064
GlobalTracer [candidate] (236.834 ms) : 0, 236834
IAST [baseline] (21.39 ms) : 0, 21390
IAST [candidate] (21.469 ms) : 0, 21469
AppSec [baseline] (175.821 ms) : 0, 175821
AppSec [candidate] (176.068 ms) : 0, 176068
Remote Config [baseline] (662.582 µs) : 0, 663
Remote Config [candidate] (647.624 µs) : 0, 648
Telemetry [baseline] (8.368 ms) : 0, 8368
Telemetry [candidate] (8.3 ms) : 0, 8300
section iast
BytebuddyAgent [baseline] (832.79 ms) : 0, 832790
BytebuddyAgent [candidate] (833.162 ms) : 0, 833162
GlobalTracer [baseline] (230.551 ms) : 0, 230551
GlobalTracer [candidate] (230.785 ms) : 0, 230785
IAST [baseline] (24.851 ms) : 0, 24851
IAST [candidate] (27.724 ms) : 0, 27724
AppSec [baseline] (55.142 ms) : 0, 55142
AppSec [candidate] (51.561 ms) : 0, 51561
Remote Config [baseline] (632.996 µs) : 0, 633
Remote Config [candidate] (617.716 µs) : 0, 618
Telemetry [baseline] (8.822 ms) : 0, 8822
Telemetry [candidate] (8.787 ms) : 0, 8787
section profiling
BytebuddyAgent [baseline] (706.693 ms) : 0, 706693
BytebuddyAgent [candidate] (704.511 ms) : 0, 704511
GlobalTracer [baseline] (350.862 ms) : 0, 350862
GlobalTracer [candidate] (350.307 ms) : 0, 350307
AppSec [baseline] (55.189 ms) : 0, 55189
AppSec [candidate] (54.238 ms) : 0, 54238
Remote Config [baseline] (704.992 µs) : 0, 705
Remote Config [candidate] (704.671 µs) : 0, 705
Telemetry [baseline] (8.905 ms) : 0, 8905
Telemetry [candidate] (8.918 ms) : 0, 8918
ProfilingAgent [baseline] (95.985 ms) : 0, 95985
ProfilingAgent [candidate] (95.088 ms) : 0, 95088
Profiling [baseline] (96.009 ms) : 0, 96009
Profiling [candidate] (95.112 ms) : 0, 95112

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
end_time	2025-01-30T09:38:20	2025-01-30T09:45:26
git_branch	master	mario.vidal/fix_replace
git_commit_date	1738228543	1738229021
git_commit_sha	`d3cfbcb`	`d23ea24`
release_version	1.46.0-SNAPSHOT~d3cfbcbf17	1.46.0-SNAPSHOT~d23ea24818
start_time	2025-01-30T09:38:06	2025-01-30T09:45:12

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1738230686	1738230686
ci_job_id	786899588	786899588
ci_pipeline_id	54415882	54415882
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-rth72t5k-project-304-concurrent-0-luxi24jr 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-rth72t5k-project-304-concurrent-0-luxi24jr 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 17 unstable metrics.

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~d23ea24818, baseline=1.46.0-SNAPSHOT~d3cfbcbf17
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.361 ms) : 1341, 1380
.   : milestone, 1361,
appsec (1.747 ms) : 1723, 1771
.   : milestone, 1747,
appsec_no_iast (1.764 ms) : 1741, 1787
.   : milestone, 1764,
iast (1.507 ms) : 1483, 1531
.   : milestone, 1507,
profiling (1.549 ms) : 1523, 1574
.   : milestone, 1549,
tracing (1.492 ms) : 1468, 1517
.   : milestone, 1492,
section candidate
no_agent (1.378 ms) : 1359, 1398
.   : milestone, 1378,
appsec (1.761 ms) : 1738, 1785
.   : milestone, 1761,
appsec_no_iast (1.757 ms) : 1732, 1781
.   : milestone, 1757,
iast (1.516 ms) : 1491, 1540
.   : milestone, 1516,
profiling (1.572 ms) : 1549, 1596
.   : milestone, 1572,
tracing (1.51 ms) : 1485, 1534
.   : milestone, 1510,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.361 ms [1.341 ms, 1.38 ms]	-
appsec	1.747 ms [1.723 ms, 1.771 ms]	386.44 µs (28.4%)
appsec_no_iast	1.764 ms [1.741 ms, 1.787 ms]	403.084 µs (29.6%)
iast	1.507 ms [1.483 ms, 1.531 ms]	146.285 µs (10.8%)
profiling	1.549 ms [1.523 ms, 1.574 ms]	188.091 µs (13.8%)
tracing	1.492 ms [1.468 ms, 1.517 ms]	131.667 µs (9.7%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.378 ms [1.359 ms, 1.398 ms]	-
appsec	1.761 ms [1.738 ms, 1.785 ms]	382.932 µs (27.8%)
appsec_no_iast	1.757 ms [1.732 ms, 1.781 ms]	378.259 µs (27.4%)
iast	1.516 ms [1.491 ms, 1.54 ms]	137.137 µs (9.9%)
profiling	1.572 ms [1.549 ms, 1.596 ms]	193.975 µs (14.1%)
tracing	1.51 ms [1.485 ms, 1.534 ms]	131.092 µs (9.5%)

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~d23ea24818, baseline=1.46.0-SNAPSHOT~d3cfbcbf17
    dateFormat X
    axisFormat %s
section baseline
no_agent (381.977 µs) : 362, 402
.   : milestone, 382,
iast (515.072 µs) : 493, 537
.   : milestone, 515,
iast_FULL (748.184 µs) : 726, 770
.   : milestone, 748,
iast_GLOBAL (560.161 µs) : 537, 584
.   : milestone, 560,
iast_HARDCODED_SECRET_DISABLED (516.26 µs) : 493, 539
.   : milestone, 516,
iast_INACTIVE (469.967 µs) : 448, 492
.   : milestone, 470,
iast_TELEMETRY_OFF (506.483 µs) : 483, 530
.   : milestone, 506,
tracing (461.444 µs) : 440, 483
.   : milestone, 461,
section candidate
no_agent (387.657 µs) : 367, 408
.   : milestone, 388,
iast (517.981 µs) : 495, 541
.   : milestone, 518,
iast_FULL (747.696 µs) : 725, 770
.   : milestone, 748,
iast_GLOBAL (558.951 µs) : 536, 582
.   : milestone, 559,
iast_HARDCODED_SECRET_DISABLED (519.102 µs) : 496, 542
.   : milestone, 519,
iast_INACTIVE (468.252 µs) : 446, 491
.   : milestone, 468,
iast_TELEMETRY_OFF (502.408 µs) : 479, 526
.   : milestone, 502,
tracing (459.137 µs) : 438, 480
.   : milestone, 459,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	381.977 µs [362.394 µs, 401.56 µs]	-
iast	515.072 µs [493.308 µs, 536.836 µs]	133.095 µs (34.8%)
iast_FULL	748.184 µs [726.488 µs, 769.879 µs]	366.206 µs (95.9%)
iast_GLOBAL	560.161 µs [536.583 µs, 583.739 µs]	178.184 µs (46.6%)
iast_HARDCODED_SECRET_DISABLED	516.26 µs [493.167 µs, 539.353 µs]	134.283 µs (35.2%)
iast_INACTIVE	469.967 µs [448.042 µs, 491.892 µs]	87.99 µs (23.0%)
iast_TELEMETRY_OFF	506.483 µs [483.155 µs, 529.81 µs]	124.505 µs (32.6%)
tracing	461.444 µs [439.587 µs, 483.301 µs]	79.466 µs (20.8%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	387.657 µs [367.473 µs, 407.841 µs]	-
iast	517.981 µs [494.744 µs, 541.219 µs]	130.324 µs (33.6%)
iast_FULL	747.696 µs [725.432 µs, 769.961 µs]	360.039 µs (92.9%)
iast_GLOBAL	558.951 µs [536.079 µs, 581.823 µs]	171.294 µs (44.2%)
iast_HARDCODED_SECRET_DISABLED	519.102 µs [495.839 µs, 542.366 µs]	131.445 µs (33.9%)
iast_INACTIVE	468.252 µs [445.998 µs, 490.507 µs]	80.595 µs (20.8%)
iast_TELEMETRY_OFF	502.408 µs [479.24 µs, 525.575 µs]	114.75 µs (29.6%)
tracing	459.137 µs [437.951 µs, 480.322 µs]	71.48 µs (18.4%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mario.vidal/fix_replace
git_commit_date	1738228543	1738229021
git_commit_sha	`d3cfbcb`	`d23ea24`
release_version	1.46.0-SNAPSHOT~d3cfbcbf17	1.46.0-SNAPSHOT~d23ea24818

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1738231251	1738231251
ci_job_id	786899589	786899589
ci_pipeline_id	54415882	54415882
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-ojmsshtx-project-304-concurrent-5-d2beehfd 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-ojmsshtx-project-304-concurrent-5-d2beehfd 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~d23ea24818, baseline=1.46.0-SNAPSHOT~d3cfbcbf17
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.429 s) : 15429000, 15429000
.   : milestone, 15429000,
appsec (15.156 s) : 15156000, 15156000
.   : milestone, 15156000,
iast (19.086 s) : 19086000, 19086000
.   : milestone, 19086000,
iast_GLOBAL (18.25 s) : 18250000, 18250000
.   : milestone, 18250000,
profiling (15.126 s) : 15126000, 15126000
.   : milestone, 15126000,
tracing (14.995 s) : 14995000, 14995000
.   : milestone, 14995000,
section candidate
no_agent (15.452 s) : 15452000, 15452000
.   : milestone, 15452000,
appsec (15.046 s) : 15046000, 15046000
.   : milestone, 15046000,
iast (18.798 s) : 18798000, 18798000
.   : milestone, 18798000,
iast_GLOBAL (17.83 s) : 17830000, 17830000
.   : milestone, 17830000,
profiling (15.074 s) : 15074000, 15074000
.   : milestone, 15074000,
tracing (15.044 s) : 15044000, 15044000
.   : milestone, 15044000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.429 s [15.429 s, 15.429 s]	-
appsec	15.156 s [15.156 s, 15.156 s]	-273.0 ms (-1.8%)
iast	19.086 s [19.086 s, 19.086 s]	3.657 s (23.7%)
iast_GLOBAL	18.25 s [18.25 s, 18.25 s]	2.821 s (18.3%)
profiling	15.126 s [15.126 s, 15.126 s]	-303.0 ms (-2.0%)
tracing	14.995 s [14.995 s, 14.995 s]	-434.0 ms (-2.8%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.452 s [15.452 s, 15.452 s]	-
appsec	15.046 s [15.046 s, 15.046 s]	-406.0 ms (-2.6%)
iast	18.798 s [18.798 s, 18.798 s]	3.346 s (21.7%)
iast_GLOBAL	17.83 s [17.83 s, 17.83 s]	2.378 s (15.4%)
profiling	15.074 s [15.074 s, 15.074 s]	-378.0 ms (-2.4%)
tracing	15.044 s [15.044 s, 15.044 s]	-408.0 ms (-2.6%)

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~d23ea24818, baseline=1.46.0-SNAPSHOT~d3cfbcbf17
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.467 ms) : 1456, 1479
.   : milestone, 1467,
appsec (2.357 ms) : 2313, 2400
.   : milestone, 2357,
iast (2.109 ms) : 2054, 2163
.   : milestone, 2109,
iast_GLOBAL (2.152 ms) : 2097, 2207
.   : milestone, 2152,
profiling (1.982 ms) : 1938, 2026
.   : milestone, 1982,
tracing (1.931 ms) : 1889, 1973
.   : milestone, 1931,
section candidate
no_agent (1.467 ms) : 1456, 1479
.   : milestone, 1467,
appsec (2.36 ms) : 2317, 2404
.   : milestone, 2360,
iast (2.099 ms) : 2045, 2154
.   : milestone, 2099,
iast_GLOBAL (2.149 ms) : 2094, 2204
.   : milestone, 2149,
profiling (1.969 ms) : 1925, 2012
.   : milestone, 1969,
tracing (1.95 ms) : 1908, 1993
.   : milestone, 1950,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.467 ms [1.456 ms, 1.479 ms]	-
appsec	2.357 ms [2.313 ms, 2.4 ms]	889.106 µs (60.6%)
iast	2.109 ms [2.054 ms, 2.163 ms]	641.562 µs (43.7%)
iast_GLOBAL	2.152 ms [2.097 ms, 2.207 ms]	684.793 µs (46.7%)
profiling	1.982 ms [1.938 ms, 2.026 ms]	514.684 µs (35.1%)
tracing	1.931 ms [1.889 ms, 1.973 ms]	463.723 µs (31.6%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.467 ms [1.456 ms, 1.479 ms]	-
appsec	2.36 ms [2.317 ms, 2.404 ms]	893.316 µs (60.9%)
iast	2.099 ms [2.045 ms, 2.154 ms]	632.366 µs (43.1%)
iast_GLOBAL	2.149 ms [2.094 ms, 2.204 ms]	681.879 µs (46.5%)
profiling	1.969 ms [1.925 ms, 2.012 ms]	501.585 µs (34.2%)
tracing	1.95 ms [1.908 ms, 1.993 ms]	483.33 µs (32.9%)

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.cloud:google-cloud-datastore](https://github.com/googleapis/java-datastore) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.25.4` -> `2.26.0` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.45.2` -> `1.46.0` | | [com.datadoghq:dd-trace-ot](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.45.2` -> `1.46.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | --- ### Release Notes <details> <summary>googleapis/java-datastore (com.google.cloud:google-cloud-datastore)</summary> ### [`v2.26.0`](https://github.com/googleapis/java-datastore/blob/HEAD/CHANGELOG.md#2260-2025-01-29) ##### Features - Add firestoreInDatastoreMode for datastore emulator ([#1698](googleapis/java-datastore#1698)) ([50f106d](googleapis/java-datastore@50f106d)) ##### Dependencies - Update dependency com.google.cloud:sdk-platform-java-config to v3.42.0 ([#1725](googleapis/java-datastore#1725)) ([1cbaf22](googleapis/java-datastore@1cbaf22)) </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.46.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.46.0): 1.46.0 ##### Breaking Changes > \[!WARNING] > jnr-unixsocket is now an external dependency of dd-trace-ot and must be included when deploying dd-trace-ot. > \[!NOTE] > The API `TracerScope.setAsync(boolean)`, used to manually control asynchronous span propagation, does no more apply to the scope instance but to the active span scope. ##### Components ##### Application Security Management (IAST) - 🐛 Fix String.replace instrumentation for IAST ([#8281](DataDog/dd-trace-java#8281) - [@Mariovido](https://github.com/Mariovido)) - ✨ Apply the standard nomenclature to the stacktrace configs ([#8244](DataDog/dd-trace-java#8244) - [@jandro996](https://github.com/jandro996)) - 🐛 Exclude false positive weak randomness ([#8232](DataDog/dd-trace-java#8232) - [@jandro996](https://github.com/jandro996)) - ✨ Propagation of translateEscapes of String class ([#8186](DataDog/dd-trace-java#8186) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Add security control metrics ([#8175](DataDog/dd-trace-java#8175) - [@jandro996](https://github.com/jandro996)) - ✨ Increase IAST propagation to StringBuffer setLength ([#8128](DataDog/dd-trace-java#8128) - [@Mariovido](https://github.com/Mariovido)) - ✨ Add IAST taint tracking for DB values ([#8072](DataDog/dd-trace-java#8072) - [@Mariovido](https://github.com/Mariovido)) ##### Application Security Management (WAF) - 🐛 Prevents a NPE when there is no subscriber for user events ([#8258](DataDog/dd-trace-java#8258) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Apply the standard nomenclature to the stacktrace configs ([#8244](DataDog/dd-trace-java#8244) - [@jandro996](https://github.com/jandro996)) - 🐛 Ensure cached subscriptions are cleared on reconfiguration via RC ([#8229](DataDog/dd-trace-java#8229) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Add support for session tracking in Vertx ([#8167](DataDog/dd-trace-java#8167) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Create span tag: \_dd.appsec.rasp.timeout ([#8269](DataDog/dd-trace-java#8269) - [@Mariovido](https://github.com/Mariovido)) ##### Build & Tooling - 🐛 Ensure shaded helpers have unique names when injected into class-loaders ([#8192](DataDog/dd-trace-java#8192) - [@mcculls](https://github.com/mcculls)) ##### Configuration at Runtime - 🐛 Remove filtering of `DD_SERVICE` and `DD_ENV` from the tracer ([#8176](DataDog/dd-trace-java#8176) - [@mhlidd](https://github.com/mhlidd)) ##### Continuous Integration Visibility - 🧹 Generalize TestRetryPolicy to TestExecutionPolicy ([#8302](DataDog/dd-trace-java#8302) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Parallelize CI Visibility settings requests ([#8299](DataDog/dd-trace-java#8299) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Generalize test retry logic ([#8289](DataDog/dd-trace-java#8289) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Generalize tests skipping logic ([#8288](DataDog/dd-trace-java#8288) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Remove skip and shouldBeSkipped methods from TestEventsHandler in favor of isSkippable ([#8286](DataDog/dd-trace-java#8286) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨⚡ Optimize Git repository information computation ([#8270](DataDog/dd-trace-java#8270) - [@dougqh](https://github.com/dougqh)) - ✨ Always request known tests from the backend ([#8268](DataDog/dd-trace-java#8268) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Fix NPE when trying to get retry analyzer in Test NG ([#8253](DataDog/dd-trace-java#8253) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Set test framework and test framework version tags atomically ([#8252](DataDog/dd-trace-java#8252) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add debug logging to Android Gradle module layout logic ([#8251](DataDog/dd-trace-java#8251) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix source and destination folders computation for Android Gradle projects ([#8190](DataDog/dd-trace-java#8190) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add basic Scala Weaver sbt support ([#8189](DataDog/dd-trace-java#8189) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement impacted tests detection ([#8188](DataDog/dd-trace-java#8188) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) ##### Data Streams Monitoring - ✨ Change hash computation for protobuf to better represent impacting changes + save proto number in schema ([#8201](DataDog/dd-trace-java#8201) - [@vandonr](https://github.com/vandonr)) ##### Database Monitoring - Add peer service tag in dbm sql commenter ([#7913](DataDog/dd-trace-java#7913) - [@jordan-wong](https://github.com/jordan-wong)) ##### Dynamic Instrumentation - ✨ Add support for SymDB to scan directories ([#8306](DataDog/dd-trace-java#8306) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add SymDB report for any jar scanning failures ([#8300](DataDog/dd-trace-java#8300) - [@jpbempel](https://github.com/jpbempel)) - ✨ Use two budgets depending on type ([#8283](DataDog/dd-trace-java#8283) - [@evanchooly](https://github.com/evanchooly)) - ✨ Institute a 10 snapshot per probe per trace budget ([#8277](DataDog/dd-trace-java#8277) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Avoid double snapshots for Exception Replay ([#8273](DataDog/dd-trace-java#8273) - [@jpbempel](https://github.com/jpbempel)) - ✨ Simplify code origins. Separate out snapshot generation. ([#8263](DataDog/dd-trace-java#8263) - [@evanchooly](https://github.com/evanchooly)) - ✨ Add Exception probe custom instrumentation ([#8230](DataDog/dd-trace-java#8230) - [@jpbempel](https://github.com/jpbempel)) - ✨ Enhance log probes to honor debug session tags ([#8215](DataDog/dd-trace-java#8215) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Don't redact env tokens from debugger probe snapshots ([#8211](DataDog/dd-trace-java#8211) - [@watson](https://github.com/watson)) - ✨⚡ Move Trace/SpanId capture at commit time ([#8184](DataDog/dd-trace-java#8184) - [@jpbempel](https://github.com/jpbempel)) - 🐛 Capture values at entry for method probe ([#8169](DataDog/dd-trace-java#8169) - [@jpbempel](https://github.com/jpbempel)) ##### JMX fetch - 🐛 Mute JMXFetch Shutdown in progress error ([#8068](DataDog/dd-trace-java#8068) - [@ygree](https://github.com/ygree)) ##### OpenTracing - ⚠️🧹 Make jnr-unixsocket an explicit dependency of dd-trace-ot ([#8307](DataDog/dd-trace-java#8307) - [@mcculls](https://github.com/mcculls)) ##### Profiling - 🐛 Avoid unsupported API call for creating folders on windows ([#8304](DataDog/dd-trace-java#8304) - [@jbachorik](https://github.com/jbachorik)) - ✨ Tag profiles for serverless ([#8279](DataDog/dd-trace-java#8279) - [@jbachorik](https://github.com/jbachorik)) - ✨ add queue type and length to queue events ([#8242](DataDog/dd-trace-java#8242) - [@richardstartin](https://github.com/richardstartin)) - 🐛 TempLocationManager Fixes and Improvements ([#8191](DataDog/dd-trace-java#8191) - [@jbachorik](https://github.com/jbachorik)) - ✨ Bump ddprof to 1.18.0 ([#8173](DataDog/dd-trace-java#8173) - [@jbachorik](https://github.com/jbachorik)) - ✨ Report profiler initialization and configuration errors to telemetry ([#8171](DataDog/dd-trace-java#8171) - [@jbachorik](https://github.com/jbachorik)) ##### Telemetry - ✨ Add pending traces report in tracer flares ([#8053](DataDog/dd-trace-java#8053) - [@mhlidd](https://github.com/mhlidd)) ##### Testing - ✨ Test http server requests in parallel ([#8222](DataDog/dd-trace-java#8222) - [@amarziali](https://github.com/amarziali)) ##### Trace context propagation - ✨ Add non default propagator registration ([#8310](DataDog/dd-trace-java#8310) - [@PerfectSlayer](https://github.com/PerfectSlayer)) ##### Tracer core - ✨ Probe for existence of IBMSASL or ACCP security providers ([#8276](DataDog/dd-trace-java#8276) - [@mcculls](https://github.com/mcculls)) - ✨⚡ Overhead improvement to agent feedback based sampling ([#8265](DataDog/dd-trace-java#8265) - [@dougqh](https://github.com/dougqh)) - 🧹 Move async propagation API from scope to tracer ([#8231](DataDog/dd-trace-java#8231) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Introduce context propagation API ([#8161](DataDog/dd-trace-java#8161) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨🧪 Use env-entry to add tags per webapp deployment ([#8138](DataDog/dd-trace-java#8138) - [@amarziali](https://github.com/amarziali)) - ✨ Introduce context helpers API ([#8134](DataDog/dd-trace-java#8134) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Support IPv6 values for `DD_AGENT_HOST` and `DD_TRACE_AGENT_URL` ([#7984](DataDog/dd-trace-java#7984) - [@mhlidd](https://github.com/mhlidd)) ##### Instrumentations ##### Apache HttpComponents - 🐛 Properly finish spans and support latest apache httpclient5 ([#8272](DataDog/dd-trace-java#8272) - [@amarziali](https://github.com/amarziali)) ##### AWS Lambda instrumentation - 🐛 Properly capture lambda payloads for all handler types. ([#8264](DataDog/dd-trace-java#8264) - [@purple4reina](https://github.com/purple4reina)) ##### AWS S3 instrumentation - 💡 Create S3 instrumentation + add span pointers ([#8075](DataDog/dd-trace-java#8075) - [@nhulston](https://github.com/nhulston)) ##### AWS SDK instrumentation - 🐛 Revert "Add avoid double instrumenting lambda non-streaming handlers." ([#8247](DataDog/dd-trace-java#8247) - [@nhulston](https://github.com/nhulston)) ##### Cassandra - ✨ Allow extracting keyspace from statement result ([#8239](DataDog/dd-trace-java#8239) - [@amarziali](https://github.com/amarziali)) ##### Core Java language instrumentation - ✨ Propagation of translateEscapes of String class ([#8186](DataDog/dd-trace-java#8186) - [@sezen-datadog](https://github.com/sezen-datadog)) ##### Eclipse Vert.x instrumentation - 🐛 Fix vertx worker propagation and error handling ([#8237](DataDog/dd-trace-java#8237) - [@amarziali](https://github.com/amarziali)) - ✨ Support vertx 5 ([#8220](DataDog/dd-trace-java#8220) - [@amarziali](https://github.com/amarziali)) - ✨ Add support for session tracking in Vertx ([#8167](DataDog/dd-trace-java#8167) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) ##### Kafka instrumentation - 🐛 Prevent possible NPE calculating Kafka record header size ([#8292](DataDog/dd-trace-java#8292) - [@ygree](https://github.com/ygree)) ##### Mule instrumentation - 🐛 Fix crash using Mule with JPMS ([#8187](DataDog/dd-trace-java#8187) - [@amarziali](https://github.com/amarziali)) ##### Protocol Buffer instrumentation - ✨ Change hash computation for protobuf to better represent impacting changes + save proto number in schema ([#8201](DataDog/dd-trace-java#8201) - [@vandonr](https://github.com/vandonr)) ##### Spring instrumentation - 🐛 Preserve getQualifier from spring scheduling runnables ([#8293](DataDog/dd-trace-java#8293) - [@amarziali](https://github.com/amarziali)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: bb09d47e4eed77a003f630273b4d0a84003eb899

Fix algorithm of replace(CharSequence, CharSequence) + adding new tests

6dc12f5

Mariovido added type: bug comp: asm iast Application Security Management (IAST) labels Jan 24, 2025

Fix tests

2502bd6

smola changed the title ~~Fix afterReplaceCharSeq call site~~ Fix String.replace instrumentation for IAST Jan 24, 2025

Optimize quoteReplacement to be executed only once

a6353bc

Mariovido added type: bug and removed type: bug labels Jan 24, 2025

smola approved these changes Jan 28, 2025

View reviewed changes

Mariovido marked this pull request as ready for review January 28, 2025 09:13

Mariovido requested a review from a team as a code owner January 28, 2025 09:13

Mariovido requested review from manuel-alvarez-alvarez and jandro996 January 28, 2025 09:13

sezen-datadog approved these changes Jan 28, 2025

View reviewed changes

Return replacedString if everything is fine

1c08728

Mariovido requested a review from a team as a code owner January 28, 2025 10:32

Mariovido added type: bug and removed type: bug labels Jan 28, 2025

manuel-alvarez-alvarez approved these changes Jan 30, 2025

View reviewed changes

Merge branch 'master' into mario.vidal/fix_replace

d23ea24

Mariovido added type: bug and removed type: bug labels Jan 30, 2025

Mariovido merged commit 77fbf0a into master Jan 30, 2025
195 of 196 checks passed

Mariovido deleted the mario.vidal/fix_replace branch January 30, 2025 10:10

github-actions bot added this to the 1.46.0 milestone Jan 30, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix String.replace instrumentation for IAST #8281

Fix String.replace instrumentation for IAST #8281

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Fix String.replace instrumentation for IAST #8281

Fix String.replace instrumentation for IAST #8281

Uh oh!

Conversation

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

Uh oh!

Uh oh!