DRAFT IW #10055
Draft
DRAFT IW #10055
+2,611
−17
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Implements Remote Config infrastructure for Supply Chain Analysis (SCA) vulnerability detection via dynamic instrumentation. This commit adds: - New Product.ASM_SCA enum value for Remote Config product type - CAPABILITY_ASM_SCA_VULNERABILITY_DETECTION capability flag (bit 47) - AppSecSCAConfig data model with InstrumentationTarget (className/methodName) - AppSecSCAConfigDeserializer for JSON deserialization - subscribeSCA()/unsubscribeSCA() lifecycle methods in AppSecConfigServiceImpl - Integration into Remote Config subscription/cleanup flows The subscription stores incoming SCA configs in currentSCAConfig field. Actual bytecode retransformation will be implemented in future commits when AppSecInstrumentationUpdater is added.
Adds dynamic bytecode instrumentation for Supply Chain Analysis (SCA) vulnerability detection. When Remote Config sends instrumentation targets, the agent retransforms loaded classes and injects detection logic at method entry using ASM. Instrumented methods call AppSecSCADetector.onMethodInvocation() to log vulnerable library usage (POC implementation). Future versions will report to Datadog backend with CVE metadata and stack traces.
…Instrumentation API Completes end-to-end integration of SCA hot instrumentation by wiring the Java Instrumentation API through the agent initialization chain. The Instrumentation instance is now passed from Agent.start() → AppSecSystem.start() → AppSecConfigServiceImpl.setInstrumentation(), enabling dynamic bytecode transformation when SCA configs arrive via Remote Config.
jandro996
added
tag: do not merge
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 5 performance regressions! Performance is the same for 49 metrics, 11 unstable metrics.
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.57.0-SNAPSHOT~6e61adb597, baseline=1.57.0-SNAPSHOT~17c7fcf3e9
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.056 s) : 0, 1055974
Total [baseline] (10.814 s) : 0, 10813972
Agent [candidate] (1.071 s) : 0, 1070870
Total [candidate] (11.027 s) : 0, 11026859
section appsec
Agent [baseline] (1.232 s) : 0, 1231998
Total [baseline] (10.897 s) : 0, 10896716
Agent [candidate] (1.233 s) : 0, 1232605
Total [candidate] (10.891 s) : 0, 10891426
section iast
Agent [baseline] (1.211 s) : 0, 1210511
Total [baseline] (11.195 s) : 0, 11194539
Agent [candidate] (1.204 s) : 0, 1203666
Total [candidate] (11.259 s) : 0, 11259432
section profiling
Agent [baseline] (1.208 s) : 0, 1208052
Total [baseline] (10.947 s) : 0, 10946614
Agent [candidate] (1.207 s) : 0, 1206956
Total [candidate] (11.016 s) : 0, 11016497
gantt
title petclinic - break down per module: candidate=1.57.0-SNAPSHOT~6e61adb597, baseline=1.57.0-SNAPSHOT~17c7fcf3e9
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.493 ms) : 0, 1493
crashtracking [candidate] (1.505 ms) : 0, 1505
BytebuddyAgent [baseline] (709.044 ms) : 0, 709044
BytebuddyAgent [candidate] (714.601 ms) : 0, 714601
GlobalTracer [baseline] (250.705 ms) : 0, 250705
GlobalTracer [candidate] (252.174 ms) : 0, 252174
AppSec [baseline] (32.217 ms) : 0, 32217
AppSec [candidate] (39.763 ms) : 0, 39763
Debugger [baseline] (6.43 ms) : 0, 6430
Debugger [candidate] (6.76 ms) : 0, 6760
Remote Config [baseline] (682.289 µs) : 0, 682
Remote Config [candidate] (699.534 µs) : 0, 700
Telemetry [baseline] (14.061 ms) : 0, 14061
Telemetry [candidate] (14.597 ms) : 0, 14597
Flare Poller [baseline] (6.434 ms) : 0, 6434
Flare Poller [candidate] (5.744 ms) : 0, 5744
section appsec
crashtracking [baseline] (1.497 ms) : 0, 1497
crashtracking [candidate] (1.481 ms) : 0, 1481
BytebuddyAgent [baseline] (733.253 ms) : 0, 733253
BytebuddyAgent [candidate] (732.576 ms) : 0, 732576
GlobalTracer [baseline] (242.472 ms) : 0, 242472
GlobalTracer [candidate] (242.179 ms) : 0, 242179
AppSec [baseline] (175.587 ms) : 0, 175587
AppSec [candidate] (177.503 ms) : 0, 177503
Debugger [baseline] (6.302 ms) : 0, 6302
Debugger [candidate] (6.268 ms) : 0, 6268
Remote Config [baseline] (686.361 µs) : 0, 686
Remote Config [candidate] (692.527 µs) : 0, 693
Telemetry [baseline] (8.126 ms) : 0, 8126
Telemetry [candidate] (8.135 ms) : 0, 8135
Flare Poller [baseline] (3.962 ms) : 0, 3962
Flare Poller [candidate] (3.894 ms) : 0, 3894
IAST [baseline] (25.075 ms) : 0, 25075
IAST [candidate] (24.885 ms) : 0, 24885
section iast
crashtracking [baseline] (1.512 ms) : 0, 1512
crashtracking [candidate] (1.482 ms) : 0, 1482
BytebuddyAgent [baseline] (845.315 ms) : 0, 845315
BytebuddyAgent [candidate] (834.096 ms) : 0, 834096
GlobalTracer [baseline] (240.33 ms) : 0, 240330
GlobalTracer [candidate] (239.041 ms) : 0, 239041
AppSec [baseline] (31.647 ms) : 0, 31647
AppSec [candidate] (36.727 ms) : 0, 36727
Debugger [baseline] (6.135 ms) : 0, 6135
Debugger [candidate] (6.144 ms) : 0, 6144
Remote Config [baseline] (617.072 µs) : 0, 617
Remote Config [candidate] (601.204 µs) : 0, 601
Telemetry [baseline] (8.154 ms) : 0, 8154
Telemetry [candidate] (7.925 ms) : 0, 7925
Flare Poller [baseline] (10.931 ms) : 0, 10931
Flare Poller [candidate] (10.931 ms) : 0, 10931
IAST [baseline] (30.543 ms) : 0, 30543
IAST [candidate] (31.734 ms) : 0, 31734
section profiling
crashtracking [baseline] (1.454 ms) : 0, 1454
crashtracking [candidate] (1.433 ms) : 0, 1433
BytebuddyAgent [baseline] (740.675 ms) : 0, 740675
BytebuddyAgent [candidate] (735.757 ms) : 0, 735757
GlobalTracer [baseline] (224.021 ms) : 0, 224021
GlobalTracer [candidate] (223.013 ms) : 0, 223013
AppSec [baseline] (32.468 ms) : 0, 32468
AppSec [candidate] (39.464 ms) : 0, 39464
Debugger [baseline] (7.685 ms) : 0, 7685
Debugger [candidate] (10.723 ms) : 0, 10723
Remote Config [baseline] (719.253 µs) : 0, 719
Remote Config [candidate] (2.984 ms) : 0, 2984
Telemetry [baseline] (15.684 ms) : 0, 15684
Telemetry [candidate] (9.768 ms) : 0, 9768
Flare Poller [baseline] (4.161 ms) : 0, 4161
Flare Poller [candidate] (4.295 ms) : 0, 4295
ProfilingAgent [baseline] (111.469 ms) : 0, 111469
ProfilingAgent [candidate] (110.104 ms) : 0, 110104
Profiling [baseline] (112.094 ms) : 0, 112094
Profiling [candidate] (110.776 ms) : 0, 110776
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.57.0-SNAPSHOT~6e61adb597, baseline=1.57.0-SNAPSHOT~17c7fcf3e9
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.055 s) : 0, 1055251
Total [baseline] (8.723 s) : 0, 8722845
Agent [candidate] (1.059 s) : 0, 1058930
Total [candidate] (8.747 s) : 0, 8746707
section iast
Agent [baseline] (1.201 s) : 0, 1201138
Total [baseline] (9.362 s) : 0, 9362310
Agent [candidate] (1.203 s) : 0, 1202928
Total [candidate] (9.318 s) : 0, 9318247
gantt
title insecure-bank - break down per module: candidate=1.57.0-SNAPSHOT~6e61adb597, baseline=1.57.0-SNAPSHOT~17c7fcf3e9
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.5 ms) : 0, 1500
crashtracking [candidate] (1.488 ms) : 0, 1488
BytebuddyAgent [baseline] (709.098 ms) : 0, 709098
BytebuddyAgent [candidate] (707.14 ms) : 0, 707140
GlobalTracer [baseline] (250.097 ms) : 0, 250097
GlobalTracer [candidate] (249.407 ms) : 0, 249407
AppSec [baseline] (31.96 ms) : 0, 31960
AppSec [candidate] (38.996 ms) : 0, 38996
Debugger [baseline] (6.404 ms) : 0, 6404
Debugger [candidate] (6.705 ms) : 0, 6705
Remote Config [baseline] (683.016 µs) : 0, 683
Remote Config [candidate] (693.394 µs) : 0, 693
Telemetry [baseline] (15.663 ms) : 0, 15663
Telemetry [candidate] (14.044 ms) : 0, 14044
Flare Poller [baseline] (4.885 ms) : 0, 4885
Flare Poller [candidate] (5.701 ms) : 0, 5701
section iast
crashtracking [baseline] (1.496 ms) : 0, 1496
crashtracking [candidate] (1.482 ms) : 0, 1482
BytebuddyAgent [baseline] (837.491 ms) : 0, 837491
BytebuddyAgent [candidate] (833.995 ms) : 0, 833995
GlobalTracer [baseline] (239.172 ms) : 0, 239172
GlobalTracer [candidate] (238.93 ms) : 0, 238930
AppSec [baseline] (30.797 ms) : 0, 30797
AppSec [candidate] (33.021 ms) : 0, 33021
Debugger [baseline] (6.134 ms) : 0, 6134
Debugger [candidate] (6.04 ms) : 0, 6040
Remote Config [baseline] (622.874 µs) : 0, 623
Remote Config [candidate] (592.909 µs) : 0, 593
Telemetry [baseline] (8.099 ms) : 0, 8099
Telemetry [candidate] (7.788 ms) : 0, 7788
Flare Poller [baseline] (10.788 ms) : 0, 10788
Flare Poller [candidate] (10.971 ms) : 0, 10971
IAST [baseline] (31.472 ms) : 0, 31472
IAST [candidate] (35.269 ms) : 0, 35269
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 6 performance regressions! Performance is the same for 15 metrics, 15 unstable metrics.
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.57.0-SNAPSHOT~6e61adb597, baseline=1.57.0-SNAPSHOT~17c7fcf3e9
dateFormat X
axisFormat %s
section baseline
no_agent (1.212 ms) : 1200, 1224
. : milestone, 1212,
iast (3.19 ms) : 3145, 3236
. : milestone, 3190,
iast_FULL (5.748 ms) : 5691, 5806
. : milestone, 5748,
iast_GLOBAL (3.654 ms) : 3600, 3708
. : milestone, 3654,
profiling (1.962 ms) : 1946, 1979
. : milestone, 1962,
tracing (1.827 ms) : 1813, 1842
. : milestone, 1827,
section candidate
no_agent (1.224 ms) : 1212, 1237
. : milestone, 1224,
iast (3.275 ms) : 3234, 3316
. : milestone, 3275,
iast_FULL (6.052 ms) : 5991, 6114
. : milestone, 6052,
iast_GLOBAL (3.517 ms) : 3469, 3565
. : milestone, 3517,
profiling (2.037 ms) : 2018, 2055
. : milestone, 2037,
tracing (1.812 ms) : 1797, 1827
. : milestone, 1812,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.57.0-SNAPSHOT~6e61adb597, baseline=1.57.0-SNAPSHOT~17c7fcf3e9
dateFormat X
axisFormat %s
section baseline
no_agent (19.069 ms) : 18875, 19263
. : milestone, 19069,
appsec (18.766 ms) : 18577, 18956
. : milestone, 18766,
code_origins (17.606 ms) : 17428, 17784
. : milestone, 17606,
iast (17.458 ms) : 17285, 17631
. : milestone, 17458,
profiling (18.236 ms) : 18055, 18417
. : milestone, 18236,
tracing (17.541 ms) : 17365, 17716
. : milestone, 17541,
section candidate
no_agent (19.27 ms) : 19076, 19465
. : milestone, 19270,
appsec (19.554 ms) : 19356, 19752
. : milestone, 19554,
code_origins (18.366 ms) : 18180, 18551
. : milestone, 18366,
iast (17.542 ms) : 17366, 17719
. : milestone, 17542,
profiling (20.083 ms) : 19868, 20297
. : milestone, 20083,
tracing (18.597 ms) : 18409, 18784
. : milestone, 18597,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.57.0-SNAPSHOT~6e61adb597, baseline=1.57.0-SNAPSHOT~17c7fcf3e9
dateFormat X
axisFormat %s
section baseline
no_agent (1.476 ms) : 1464, 1487
. : milestone, 1476,
appsec (2.45 ms) : 2399, 2501
. : milestone, 2450,
iast (2.211 ms) : 2147, 2276
. : milestone, 2211,
iast_GLOBAL (2.255 ms) : 2190, 2320
. : milestone, 2255,
profiling (2.073 ms) : 2020, 2126
. : milestone, 2073,
tracing (2.042 ms) : 1991, 2093
. : milestone, 2042,
section candidate
no_agent (1.476 ms) : 1465, 1488
. : milestone, 1476,
appsec (3.688 ms) : 3469, 3907
. : milestone, 3688,
iast (2.212 ms) : 2147, 2277
. : milestone, 2212,
iast_GLOBAL (2.256 ms) : 2191, 2321
. : milestone, 2256,
profiling (2.094 ms) : 2040, 2148
. : milestone, 2094,
tracing (2.041 ms) : 1990, 2092
. : milestone, 2041,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.57.0-SNAPSHOT~6e61adb597, baseline=1.57.0-SNAPSHOT~17c7fcf3e9
dateFormat X
axisFormat %s
section baseline
no_agent (15.578 s) : 15578000, 15578000
. : milestone, 15578000,
appsec (14.872 s) : 14872000, 14872000
. : milestone, 14872000,
iast (18.236 s) : 18236000, 18236000
. : milestone, 18236000,
iast_GLOBAL (18.306 s) : 18306000, 18306000
. : milestone, 18306000,
profiling (14.956 s) : 14956000, 14956000
. : milestone, 14956000,
tracing (14.815 s) : 14815000, 14815000
. : milestone, 14815000,
section candidate
no_agent (15.511 s) : 15511000, 15511000
. : milestone, 15511000,
appsec (15.096 s) : 15096000, 15096000
. : milestone, 15096000,
iast (18.379 s) : 18379000, 18379000
. : milestone, 18379000,
iast_GLOBAL (18.018 s) : 18018000, 18018000
. : milestone, 18018000,
profiling (14.914 s) : 14914000, 14914000
. : milestone, 14914000,
tracing (14.511 s) : 14511000, 14511000
. : milestone, 14511000,
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Motivation
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any useful labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: [PROJ-IDENT]