Create span tag: _dd.appsec.rasp.timeout #8269

Mariovido · 2025-01-22T14:38:03Z

What Does This Do

This adds a new span tag that was previously missing and is necessary for the consolidation of ASM Span Tags, Metrics, and Logs across all supported languages. The newly implemented span tag is as follows:

_dd.appsec.rasp.timeout: Represents a RASP timeout. This value is a counter when the library experiences a per-run timeout.

Motivation

Our goal is to implement all the missing ASM Span Tags, Metrics, and Logs.

Additional Notes

Also, this PR adds tests that were missing.

Contributor Checklist

Format the title according the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any usefull labels
Don't use close, fix or any linking keywords when referencing an issue.
Use solves instead, and assign the PR milestone to the issue
Update the public documentation in case of new configuration flag or behavior

Jira ticket: APPSEC-56477

pr-commenter · 2025-01-22T15:11:52Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mario.vidal/span_rasp_timeout
git_commit_date	1738228543	1738229042
git_commit_sha	`d3cfbcb`	`7ec2cb4`
release_version	1.46.0-SNAPSHOT~d3cfbcbf17	1.46.0-SNAPSHOT~7ec2cb4633

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1738231579	1738231579
ci_job_id	786899876	786899876
ci_pipeline_id	54415913	54415913
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-unakjcuf-project-304-concurrent-2-4gzt61tl 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-unakjcuf-project-304-concurrent-2-4gzt61tl 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 51 metrics, 12 unstable metrics.

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.46.0-SNAPSHOT~7ec2cb4633, baseline=1.46.0-SNAPSHOT~d3cfbcbf17

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.036 s) : 0, 1035748
Total [baseline] (10.503 s) : 0, 10503106
Agent [candidate] (1.038 s) : 0, 1038009
Total [candidate] (10.489 s) : 0, 10488970
section appsec
Agent [baseline] (1.183 s) : 0, 1182737
Total [baseline] (10.766 s) : 0, 10765860
Agent [candidate] (1.182 s) : 0, 1182111
Total [candidate] (10.739 s) : 0, 10739203
section iast
Agent [baseline] (1.17 s) : 0, 1169704
Total [baseline] (10.973 s) : 0, 10972762
Agent [candidate] (1.177 s) : 0, 1176983
Total [candidate] (10.968 s) : 0, 10968229
section profiling
Agent [baseline] (1.262 s) : 0, 1261619
Total [baseline] (10.902 s) : 0, 10902337
Agent [candidate] (1.26 s) : 0, 1260148
Total [candidate] (10.881 s) : 0, 10880568

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.036 s	-
Agent	appsec	1.183 s	146.989 ms (14.2%)
Agent	iast	1.17 s	133.955 ms (12.9%)
Agent	profiling	1.262 s	225.871 ms (21.8%)
Total	tracing	10.503 s	-
Total	appsec	10.766 s	262.754 ms (2.5%)
Total	iast	10.973 s	469.657 ms (4.5%)
Total	profiling	10.902 s	399.232 ms (3.8%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.038 s	-
Agent	appsec	1.182 s	144.102 ms (13.9%)
Agent	iast	1.177 s	138.974 ms (13.4%)
Agent	profiling	1.26 s	222.139 ms (21.4%)
Total	tracing	10.489 s	-
Total	appsec	10.739 s	250.233 ms (2.4%)
Total	iast	10.968 s	479.258 ms (4.6%)
Total	profiling	10.881 s	391.597 ms (3.7%)

gantt
    title petclinic - break down per module: candidate=1.46.0-SNAPSHOT~7ec2cb4633, baseline=1.46.0-SNAPSHOT~d3cfbcbf17

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (713.684 ms) : 0, 713684
BytebuddyAgent [candidate] (714.1 ms) : 0, 714100
GlobalTracer [baseline] (239.367 ms) : 0, 239367
GlobalTracer [candidate] (240.042 ms) : 0, 240042
AppSec [baseline] (55.409 ms) : 0, 55409
AppSec [candidate] (55.369 ms) : 0, 55369
Remote Config [baseline] (706.16 µs) : 0, 706
Remote Config [candidate] (717.921 µs) : 0, 718
Telemetry [baseline] (11.366 ms) : 0, 11366
Telemetry [candidate] (12.494 ms) : 0, 12494
section appsec
BytebuddyAgent [baseline] (733.55 ms) : 0, 733550
BytebuddyAgent [candidate] (732.38 ms) : 0, 732380
GlobalTracer [baseline] (237.755 ms) : 0, 237755
GlobalTracer [candidate] (238.221 ms) : 0, 238221
AppSec [baseline] (176.409 ms) : 0, 176409
AppSec [candidate] (175.642 ms) : 0, 175642
Remote Config [baseline] (650.78 µs) : 0, 651
Remote Config [candidate] (669.083 µs) : 0, 669
Telemetry [baseline] (8.314 ms) : 0, 8314
Telemetry [candidate] (9.057 ms) : 0, 9057
IAST [baseline] (21.431 ms) : 0, 21431
IAST [candidate] (21.715 ms) : 0, 21715
section iast
BytebuddyAgent [baseline] (834.504 ms) : 0, 834504
BytebuddyAgent [candidate] (839.426 ms) : 0, 839426
GlobalTracer [baseline] (231.079 ms) : 0, 231079
GlobalTracer [candidate] (232.317 ms) : 0, 232317
AppSec [baseline] (53.66 ms) : 0, 53660
AppSec [candidate] (53.616 ms) : 0, 53616
Remote Config [baseline] (617.996 µs) : 0, 618
Remote Config [candidate] (621.322 µs) : 0, 621
Telemetry [baseline] (8.736 ms) : 0, 8736
Telemetry [candidate] (8.783 ms) : 0, 8783
IAST [baseline] (25.696 ms) : 0, 25696
IAST [candidate] (26.716 ms) : 0, 26716
section profiling
ProfilingAgent [baseline] (96.839 ms) : 0, 96839
ProfilingAgent [candidate] (94.944 ms) : 0, 94944
BytebuddyAgent [baseline] (705.994 ms) : 0, 705994
BytebuddyAgent [candidate] (706.673 ms) : 0, 706673
GlobalTracer [baseline] (351.881 ms) : 0, 351881
GlobalTracer [candidate] (352.134 ms) : 0, 352134
AppSec [baseline] (55.094 ms) : 0, 55094
AppSec [candidate] (54.436 ms) : 0, 54436
Remote Config [baseline] (716.987 µs) : 0, 717
Remote Config [candidate] (706.001 µs) : 0, 706
Telemetry [baseline] (8.943 ms) : 0, 8943
Telemetry [candidate] (8.883 ms) : 0, 8883
Profiling [baseline] (96.865 ms) : 0, 96865
Profiling [candidate] (94.969 ms) : 0, 94969

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.46.0-SNAPSHOT~7ec2cb4633, baseline=1.46.0-SNAPSHOT~d3cfbcbf17

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.047 s) : 0, 1047035
Total [baseline] (8.658 s) : 0, 8657925
Agent [candidate] (1.045 s) : 0, 1045317
Total [candidate] (8.667 s) : 0, 8667045
section iast
Agent [baseline] (1.171 s) : 0, 1171138
Total [baseline] (9.244 s) : 0, 9244129
Agent [candidate] (1.176 s) : 0, 1176314
Total [candidate] (9.301 s) : 0, 9301494
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.175 s) : 0, 1175459
Total [baseline] (9.208 s) : 0, 9207985
Agent [candidate] (1.177 s) : 0, 1177386
Total [candidate] (9.201 s) : 0, 9201342
section iast_TELEMETRY_OFF
Agent [baseline] (1.164 s) : 0, 1163951
Total [baseline] (9.207 s) : 0, 9207086
Agent [candidate] (1.177 s) : 0, 1176776
Total [candidate] (9.284 s) : 0, 9284252

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.047 s	-
Agent	iast	1.171 s	124.103 ms (11.9%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.175 s	128.424 ms (12.3%)
Agent	iast_TELEMETRY_OFF	1.164 s	116.916 ms (11.2%)
Total	tracing	8.658 s	-
Total	iast	9.244 s	586.204 ms (6.8%)
Total	iast_HARDCODED_SECRET_DISABLED	9.208 s	550.06 ms (6.4%)
Total	iast_TELEMETRY_OFF	9.207 s	549.161 ms (6.3%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.045 s	-
Agent	iast	1.176 s	130.996 ms (12.5%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.177 s	132.068 ms (12.6%)
Agent	iast_TELEMETRY_OFF	1.177 s	131.459 ms (12.6%)
Total	tracing	8.667 s	-
Total	iast	9.301 s	634.449 ms (7.3%)
Total	iast_HARDCODED_SECRET_DISABLED	9.201 s	534.297 ms (6.2%)
Total	iast_TELEMETRY_OFF	9.284 s	617.206 ms (7.1%)

gantt
    title insecure-bank - break down per module: candidate=1.46.0-SNAPSHOT~7ec2cb4633, baseline=1.46.0-SNAPSHOT~d3cfbcbf17

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (720.757 ms) : 0, 720757
BytebuddyAgent [candidate] (720.095 ms) : 0, 720095
GlobalTracer [baseline] (241.356 ms) : 0, 241356
GlobalTracer [candidate] (241.495 ms) : 0, 241495
AppSec [baseline] (55.676 ms) : 0, 55676
AppSec [candidate] (55.419 ms) : 0, 55419
Remote Config [baseline] (724.431 µs) : 0, 724
Remote Config [candidate] (710.289 µs) : 0, 710
Telemetry [baseline] (13.126 ms) : 0, 13126
Telemetry [candidate] (12.244 ms) : 0, 12244
section iast
BytebuddyAgent [baseline] (834.547 ms) : 0, 834547
BytebuddyAgent [candidate] (839.494 ms) : 0, 839494
GlobalTracer [baseline] (231.815 ms) : 0, 231815
GlobalTracer [candidate] (232.302 ms) : 0, 232302
IAST [baseline] (24.228 ms) : 0, 24228
IAST [candidate] (27.453 ms) : 0, 27453
AppSec [baseline] (55.104 ms) : 0, 55104
AppSec [candidate] (52.113 ms) : 0, 52113
Remote Config [baseline] (621.378 µs) : 0, 621
Remote Config [candidate] (627.924 µs) : 0, 628
Telemetry [baseline] (8.836 ms) : 0, 8836
Telemetry [candidate] (8.797 ms) : 0, 8797
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (839.633 ms) : 0, 839633
BytebuddyAgent [candidate] (839.893 ms) : 0, 839893
GlobalTracer [baseline] (231.337 ms) : 0, 231337
GlobalTracer [candidate] (232.132 ms) : 0, 232132
IAST [baseline] (26.449 ms) : 0, 26449
IAST [candidate] (22.923 ms) : 0, 22923
AppSec [baseline] (53.181 ms) : 0, 53181
AppSec [candidate] (57.663 ms) : 0, 57663
Remote Config [baseline] (614.186 µs) : 0, 614
Remote Config [candidate] (623.34 µs) : 0, 623
Telemetry [baseline] (8.793 ms) : 0, 8793
Telemetry [candidate] (8.752 ms) : 0, 8752
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (830.4 ms) : 0, 830400
BytebuddyAgent [candidate] (840.416 ms) : 0, 840416
GlobalTracer [baseline] (229.645 ms) : 0, 229645
GlobalTracer [candidate] (232.027 ms) : 0, 232027
IAST [baseline] (25.169 ms) : 0, 25169
IAST [candidate] (23.671 ms) : 0, 23671
AppSec [baseline] (54.09 ms) : 0, 54090
AppSec [candidate] (55.971 ms) : 0, 55971
Remote Config [baseline] (620.43 µs) : 0, 620
Remote Config [candidate] (612.269 µs) : 0, 612
Telemetry [baseline] (8.594 ms) : 0, 8594
Telemetry [candidate] (8.61 ms) : 0, 8610

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
end_time	2025-01-30T09:36:18	2025-01-30T09:43:22
git_branch	master	mario.vidal/span_rasp_timeout
git_commit_date	1738228543	1738229042
git_commit_sha	`d3cfbcb`	`7ec2cb4`
release_version	1.46.0-SNAPSHOT~d3cfbcbf17	1.46.0-SNAPSHOT~7ec2cb4633
start_time	2025-01-30T09:36:04	2025-01-30T09:43:08

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1738230560	1738230560
ci_job_id	786899877	786899877
ci_pipeline_id	54415913	54415913
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-unakjcuf-project-304-concurrent-3-bbetmylz 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-unakjcuf-project-304-concurrent-3-bbetmylz 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 17 unstable metrics.

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~7ec2cb4633, baseline=1.46.0-SNAPSHOT~d3cfbcbf17
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.341 ms) : 1322, 1361
.   : milestone, 1341,
appsec (1.774 ms) : 1751, 1797
.   : milestone, 1774,
appsec_no_iast (1.739 ms) : 1713, 1764
.   : milestone, 1739,
iast (1.511 ms) : 1487, 1536
.   : milestone, 1511,
profiling (1.529 ms) : 1504, 1555
.   : milestone, 1529,
tracing (1.488 ms) : 1464, 1513
.   : milestone, 1488,
section candidate
no_agent (1.35 ms) : 1330, 1369
.   : milestone, 1350,
appsec (1.729 ms) : 1706, 1753
.   : milestone, 1729,
appsec_no_iast (1.746 ms) : 1722, 1770
.   : milestone, 1746,
iast (1.507 ms) : 1482, 1532
.   : milestone, 1507,
profiling (1.57 ms) : 1545, 1594
.   : milestone, 1570,
tracing (1.482 ms) : 1458, 1506
.   : milestone, 1482,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.341 ms [1.322 ms, 1.361 ms]	-
appsec	1.774 ms [1.751 ms, 1.797 ms]	432.534 µs (32.2%)
appsec_no_iast	1.739 ms [1.713 ms, 1.764 ms]	397.108 µs (29.6%)
iast	1.511 ms [1.487 ms, 1.536 ms]	169.796 µs (12.7%)
profiling	1.529 ms [1.504 ms, 1.555 ms]	187.651 µs (14.0%)
tracing	1.488 ms [1.464 ms, 1.513 ms]	147.031 µs (11.0%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.35 ms [1.33 ms, 1.369 ms]	-
appsec	1.729 ms [1.706 ms, 1.753 ms]	379.633 µs (28.1%)
appsec_no_iast	1.746 ms [1.722 ms, 1.77 ms]	395.981 µs (29.3%)
iast	1.507 ms [1.482 ms, 1.532 ms]	157.364 µs (11.7%)
profiling	1.57 ms [1.545 ms, 1.594 ms]	220.157 µs (16.3%)
tracing	1.482 ms [1.458 ms, 1.506 ms]	132.43 µs (9.8%)

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~7ec2cb4633, baseline=1.46.0-SNAPSHOT~d3cfbcbf17
    dateFormat X
    axisFormat %s
section baseline
no_agent (374.743 µs) : 353, 396
.   : milestone, 375,
iast (505.402 µs) : 482, 528
.   : milestone, 505,
iast_FULL (733.839 µs) : 711, 757
.   : milestone, 734,
iast_GLOBAL (557.193 µs) : 534, 580
.   : milestone, 557,
iast_HARDCODED_SECRET_DISABLED (502.985 µs) : 480, 526
.   : milestone, 503,
iast_INACTIVE (454.789 µs) : 433, 476
.   : milestone, 455,
iast_TELEMETRY_OFF (489.76 µs) : 467, 513
.   : milestone, 490,
tracing (455.091 µs) : 434, 477
.   : milestone, 455,
section candidate
no_agent (367.958 µs) : 348, 387
.   : milestone, 368,
iast (508.981 µs) : 486, 532
.   : milestone, 509,
iast_FULL (740.223 µs) : 717, 763
.   : milestone, 740,
iast_GLOBAL (548.909 µs) : 526, 572
.   : milestone, 549,
iast_HARDCODED_SECRET_DISABLED (505.849 µs) : 483, 529
.   : milestone, 506,
iast_INACTIVE (457.346 µs) : 435, 479
.   : milestone, 457,
iast_TELEMETRY_OFF (507.668 µs) : 484, 531
.   : milestone, 508,
tracing (446.076 µs) : 426, 467
.   : milestone, 446,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	374.743 µs [353.313 µs, 396.173 µs]	-
iast	505.402 µs [482.425 µs, 528.379 µs]	130.659 µs (34.9%)
iast_FULL	733.839 µs [710.745 µs, 756.933 µs]	359.096 µs (95.8%)
iast_GLOBAL	557.193 µs [534.376 µs, 580.01 µs]	182.45 µs (48.7%)
iast_HARDCODED_SECRET_DISABLED	502.985 µs [480.046 µs, 525.925 µs]	128.242 µs (34.2%)
iast_INACTIVE	454.789 µs [433.113 µs, 476.466 µs]	80.046 µs (21.4%)
iast_TELEMETRY_OFF	489.76 µs [466.784 µs, 512.737 µs]	115.017 µs (30.7%)
tracing	455.091 µs [433.5 µs, 476.682 µs]	80.348 µs (21.4%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	367.958 µs [348.445 µs, 387.472 µs]	-
iast	508.981 µs [485.771 µs, 532.19 µs]	141.022 µs (38.3%)
iast_FULL	740.223 µs [717.116 µs, 763.331 µs]	372.265 µs (101.2%)
iast_GLOBAL	548.909 µs [526.011 µs, 571.807 µs]	180.951 µs (49.2%)
iast_HARDCODED_SECRET_DISABLED	505.849 µs [482.958 µs, 528.739 µs]	137.89 µs (37.5%)
iast_INACTIVE	457.346 µs [435.245 µs, 479.447 µs]	89.388 µs (24.3%)
iast_TELEMETRY_OFF	507.668 µs [484.292 µs, 531.045 µs]	139.71 µs (38.0%)
tracing	446.076 µs [425.651 µs, 466.502 µs]	78.118 µs (21.2%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mario.vidal/span_rasp_timeout
git_commit_date	1738228543	1738229042
git_commit_sha	`d3cfbcb`	`7ec2cb4`
release_version	1.46.0-SNAPSHOT~d3cfbcbf17	1.46.0-SNAPSHOT~7ec2cb4633

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1738231112	1738231112
ci_job_id	786899878	786899878
ci_pipeline_id	54415913	54415913
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-pgoe76dg-project-304-concurrent-1-thjtan6u 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-pgoe76dg-project-304-concurrent-1-thjtan6u 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~7ec2cb4633, baseline=1.46.0-SNAPSHOT~d3cfbcbf17
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.478 s) : 15478000, 15478000
.   : milestone, 15478000,
appsec (14.998 s) : 14998000, 14998000
.   : milestone, 14998000,
iast (19.058 s) : 19058000, 19058000
.   : milestone, 19058000,
iast_GLOBAL (17.947 s) : 17947000, 17947000
.   : milestone, 17947000,
profiling (15.064 s) : 15064000, 15064000
.   : milestone, 15064000,
tracing (15.145 s) : 15145000, 15145000
.   : milestone, 15145000,
section candidate
no_agent (14.935 s) : 14935000, 14935000
.   : milestone, 14935000,
appsec (14.849 s) : 14849000, 14849000
.   : milestone, 14849000,
iast (19.062 s) : 19062000, 19062000
.   : milestone, 19062000,
iast_GLOBAL (18.535 s) : 18535000, 18535000
.   : milestone, 18535000,
profiling (15.217 s) : 15217000, 15217000
.   : milestone, 15217000,
tracing (15.058 s) : 15058000, 15058000
.   : milestone, 15058000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.478 s [15.478 s, 15.478 s]	-
appsec	14.998 s [14.998 s, 14.998 s]	-480.0 ms (-3.1%)
iast	19.058 s [19.058 s, 19.058 s]	3.58 s (23.1%)
iast_GLOBAL	17.947 s [17.947 s, 17.947 s]	2.469 s (16.0%)
profiling	15.064 s [15.064 s, 15.064 s]	-414.0 ms (-2.7%)
tracing	15.145 s [15.145 s, 15.145 s]	-333.0 ms (-2.2%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	14.935 s [14.935 s, 14.935 s]	-
appsec	14.849 s [14.849 s, 14.849 s]	-86.0 ms (-0.6%)
iast	19.062 s [19.062 s, 19.062 s]	4.127 s (27.6%)
iast_GLOBAL	18.535 s [18.535 s, 18.535 s]	3.6 s (24.1%)
profiling	15.217 s [15.217 s, 15.217 s]	282.0 ms (1.9%)
tracing	15.058 s [15.058 s, 15.058 s]	123.0 ms (0.8%)

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~7ec2cb4633, baseline=1.46.0-SNAPSHOT~d3cfbcbf17
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.468 ms) : 1457, 1480
.   : milestone, 1468,
appsec (2.359 ms) : 2316, 2402
.   : milestone, 2359,
iast (2.098 ms) : 2044, 2153
.   : milestone, 2098,
iast_GLOBAL (2.146 ms) : 2091, 2200
.   : milestone, 2146,
profiling (1.959 ms) : 1916, 2003
.   : milestone, 1959,
tracing (1.947 ms) : 1905, 1989
.   : milestone, 1947,
section candidate
no_agent (1.472 ms) : 1460, 1483
.   : milestone, 1472,
appsec (2.349 ms) : 2306, 2393
.   : milestone, 2349,
iast (2.1 ms) : 2045, 2155
.   : milestone, 2100,
iast_GLOBAL (2.151 ms) : 2097, 2206
.   : milestone, 2151,
profiling (1.998 ms) : 1952, 2043
.   : milestone, 1998,
tracing (1.948 ms) : 1905, 1990
.   : milestone, 1948,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.468 ms [1.457 ms, 1.48 ms]	-
appsec	2.359 ms [2.316 ms, 2.402 ms]	890.957 µs (60.7%)
iast	2.098 ms [2.044 ms, 2.153 ms]	629.877 µs (42.9%)
iast_GLOBAL	2.146 ms [2.091 ms, 2.2 ms]	677.498 µs (46.1%)
profiling	1.959 ms [1.916 ms, 2.003 ms]	491.007 µs (33.4%)
tracing	1.947 ms [1.905 ms, 1.989 ms]	478.707 µs (32.6%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.472 ms [1.46 ms, 1.483 ms]	-
appsec	2.349 ms [2.306 ms, 2.393 ms]	877.491 µs (59.6%)
iast	2.1 ms [2.045 ms, 2.155 ms]	628.433 µs (42.7%)
iast_GLOBAL	2.151 ms [2.097 ms, 2.206 ms]	679.734 µs (46.2%)
profiling	1.998 ms [1.952 ms, 2.043 ms]	525.933 µs (35.7%)
tracing	1.948 ms [1.905 ms, 1.99 ms]	475.9 µs (32.3%)

dd-java-agent/appsec/src/main/java/com/datadog/appsec/powerwaf/PowerWAFModule.java

manuel-alvarez-alvarez · 2025-01-27T13:10:38Z

Can we have a look to the performance benchmarks? (maybe the issue is spurious and fixes itself by running them again)

Mariovido · 2025-01-27T15:38:19Z

Can we have a look to the performance benchmarks? (maybe the issue is spurious and fixes itself by running them again)

@manuel-alvarez-alvarez I have rerun again the benchmarks and it seems that the results are fine :)

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.cloud:google-cloud-datastore](https://github.com/googleapis/java-datastore) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.25.4` -> `2.26.0` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.45.2` -> `1.46.0` | | [com.datadoghq:dd-trace-ot](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.45.2` -> `1.46.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | --- ### Release Notes <details> <summary>googleapis/java-datastore (com.google.cloud:google-cloud-datastore)</summary> ### [`v2.26.0`](https://github.com/googleapis/java-datastore/blob/HEAD/CHANGELOG.md#2260-2025-01-29) ##### Features - Add firestoreInDatastoreMode for datastore emulator ([#1698](googleapis/java-datastore#1698)) ([50f106d](googleapis/java-datastore@50f106d)) ##### Dependencies - Update dependency com.google.cloud:sdk-platform-java-config to v3.42.0 ([#1725](googleapis/java-datastore#1725)) ([1cbaf22](googleapis/java-datastore@1cbaf22)) </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.46.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.46.0): 1.46.0 ##### Breaking Changes > \[!WARNING] > jnr-unixsocket is now an external dependency of dd-trace-ot and must be included when deploying dd-trace-ot. > \[!NOTE] > The API `TracerScope.setAsync(boolean)`, used to manually control asynchronous span propagation, does no more apply to the scope instance but to the active span scope. ##### Components ##### Application Security Management (IAST) - 🐛 Fix String.replace instrumentation for IAST ([#8281](DataDog/dd-trace-java#8281) - [@Mariovido](https://github.com/Mariovido)) - ✨ Apply the standard nomenclature to the stacktrace configs ([#8244](DataDog/dd-trace-java#8244) - [@jandro996](https://github.com/jandro996)) - 🐛 Exclude false positive weak randomness ([#8232](DataDog/dd-trace-java#8232) - [@jandro996](https://github.com/jandro996)) - ✨ Propagation of translateEscapes of String class ([#8186](DataDog/dd-trace-java#8186) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Add security control metrics ([#8175](DataDog/dd-trace-java#8175) - [@jandro996](https://github.com/jandro996)) - ✨ Increase IAST propagation to StringBuffer setLength ([#8128](DataDog/dd-trace-java#8128) - [@Mariovido](https://github.com/Mariovido)) - ✨ Add IAST taint tracking for DB values ([#8072](DataDog/dd-trace-java#8072) - [@Mariovido](https://github.com/Mariovido)) ##### Application Security Management (WAF) - 🐛 Prevents a NPE when there is no subscriber for user events ([#8258](DataDog/dd-trace-java#8258) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Apply the standard nomenclature to the stacktrace configs ([#8244](DataDog/dd-trace-java#8244) - [@jandro996](https://github.com/jandro996)) - 🐛 Ensure cached subscriptions are cleared on reconfiguration via RC ([#8229](DataDog/dd-trace-java#8229) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Add support for session tracking in Vertx ([#8167](DataDog/dd-trace-java#8167) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Create span tag: \_dd.appsec.rasp.timeout ([#8269](DataDog/dd-trace-java#8269) - [@Mariovido](https://github.com/Mariovido)) ##### Build & Tooling - 🐛 Ensure shaded helpers have unique names when injected into class-loaders ([#8192](DataDog/dd-trace-java#8192) - [@mcculls](https://github.com/mcculls)) ##### Configuration at Runtime - 🐛 Remove filtering of `DD_SERVICE` and `DD_ENV` from the tracer ([#8176](DataDog/dd-trace-java#8176) - [@mhlidd](https://github.com/mhlidd)) ##### Continuous Integration Visibility - 🧹 Generalize TestRetryPolicy to TestExecutionPolicy ([#8302](DataDog/dd-trace-java#8302) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Parallelize CI Visibility settings requests ([#8299](DataDog/dd-trace-java#8299) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Generalize test retry logic ([#8289](DataDog/dd-trace-java#8289) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Generalize tests skipping logic ([#8288](DataDog/dd-trace-java#8288) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Remove skip and shouldBeSkipped methods from TestEventsHandler in favor of isSkippable ([#8286](DataDog/dd-trace-java#8286) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨⚡ Optimize Git repository information computation ([#8270](DataDog/dd-trace-java#8270) - [@dougqh](https://github.com/dougqh)) - ✨ Always request known tests from the backend ([#8268](DataDog/dd-trace-java#8268) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Fix NPE when trying to get retry analyzer in Test NG ([#8253](DataDog/dd-trace-java#8253) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Set test framework and test framework version tags atomically ([#8252](DataDog/dd-trace-java#8252) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add debug logging to Android Gradle module layout logic ([#8251](DataDog/dd-trace-java#8251) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix source and destination folders computation for Android Gradle projects ([#8190](DataDog/dd-trace-java#8190) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add basic Scala Weaver sbt support ([#8189](DataDog/dd-trace-java#8189) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement impacted tests detection ([#8188](DataDog/dd-trace-java#8188) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) ##### Data Streams Monitoring - ✨ Change hash computation for protobuf to better represent impacting changes + save proto number in schema ([#8201](DataDog/dd-trace-java#8201) - [@vandonr](https://github.com/vandonr)) ##### Database Monitoring - Add peer service tag in dbm sql commenter ([#7913](DataDog/dd-trace-java#7913) - [@jordan-wong](https://github.com/jordan-wong)) ##### Dynamic Instrumentation - ✨ Add support for SymDB to scan directories ([#8306](DataDog/dd-trace-java#8306) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add SymDB report for any jar scanning failures ([#8300](DataDog/dd-trace-java#8300) - [@jpbempel](https://github.com/jpbempel)) - ✨ Use two budgets depending on type ([#8283](DataDog/dd-trace-java#8283) - [@evanchooly](https://github.com/evanchooly)) - ✨ Institute a 10 snapshot per probe per trace budget ([#8277](DataDog/dd-trace-java#8277) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Avoid double snapshots for Exception Replay ([#8273](DataDog/dd-trace-java#8273) - [@jpbempel](https://github.com/jpbempel)) - ✨ Simplify code origins. Separate out snapshot generation. ([#8263](DataDog/dd-trace-java#8263) - [@evanchooly](https://github.com/evanchooly)) - ✨ Add Exception probe custom instrumentation ([#8230](DataDog/dd-trace-java#8230) - [@jpbempel](https://github.com/jpbempel)) - ✨ Enhance log probes to honor debug session tags ([#8215](DataDog/dd-trace-java#8215) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Don't redact env tokens from debugger probe snapshots ([#8211](DataDog/dd-trace-java#8211) - [@watson](https://github.com/watson)) - ✨⚡ Move Trace/SpanId capture at commit time ([#8184](DataDog/dd-trace-java#8184) - [@jpbempel](https://github.com/jpbempel)) - 🐛 Capture values at entry for method probe ([#8169](DataDog/dd-trace-java#8169) - [@jpbempel](https://github.com/jpbempel)) ##### JMX fetch - 🐛 Mute JMXFetch Shutdown in progress error ([#8068](DataDog/dd-trace-java#8068) - [@ygree](https://github.com/ygree)) ##### OpenTracing - ⚠️🧹 Make jnr-unixsocket an explicit dependency of dd-trace-ot ([#8307](DataDog/dd-trace-java#8307) - [@mcculls](https://github.com/mcculls)) ##### Profiling - 🐛 Avoid unsupported API call for creating folders on windows ([#8304](DataDog/dd-trace-java#8304) - [@jbachorik](https://github.com/jbachorik)) - ✨ Tag profiles for serverless ([#8279](DataDog/dd-trace-java#8279) - [@jbachorik](https://github.com/jbachorik)) - ✨ add queue type and length to queue events ([#8242](DataDog/dd-trace-java#8242) - [@richardstartin](https://github.com/richardstartin)) - 🐛 TempLocationManager Fixes and Improvements ([#8191](DataDog/dd-trace-java#8191) - [@jbachorik](https://github.com/jbachorik)) - ✨ Bump ddprof to 1.18.0 ([#8173](DataDog/dd-trace-java#8173) - [@jbachorik](https://github.com/jbachorik)) - ✨ Report profiler initialization and configuration errors to telemetry ([#8171](DataDog/dd-trace-java#8171) - [@jbachorik](https://github.com/jbachorik)) ##### Telemetry - ✨ Add pending traces report in tracer flares ([#8053](DataDog/dd-trace-java#8053) - [@mhlidd](https://github.com/mhlidd)) ##### Testing - ✨ Test http server requests in parallel ([#8222](DataDog/dd-trace-java#8222) - [@amarziali](https://github.com/amarziali)) ##### Trace context propagation - ✨ Add non default propagator registration ([#8310](DataDog/dd-trace-java#8310) - [@PerfectSlayer](https://github.com/PerfectSlayer)) ##### Tracer core - ✨ Probe for existence of IBMSASL or ACCP security providers ([#8276](DataDog/dd-trace-java#8276) - [@mcculls](https://github.com/mcculls)) - ✨⚡ Overhead improvement to agent feedback based sampling ([#8265](DataDog/dd-trace-java#8265) - [@dougqh](https://github.com/dougqh)) - 🧹 Move async propagation API from scope to tracer ([#8231](DataDog/dd-trace-java#8231) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Introduce context propagation API ([#8161](DataDog/dd-trace-java#8161) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨🧪 Use env-entry to add tags per webapp deployment ([#8138](DataDog/dd-trace-java#8138) - [@amarziali](https://github.com/amarziali)) - ✨ Introduce context helpers API ([#8134](DataDog/dd-trace-java#8134) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Support IPv6 values for `DD_AGENT_HOST` and `DD_TRACE_AGENT_URL` ([#7984](DataDog/dd-trace-java#7984) - [@mhlidd](https://github.com/mhlidd)) ##### Instrumentations ##### Apache HttpComponents - 🐛 Properly finish spans and support latest apache httpclient5 ([#8272](DataDog/dd-trace-java#8272) - [@amarziali](https://github.com/amarziali)) ##### AWS Lambda instrumentation - 🐛 Properly capture lambda payloads for all handler types. ([#8264](DataDog/dd-trace-java#8264) - [@purple4reina](https://github.com/purple4reina)) ##### AWS S3 instrumentation - 💡 Create S3 instrumentation + add span pointers ([#8075](DataDog/dd-trace-java#8075) - [@nhulston](https://github.com/nhulston)) ##### AWS SDK instrumentation - 🐛 Revert "Add avoid double instrumenting lambda non-streaming handlers." ([#8247](DataDog/dd-trace-java#8247) - [@nhulston](https://github.com/nhulston)) ##### Cassandra - ✨ Allow extracting keyspace from statement result ([#8239](DataDog/dd-trace-java#8239) - [@amarziali](https://github.com/amarziali)) ##### Core Java language instrumentation - ✨ Propagation of translateEscapes of String class ([#8186](DataDog/dd-trace-java#8186) - [@sezen-datadog](https://github.com/sezen-datadog)) ##### Eclipse Vert.x instrumentation - 🐛 Fix vertx worker propagation and error handling ([#8237](DataDog/dd-trace-java#8237) - [@amarziali](https://github.com/amarziali)) - ✨ Support vertx 5 ([#8220](DataDog/dd-trace-java#8220) - [@amarziali](https://github.com/amarziali)) - ✨ Add support for session tracking in Vertx ([#8167](DataDog/dd-trace-java#8167) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) ##### Kafka instrumentation - 🐛 Prevent possible NPE calculating Kafka record header size ([#8292](DataDog/dd-trace-java#8292) - [@ygree](https://github.com/ygree)) ##### Mule instrumentation - 🐛 Fix crash using Mule with JPMS ([#8187](DataDog/dd-trace-java#8187) - [@amarziali](https://github.com/amarziali)) ##### Protocol Buffer instrumentation - ✨ Change hash computation for protobuf to better represent impacting changes + save proto number in schema ([#8201](DataDog/dd-trace-java#8201) - [@vandonr](https://github.com/vandonr)) ##### Spring instrumentation - 🐛 Preserve getQualifier from spring scheduling runnables ([#8293](DataDog/dd-trace-java#8293) - [@amarziali](https://github.com/amarziali)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: bb09d47e4eed77a003f630273b4d0a84003eb899

Add span tag _dd.appsec.rasp.timeout

d14586c

Mariovido added type: enhancement comp: asm iast Application Security Management (IAST) labels Jan 22, 2025

Mariovido added 2 commits January 22, 2025 16:04

Add tests

23c682d

Refactor test

588123e

Mariovido added type: enhancement and removed type: enhancement labels Jan 22, 2025

Mariovido marked this pull request as ready for review January 22, 2025 15:47

Mariovido requested a review from a team as a code owner January 22, 2025 15:47

Mariovido requested review from smola and manuel-alvarez-alvarez January 22, 2025 15:47

smola reviewed Jan 24, 2025

View reviewed changes

dd-java-agent/appsec/src/main/java/com/datadog/appsec/powerwaf/PowerWAFModule.java Outdated Show resolved Hide resolved

Moved metrics of Waf to the else of isRasp + add tests for both metrics

50709f8

Mariovido added comp: api Tracer public API and removed comp: api Tracer public API labels Jan 27, 2025

Merge branch 'master' into mario.vidal/span_rasp_timeout

672a97e

Mariovido added type: enhancement and removed type: enhancement labels Jan 27, 2025

smola approved these changes Jan 29, 2025

View reviewed changes

manuel-alvarez-alvarez approved these changes Jan 30, 2025

View reviewed changes

Merge branch 'master' into mario.vidal/span_rasp_timeout

7ec2cb4

Mariovido added type: enhancement and removed type: enhancement labels Jan 30, 2025

Mariovido merged commit 1759b2d into master Jan 30, 2025
195 of 196 checks passed

Mariovido deleted the mario.vidal/span_rasp_timeout branch January 30, 2025 10:48

github-actions bot added this to the 1.46.0 milestone Jan 30, 2025

smola removed the comp: asm iast Application Security Management (IAST) label Jan 31, 2025

smola added the comp: asm waf Application Security Management (WAF) label Jan 31, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Create span tag: _dd.appsec.rasp.timeout #8269

Create span tag: _dd.appsec.rasp.timeout #8269

Mariovido commented Jan 22, 2025 •

edited

Loading

pr-commenter bot commented Jan 22, 2025 •

edited

Loading

manuel-alvarez-alvarez commented Jan 27, 2025

Mariovido commented Jan 27, 2025

Create span tag: _dd.appsec.rasp.timeout #8269

Create span tag: _dd.appsec.rasp.timeout #8269

Conversation

Mariovido commented Jan 22, 2025 • edited Loading

What Does This Do

Motivation

Additional Notes

Contributor Checklist

pr-commenter bot commented Jan 22, 2025 • edited Loading

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

manuel-alvarez-alvarez commented Jan 27, 2025

Mariovido commented Jan 27, 2025

Mariovido commented Jan 22, 2025 •

edited

Loading

pr-commenter bot commented Jan 22, 2025 •

edited

Loading