Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(asm): add SSRF support for urllib.request #9224

Merged
merged 53 commits into from May 13, 2024

Conversation

juanjux
Copy link
Collaborator

@juanjux juanjux commented May 10, 2024

Description

Add SSRF taint sink support for the stdlib urllib.request module. Also adds a release note that covers this feature and all the previous ones expanding SSRF support (so there is only one release note instead of 4).

Checklist

  • Change(s) are motivated and described in the PR description
  • Testing strategy is described if automated tests are not included in the PR
  • Risks are described (performance impact, potential for breakage, maintainability)
  • Change is maintainable (easy to change, telemetry, documentation)
  • Library release note guidelines are followed or label changelog/no-changelog is set
  • Documentation is included (in-code, generated user docs, public corp docs)
  • Backport labels are set (if applicable)
  • If this PR changes the public interface, I've notified @DataDog/apm-tees.

Reviewer Checklist

  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Description motivates each change
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Change is maintainable (easy to change, telemetry, documentation)
  • Release note makes sense to a user of the library
  • Author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

juanjux and others added 25 commits May 9, 2024 12:05
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
@juanjux juanjux added the ASM Application Security Monitoring label May 10, 2024
@juanjux juanjux self-assigned this May 10, 2024
@juanjux juanjux requested review from a team as code owners May 10, 2024 13:57
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
@datadog-dd-trace-py-rkomorn
Copy link

datadog-dd-trace-py-rkomorn bot commented May 10, 2024

Datadog Report

Branch report: juanjux/stdlib-urllib-ssrf
Commit report: 5aa62f0
Test service: dd-trace-py

✅ 0 Failed, 115738 Passed, 59735 Skipped, 2h 51m 54.13s Total duration (7h 28m 26.73s time saved)

@pr-commenter
Copy link

pr-commenter bot commented May 10, 2024

Benchmarks

Benchmark execution time: 2024-05-13 16:01:50

Comparing candidate commit 2edc164 in PR branch juanjux/stdlib-urllib-ssrf with baseline commit 228ac3b in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 209 metrics, 9 unstable metrics.

@codecov-commenter
Copy link

codecov-commenter commented May 10, 2024

Codecov Report

Attention: Patch coverage is 0% with 55 lines in your changes are missing coverage. Please review.

Project coverage is 6.79%. Comparing base (228ac3b) to head (2edc164).

Files Patch % Lines
tests/appsec/iast/taint_sinks/test_ssrf.py 0.00% 30 Missing ⚠️
ddtrace/contrib/urllib/patch.py 0.00% 21 Missing ⚠️
ddtrace/contrib/urllib/__init__.py 0.00% 4 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             main    #9224       +/-   ##
===========================================
- Coverage   78.60%    6.79%   -71.81%     
===========================================
  Files        1279     1251       -28     
  Lines      120589   118864     -1725     
===========================================
- Hits        94784     8079    -86705     
- Misses      25805   110785    +84980     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

juanjux and others added 5 commits May 10, 2024 21:08
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
ddtrace/contrib/urllib/__init__.py Outdated Show resolved Hide resolved
ddtrace/contrib/urllib/patch.py Outdated Show resolved Hide resolved
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
Signed-off-by: Juanjo Alvarez <juanjo.alvarezmartinez@datadoghq.com>
@juanjux juanjux enabled auto-merge (squash) May 13, 2024 15:33
@juanjux juanjux disabled auto-merge May 13, 2024 16:21
@juanjux juanjux merged commit 2ac3363 into main May 13, 2024
203 of 205 checks passed
@juanjux juanjux deleted the juanjux/stdlib-urllib-ssrf branch May 13, 2024 16:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ASM Application Security Monitoring
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

5 participants