Extract Vert.x json body response schemas #9001
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
manuel-alvarez-alvarez
added
comp: asm waf
BenchmarksStartupParameters
See matching parameters
SummaryFound 2 performance improvements and 1 performance regressions! Performance is the same for 40 metrics, 10 unstable metrics.
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.50.0-SNAPSHOT~37afc9b0b3, baseline=1.50.0-SNAPSHOT~a7ce6e7f58
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.04 s) : 0, 1040038
Total [baseline] (10.542 s) : 0, 10541883
Agent [candidate] (1.031 s) : 0, 1030684
Total [candidate] (10.575 s) : 0, 10574647
section appsec
Agent [baseline] (1.185 s) : 0, 1185354
Total [baseline] (10.777 s) : 0, 10776876
Agent [candidate] (1.183 s) : 0, 1183498
Total [candidate] (10.721 s) : 0, 10721162
section iast
Agent [baseline] (1.153 s) : 0, 1152634
Total [baseline] (10.835 s) : 0, 10835300
Agent [candidate] (1.155 s) : 0, 1154793
Total [candidate] (10.857 s) : 0, 10856862
section profiling
Agent [baseline] (1.266 s) : 0, 1265961
Total [baseline] (10.916 s) : 0, 10915581
Agent [candidate] (1.275 s) : 0, 1274718
Total [candidate] (10.913 s) : 0, 10913392
gantt
title petclinic - break down per module: candidate=1.50.0-SNAPSHOT~37afc9b0b3, baseline=1.50.0-SNAPSHOT~a7ce6e7f58
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (694.586 ms) : 0, 694586
BytebuddyAgent [candidate] (685.515 ms) : 0, 685515
GlobalTracer [baseline] (244.499 ms) : 0, 244499
GlobalTracer [candidate] (242.225 ms) : 0, 242225
AppSec [baseline] (59.705 ms) : 0, 59705
AppSec [candidate] (62.273 ms) : 0, 62273
Debugger [baseline] (7.75 ms) : 0, 7750
Debugger [candidate] (6.898 ms) : 0, 6898
Remote Config [baseline] (726.819 µs) : 0, 727
Remote Config [candidate] (667.376 µs) : 0, 667
Telemetry [baseline] (9.019 ms) : 0, 9019
Telemetry [candidate] (9.642 ms) : 0, 9642
section appsec
BytebuddyAgent [baseline] (712.364 ms) : 0, 712364
BytebuddyAgent [candidate] (708.596 ms) : 0, 708596
GlobalTracer [baseline] (236.862 ms) : 0, 236862
GlobalTracer [candidate] (235.476 ms) : 0, 235476
IAST [baseline] (22.058 ms) : 0, 22058
IAST [candidate] (21.833 ms) : 0, 21833
AppSec [baseline] (176.463 ms) : 0, 176463
AppSec [candidate] (180.245 ms) : 0, 180245
Debugger [baseline] (5.978 ms) : 0, 5978
Debugger [candidate] (5.913 ms) : 0, 5913
Remote Config [baseline] (620.473 µs) : 0, 620
Remote Config [candidate] (641.874 µs) : 0, 642
Telemetry [baseline] (7.359 ms) : 0, 7359
Telemetry [candidate] (7.356 ms) : 0, 7356
section iast
BytebuddyAgent [baseline] (804.523 ms) : 0, 804523
BytebuddyAgent [candidate] (803.421 ms) : 0, 803421
GlobalTracer [baseline] (231.517 ms) : 0, 231517
GlobalTracer [candidate] (231.593 ms) : 0, 231593
IAST [baseline] (25.233 ms) : 0, 25233
IAST [candidate] (28.323 ms) : 0, 28323
AppSec [baseline] (52.703 ms) : 0, 52703
AppSec [candidate] (53.577 ms) : 0, 53577
Debugger [baseline] (5.903 ms) : 0, 5903
Debugger [candidate] (5.979 ms) : 0, 5979
Remote Config [baseline] (583.061 µs) : 0, 583
Remote Config [candidate] (611.92 µs) : 0, 612
Telemetry [baseline] (7.917 ms) : 0, 7917
Telemetry [candidate] (7.903 ms) : 0, 7903
section profiling
BytebuddyAgent [baseline] (675.606 ms) : 0, 675606
BytebuddyAgent [candidate] (676.913 ms) : 0, 676913
GlobalTracer [baseline] (360.088 ms) : 0, 360088
GlobalTracer [candidate] (360.045 ms) : 0, 360045
AppSec [baseline] (61.724 ms) : 0, 61724
AppSec [candidate] (65.158 ms) : 0, 65158
Debugger [baseline] (6.098 ms) : 0, 6098
Debugger [candidate] (6.161 ms) : 0, 6161
Remote Config [baseline] (643.909 µs) : 0, 644
Remote Config [candidate] (650.885 µs) : 0, 651
Telemetry [baseline] (8.219 ms) : 0, 8219
Telemetry [candidate] (8.258 ms) : 0, 8258
ProfilingAgent [baseline] (102.699 ms) : 0, 102699
ProfilingAgent [candidate] (106.689 ms) : 0, 106689
Profiling [baseline] (102.724 ms) : 0, 102724
Profiling [candidate] (106.715 ms) : 0, 106715
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.50.0-SNAPSHOT~37afc9b0b3, baseline=1.50.0-SNAPSHOT~a7ce6e7f58
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.021 s) : 0, 1021260
Total [baseline] (8.565 s) : 0, 8564552
Agent [candidate] (1.035 s) : 0, 1035451
Total [candidate] (8.538 s) : 0, 8537980
section iast
Agent [baseline] (1.154 s) : 0, 1153562
Total [baseline] (9.2 s) : 0, 9199667
Agent [candidate] (1.16 s) : 0, 1160116
Total [candidate] (9.225 s) : 0, 9224983
gantt
title insecure-bank - break down per module: candidate=1.50.0-SNAPSHOT~37afc9b0b3, baseline=1.50.0-SNAPSHOT~a7ce6e7f58
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (683.451 ms) : 0, 683451
BytebuddyAgent [candidate] (688.959 ms) : 0, 688959
GlobalTracer [baseline] (240.402 ms) : 0, 240402
GlobalTracer [candidate] (242.671 ms) : 0, 242671
AppSec [baseline] (56.805 ms) : 0, 56805
AppSec [candidate] (61.901 ms) : 0, 61901
Debugger [baseline] (7.517 ms) : 0, 7517
Debugger [candidate] (6.989 ms) : 0, 6989
Remote Config [baseline] (720.381 µs) : 0, 720
Remote Config [candidate] (668.19 µs) : 0, 668
Telemetry [baseline] (8.847 ms) : 0, 8847
Telemetry [candidate] (10.667 ms) : 0, 10667
section iast
BytebuddyAgent [baseline] (805.757 ms) : 0, 805757
BytebuddyAgent [candidate] (806.186 ms) : 0, 806186
GlobalTracer [baseline] (231.5 ms) : 0, 231500
GlobalTracer [candidate] (232.972 ms) : 0, 232972
IAST [baseline] (29.207 ms) : 0, 29207
IAST [candidate] (28.946 ms) : 0, 28946
AppSec [baseline] (49.308 ms) : 0, 49308
AppSec [candidate] (53.13 ms) : 0, 53130
Debugger [baseline] (5.847 ms) : 0, 5847
Debugger [candidate] (6.072 ms) : 0, 6072
Remote Config [baseline] (599.438 µs) : 0, 599
Remote Config [candidate] (602.611 µs) : 0, 603
Telemetry [baseline] (7.868 ms) : 0, 7868
Telemetry [candidate] (8.008 ms) : 0, 8008
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 3 performance regressions! Performance is the same for 0 metrics, 9 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~37afc9b0b3, baseline=1.50.0-SNAPSHOT~a7ce6e7f58
dateFormat X
axisFormat %s
section baseline
no_agent (13.23 ms) : 13113, 13347
. : milestone, 13230,
appsec (71.836 ms) : 70903, 72768
. : milestone, 71836,
code_origins (87.835 ms) : 86138, 89531
. : milestone, 87835,
iast (78.84 ms) : 77614, 80065
. : milestone, 78840,
profiling (62.142 ms) : 61302, 62982
. : milestone, 62142,
tracing (51.945 ms) : 51169, 52721
. : milestone, 51945,
section candidate
no_agent (133.555 ms) : 130720, 136391
. : milestone, 133555,
appsec (155.932 ms) : 151447, 160417
. : milestone, 155932,
code_origins (169.617 ms) : 159938, 179296
. : milestone, 169617,
iast (161.864 ms) : 155902, 167826
. : milestone, 161864,
profiling (146.948 ms) : 143217, 150678
. : milestone, 146948,
tracing (138.995 ms) : 135913, 142077
. : milestone, 138995,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~37afc9b0b3, baseline=1.50.0-SNAPSHOT~a7ce6e7f58
dateFormat X
axisFormat %s
section baseline
no_agent (15.017 s) : 15017000, 15017000
. : milestone, 15017000,
appsec (15.011 s) : 15011000, 15011000
. : milestone, 15011000,
iast (18.755 s) : 18755000, 18755000
. : milestone, 18755000,
iast_GLOBAL (18.208 s) : 18208000, 18208000
. : milestone, 18208000,
profiling (15.387 s) : 15387000, 15387000
. : milestone, 15387000,
tracing (14.873 s) : 14873000, 14873000
. : milestone, 14873000,
section candidate
no_agent (14.831 s) : 14831000, 14831000
. : milestone, 14831000,
appsec (14.962 s) : 14962000, 14962000
. : milestone, 14962000,
iast (18.986 s) : 18986000, 18986000
. : milestone, 18986000,
iast_GLOBAL (17.673 s) : 17673000, 17673000
. : milestone, 17673000,
profiling (15.027 s) : 15027000, 15027000
. : milestone, 15027000,
tracing (14.853 s) : 14853000, 14853000
. : milestone, 14853000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~37afc9b0b3, baseline=1.50.0-SNAPSHOT~a7ce6e7f58
dateFormat X
axisFormat %s
section baseline
no_agent (1.475 ms) : 1463, 1486
. : milestone, 1475,
appsec (2.398 ms) : 2349, 2446
. : milestone, 2398,
iast (2.179 ms) : 2118, 2241
. : milestone, 2179,
iast_GLOBAL (2.221 ms) : 2160, 2283
. : milestone, 2221,
profiling (2.028 ms) : 1979, 2078
. : milestone, 2028,
tracing (2.005 ms) : 1958, 2053
. : milestone, 2005,
section candidate
no_agent (1.473 ms) : 1461, 1484
. : milestone, 1473,
appsec (2.4 ms) : 2351, 2449
. : milestone, 2400,
iast (2.181 ms) : 2119, 2242
. : milestone, 2181,
iast_GLOBAL (2.228 ms) : 2166, 2290
. : milestone, 2228,
profiling (2.023 ms) : 1973, 2072
. : milestone, 2023,
tracing (1.992 ms) : 1944, 2039
. : milestone, 1992,
|
manuel-alvarez-alvarez
force-pushed
the
malvarez/vertx-response-extraction
branch
from
e6d0da9 to
bf5e01e
Compare
jandro996
reviewed
Jun 19, 2025
There was a problem hiding this comment.
Correct me if I'm wrong but I feel that we are missing this part of the RFC
DD_API_SECURITY_PARSE_RESPONSE_BODY: this is a configuration option which libraries with the ability to parse the response body must implement to allow the user to disable this feature. With a true, or equivalent value, response body parsing should be enabled. If implemented, the default value of this configuration option must be true.
There is also a system test that validates this
tests/appsec/api_security/test_schemas.py::Test_Schema_Response_Body_env_var::test_request_method
Yep, parsing the body is not going to be implemented in the library at the moment. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Adds response body extraction for Vert.x JSON endpoints to enable automatic API schema discovery and protection by the Web Application Firewall (WAF). Support is for Vert.x >= 4.x (leverages new JSON response API introduced in v4.x)
Motivation
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any usefull labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-57920