Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(iast): partial matches on function names should not be patched [backport 2.11] #11017

Open
wants to merge 2 commits into
base: 2.11
Choose a base branch
from

Conversation

gnufede
Copy link
Member

@gnufede gnufede commented Oct 14, 2024

backport of #11015
Code Security: This PR fixes an issue where partial matches of the functions we want to patch would be patched instead of exact matches

Checklist

  • PR author has checked that all the criteria below are met
  • The PR description includes an overview of the change
  • The PR description articulates the motivation for the change
  • The change includes tests OR the PR description describes a testing strategy
  • The PR description notes risks associated with the change, if any
  • Newly-added code is easy to change
  • The change follows the library release note guidelines
  • The change includes or references documentation updates if necessary
  • Backport labels are set (if applicable)

Reviewer Checklist

  • Reviewer has checked that all the criteria below are met
  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Newly-added code is easy to change
  • Release note makes sense to a user of the library
  • If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance
    policy

(cherry picked from commit a72b931)

…11015)

Code Security: This PR fixes an issue where partial matches of the
functions we want to patch would be patched instead of exact matches

- [x] PR author has checked that all the criteria below are met
- The PR description includes an overview of the change
- The PR description articulates the motivation for the change
- The change includes tests OR the PR description describes a testing
strategy
- The PR description notes risks associated with the change, if any
- Newly-added code is easy to change
- The change follows the [library release note
guidelines](https://ddtrace.readthedocs.io/en/stable/releasenotes.html)
- The change includes or references documentation updates if necessary
- Backport labels are set (if
[applicable](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting))

- [x] Reviewer has checked that all the criteria below are met
- Title is accurate
- All changes are related to the pull request's stated goal
- Avoids breaking
[API](https://ddtrace.readthedocs.io/en/stable/versioning.html#interfaces)
changes
- Testing strategy adequately addresses listed risks
- Newly-added code is easy to change
- Release note makes sense to a user of the library
- If necessary, author has acknowledged and discussed the performance
implications of this PR as reported in the benchmarks PR comment
- Backport labels are set in a manner that is consistent with the
[release branch maintenance
policy](https://ddtrace.readthedocs.io/en/latest/contributing.html#backporting)

(cherry picked from commit a72b931)
@gnufede gnufede requested review from a team as code owners October 14, 2024 14:43
@gnufede gnufede added the ASM Application Security Monitoring label Oct 14, 2024
@datadog-dd-trace-py-rkomorn
Copy link

datadog-dd-trace-py-rkomorn bot commented Oct 14, 2024

Datadog Report

Branch report: backport-11015-to-2.11
Commit report: 540be7a
Test service: dd-trace-py

✅ 0 Failed, 109917 Passed, 3980 Skipped, 5m 38.58s Total duration (30m 32.72s time saved)

@codecov-commenter
Copy link

codecov-commenter commented Oct 14, 2024

Codecov Report

Attention: Patch coverage is 20.00000% with 4 lines in your changes missing coverage. Please review.

Project coverage is 10.55%. Comparing base (9c353ce) to head (540be7a).
Report is 53 commits behind head on 2.11.

Files with missing lines Patch % Lines
tests/appsec/iast/_ast/test_ast_patching.py 0.00% 4 Missing ⚠️
Additional details and impacted files
@@             Coverage Diff             @@
##             2.11   #11017       +/-   ##
===========================================
- Coverage   34.18%   10.55%   -23.63%     
===========================================
  Files        1385     1387        +2     
  Lines      129280   129707      +427     
===========================================
- Hits        44191    13692    -30499     
- Misses      85089   116015    +30926     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@pr-commenter
Copy link

pr-commenter bot commented Oct 14, 2024

Benchmarks

Benchmark execution time: 2024-10-14 16:05:05

Comparing candidate commit 540be7a in PR branch backport-11015-to-2.11 with baseline commit 896d8ed in branch 2.11.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 214 metrics, 2 unstable metrics.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ASM Application Security Monitoring
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants