Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix mongoose IAST exec with callback #4045

Merged
merged 10 commits into from
Feb 12, 2024
Merged

Fix mongoose IAST exec with callback #4045

merged 10 commits into from
Feb 12, 2024

Conversation

uurien
Copy link
Collaborator

@uurien uurien commented Feb 9, 2024

What does this PR do?

Fix mongoose instrumentation when it is used with .exec(callback) function, like Model.find(query).exec(cb) instead of Model.find(query).then(cb) or Model.find(query, cb).

Motivation

Fix bug

Checklist

  • Unit tests.

Additional Notes

Security

Datadog employees:

  • If this PR touches code that signs or publishes builds or packages, or handles credentials of any kind, I've requested a review from @DataDog/security-design-and-guidance.
  • This PR doesn't touch any of that.

Unsure? Have a question? Request a review!

Copy link

github-actions bot commented Feb 9, 2024

Overall package size

Self size: 6.03 MB
Deduped: 61.63 MB
No deduping: 62.38 MB

Dependency sizes

name version self size total size
@datadog/native-iast-taint-tracking 1.6.4 16.43 MB 16.44 MB
@datadog/native-appsec 7.0.0 14.51 MB 14.52 MB
@datadog/pprof 5.0.0 9.59 MB 10.44 MB
protobufjs 7.2.5 2.77 MB 6.56 MB
@datadog/native-iast-rewriter 2.2.3 2.19 MB 2.28 MB
@opentelemetry/core 1.14.0 872.87 kB 1.47 MB
@datadog/native-metrics 2.0.0 898.77 kB 1.3 MB
@opentelemetry/api 1.4.1 780.32 kB 780.32 kB
import-in-the-middle 1.7.3 67.62 kB 731.01 kB
pprof-format 2.0.7 588.12 kB 588.12 kB
msgpack-lite 0.1.26 201.16 kB 281.59 kB
opentracing 0.14.7 194.81 kB 194.81 kB
semver 7.5.4 93.4 kB 123.8 kB
@datadog/sketches-js 2.1.0 109.9 kB 109.9 kB
lodash.sortby 4.7.0 75.76 kB 75.76 kB
lru-cache 7.14.0 74.95 kB 74.95 kB
ipaddr.js 2.1.0 60.23 kB 60.23 kB
ignore 5.2.4 51.22 kB 51.22 kB
int64-buffer 0.1.10 49.18 kB 49.18 kB
shell-quote 1.8.1 44.96 kB 44.96 kB
istanbul-lib-coverage 3.2.0 29.34 kB 29.34 kB
tlhunter-sorted-set 0.1.0 24.94 kB 24.94 kB
limiter 1.1.5 23.17 kB 23.17 kB
dc-polyfill 0.1.4 23.1 kB 23.1 kB
retry 0.13.1 18.85 kB 18.85 kB
node-abort-controller 3.1.1 16.89 kB 16.89 kB
jest-docblock 29.7.0 8.99 kB 12.76 kB
crypto-randomuuid 1.0.0 11.18 kB 11.18 kB
path-to-regexp 0.1.7 6.78 kB 6.78 kB
koalas 1.0.2 6.47 kB 6.47 kB
methods 1.1.2 5.29 kB 5.29 kB
module-details-from-path 1.0.3 4.47 kB 4.47 kB

🤖 This report was automatically generated by heaviest-objects-in-the-universe

Copy link

codecov bot commented Feb 9, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (7561fb5) 85.29% compared to head (3be8ee6) 85.29%.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #4045   +/-   ##
=======================================
  Coverage   85.29%   85.29%           
=======================================
  Files         243      243           
  Lines       10558    10558           
  Branches       33       33           
=======================================
  Hits         9005     9005           
  Misses       1553     1553           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@pr-commenter
Copy link

pr-commenter bot commented Feb 9, 2024

Benchmarks

Benchmark execution time: 2024-02-12 13:31:18

Comparing candidate commit 3be8ee6 in PR branch fix-mongoose-iast-exec with baseline commit 7561fb5 in branch master.

Found 1 performance improvements and 0 performance regressions! Performance is the same for 258 metrics, 7 unstable metrics.

scenario:plugin-graphql-with-depth-off-18

  • 🟩 max_rss_usage [-99.281MB; -95.155MB] or [-10.618%; -10.176%]

@uurien uurien marked this pull request as ready for review February 12, 2024 13:19
@uurien uurien requested review from a team as code owners February 12, 2024 13:19
@uurien uurien requested a review from jbertran February 12, 2024 13:19
@simon-id simon-id merged commit 06ef74d into master Feb 12, 2024
110 of 111 checks passed
@simon-id simon-id deleted the fix-mongoose-iast-exec branch February 12, 2024 19:46
@simon-id simon-id changed the title Fix mongoose iast exec Fix mongoose IAST exec with callback Feb 12, 2024
tlhunter pushed a commit that referenced this pull request Feb 12, 2024
* Add test for fix

* Another test, expecting to detect the vuln

* fix mongoose instru not supporting deferred callback

* add more tests

* make sure callback is not wrapped twice

---------

Co-authored-by: simon-id <simon.id@datadoghq.com>
tlhunter pushed a commit that referenced this pull request Feb 12, 2024
* Add test for fix

* Another test, expecting to detect the vuln

* fix mongoose instru not supporting deferred callback

* add more tests

* make sure callback is not wrapped twice

---------

Co-authored-by: simon-id <simon.id@datadoghq.com>
tlhunter pushed a commit that referenced this pull request Feb 12, 2024
* Add test for fix

* Another test, expecting to detect the vuln

* fix mongoose instru not supporting deferred callback

* add more tests

* make sure callback is not wrapped twice

---------

Co-authored-by: simon-id <simon.id@datadoghq.com>
This was referenced Feb 13, 2024
tlhunter pushed a commit that referenced this pull request Feb 14, 2024
* Add test for fix

* Another test, expecting to detect the vuln

* fix mongoose instru not supporting deferred callback

* add more tests

* make sure callback is not wrapped twice

---------

Co-authored-by: simon-id <simon.id@datadoghq.com>
tlhunter pushed a commit that referenced this pull request Feb 14, 2024
* Add test for fix

* Another test, expecting to detect the vuln

* fix mongoose instru not supporting deferred callback

* add more tests

* make sure callback is not wrapped twice

---------

Co-authored-by: simon-id <simon.id@datadoghq.com>
tlhunter pushed a commit that referenced this pull request Feb 14, 2024
* Add test for fix

* Another test, expecting to detect the vuln

* fix mongoose instru not supporting deferred callback

* add more tests

* make sure callback is not wrapped twice

---------

Co-authored-by: simon-id <simon.id@datadoghq.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants