Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add RestClient instrumentation for SSRF detection #4424

Merged
merged 14 commits into from
Feb 24, 2025

Conversation

y9v
Copy link
Member

@y9v y9v commented Feb 21, 2025

What does this PR do?
It adds SSRF detection for rest-client gem.

To enable rest-client AppSec instrumentation:

Datadog.configure do |c|
  c.tracing.enabled = true
  c.tracing.instrument :rack

  c.appsec.enabled = true
  c.appsec.instrument :rest_client
end

Motivation:
We want to add SSRF detection to more http client libraries.

Change log entry
Yes. AppSec: Add detection of Server-Side Request Forgery attacks for rest-client http client.

Additional Notes:
None.

How to test the change?
CI and app-generator (rails-ssrf application)

@y9v y9v self-assigned this Feb 21, 2025
@y9v y9v requested review from a team as code owners February 21, 2025 11:03
@github-actions github-actions bot added integrations Involves tracing integrations appsec Application Security monitoring product labels Feb 21, 2025
@pr-commenter
Copy link

pr-commenter bot commented Feb 21, 2025

Benchmarks

Benchmark execution time: 2025-02-24 12:13:50

Comparing candidate commit a632a16 in PR branch appsec-add-rest-client-instrumentation with baseline commit 2d817ff in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 31 metrics, 2 unstable metrics.

@datadog-datadog-prod-us1
Copy link
Contributor

datadog-datadog-prod-us1 bot commented Feb 21, 2025

Datadog Report

Branch report: appsec-add-rest-client-instrumentation
Commit report: a632a16
Test service: dd-trace-rb

✅ 0 Failed, 20612 Passed, 1375 Skipped, 3m 21.69s Total Time

@codecov-commenter
Copy link

codecov-commenter commented Feb 21, 2025

Codecov Report

Attention: Patch coverage is 97.67442% with 3 lines in your changes missing coverage. Please review.

Project coverage is 97.72%. Comparing base (2d817ff) to head (a632a16).

Files with missing lines Patch % Lines
.../datadog/appsec/contrib/rest_client/integration.rb 90.90% 2 Missing ⚠️
lib/datadog/appsec/contrib/rest_client/patcher.rb 92.30% 1 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #4424      +/-   ##
==========================================
- Coverage   97.73%   97.72%   -0.01%     
==========================================
  Files        1363     1368       +5     
  Lines       83309    83438     +129     
  Branches     4217     4220       +3     
==========================================
+ Hits        81418    81543     +125     
- Misses       1891     1895       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@y9v y9v changed the title Add AppSec RestClient instrumentation for SSRF detection Add RestClient instrumentation for SSRF detection Feb 21, 2025
Copy link
Member

@Strech Strech left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

P.S I would consider few adjustments to tests and ask Tony about the Matrixfile

@y9v y9v force-pushed the appsec-add-rest-client-instrumentation branch from f8b49c5 to 49978b9 Compare February 24, 2025 11:33
@y9v y9v merged commit 4c0614d into master Feb 24, 2025
509 checks passed
@y9v y9v deleted the appsec-add-rest-client-instrumentation branch February 24, 2025 13:17
@github-actions github-actions bot added this to the 2.12.0 milestone Feb 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
appsec Application Security monitoring product integrations Involves tracing integrations
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants