Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore(iast): BytesIO only aspect #10735

Closed
wants to merge 12 commits into from
Closed

Conversation

gnufede
Copy link
Member

@gnufede gnufede commented Sep 20, 2024

Checklist

  • PR author has checked that all the criteria below are met
  • The PR description includes an overview of the change
  • The PR description articulates the motivation for the change
  • The change includes tests OR the PR description describes a testing strategy
  • The PR description notes risks associated with the change, if any
  • Newly-added code is easy to change
  • The change follows the library release note guidelines
  • The change includes or references documentation updates if necessary
  • Backport labels are set (if applicable)

Reviewer Checklist

  • Reviewer has checked that all the criteria below are met
  • Title is accurate
  • All changes are related to the pull request's stated goal
  • Avoids breaking API changes
  • Testing strategy adequately addresses listed risks
  • Newly-added code is easy to change
  • Release note makes sense to a user of the library
  • If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
  • Backport labels are set in a manner that is consistent with the release branch maintenance policy

@gnufede gnufede changed the title chore(iast): BytesIO and StringIO aspects chore(iast): BytesIO only aspect Sep 20, 2024
Copy link
Contributor

github-actions bot commented Sep 20, 2024

CODEOWNERS have been resolved as:

tests/appsec/iast/fixtures/ast/io/function_bytesio.py                   @DataDog/asm-python
tests/appsec/iast/fixtures/ast/io/function_stringio.py                  @DataDog/asm-python
tests/appsec/iast/fixtures/ast/io/module_bytesio.py                     @DataDog/asm-python
tests/appsec/iast/fixtures/ast/io/module_read.py                        @DataDog/asm-python
tests/appsec/iast/fixtures/ast/io/module_stringio.py                    @DataDog/asm-python
ddtrace/appsec/_common_module_patches.py                                @DataDog/asm-python
ddtrace/appsec/_constants.py                                            @DataDog/asm-python
ddtrace/appsec/_iast/_ast/ast_patching.py                               @DataDog/asm-python
ddtrace/appsec/_iast/_ast/visitor.py                                    @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Utils/StringUtils.cpp              @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/Utils/StringUtils.h                @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/__init__.py                        @DataDog/asm-python
ddtrace/appsec/_iast/_taint_tracking/aspects.py                         @DataDog/asm-python
tests/appsec/app.py                                                     @DataDog/asm-python
tests/appsec/iast/_ast/test_ast_patching.py                             @DataDog/asm-python
tests/appsec/iast/fixtures/propagation_path.py                          @DataDog/asm-python
tests/appsec/integrations/test_flask_iast_patching.py                   @DataDog/asm-python

# try_unwrap("_io", "StringIO.read")


def wrapped_read_F3E51D71B4EC16EF(original_read_callable, instance, args, kwargs):
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Quality Violation

Suggested change
def wrapped_read_F3E51D71B4EC16EF(original_read_callable, instance, args, kwargs):
def wrapped_read_f3_e51_d71_b4_e_c16_e_f(original_read_callable, instance, args, kwargs):
use snake_case and not camelCase (...read more)

Ensure that function use snake_case.

This rule is not valid for tests files (prefixed by test_ or suffixed by _test.py) because testing requires some camel case methods, such as, tearDown, setUp, and more.

Learn More

View in Datadog  Leave us feedback  Documentation

]


def stringio_aspect(orig_function: Optional[Callable], flag_added_args: int, *args: Any, **kwargs: Any) -> _io.StringIO:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Quality Violation

do not use Any, use a concrete type (...read more)

Use the Any type very carefully. Most of the time, the Any type is used because we do not know exactly what type is being used. If you want to specify that a value can be of any type, use object instead of Any.

Learn More

View in Datadog  Leave us feedback  Documentation

return result


def bytesio_aspect(orig_function: Optional[Callable], flag_added_args: int, *args: Any, **kwargs: Any) -> _io.BytesIO:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 Code Quality Violation

do not use Any, use a concrete type (...read more)

Use the Any type very carefully. Most of the time, the Any type is used because we do not know exactly what type is being used. If you want to specify that a value can be of any type, use object instead of Any.

Learn More

View in Datadog  Leave us feedback  Documentation

@datadog-dd-trace-py-rkomorn
Copy link

datadog-dd-trace-py-rkomorn bot commented Sep 20, 2024

Datadog Report

Branch report: gnufede/iast-taint-bytesio-only
Commit report: d4ab724
Test service: dd-trace-py

✅ 0 Failed, 1888 Passed, 217 Skipped, 866.99ms Total duration (18.46s time saved)

@pr-commenter
Copy link

pr-commenter bot commented Sep 20, 2024

Benchmarks

Benchmark execution time: 2024-09-20 16:57:50

Comparing candidate commit 547c31c in PR branch gnufede/iast-taint-bytesio-only with baseline commit 33daba9 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 356 metrics, 48 unstable metrics.

@gnufede gnufede closed this Sep 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant