feat(appsec): extend RASP callsite coverage to File-argument constructors of FileOutputStream and FileInputStream#11113
Open
feat(appsec): extend RASP callsite coverage to File-argument constructors of FileOutputStream and FileInputStream#11113
Conversation
…ctors Add RASP callsite coverage for File-argument constructors that were previously not instrumented: - FileOutputStream(File) and FileOutputStream(File, boolean): call FileIORaspHelper.INSTANCE.beforeFileWritten(file.getPath()) - FileInputStream(File): call FileIORaspHelper.INSTANCE.beforeFileLoaded(file.getPath()) No IAST changes — the File-based constructors delegate path resolution to the JVM, so IAST taint tracking via the String constructor already covers those code paths at a higher level. Tests added following the existing RASP test pattern.
Contributor
|
Hi! 👋 Thanks for your pull request! 🎉 To help us review it, please make sure to:
If you need help, please check our contributing guidelines. |
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 59 metrics, 12 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~a66eb337bf, baseline=1.62.0-SNAPSHOT~693449b6f0f
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.064 s) : 0, 1064226
Total [baseline] (8.897 s) : 0, 8896899
Agent [candidate] (1.057 s) : 0, 1056689
Total [candidate] (8.822 s) : 0, 8822422
section iast
Agent [baseline] (1.225 s) : 0, 1224926
Total [baseline] (9.566 s) : 0, 9565561
Agent [candidate] (1.227 s) : 0, 1226784
Total [candidate] (9.584 s) : 0, 9584333
gantt
title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~a66eb337bf, baseline=1.62.0-SNAPSHOT~693449b6f0f
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.253 ms) : 0, 1253
crashtracking [candidate] (1.24 ms) : 0, 1240
BytebuddyAgent [baseline] (640.648 ms) : 0, 640648
BytebuddyAgent [candidate] (632.88 ms) : 0, 632880
AgentMeter [baseline] (29.845 ms) : 0, 29845
AgentMeter [candidate] (29.299 ms) : 0, 29299
GlobalTracer [baseline] (250.463 ms) : 0, 250463
GlobalTracer [candidate] (248.327 ms) : 0, 248327
AppSec [baseline] (32.493 ms) : 0, 32493
AppSec [candidate] (32.328 ms) : 0, 32328
Debugger [baseline] (59.348 ms) : 0, 59348
Debugger [candidate] (58.907 ms) : 0, 58907
Remote Config [baseline] (601.09 µs) : 0, 601
Remote Config [candidate] (589.078 µs) : 0, 589
Telemetry [baseline] (8.088 ms) : 0, 8088
Telemetry [candidate] (8.011 ms) : 0, 8011
Flare Poller [baseline] (5.124 ms) : 0, 5124
Flare Poller [candidate] (8.956 ms) : 0, 8956
section iast
crashtracking [baseline] (1.237 ms) : 0, 1237
crashtracking [candidate] (1.221 ms) : 0, 1221
BytebuddyAgent [baseline] (803.789 ms) : 0, 803789
BytebuddyAgent [candidate] (806.602 ms) : 0, 806602
AgentMeter [baseline] (11.489 ms) : 0, 11489
AgentMeter [candidate] (11.232 ms) : 0, 11232
GlobalTracer [baseline] (238.739 ms) : 0, 238739
GlobalTracer [candidate] (238.172 ms) : 0, 238172
AppSec [baseline] (31.075 ms) : 0, 31075
AppSec [candidate] (26.718 ms) : 0, 26718
Debugger [baseline] (58.673 ms) : 0, 58673
Debugger [candidate] (64.308 ms) : 0, 64308
Remote Config [baseline] (531.53 µs) : 0, 532
Remote Config [candidate] (515.289 µs) : 0, 515
Telemetry [baseline] (13.61 ms) : 0, 13610
Telemetry [candidate] (7.831 ms) : 0, 7831
Flare Poller [baseline] (3.771 ms) : 0, 3771
Flare Poller [candidate] (3.447 ms) : 0, 3447
IAST [baseline] (25.694 ms) : 0, 25694
IAST [candidate] (30.001 ms) : 0, 30001
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~a66eb337bf, baseline=1.62.0-SNAPSHOT~693449b6f0f
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.056 s) : 0, 1055966
Total [baseline] (11.114 s) : 0, 11114410
Agent [candidate] (1.056 s) : 0, 1055680
Total [candidate] (11.077 s) : 0, 11076603
section appsec
Agent [baseline] (1.247 s) : 0, 1247258
Total [baseline] (11.205 s) : 0, 11204685
Agent [candidate] (1.267 s) : 0, 1266749
Total [candidate] (11.03 s) : 0, 11029638
section iast
Agent [baseline] (1.222 s) : 0, 1222363
Total [baseline] (11.397 s) : 0, 11397241
Agent [candidate] (1.239 s) : 0, 1239173
Total [candidate] (11.351 s) : 0, 11351181
section profiling
Agent [baseline] (1.183 s) : 0, 1182821
Total [baseline] (11.0 s) : 0, 10999937
Agent [candidate] (1.185 s) : 0, 1184839
Total [candidate] (11.086 s) : 0, 11085801
gantt
title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~a66eb337bf, baseline=1.62.0-SNAPSHOT~693449b6f0f
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.22 ms) : 0, 1220
crashtracking [candidate] (1.218 ms) : 0, 1218
BytebuddyAgent [baseline] (631.048 ms) : 0, 631048
BytebuddyAgent [candidate] (631.807 ms) : 0, 631807
AgentMeter [baseline] (29.308 ms) : 0, 29308
AgentMeter [candidate] (29.317 ms) : 0, 29317
GlobalTracer [baseline] (248.351 ms) : 0, 248351
GlobalTracer [candidate] (248.204 ms) : 0, 248204
AppSec [baseline] (32.275 ms) : 0, 32275
AppSec [candidate] (32.211 ms) : 0, 32211
Debugger [baseline] (60.04 ms) : 0, 60040
Debugger [candidate] (59.943 ms) : 0, 59943
Remote Config [baseline] (589.99 µs) : 0, 590
Remote Config [candidate] (586.11 µs) : 0, 586
Telemetry [baseline] (8.078 ms) : 0, 8078
Telemetry [candidate] (8.083 ms) : 0, 8083
Flare Poller [baseline] (8.961 ms) : 0, 8961
Flare Poller [candidate] (8.303 ms) : 0, 8303
section appsec
crashtracking [baseline] (1.223 ms) : 0, 1223
crashtracking [candidate] (1.218 ms) : 0, 1218
BytebuddyAgent [baseline] (661.221 ms) : 0, 661221
BytebuddyAgent [candidate] (676.616 ms) : 0, 676616
AgentMeter [baseline] (12.082 ms) : 0, 12082
AgentMeter [candidate] (12.023 ms) : 0, 12023
GlobalTracer [baseline] (248.798 ms) : 0, 248798
GlobalTracer [candidate] (250.463 ms) : 0, 250463
AppSec [baseline] (184.882 ms) : 0, 184882
AppSec [candidate] (186.448 ms) : 0, 186448
Debugger [baseline] (65.676 ms) : 0, 65676
Debugger [candidate] (67.073 ms) : 0, 67073
Remote Config [baseline] (605.726 µs) : 0, 606
Remote Config [candidate] (589.234 µs) : 0, 589
Telemetry [baseline] (8.31 ms) : 0, 8310
Telemetry [candidate] (7.938 ms) : 0, 7938
Flare Poller [baseline] (3.505 ms) : 0, 3505
Flare Poller [candidate] (3.502 ms) : 0, 3502
IAST [baseline] (24.592 ms) : 0, 24592
IAST [candidate] (24.432 ms) : 0, 24432
section iast
crashtracking [baseline] (1.22 ms) : 0, 1220
crashtracking [candidate] (1.232 ms) : 0, 1232
BytebuddyAgent [baseline] (799.042 ms) : 0, 799042
BytebuddyAgent [candidate] (815.193 ms) : 0, 815193
AgentMeter [baseline] (11.419 ms) : 0, 11419
AgentMeter [candidate] (11.385 ms) : 0, 11385
GlobalTracer [baseline] (238.738 ms) : 0, 238738
GlobalTracer [candidate] (239.833 ms) : 0, 239833
AppSec [baseline] (32.006 ms) : 0, 32006
AppSec [candidate] (27.59 ms) : 0, 27590
Debugger [baseline] (62.15 ms) : 0, 62150
Debugger [candidate] (65.59 ms) : 0, 65590
Remote Config [baseline] (534.657 µs) : 0, 535
Remote Config [candidate] (538.421 µs) : 0, 538
Telemetry [baseline] (11.775 ms) : 0, 11775
Telemetry [candidate] (8.007 ms) : 0, 8007
Flare Poller [baseline] (3.477 ms) : 0, 3477
Flare Poller [candidate] (3.47 ms) : 0, 3470
IAST [baseline] (25.804 ms) : 0, 25804
IAST [candidate] (29.437 ms) : 0, 29437
section profiling
crashtracking [baseline] (1.175 ms) : 0, 1175
crashtracking [candidate] (1.171 ms) : 0, 1171
BytebuddyAgent [baseline] (690.465 ms) : 0, 690465
BytebuddyAgent [candidate] (691.521 ms) : 0, 691521
AgentMeter [baseline] (9.078 ms) : 0, 9078
AgentMeter [candidate] (9.124 ms) : 0, 9124
GlobalTracer [baseline] (206.819 ms) : 0, 206819
GlobalTracer [candidate] (207.448 ms) : 0, 207448
AppSec [baseline] (32.736 ms) : 0, 32736
AppSec [candidate] (32.883 ms) : 0, 32883
Debugger [baseline] (65.536 ms) : 0, 65536
Debugger [candidate] (65.5 ms) : 0, 65500
Remote Config [baseline] (574.34 µs) : 0, 574
Remote Config [candidate] (575.689 µs) : 0, 576
Telemetry [baseline] (7.779 ms) : 0, 7779
Telemetry [candidate] (7.766 ms) : 0, 7766
Flare Poller [baseline] (3.528 ms) : 0, 3528
Flare Poller [candidate] (3.517 ms) : 0, 3517
ProfilingAgent [baseline] (94.132 ms) : 0, 94132
ProfilingAgent [candidate] (94.218 ms) : 0, 94218
Profiling [baseline] (94.711 ms) : 0, 94711
Profiling [candidate] (94.81 ms) : 0, 94810
LoadParameters
See matching parameters
SummaryFound 1 performance improvements and 3 performance regressions! Performance is the same for 16 metrics, 16 unstable metrics.
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~a66eb337bf, baseline=1.62.0-SNAPSHOT~693449b6f0f
dateFormat X
axisFormat %s
section baseline
no_agent (1.25 ms) : 1239, 1262
. : milestone, 1250,
iast (3.339 ms) : 3292, 3385
. : milestone, 3339,
iast_FULL (6.469 ms) : 6401, 6537
. : milestone, 6469,
iast_GLOBAL (3.679 ms) : 3624, 3734
. : milestone, 3679,
profiling (2.06 ms) : 2042, 2077
. : milestone, 2060,
tracing (1.925 ms) : 1909, 1942
. : milestone, 1925,
section candidate
no_agent (1.259 ms) : 1248, 1270
. : milestone, 1259,
iast (3.361 ms) : 3307, 3416
. : milestone, 3361,
iast_FULL (6.104 ms) : 6042, 6165
. : milestone, 6104,
iast_GLOBAL (3.583 ms) : 3526, 3639
. : milestone, 3583,
profiling (2.099 ms) : 2079, 2118
. : milestone, 2099,
tracing (1.828 ms) : 1813, 1842
. : milestone, 1828,
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~a66eb337bf, baseline=1.62.0-SNAPSHOT~693449b6f0f
dateFormat X
axisFormat %s
section baseline
no_agent (19.32 ms) : 19124, 19517
. : milestone, 19320,
appsec (19.212 ms) : 19015, 19409
. : milestone, 19212,
code_origins (18.072 ms) : 17893, 18250
. : milestone, 18072,
iast (17.918 ms) : 17737, 18098
. : milestone, 17918,
profiling (19.075 ms) : 18883, 19267
. : milestone, 19075,
tracing (18.178 ms) : 18000, 18355
. : milestone, 18178,
section candidate
no_agent (18.46 ms) : 18266, 18654
. : milestone, 18460,
appsec (19.807 ms) : 19610, 20003
. : milestone, 19807,
code_origins (18.01 ms) : 17832, 18188
. : milestone, 18010,
iast (17.948 ms) : 17770, 18125
. : milestone, 17948,
profiling (20.745 ms) : 20534, 20955
. : milestone, 20745,
tracing (17.79 ms) : 17613, 17966
. : milestone, 17790,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~a66eb337bf, baseline=1.62.0-SNAPSHOT~693449b6f0f
dateFormat X
axisFormat %s
section baseline
no_agent (1.487 ms) : 1476, 1499
. : milestone, 1487,
appsec (3.817 ms) : 3596, 4039
. : milestone, 3817,
iast (2.264 ms) : 2194, 2333
. : milestone, 2264,
iast_GLOBAL (2.311 ms) : 2241, 2381
. : milestone, 2311,
profiling (2.088 ms) : 2033, 2142
. : milestone, 2088,
tracing (2.075 ms) : 2022, 2129
. : milestone, 2075,
section candidate
no_agent (1.489 ms) : 1477, 1501
. : milestone, 1489,
appsec (3.83 ms) : 3607, 4052
. : milestone, 3830,
iast (2.278 ms) : 2208, 2347
. : milestone, 2278,
iast_GLOBAL (2.31 ms) : 2240, 2381
. : milestone, 2310,
profiling (2.099 ms) : 2044, 2155
. : milestone, 2099,
tracing (2.07 ms) : 2016, 2123
. : milestone, 2070,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~a66eb337bf, baseline=1.62.0-SNAPSHOT~693449b6f0f
dateFormat X
axisFormat %s
section baseline
no_agent (14.964 s) : 14964000, 14964000
. : milestone, 14964000,
appsec (14.814 s) : 14814000, 14814000
. : milestone, 14814000,
iast (18.232 s) : 18232000, 18232000
. : milestone, 18232000,
iast_GLOBAL (18.092 s) : 18092000, 18092000
. : milestone, 18092000,
profiling (14.934 s) : 14934000, 14934000
. : milestone, 14934000,
tracing (15.091 s) : 15091000, 15091000
. : milestone, 15091000,
section candidate
no_agent (15.547 s) : 15547000, 15547000
. : milestone, 15547000,
appsec (14.902 s) : 14902000, 14902000
. : milestone, 14902000,
iast (18.355 s) : 18355000, 18355000
. : milestone, 18355000,
iast_GLOBAL (18.116 s) : 18116000, 18116000
. : milestone, 18116000,
profiling (14.983 s) : 14983000, 14983000
. : milestone, 14983000,
tracing (15.104 s) : 15104000, 15104000
. : milestone, 15104000,
|
…, RandomAccessFile, Files.* and FileChannel Extends RASP callsite instrumentation (APPSEC-61874) beyond FileInputStream/FileOutputStream to all remaining Java file I/O APIs that were not covered. No IAST changes. New callsites: - FileReaderCallSite: FileReader(String/File) + Java 11+ Charset variants → beforeFileLoaded - FileWriterCallSite: FileWriter(String/File/boolean) + Java 11+ Charset variants → beforeFileWritten - RandomAccessFileCallSite: RandomAccessFile(String/File, mode) → beforeFileLoaded for "r", both beforeFileLoaded + beforeFileWritten for "rw"/"rws"/"rwd" - FilesCallSite: all Files.* read and write methods (newOutputStream, copy(IS,Path), write, writeString, newBufferedWriter, move, newInputStream, readAllBytes, readAllLines, readString, newBufferedReader, lines) - FileChannelCallSite: FileChannel.open(Path, ...) → fires both read and write callbacks Extended callsites: - PathCallSite: add resolve(Path) and resolveSibling(Path) → beforeFileLoaded - PathsCallSite: add Path.of(String[], URI) (Java 11+) → beforeFileLoaded FileIORaspHelper: add beforeRandomAccessFileOpened(path, mode) helper Relates to #11084 and #11113
Adds a java11Test source set that compiles with --release 11 and runs only on JDK 11+. Tests cover the Java 11-only overloads that were instrumented but previously untestable from Java 8 sources: - FileReader(String/File, Charset) constructors - FileWriter(String/File, Charset[, boolean]) constructors - Files.writeString(Path, CharSequence, [Charset,] OpenOption...) - Files.readString(Path[, Charset]) - Path.of(String, String[]) and Path.of(URI) static methods Build configuration uses ext.java11TestMinJavaVersionForTests so the testJvmConstraints plugin skips the suite on pre-11 JVMs.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 468e83facb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…tions FileChannel.open() with READ-only options was incorrectly triggering the fileWritten callback, which could cause false positives in the zipslip rule (dog-920-110) when a read-only channel open with a traversal path coincided with a multipart zip upload in the same request. Split beforeOpen into two overload-specific methods so the OpenOption arguments can be inspected at the call site, mirroring the existing pattern in beforeRandomAccessFileOpened. Also fix a latent bug in AdviceGeneratorImpl: .sorted() without a comparator on ArgumentSpecification (which does not implement Comparable) would ClassCastException when an advice method captures a strict subset of a target method's arguments. Fixed with Comparator.comparingInt.
jandro996
commented
Apr 15, 2026
Member
Author
There was a problem hiding this comment.
@manuel-alvarez-alvarez I'm going to move this to a separated PR but I want your thoughts about this before do it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
Extends RASP callsite coverage for Java file I/O APIs. All new callsites are RASP-only — no IAST changes, since
File-based andPath-based constructors delegate path resolution to the JVM, and IAST tainttracking via the
Stringconstructors already covers those code paths.New callsites
FileReaderCallSite→beforeFileLoadedFileReader(String),FileReader(File)FileReader(String, Charset),FileReader(File, Charset)(Java 11+)FileWriterCallSite→beforeFileWrittenFileWriter(String),FileWriter(String, boolean),FileWriter(File),FileWriter(File, boolean)FileWriter(String, Charset),FileWriter(String, Charset, boolean),FileWriter(File, Charset),FileWriter(File, Charset, boolean)(Java 11+)RandomAccessFileCallSite→beforeFileLoadedfor mode"r"; bothbeforeFileLoaded+beforeFileWrittenfor"rw"/"rws"/"rwd"RandomAccessFile(String, String),RandomAccessFile(File, String)FilesCallSitebeforeFileWritten:Files.newOutputStream,Files.write(bytes),Files.write(lines, charset),Files.write(lines),Files.newBufferedWriter(path, charset),Files.newBufferedWriter(path),Files.copy(InputStream, Path, ...),Files.moveFiles.writeString(path, seq),Files.writeString(path, seq, charset)beforeFileLoaded:Files.newInputStream,Files.readAllBytes,Files.readAllLines(path, charset),Files.readAllLines(path),Files.newBufferedReader(path, charset),Files.newBufferedReader(path),Files.lines(path, charset),Files.lines(path)Files.readString(path),Files.readString(path, charset)FileChannelCallSite→ bothbeforeFileLoaded+beforeFileWritten(channel mode is determined at runtime, not statically)FileChannel.open(Path, OpenOption[]),FileChannel.open(Path, Set<OpenOption>, FileAttribute[])Extended callsites
FileInputStreamCallSite(extends #11084) — addedFileInputStream(File)→beforeFileLoadedFileOutputStreamCallSite(extends #11084) — addedFileOutputStream(File),FileOutputStream(File, boolean)→beforeFileWrittenPathCallSite— addedPath.resolve(Path),Path.resolveSibling(Path)→beforeFileLoadedPathsCallSite— addedPath.of(String, String[]),Path.of(URI)(Java 11+) →beforeFileLoadedAdditional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueJira Ticket: APPSEC-61874