Skip to content

Extract Ratpack json body response schemas #9013

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: malvarez/play-response-extraction
Choose a base branch
from

Conversation

manuel-alvarez-alvarez
Copy link
Member

@manuel-alvarez-alvarez manuel-alvarez-alvarez commented Jun 19, 2025

What Does This Do

Adds response body extraction for Ratpack JSON endpoints to enable automatic API schema discovery and protection by the Web Application Firewall (WAF).

Motivation

Additional Notes

Contributor Checklist

Jira ticket: APPSEC-57915

@manuel-alvarez-alvarez manuel-alvarez-alvarez added comp: asm waf Application Security Management (WAF) type: enhancement inst: ratpack Ratpack instrumentation labels Jun 19, 2025
@manuel-alvarez-alvarez manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from 686764c to 7e087e5 Compare June 19, 2025 16:03
@manuel-alvarez-alvarez manuel-alvarez-alvarez marked this pull request as ready for review June 19, 2025 16:04
@manuel-alvarez-alvarez manuel-alvarez-alvarez requested review from a team as code owners June 19, 2025 16:04
@pr-commenter
Copy link

pr-commenter bot commented Jun 19, 2025

Benchmarks

Startup

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master malvarez/ratpack-response-extraction
git_commit_date 1750342534 1750349003
git_commit_sha e0a1fc0 7e087e5
release_version 1.50.0-SNAPSHOT~e0a1fc0e75 1.50.0-SNAPSHOT~7e087e5fb5
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
ci_job_date 1750350779 1750350779
ci_job_id 990419620 990419620
ci_pipeline_id 68257708 68257708
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-ecr1ksdw-project-304-concurrent-0-aientxcv 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-ecr1ksdw-project-304-concurrent-0-aientxcv 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module Agent Agent
parent None None
variant iast iast

Summary

Found 2 performance improvements and 2 performance regressions! Performance is the same for 39 metrics, 10 unstable metrics.

scenario Δ mean execution_time candidate mean execution_time baseline mean execution_time
scenario:startup:insecure-bank:tracing:Remote Config better
[-82.687µs; -35.616µs] or [-11.605%; -4.999%]
653.370µs 712.521µs
scenario:startup:petclinic:appsec:AppSec worse
[+3.541ms; +6.606ms] or [+2.015%; +3.760%]
180.775ms 175.701ms
scenario:startup:petclinic:profiling:AppSec worse
[+1.774ms; +3.795ms] or [+2.840%; +6.077%]
65.229ms 62.445ms
scenario:startup:petclinic:tracing:Remote Config better
[-101.686µs; -38.904µs] or [-13.646%; -5.221%]
674.868µs 745.163µs
Startup time reports for insecure-bank
gantt
    title insecure-bank - global startup overhead: candidate=1.50.0-SNAPSHOT~7e087e5fb5, baseline=1.50.0-SNAPSHOT~e0a1fc0e75

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.023 s) : 0, 1023068
Total [baseline] (8.536 s) : 0, 8535879
Agent [candidate] (1.029 s) : 0, 1029351
Total [candidate] (8.51 s) : 0, 8510476
section iast
Agent [baseline] (1.156 s) : 0, 1156159
Total [baseline] (9.274 s) : 0, 9274488
Agent [candidate] (1.164 s) : 0, 1163674
Total [candidate] (9.202 s) : 0, 9201659
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.023 s -
Agent iast 1.156 s 133.092 ms (13.0%)
Total tracing 8.536 s -
Total iast 9.274 s 738.609 ms (8.7%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.029 s -
Agent iast 1.164 s 134.323 ms (13.0%)
Total tracing 8.51 s -
Total iast 9.202 s 691.182 ms (8.1%)
gantt
    title insecure-bank - break down per module: candidate=1.50.0-SNAPSHOT~7e087e5fb5, baseline=1.50.0-SNAPSHOT~e0a1fc0e75

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (683.392 ms) : 0, 683392
BytebuddyAgent [candidate] (685.396 ms) : 0, 685396
GlobalTracer [baseline] (240.777 ms) : 0, 240777
GlobalTracer [candidate] (241.064 ms) : 0, 241064
AppSec [baseline] (59.089 ms) : 0, 59089
AppSec [candidate] (62.157 ms) : 0, 62157
Debugger [baseline] (6.825 ms) : 0, 6825
Debugger [candidate] (6.172 ms) : 0, 6172
Remote Config [baseline] (712.521 µs) : 0, 713
Remote Config [candidate] (653.37 µs) : 0, 653
Telemetry [baseline] (8.959 ms) : 0, 8959
Telemetry [candidate] (10.468 ms) : 0, 10468
section iast
BytebuddyAgent [baseline] (805.538 ms) : 0, 805538
BytebuddyAgent [candidate] (810.921 ms) : 0, 810921
GlobalTracer [baseline] (232.586 ms) : 0, 232586
GlobalTracer [candidate] (232.451 ms) : 0, 232451
IAST [baseline] (24.639 ms) : 0, 24639
IAST [candidate] (28.638 ms) : 0, 28638
AppSec [baseline] (55.202 ms) : 0, 55202
AppSec [candidate] (53.658 ms) : 0, 53658
Debugger [baseline] (5.986 ms) : 0, 5986
Debugger [candidate] (5.99 ms) : 0, 5990
Remote Config [baseline] (609.666 µs) : 0, 610
Remote Config [candidate] (581.951 µs) : 0, 582
Telemetry [baseline] (7.99 ms) : 0, 7990
Telemetry [candidate] (7.906 ms) : 0, 7906
Loading
Startup time reports for petclinic
gantt
    title petclinic - global startup overhead: candidate=1.50.0-SNAPSHOT~7e087e5fb5, baseline=1.50.0-SNAPSHOT~e0a1fc0e75

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.042 s) : 0, 1042179
Total [baseline] (10.785 s) : 0, 10784590
Agent [candidate] (1.03 s) : 0, 1030439
Total [candidate] (10.665 s) : 0, 10665342
section appsec
Agent [baseline] (1.178 s) : 0, 1178105
Total [baseline] (10.679 s) : 0, 10679023
Agent [candidate] (1.192 s) : 0, 1191831
Total [candidate] (10.861 s) : 0, 10861185
section iast
Agent [baseline] (1.16 s) : 0, 1160490
Total [baseline] (10.867 s) : 0, 10866665
Agent [candidate] (1.17 s) : 0, 1169571
Total [candidate] (10.877 s) : 0, 10877099
section profiling
Agent [baseline] (1.283 s) : 0, 1282515
Total [baseline] (11.134 s) : 0, 11133962
Agent [candidate] (1.283 s) : 0, 1283262
Total [candidate] (10.904 s) : 0, 10903730
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.042 s -
Agent appsec 1.178 s 135.926 ms (13.0%)
Agent iast 1.16 s 118.311 ms (11.4%)
Agent profiling 1.283 s 240.336 ms (23.1%)
Total tracing 10.785 s -
Total appsec 10.679 s -105.567 ms (-1.0%)
Total iast 10.867 s 82.075 ms (0.8%)
Total profiling 11.134 s 349.372 ms (3.2%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.03 s -
Agent appsec 1.192 s 161.392 ms (15.7%)
Agent iast 1.17 s 139.132 ms (13.5%)
Agent profiling 1.283 s 252.822 ms (24.5%)
Total tracing 10.665 s -
Total appsec 10.861 s 195.843 ms (1.8%)
Total iast 10.877 s 211.757 ms (2.0%)
Total profiling 10.904 s 238.388 ms (2.2%)
gantt
    title petclinic - break down per module: candidate=1.50.0-SNAPSHOT~7e087e5fb5, baseline=1.50.0-SNAPSHOT~e0a1fc0e75

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (698.357 ms) : 0, 698357
BytebuddyAgent [candidate] (685.505 ms) : 0, 685505
GlobalTracer [baseline] (244.126 ms) : 0, 244126
GlobalTracer [candidate] (241.307 ms) : 0, 241307
AppSec [baseline] (56.889 ms) : 0, 56889
AppSec [candidate] (60.356 ms) : 0, 60356
Debugger [baseline] (6.24 ms) : 0, 6240
Debugger [candidate] (6.277 ms) : 0, 6277
Remote Config [baseline] (745.163 µs) : 0, 745
Remote Config [candidate] (674.868 µs) : 0, 675
Telemetry [baseline] (12.032 ms) : 0, 12032
Telemetry [candidate] (12.851 ms) : 0, 12851
section appsec
BytebuddyAgent [baseline] (707.672 ms) : 0, 707672
BytebuddyAgent [candidate] (714.542 ms) : 0, 714542
GlobalTracer [baseline] (235.594 ms) : 0, 235594
GlobalTracer [candidate] (237.025 ms) : 0, 237025
IAST [baseline] (21.833 ms) : 0, 21833
IAST [candidate] (21.923 ms) : 0, 21923
AppSec [baseline] (175.701 ms) : 0, 175701
AppSec [candidate] (180.775 ms) : 0, 180775
Debugger [baseline] (5.905 ms) : 0, 5905
Debugger [candidate] (5.936 ms) : 0, 5936
Remote Config [baseline] (618.489 µs) : 0, 618
Remote Config [candidate] (647.688 µs) : 0, 648
Telemetry [baseline] (7.285 ms) : 0, 7285
Telemetry [candidate] (7.37 ms) : 0, 7370
section iast
BytebuddyAgent [baseline] (810.431 ms) : 0, 810431
BytebuddyAgent [candidate] (815.413 ms) : 0, 815413
GlobalTracer [baseline] (232.66 ms) : 0, 232660
GlobalTracer [candidate] (232.479 ms) : 0, 232479
IAST [baseline] (27.108 ms) : 0, 27108
IAST [candidate] (27.28 ms) : 0, 27280
AppSec [baseline] (51.482 ms) : 0, 51482
AppSec [candidate] (55.966 ms) : 0, 55966
Debugger [baseline] (5.933 ms) : 0, 5933
Debugger [candidate] (6.074 ms) : 0, 6074
Remote Config [baseline] (587.107 µs) : 0, 587
Remote Config [candidate] (596.895 µs) : 0, 597
Telemetry [baseline] (7.948 ms) : 0, 7948
Telemetry [candidate] (8.032 ms) : 0, 8032
section profiling
BytebuddyAgent [baseline] (685.938 ms) : 0, 685938
BytebuddyAgent [candidate] (680.414 ms) : 0, 680414
GlobalTracer [baseline] (363.108 ms) : 0, 363108
GlobalTracer [candidate] (362.329 ms) : 0, 362329
AppSec [baseline] (62.445 ms) : 0, 62445
AppSec [candidate] (65.229 ms) : 0, 65229
Debugger [baseline] (6.173 ms) : 0, 6173
Debugger [candidate] (6.212 ms) : 0, 6212
Remote Config [baseline] (647.324 µs) : 0, 647
Remote Config [candidate] (662.335 µs) : 0, 662
Telemetry [baseline] (8.305 ms) : 0, 8305
Telemetry [candidate] (8.279 ms) : 0, 8279
ProfilingAgent [baseline] (104.501 ms) : 0, 104501
ProfilingAgent [candidate] (109.121 ms) : 0, 109121
Profiling [baseline] (104.526 ms) : 0, 104526
Profiling [candidate] (109.146 ms) : 0, 109146
Loading

Load

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
end_time 2025-06-19T16:22:07 2025-06-19T16:23:43
git_branch master malvarez/ratpack-response-extraction
git_commit_date 1750342534 1750349003
git_commit_sha e0a1fc0 7e087e5
release_version 1.50.0-SNAPSHOT~e0a1fc0e75 1.50.0-SNAPSHOT~7e087e5fb5
start_time 2025-06-19T16:21:34 2025-06-19T16:23:10
See matching parameters
Baseline Candidate
application petclinic petclinic
ci_job_date 1750350223 1750350223
ci_job_id 990419621 990419621
ci_pipeline_id 68257708 68257708
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-9fhc4bx7-project-304-concurrent-0-zm25c9bs 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-9fhc4bx7-project-304-concurrent-0-zm25c9bs 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
thresholds_or_results results results
variant appsec appsec

Summary

Found 0 performance improvements and 2 performance regressions! Performance is the same for 0 metrics, 10 unstable metrics.

scenario Δ mean http_req_duration Δ mean throughput candidate mean http_req_duration candidate mean throughput baseline mean http_req_duration baseline mean throughput
scenario:load:petclinic:no_agent unstable
[+66.951ms; +69.439ms] or [+769.987%; +798.606%]
worse
[-517.950op/s; -489.240op/s] or [-91.289%; -86.228%]
76.890ms 63.781op/s 8.695ms 567.376op/s
scenario:load:petclinic:tracing unstable
[+73.575ms; +76.375ms] or [+892.799%; +926.780%]
worse
[-553.313op/s; -522.288op/s] or [-92.680%; -87.483%]
83.216ms 59.214op/s 8.241ms 597.015op/s
Request duration reports for petclinic
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~7e087e5fb5, baseline=1.50.0-SNAPSHOT~e0a1fc0e75
    dateFormat X
    axisFormat %s
section baseline
no_agent (8.695 ms) : 8671, 8719
.   : milestone, 8695,
appsec (39.513 ms) : 38980, 40046
.   : milestone, 39513,
code_origins (53.306 ms) : 52182, 54430
.   : milestone, 53306,
iast (47.454 ms) : 46782, 48127
.   : milestone, 47454,
profiling (11.005 ms) : 10930, 11081
.   : milestone, 11005,
tracing (8.241 ms) : 8214, 8268
.   : milestone, 8241,
section candidate
no_agent (76.89 ms) : 75255, 78525
.   : milestone, 76890,
appsec (96.475 ms) : 93665, 99286
.   : milestone, 96475,
code_origins (114.259 ms) : 107749, 120768
.   : milestone, 114259,
iast (101.893 ms) : 98240, 105545
.   : milestone, 101893,
profiling (89.274 ms) : 87100, 91448
.   : milestone, 89274,
tracing (83.216 ms) : 81376, 85056
.   : milestone, 83216,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 8.695 ms [8.671 ms, 8.719 ms] -
appsec 39.513 ms [38.98 ms, 40.046 ms] 30.818 ms (354.4%)
code_origins 53.306 ms [52.182 ms, 54.43 ms] 44.611 ms (513.1%)
iast 47.454 ms [46.782 ms, 48.127 ms] 38.759 ms (445.8%)
profiling 11.005 ms [10.93 ms, 11.081 ms] 2.31 ms (26.6%)
tracing 8.241 ms [8.214 ms, 8.268 ms] -454.113 µs (-5.2%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 76.89 ms [75.255 ms, 78.525 ms] -
appsec 96.475 ms [93.665 ms, 99.286 ms] 19.585 ms (25.5%)
code_origins 114.259 ms [107.749 ms, 120.768 ms] 37.369 ms (48.6%)
iast 101.893 ms [98.24 ms, 105.545 ms] 25.003 ms (32.5%)
profiling 89.274 ms [87.1 ms, 91.448 ms] 12.384 ms (16.1%)
tracing 83.216 ms [81.376 ms, 85.056 ms] 6.326 ms (8.2%)

Dacapo

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master malvarez/ratpack-response-extraction
git_commit_date 1750342534 1750349003
git_commit_sha e0a1fc0 7e087e5
release_version 1.50.0-SNAPSHOT~e0a1fc0e75 1.50.0-SNAPSHOT~7e087e5fb5
See matching parameters
Baseline Candidate
application biojava biojava
ci_job_date 1750350938 1750350938
ci_job_id 990419622 990419622
ci_pipeline_id 68257708 68257708
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-ecr1ksdw-project-304-concurrent-1-wig4qwen 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-ecr1ksdw-project-304-concurrent-1-wig4qwen 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
variant appsec appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics.

Execution time for tomcat
gantt
    title tomcat - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~7e087e5fb5, baseline=1.50.0-SNAPSHOT~e0a1fc0e75
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.476 ms) : 1465, 1488
.   : milestone, 1476,
appsec (2.394 ms) : 2345, 2442
.   : milestone, 2394,
iast (2.182 ms) : 2121, 2243
.   : milestone, 2182,
iast_GLOBAL (2.231 ms) : 2170, 2293
.   : milestone, 2231,
profiling (2.048 ms) : 1998, 2099
.   : milestone, 2048,
tracing (2.003 ms) : 1956, 2050
.   : milestone, 2003,
section candidate
no_agent (1.475 ms) : 1463, 1486
.   : milestone, 1475,
appsec (2.402 ms) : 2353, 2451
.   : milestone, 2402,
iast (2.186 ms) : 2124, 2248
.   : milestone, 2186,
iast_GLOBAL (2.235 ms) : 2173, 2297
.   : milestone, 2235,
profiling (2.452 ms) : 2293, 2611
.   : milestone, 2452,
tracing (2.014 ms) : 1966, 2062
.   : milestone, 2014,
Loading
  • baseline results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 1.476 ms [1.465 ms, 1.488 ms] -
appsec 2.394 ms [2.345 ms, 2.442 ms] 917.474 µs (62.1%)
iast 2.182 ms [2.121 ms, 2.243 ms] 705.576 µs (47.8%)
iast_GLOBAL 2.231 ms [2.17 ms, 2.293 ms] 755.222 µs (51.2%)
profiling 2.048 ms [1.998 ms, 2.099 ms] 571.919 µs (38.7%)
tracing 2.003 ms [1.956 ms, 2.05 ms] 526.709 µs (35.7%)
  • candidate results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 1.475 ms [1.463 ms, 1.486 ms] -
appsec 2.402 ms [2.353 ms, 2.451 ms] 927.203 µs (62.9%)
iast 2.186 ms [2.124 ms, 2.248 ms] 711.227 µs (48.2%)
iast_GLOBAL 2.235 ms [2.173 ms, 2.297 ms] 760.415 µs (51.6%)
profiling 2.452 ms [2.293 ms, 2.611 ms] 977.359 µs (66.3%)
tracing 2.014 ms [1.966 ms, 2.062 ms] 539.245 µs (36.6%)
Execution time for biojava
gantt
    title biojava - execution time [CI 0.99] : candidate=1.50.0-SNAPSHOT~7e087e5fb5, baseline=1.50.0-SNAPSHOT~e0a1fc0e75
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.316 s) : 15316000, 15316000
.   : milestone, 15316000,
appsec (14.754 s) : 14754000, 14754000
.   : milestone, 14754000,
iast (18.67 s) : 18670000, 18670000
.   : milestone, 18670000,
iast_GLOBAL (17.975 s) : 17975000, 17975000
.   : milestone, 17975000,
profiling (14.937 s) : 14937000, 14937000
.   : milestone, 14937000,
tracing (14.922 s) : 14922000, 14922000
.   : milestone, 14922000,
section candidate
no_agent (15.258 s) : 15258000, 15258000
.   : milestone, 15258000,
appsec (14.818 s) : 14818000, 14818000
.   : milestone, 14818000,
iast (18.416 s) : 18416000, 18416000
.   : milestone, 18416000,
iast_GLOBAL (17.95 s) : 17950000, 17950000
.   : milestone, 17950000,
profiling (15.272 s) : 15272000, 15272000
.   : milestone, 15272000,
tracing (14.851 s) : 14851000, 14851000
.   : milestone, 14851000,
Loading
  • baseline results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 15.316 s [15.316 s, 15.316 s] -
appsec 14.754 s [14.754 s, 14.754 s] -562.0 ms (-3.7%)
iast 18.67 s [18.67 s, 18.67 s] 3.354 s (21.9%)
iast_GLOBAL 17.975 s [17.975 s, 17.975 s] 2.659 s (17.4%)
profiling 14.937 s [14.937 s, 14.937 s] -379.0 ms (-2.5%)
tracing 14.922 s [14.922 s, 14.922 s] -394.0 ms (-2.6%)
  • candidate results
Variant Execution Time [CI 0.99] Δ no_agent
no_agent 15.258 s [15.258 s, 15.258 s] -
appsec 14.818 s [14.818 s, 14.818 s] -440.0 ms (-2.9%)
iast 18.416 s [18.416 s, 18.416 s] 3.158 s (20.7%)
iast_GLOBAL 17.95 s [17.95 s, 17.95 s] 2.692 s (17.6%)
profiling 15.272 s [15.272 s, 15.272 s] 14.0 ms (0.1%)
tracing 14.851 s [14.851 s, 14.851 s] -407.0 ms (-2.7%)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
comp: asm waf Application Security Management (WAF) inst: ratpack Ratpack instrumentation type: enhancement
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant