- 
                Notifications
    You must be signed in to change notification settings 
- Fork 467
fix(iast): weak hash error if vulnerability is outside the context [backport 3.17] #15038
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
| 
  | 
f68f39c    to
    11b9fbd      
    Compare
  
    | Bootstrap import analysisComparison of import times between this PR and base. SummaryThe average import time from this PR is: 240 ± 2 ms. The average import time from base is: 242 ± 2 ms. The import time difference between this PR and base is: -1.6 ± 0.09 ms. Import time breakdownThe following import paths have shrunk: 
             | 
| Performance SLOsComparing candidate backport-15029-to-3.17 (11b9fbd) with baseline 3.17 (43f65b0) 🟡 Near SLO Breach (4 suites)🟡 djangosimple - 30/30✅ appsecTime: ✅ 20.487ms (SLO: <22.300ms -8.1%) vs baseline: +0.1% Memory: ✅ 65.483MB (SLO: <67.000MB -2.3%) vs baseline: +4.8% ✅ exception-replay-enabledTime: ✅ 1.340ms (SLO: <1.450ms -7.6%) vs baseline: -0.2% Memory: ✅ 64.555MB (SLO: <67.000MB -3.6%) vs baseline: +4.9% ✅ iastTime: ✅ 20.405ms (SLO: <22.250ms -8.3%) vs baseline: ~same Memory: ✅ 65.463MB (SLO: <67.000MB -2.3%) vs baseline: +4.8% ✅ profilerTime: ✅ 15.290ms (SLO: <16.550ms -7.6%) vs baseline: +0.9% Memory: ✅ 53.745MB (SLO: <54.500MB 🟡 -1.4%) vs baseline: +4.9% ✅ resource-renamingTime: ✅ 20.501ms (SLO: <21.750ms -5.7%) vs baseline: ~same Memory: ✅ 65.480MB (SLO: <67.000MB -2.3%) vs baseline: +4.8% ✅ span-code-originTime: ✅ 25.044ms (SLO: <28.200ms 📉 -11.2%) vs baseline: -0.9% Memory: ✅ 67.862MB (SLO: <69.500MB -2.4%) vs baseline: +5.1% ✅ tracerTime: ✅ 20.498ms (SLO: <21.750ms -5.8%) vs baseline: +0.3% Memory: ✅ 65.475MB (SLO: <67.000MB -2.3%) vs baseline: +4.9% ✅ tracer-and-profilerTime: ✅ 21.987ms (SLO: <23.500ms -6.4%) vs baseline: +0.3% Memory: ✅ 66.593MB (SLO: <67.500MB 🟡 -1.3%) vs baseline: +4.8% ✅ tracer-dont-create-db-spansTime: ✅ 19.347ms (SLO: <21.500ms 📉 -10.0%) vs baseline: +0.2% Memory: ✅ 65.492MB (SLO: <66.000MB 🟡 -0.8%) vs baseline: +4.9% ✅ tracer-minimalTime: ✅ 16.599ms (SLO: <17.500ms -5.1%) vs baseline: ~same Memory: ✅ 65.498MB (SLO: <66.000MB 🟡 -0.8%) vs baseline: +4.9% ✅ tracer-nativeTime: ✅ 20.466ms (SLO: <21.750ms -5.9%) vs baseline: +0.2% Memory: ✅ 71.476MB (SLO: <72.500MB 🟡 -1.4%) vs baseline: +5.0% ✅ tracer-no-cachesTime: ✅ 18.487ms (SLO: <19.650ms -5.9%) vs baseline: +0.3% Memory: ✅ 65.394MB (SLO: <67.000MB -2.4%) vs baseline: +4.7% ✅ tracer-no-databasesTime: ✅ 18.789ms (SLO: <20.100ms -6.5%) vs baseline: +0.4% Memory: ✅ 65.408MB (SLO: <67.000MB -2.4%) vs baseline: +4.8% ✅ tracer-no-middlewareTime: ✅ 20.162ms (SLO: <21.500ms -6.2%) vs baseline: ~same Memory: ✅ 65.436MB (SLO: <67.000MB -2.3%) vs baseline: +4.8% ✅ tracer-no-templatesTime: ✅ 20.247ms (SLO: <22.000ms -8.0%) vs baseline: -0.1% Memory: ✅ 65.486MB (SLO: <67.000MB -2.3%) vs baseline: +4.9% 🟡 errortrackingdjangosimple - 6/6✅ errortracking-enabled-allTime: ✅ 18.061ms (SLO: <19.850ms -9.0%) vs baseline: +0.4% Memory: ✅ 65.215MB (SLO: <66.500MB 🟡 -1.9%) vs baseline: +4.9% ✅ errortracking-enabled-userTime: ✅ 18.249ms (SLO: <19.400ms -5.9%) vs baseline: +1.3% Memory: ✅ 65.294MB (SLO: <66.500MB 🟡 -1.8%) vs baseline: +4.9% ✅ tracer-enabledTime: ✅ 18.271ms (SLO: <19.450ms -6.1%) vs baseline: +1.2% Memory: ✅ 65.274MB (SLO: <66.500MB 🟡 -1.8%) vs baseline: +4.9% 🟡 flasksimple - 18/18✅ appsec-getTime: ✅ 4.585ms (SLO: <4.750ms -3.5%) vs baseline: -0.5% Memory: ✅ 61.971MB (SLO: <65.000MB -4.7%) vs baseline: +4.9% ✅ appsec-postTime: ✅ 6.601ms (SLO: <6.750ms -2.2%) vs baseline: -0.4% Memory: ✅ 61.991MB (SLO: <65.000MB -4.6%) vs baseline: +4.9% ✅ appsec-telemetryTime: ✅ 4.576ms (SLO: <4.750ms -3.7%) vs baseline: -0.9% Memory: ✅ 61.853MB (SLO: <65.000MB -4.8%) vs baseline: +4.7% ✅ debuggerTime: ✅ 1.852ms (SLO: <2.000ms -7.4%) vs baseline: -0.8% Memory: ✅ 45.436MB (SLO: <47.000MB -3.3%) vs baseline: +4.9% ✅ iast-getTime: ✅ 1.859ms (SLO: <2.000ms -7.0%) vs baseline: -0.6% Memory: ✅ 42.389MB (SLO: <49.000MB 📉 -13.5%) vs baseline: +4.9% ✅ profilerTime: ✅ 1.909ms (SLO: <2.100ms -9.1%) vs baseline: -0.5% Memory: ✅ 46.380MB (SLO: <47.000MB 🟡 -1.3%) vs baseline: +4.7% ✅ resource-renamingTime: ✅ 3.367ms (SLO: <3.650ms -7.8%) vs baseline: -0.1% Memory: ✅ 52.239MB (SLO: <53.500MB -2.4%) vs baseline: +4.7% ✅ tracerTime: ✅ 3.353ms (SLO: <3.650ms -8.1%) vs baseline: -0.7% Memory: ✅ 52.239MB (SLO: <53.500MB -2.4%) vs baseline: +4.9% ✅ tracer-nativeTime: ✅ 3.356ms (SLO: <3.650ms -8.0%) vs baseline: -0.5% Memory: ✅ 58.312MB (SLO: <60.000MB -2.8%) vs baseline: +5.1% 🟡 telemetryaddmetric - 30/30✅ 1-count-metric-1-timesTime: ✅ 2.942µs (SLO: <20.000µs 📉 -85.3%) vs baseline: -0.9% Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.6% ✅ 1-count-metrics-100-timesTime: ✅ 203.223µs (SLO: <220.000µs -7.6%) vs baseline: ~same Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +5.2% ✅ 1-distribution-metric-1-timesTime: ✅ 3.296µs (SLO: <20.000µs 📉 -83.5%) vs baseline: ~same Memory: ✅ 32.145MB (SLO: <34.000MB -5.5%) vs baseline: +5.0% ✅ 1-distribution-metrics-100-timesTime: ✅ 215.832µs (SLO: <220.000µs 🟡 -1.9%) vs baseline: +0.1% Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.8% ✅ 1-gauge-metric-1-timesTime: ✅ 2.213µs (SLO: <20.000µs 📉 -88.9%) vs baseline: +0.6% Memory: ✅ 32.047MB (SLO: <34.000MB -5.7%) vs baseline: +4.6% ✅ 1-gauge-metrics-100-timesTime: ✅ 138.065µs (SLO: <150.000µs -8.0%) vs baseline: -1.2% Memory: ✅ 32.185MB (SLO: <34.000MB -5.3%) vs baseline: +5.2% ✅ 1-rate-metric-1-timesTime: ✅ 3.059µs (SLO: <20.000µs 📉 -84.7%) vs baseline: +0.2% Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +5.0% ✅ 1-rate-metrics-100-timesTime: ✅ 216.071µs (SLO: <250.000µs 📉 -13.6%) vs baseline: +0.1% Memory: ✅ 32.126MB (SLO: <34.000MB -5.5%) vs baseline: +4.9% ✅ 100-count-metrics-100-timesTime: ✅ 20.588ms (SLO: <22.000ms -6.4%) vs baseline: +0.6% Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +4.9% ✅ 100-distribution-metrics-100-timesTime: ✅ 2.284ms (SLO: <2.300ms 🟡 -0.7%) vs baseline: +0.8% Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.6% ✅ 100-gauge-metrics-100-timesTime: ✅ 1.430ms (SLO: <1.550ms -7.8%) vs baseline: +0.3% Memory: ✅ 32.008MB (SLO: <34.000MB -5.9%) vs baseline: +4.5% ✅ 100-rate-metrics-100-timesTime: ✅ 2.224ms (SLO: <2.550ms 📉 -12.8%) vs baseline: +0.1% Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.8% ✅ flush-1-metricTime: ✅ 4.576µs (SLO: <20.000µs 📉 -77.1%) vs baseline: +1.9% Memory: ✅ 32.106MB (SLO: <34.000MB -5.6%) vs baseline: +4.7% ✅ flush-100-metricsTime: ✅ 174.671µs (SLO: <250.000µs 📉 -30.1%) vs baseline: -0.4% Memory: ✅ 32.165MB (SLO: <34.000MB -5.4%) vs baseline: +5.0% ✅ flush-1000-metricsTime: ✅ 2.146ms (SLO: <2.500ms 📉 -14.2%) vs baseline: +0.4% Memory: ✅ 32.893MB (SLO: <34.500MB -4.7%) vs baseline: +4.9% 
 | 
Backport 8940186 from #15029 to 3.17.
Description
This PR addresses an issue where using weak hashing or cipher algorithms outside of a request context (e.g., during application startup) could raise an unhandled exception. The fix ensures proper error handling when IAST operations are performed without an active request context.
Root Cause
The issue occurred in the has_quota method of the vulnerability base class, which was not properly handling cases where there was no active request context. When IAST operations were performed outside of a request (e.g., during application startup or in unsupported frameworks), the code would attempt to access the vulnerability budget from a non-existent context, leading to an unhandled exception.
Changes
Falsewhen no context is available, preventing further processing of vulnerabilities