-
Notifications
You must be signed in to change notification settings - Fork 452
fix(appsec): report all tags on the service entry span instead of the local root span #14210
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
fix(appsec): report all tags on the service entry span instead of the local root span #14210
Conversation
cf74a41
to
4453c1f
Compare
|
Bootstrap import analysisComparison of import times between this PR and base. SummaryThe average import time from this PR is: 273 ± 7 ms. The average import time from base is: 273 ± 6 ms. The import time difference between this PR and base is: 0.5 ± 0.3 ms. The difference is not statistically significant (z = 1.61). Import time breakdownThe following import paths have shrunk:
|
4453c1f
to
95a54a8
Compare
Performance SLOsCandidate: florentinl/APPSEC-58532/report-tags-on-service-entry-span (709bc4c) 🔵 No Baseline Data (24 suites)🔵 coreapiscenario - 12/12 (2 unstable)🔵 No baseline data available for this suite
|
bd9d326
to
e7f2dde
Compare
e7f2dde
to
050c4b5
Compare
915b5b7
to
0a7ecc8
Compare
d08fce8
to
337c94d
Compare
d548fb5
to
c14225e
Compare
c14225e
to
e6c2e00
Compare
715e541
to
073481a
Compare
073481a
to
74c7d62
Compare
74c7d62
to
709bc4c
Compare
Motivation
In specific cases where we have an inferred span (belonging to an inferred service) as the parent of the framework instrumented web request (the 'web' span), Appsec is enabled on the inferred service instead of the current service.
This is because we always use set tags and metrics on the root span using the
span._local_root
helper.This leads to an incorrect reporting of the appsec enablement status, and security signals showing up on spans of a different service.
Note:
Changes
Add a helper on spans to retrieve the top level span of a given service
Modify the appsec logic to always report on the service entry span and add a failsafe to query the entry span of the current span or current root span to get a handle on a span in any situation.
Modify the tests to look for the entry span instead of the root span
Notes:
_DD_IAST_USE_ROOT_SPAN
flag. This setting also needs additional manual handling inreport_stack
as reporting to root span is not the default anymore.Checklist
Reviewer Checklist