Skip to content

Commit 0b3b442

Browse files
NachoEchevarriaNachoEchevarria
authored
Filter connection header in flaky tests (#7290)
## Summary of changes Some security WebApi tests that rely on the Sample.security.WebAPI (.NET framework) does not show consistent result. The result of the test depends on the order of the tests. The problem is that in some requests, the Connection header is returned (or not) by the framework depending on the request order. That causes the generated security header fingerprint to vary. The fingerprint hash and format is defined [here](https://docs.google.com/document/d/1DivOa9XsCggmZVzMI57vyxH2_EBJ0-qqIkRHm_sEvSs/edit?tab=t.0). In order to avoid that, a scrubber has been added to skip that particular flag in the fingerprint. Other approaches have been tried to get a consistent result that failed: * Adding a filter in FilterConfig.cs in the sample to overwrite the connection header. * Set UseProxy = false in HttpClientHandler in the test * Moved to an HttpModule and added Connection: keep-alive in EndRequest In all these cases, the framework seemed to overwrite the connection header value even when set explicitly. ## Reason for change Avoid having tests that depend on test execution order. ## Implementation details ## Test coverage ## Other details <!-- Fixes #{issue} --> <!-- ⚠️ Note: where possible, please obtain 2 approvals prior to merging. Unless CODEOWNERS specifies otherwise, for external teams it is typically best to have one review from a team member, and one review from apm-dotnet. Trivial changes do not require 2 reviews. -->
1 parent 5e90ad0 commit 0b3b442

File tree

25 files changed

+119
-105
lines changed

25 files changed

+119
-105
lines changed

‎tracer/test/Datadog.Trace.Security.IntegrationTests/AspNetBase.cs

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,14 @@ await VerifyHelper.VerifySpans(spans, settings)
256256
}
257257
}
258258

259+
protected static void FilterConnectionHeader(VerifySettings settings)
260+
{
261+
Regex appSecConnectionHeader0 = new(@"_dd.appsec.fp.http.header: hdr-0\d", RegexOptions.IgnoreCase | RegexOptions.Compiled);
262+
Regex appSecConnectionHeader1 = new(@"_dd.appsec.fp.http.header: hdr-1\d", RegexOptions.IgnoreCase | RegexOptions.Compiled);
263+
settings.AddRegexScrubber(appSecConnectionHeader0, "_dd.appsec.fp.http.header: hdr-0X");
264+
settings.AddRegexScrubber(appSecConnectionHeader1, "_dd.appsec.fp.http.header: hdr-1X");
265+
}
266+
259267
protected void AppsecMetaStructScrubbing(MockSpan target, bool forceMetaStruct = false)
260268
{
261269
// We want to retrieve the appsec event data from the meta struct to validate it in snapshots

‎tracer/test/Datadog.Trace.Security.IntegrationTests/AspNetMvc5.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -105,6 +105,7 @@ public async Task TestBlockedRequest(string test)
105105
{
106106
var url = "/Health";
107107
var settings = VerifyHelper.GetSpanVerifierSettings(test);
108+
FilterConnectionHeader(settings);
108109
await TestAppSecRequestWithVerifyAsync(_iisFixture.Agent, url, null, 5, SecurityEnabled ? 1 : 2, settings, userAgent: "Hello/V");
109110
}
110111

‎tracer/test/Datadog.Trace.Security.IntegrationTests/AspNetWebApi.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,7 @@ public Task TestSecurity(string test, string url, string body)
9090
// NOTE: by integrating the latest version of the WAF, blocking was disabled, as it does not support blocking yet
9191
var sanitisedUrl = VerifyHelper.SanitisePathsForVerify(url);
9292
var settings = VerifyHelper.GetSpanVerifierSettings(test, sanitisedUrl, body);
93+
FilterConnectionHeader(settings);
9394
return TestAppSecRequestWithVerifyAsync(_iisFixture.Agent, url, body, 5, 2, settings, "application/json");
9495
}
9596

@@ -103,6 +104,7 @@ public async Task TestBlockedRequest(string test)
103104
var url = "/api/Health";
104105

105106
var settings = VerifyHelper.GetSpanVerifierSettings(test);
107+
FilterConnectionHeader(settings);
106108
await TestAppSecRequestWithVerifyAsync(_iisFixture.Agent, url, null, 5, 1, settings, userAgent: "Hello/V");
107109
}
108110

@@ -117,6 +119,7 @@ public async Task TestBlockedRequests(string test, string url, string body = nul
117119
{
118120
var sanitisedUrl = VerifyHelper.SanitisePathsForVerify(url);
119121
var settings = VerifyHelper.GetSpanVerifierSettings(test, sanitisedUrl, body);
122+
FilterConnectionHeader(settings);
120123

121124
var expectedSpans = test == AddressesConstants.RequestPathParams ? 1 : 2;
122125

@@ -136,6 +139,7 @@ public async Task TestNullAction()
136139
var url2 = "/api/home/null-action-async/pathparam/appscan_fingerprint";
137140
var settings = VerifyHelper.GetSpanVerifierSettings();
138141
settings.UseTextForParameters($"scenario=null-action");
142+
FilterConnectionHeader(settings);
139143
var dateTime = DateTime.UtcNow;
140144
var res = await SubmitRequest(url, null, null);
141145
var res2 = await SubmitRequest(url2, null, null);

‎tracer/test/Datadog.Trace.Security.IntegrationTests/AspNetWebForms.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,7 @@ public async Task TestBlockedRequest(string test)
125125
var url = "/Health";
126126

127127
var settings = VerifyHelper.GetSpanVerifierSettings(test);
128+
FilterConnectionHeader(settings);
128129
await TestAppSecRequestWithVerifyAsync(_iisFixture.Agent, url, null, 5, 1, settings, userAgent: "Hello/V");
129130
}
130131

‎tracer/test/snapshots/Security.AspNetMvc5.Classic.enableSecurity=True.__test=blocking.verified.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
runtime-id: Guid_1,
2525
span.kind: server,
2626
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
27-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
27+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
2828
_dd.appsec.fp.http.network: net-1-1000000000,
2929
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
3030
_dd.origin: appsec,
@@ -68,7 +68,7 @@
6868
runtime-id: Guid_1,
6969
span.kind: server,
7070
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
71-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
71+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
7272
_dd.appsec.fp.http.network: net-1-1000000000,
7373
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
7474
_dd.origin: appsec,
@@ -112,7 +112,7 @@
112112
runtime-id: Guid_1,
113113
span.kind: server,
114114
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
115-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
115+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
116116
_dd.appsec.fp.http.network: net-1-1000000000,
117117
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
118118
_dd.origin: appsec,
@@ -156,7 +156,7 @@
156156
runtime-id: Guid_1,
157157
span.kind: server,
158158
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
159-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
159+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
160160
_dd.appsec.fp.http.network: net-1-1000000000,
161161
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
162162
_dd.origin: appsec,
@@ -200,7 +200,7 @@
200200
runtime-id: Guid_1,
201201
span.kind: server,
202202
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
203-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
203+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
204204
_dd.appsec.fp.http.network: net-1-1000000000,
205205
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
206206
_dd.origin: appsec,

‎tracer/test/snapshots/Security.AspNetMvc5.Integrated.enableSecurity=True.__test=blocking.verified.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
runtime-id: Guid_1,
2626
span.kind: server,
2727
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
28-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-3-98425651,
28+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-3-98425651,
2929
_dd.appsec.fp.http.network: net-1-1000000000,
3030
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
3131
_dd.origin: appsec,
@@ -70,7 +70,7 @@
7070
runtime-id: Guid_1,
7171
span.kind: server,
7272
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
73-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-3-98425651,
73+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-3-98425651,
7474
_dd.appsec.fp.http.network: net-1-1000000000,
7575
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
7676
_dd.origin: appsec,
@@ -115,7 +115,7 @@
115115
runtime-id: Guid_1,
116116
span.kind: server,
117117
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
118-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-3-98425651,
118+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-3-98425651,
119119
_dd.appsec.fp.http.network: net-1-1000000000,
120120
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
121121
_dd.origin: appsec,
@@ -160,7 +160,7 @@
160160
runtime-id: Guid_1,
161161
span.kind: server,
162162
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
163-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-3-98425651,
163+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-3-98425651,
164164
_dd.appsec.fp.http.network: net-1-1000000000,
165165
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
166166
_dd.origin: appsec,
@@ -205,7 +205,7 @@
205205
runtime-id: Guid_1,
206206
span.kind: server,
207207
_dd.appsec.fp.http.endpoint: http-get-0587c50e--,
208-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-3-98425651,
208+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-3-98425651,
209209
_dd.appsec.fp.http.network: net-1-1000000000,
210210
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
211211
_dd.origin: appsec,

‎tracer/test/snapshots/Security.AspNetWebApi.Classic.enableSecurity=True.__test=blocking.verified.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
runtime-id: Guid_1,
2525
span.kind: server,
2626
_dd.appsec.fp.http.endpoint: http-get-7ab84831--,
27-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
27+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
2828
_dd.appsec.fp.http.network: net-1-1000000000,
2929
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
3030
_dd.origin: appsec,
@@ -68,7 +68,7 @@
6868
runtime-id: Guid_1,
6969
span.kind: server,
7070
_dd.appsec.fp.http.endpoint: http-get-7ab84831--,
71-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
71+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
7272
_dd.appsec.fp.http.network: net-1-1000000000,
7373
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
7474
_dd.origin: appsec,
@@ -112,7 +112,7 @@
112112
runtime-id: Guid_1,
113113
span.kind: server,
114114
_dd.appsec.fp.http.endpoint: http-get-7ab84831--,
115-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
115+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
116116
_dd.appsec.fp.http.network: net-1-1000000000,
117117
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
118118
_dd.origin: appsec,
@@ -156,7 +156,7 @@
156156
runtime-id: Guid_1,
157157
span.kind: server,
158158
_dd.appsec.fp.http.endpoint: http-get-7ab84831--,
159-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
159+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
160160
_dd.appsec.fp.http.network: net-1-1000000000,
161161
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
162162
_dd.origin: appsec,
@@ -200,7 +200,7 @@
200200
runtime-id: Guid_1,
201201
span.kind: server,
202202
_dd.appsec.fp.http.endpoint: http-get-7ab84831--,
203-
_dd.appsec.fp.http.header: hdr-0000000000-197358b8-1-4740ae63,
203+
_dd.appsec.fp.http.header: hdr-0X00000000-197358b8-1-4740ae63,
204204
_dd.appsec.fp.http.network: net-1-1000000000,
205205
_dd.appsec.json: {"triggers":[{"rule":{"id":"ublock","name":"Hello","tags":{"category":"attack_attempt","type":"security_scanner"}},"rule_matches":[{"operator":"match_regex","operator_value":"hello","parameters":[{"address":"server.request.headers.no_cookies","highlight":["hello"],"key_path":["user-agent"],"value":"mistake not... hello/v"}]}]}]},
206206
_dd.origin: appsec,

‎tracer/test/snapshots/Security.AspNetWebApi.Classic.enableSecurity=True.__test=server.request.body_url=_api_Home_Upload_body={-Property1-- -[$slice]-}.verified.txt

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@
4848
runtime-id: Guid_1,
4949
span.kind: server,
5050
_dd.appsec.fp.http.endpoint: http-post-ae7cd782--2d59fcb7,
51-
_dd.appsec.fp.http.header: hdr-0000000100-3626b5f8-3-4d739311,
51+
_dd.appsec.fp.http.header: hdr-0X00000100-3626b5f8-3-4d739311,
5252
_dd.appsec.fp.http.network: net-1-1000000000,
5353
_dd.appsec.json: {"triggers":[{"rule":{"id":"crs-942-290","name":"Finds basic MongoDB SQL injection attempts","tags":{"category":"attack_attempt","type":"nosql_injection"}},"rule_matches":[{"operator":"match_regex","operator_value":"(?i:(?:\\[\\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and)\\]))","parameters":[{"address":"server.request.body","highlight":["[$slice]"],"key_path":["miscModel","Property1"],"value":"[$slice]"}]}]}]},
5454
_dd.origin: appsec,
@@ -116,7 +116,7 @@
116116
runtime-id: Guid_1,
117117
span.kind: server,
118118
_dd.appsec.fp.http.endpoint: http-post-ae7cd782--2d59fcb7,
119-
_dd.appsec.fp.http.header: hdr-0000000100-3626b5f8-3-4d739311,
119+
_dd.appsec.fp.http.header: hdr-0X00000100-3626b5f8-3-4d739311,
120120
_dd.appsec.fp.http.network: net-1-1000000000,
121121
_dd.appsec.json: {"triggers":[{"rule":{"id":"crs-942-290","name":"Finds basic MongoDB SQL injection attempts","tags":{"category":"attack_attempt","type":"nosql_injection"}},"rule_matches":[{"operator":"match_regex","operator_value":"(?i:(?:\\[\\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and)\\]))","parameters":[{"address":"server.request.body","highlight":["[$slice]"],"key_path":["miscModel","Property1"],"value":"[$slice]"}]}]}]},
122122
_dd.origin: appsec,
@@ -184,7 +184,7 @@
184184
runtime-id: Guid_1,
185185
span.kind: server,
186186
_dd.appsec.fp.http.endpoint: http-post-ae7cd782--2d59fcb7,
187-
_dd.appsec.fp.http.header: hdr-0000000100-3626b5f8-3-4d739311,
187+
_dd.appsec.fp.http.header: hdr-0X00000100-3626b5f8-3-4d739311,
188188
_dd.appsec.fp.http.network: net-1-1000000000,
189189
_dd.appsec.json: {"triggers":[{"rule":{"id":"crs-942-290","name":"Finds basic MongoDB SQL injection attempts","tags":{"category":"attack_attempt","type":"nosql_injection"}},"rule_matches":[{"operator":"match_regex","operator_value":"(?i:(?:\\[\\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and)\\]))","parameters":[{"address":"server.request.body","highlight":["[$slice]"],"key_path":["miscModel","Property1"],"value":"[$slice]"}]}]}]},
190190
_dd.origin: appsec,
@@ -252,7 +252,7 @@
252252
runtime-id: Guid_1,
253253
span.kind: server,
254254
_dd.appsec.fp.http.endpoint: http-post-ae7cd782--2d59fcb7,
255-
_dd.appsec.fp.http.header: hdr-0000000100-3626b5f8-3-4d739311,
255+
_dd.appsec.fp.http.header: hdr-0X00000100-3626b5f8-3-4d739311,
256256
_dd.appsec.fp.http.network: net-1-1000000000,
257257
_dd.appsec.json: {"triggers":[{"rule":{"id":"crs-942-290","name":"Finds basic MongoDB SQL injection attempts","tags":{"category":"attack_attempt","type":"nosql_injection"}},"rule_matches":[{"operator":"match_regex","operator_value":"(?i:(?:\\[\\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and)\\]))","parameters":[{"address":"server.request.body","highlight":["[$slice]"],"key_path":["miscModel","Property1"],"value":"[$slice]"}]}]}]},
258258
_dd.origin: appsec,
@@ -320,7 +320,7 @@
320320
runtime-id: Guid_1,
321321
span.kind: server,
322322
_dd.appsec.fp.http.endpoint: http-post-ae7cd782--2d59fcb7,
323-
_dd.appsec.fp.http.header: hdr-0000000100-3626b5f8-3-4d739311,
323+
_dd.appsec.fp.http.header: hdr-0X00000100-3626b5f8-3-4d739311,
324324
_dd.appsec.fp.http.network: net-1-1000000000,
325325
_dd.appsec.json: {"triggers":[{"rule":{"id":"crs-942-290","name":"Finds basic MongoDB SQL injection attempts","tags":{"category":"attack_attempt","type":"nosql_injection"}},"rule_matches":[{"operator":"match_regex","operator_value":"(?i:(?:\\[\\$(?:ne|eq|lte?|gte?|n?in|mod|all|size|exists|type|slice|x?or|div|like|between|and)\\]))","parameters":[{"address":"server.request.body","highlight":["[$slice]"],"key_path":["miscModel","Property1"],"value":"[$slice]"}]}]}]},
326326
_dd.origin: appsec,

0 commit comments

Comments
 (0)