dd-trace-dotnet icon indicating copy to clipboard operation
dd-trace-dotnet copied to clipboard

[ASM] Instrument RASP to be enabled by RC.

Open NachoEchevarria opened this issue 4 months ago • 5 comments

Summary of changes

A new scenario has been discussed: If ASM is initially disabled and later enabled by RC, then RASP should be enabled as well unless the DD_APPSEC_RASP_ENABLED variable is set to false.

That means that we need to instrument the RASP methods during startup if ASM could potentially be enabled through RC later and RASP is enabled (it's default value is true). Right now, we don't have a mechanism to enable both callsite and call target instrumentations at runtime. This has a performance cost that we would pay if a customer doesn't specifically disable ASM or RASP but they never plan to use it. Instrumenting at runtime such methods would be a solution for that and we could consider, in the future, working on it as a performance improvement.

In order to avoid such instrumentations either DD_APPSEC_ENABLED or DD_APPSEC_RASP_ENABLED should be specifically set initially as false.

Reason for change

It's is a required feature and tested through system tests.

Implementation details

Test coverage

Other details

NachoEchevarria avatar Oct 01 '24 09:10 NachoEchevarria