Add support for endpoint discovery in spring mvc #8352
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
manuel-alvarez-alvarez added comp: asm waf 
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 1 performance regressions! Performance is the same for 65 metrics, 5 unstable metrics.
Startup time reports for petclinicgantt title petclinic - global startup overhead: candidate=1.48.0-SNAPSHOT~5302575dc8, baseline=1.48.0-SNAPSHOT~4f278de73a dateFormat X axisFormat %s section tracing Agent [baseline] (1.055 s) : 0, 1054613 Total [baseline] (10.451 s) : 0, 10451407 Agent [candidate] (1.059 s) : 0, 1058905 Total [candidate] (10.52 s) : 0, 10520466 section appsec Agent [baseline] (1.189 s) : 0, 1189312 Total [baseline] (10.752 s) : 0, 10752360 Agent [candidate] (1.191 s) : 0, 1191384 Total [candidate] (10.746 s) : 0, 10745784 section iast Agent [baseline] (1.176 s) : 0, 1176138 Total [baseline] (11.001 s) : 0, 11001344 Agent [candidate] (1.177 s) : 0, 1176825 Total [candidate] (11.029 s) : 0, 11028828 section profiling Agent [baseline] (1.273 s) : 0, 1272564 Total [baseline] (10.824 s) : 0, 10824101 Agent [candidate] (1.275 s) : 0, 1275282 Total [candidate] (10.857 s) : 0, 10856585
gantt title petclinic - break down per module: candidate=1.48.0-SNAPSHOT~5302575dc8, baseline=1.48.0-SNAPSHOT~4f278de73a dateFormat X axisFormat %s section tracing BytebuddyAgent [baseline] (722.215 ms) : 0, 722215 BytebuddyAgent [candidate] (722.327 ms) : 0, 722327 GlobalTracer [baseline] (240.004 ms) : 0, 240004 GlobalTracer [candidate] (239.986 ms) : 0, 239986 AppSec [baseline] (55.141 ms) : 0, 55141 AppSec [candidate] (54.993 ms) : 0, 54993 Debugger [baseline] (4.514 ms) : 0, 4514 Debugger [candidate] (4.452 ms) : 0, 4452 Remote Config [baseline] (699.625 µs) : 0, 700 Remote Config [candidate] (701.648 µs) : 0, 702 Telemetry [baseline] (12.206 ms) : 0, 12206 Telemetry [candidate] (16.56 ms) : 0, 16560 section appsec BytebuddyAgent [baseline] (734.942 ms) : 0, 734942 BytebuddyAgent [candidate] (736.754 ms) : 0, 736754 GlobalTracer [baseline] (234.789 ms) : 0, 234789 GlobalTracer [candidate] (234.801 ms) : 0, 234801 IAST [baseline] (21.557 ms) : 0, 21557 IAST [candidate] (21.459 ms) : 0, 21459 AppSec [baseline] (175.795 ms) : 0, 175795 AppSec [candidate] (176.196 ms) : 0, 176196 Debugger [baseline] (4.275 ms) : 0, 4275 Debugger [candidate] (4.3 ms) : 0, 4300 Remote Config [baseline] (639.207 µs) : 0, 639 Remote Config [candidate] (642.942 µs) : 0, 643 Telemetry [baseline] (8.452 ms) : 0, 8452 Telemetry [candidate] (8.228 ms) : 0, 8228 section iast BytebuddyAgent [baseline] (835.325 ms) : 0, 835325 BytebuddyAgent [candidate] (836.088 ms) : 0, 836088 GlobalTracer [baseline] (229.025 ms) : 0, 229025 GlobalTracer [candidate] (228.544 ms) : 0, 228544 IAST [baseline] (22.656 ms) : 0, 22656 IAST [candidate] (22.892 ms) : 0, 22892 AppSec [baseline] (56.025 ms) : 0, 56025 AppSec [candidate] (55.992 ms) : 0, 55992 Debugger [baseline] (4.155 ms) : 0, 4155 Debugger [candidate] (4.184 ms) : 0, 4184 Remote Config [baseline] (602.042 µs) : 0, 602 Remote Config [candidate] (619.015 µs) : 0, 619 Telemetry [baseline] (8.749 ms) : 0, 8749 Telemetry [candidate] (8.833 ms) : 0, 8833 section profiling BytebuddyAgent [baseline] (709.4 ms) : 0, 709400 BytebuddyAgent [candidate] (711.515 ms) : 0, 711515 GlobalTracer [baseline] (348.499 ms) : 0, 348499 GlobalTracer [candidate] (347.888 ms) : 0, 347888 AppSec [baseline] (53.98 ms) : 0, 53980 AppSec [candidate] (53.727 ms) : 0, 53727 Debugger [baseline] (4.28 ms) : 0, 4280 Debugger [candidate] (4.29 ms) : 0, 4290 Remote Config [baseline] (685.498 µs) : 0, 685 Remote Config [candidate] (690.482 µs) : 0, 690 Telemetry [baseline] (8.987 ms) : 0, 8987 Telemetry [candidate] (9.008 ms) : 0, 9008 ProfilingAgent [baseline] (101.804 ms) : 0, 101804 ProfilingAgent [candidate] (103.287 ms) : 0, 103287 Profiling [baseline] (101.967 ms) : 0, 101967 Profiling [candidate] (103.312 ms) : 0, 103312 Startup time reports for insecure-bankgantt title insecure-bank - global startup overhead: candidate=1.48.0-SNAPSHOT~5302575dc8, baseline=1.48.0-SNAPSHOT~4f278de73a dateFormat X axisFormat %s section tracing Agent [baseline] (1.05 s) : 0, 1049588 Total [baseline] (8.704 s) : 0, 8703990 Agent [candidate] (1.05 s) : 0, 1050046 Total [candidate] (8.651 s) : 0, 8651415 section iast Agent [baseline] (1.185 s) : 0, 1185414 Total [baseline] (9.311 s) : 0, 9310748 Agent [candidate] (1.176 s) : 0, 1176272 Total [candidate] (9.27 s) : 0, 9269760 section iast_HARDCODED_SECRET_DISABLED Agent [baseline] (1.175 s) : 0, 1174658 Total [baseline] (9.189 s) : 0, 9188838 Agent [candidate] (1.176 s) : 0, 1175928 Total [candidate] (9.218 s) : 0, 9217626 section iast_TELEMETRY_OFF Agent [baseline] (1.172 s) : 0, 1171643 Total [baseline] (9.226 s) : 0, 9226181 Agent [candidate] (1.183 s) : 0, 1183407 Total [candidate] (9.267 s) : 0, 9266740
gantt title insecure-bank - break down per module: candidate=1.48.0-SNAPSHOT~5302575dc8, baseline=1.48.0-SNAPSHOT~4f278de73a dateFormat X axisFormat %s section tracing BytebuddyAgent [baseline] (717.202 ms) : 0, 717202 BytebuddyAgent [candidate] (718.207 ms) : 0, 718207 GlobalTracer [baseline] (238.691 ms) : 0, 238691 GlobalTracer [candidate] (238.574 ms) : 0, 238574 AppSec [baseline] (54.526 ms) : 0, 54526 AppSec [candidate] (54.809 ms) : 0, 54809 Debugger [baseline] (5.836 ms) : 0, 5836 Debugger [candidate] (4.443 ms) : 0, 4443 Remote Config [baseline] (696.442 µs) : 0, 696 Remote Config [candidate] (705.1 µs) : 0, 705 Telemetry [baseline] (12.944 ms) : 0, 12944 Telemetry [candidate] (13.623 ms) : 0, 13623 section iast BytebuddyAgent [baseline] (841.641 ms) : 0, 841641 BytebuddyAgent [candidate] (836.385 ms) : 0, 836385 GlobalTracer [baseline] (230.584 ms) : 0, 230584 GlobalTracer [candidate] (228.402 ms) : 0, 228402 IAST [baseline] (23.235 ms) : 0, 23235 IAST [candidate] (22.591 ms) : 0, 22591 AppSec [baseline] (56.534 ms) : 0, 56534 AppSec [candidate] (55.794 ms) : 0, 55794 Debugger [baseline] (4.233 ms) : 0, 4233 Debugger [candidate] (4.12 ms) : 0, 4120 Remote Config [baseline] (642.348 µs) : 0, 642 Remote Config [candidate] (586.53 µs) : 0, 587 Telemetry [baseline] (8.851 ms) : 0, 8851 Telemetry [candidate] (8.758 ms) : 0, 8758 section iast_HARDCODED_SECRET_DISABLED BytebuddyAgent [baseline] (834.45 ms) : 0, 834450 BytebuddyAgent [candidate] (835.554 ms) : 0, 835554 GlobalTracer [baseline] (228.478 ms) : 0, 228478 GlobalTracer [candidate] (228.783 ms) : 0, 228783 IAST [baseline] (22.649 ms) : 0, 22649 IAST [candidate] (22.723 ms) : 0, 22723 AppSec [baseline] (55.984 ms) : 0, 55984 AppSec [candidate] (55.621 ms) : 0, 55621 Debugger [baseline] (4.165 ms) : 0, 4165 Debugger [candidate] (4.173 ms) : 0, 4173 Remote Config [baseline] (606.389 µs) : 0, 606 Remote Config [candidate] (613.222 µs) : 0, 613 Telemetry [baseline] (8.756 ms) : 0, 8756 Telemetry [candidate] (8.828 ms) : 0, 8828 section iast_TELEMETRY_OFF BytebuddyAgent [baseline] (832.519 ms) : 0, 832519 BytebuddyAgent [candidate] (840.559 ms) : 0, 840559 GlobalTracer [baseline] (228.088 ms) : 0, 228088 GlobalTracer [candidate] (230.262 ms) : 0, 230262 IAST [baseline] (22.29 ms) : 0, 22290 IAST [candidate] (22.667 ms) : 0, 22667 AppSec [baseline] (55.922 ms) : 0, 55922 AppSec [candidate] (56.592 ms) : 0, 56592 Debugger [baseline] (4.103 ms) : 0, 4103 Debugger [candidate] (4.183 ms) : 0, 4183 Remote Config [baseline] (586.841 µs) : 0, 587 Remote Config [candidate] (623.61 µs) : 0, 624 Telemetry [baseline] (8.595 ms) : 0, 8595 Telemetry [candidate] (8.745 ms) : 0, 8745 LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 14 metrics, 16 unstable metrics. Request duration reports for petclinicgantt title petclinic - request duration [CI 0.99] : candidate=1.48.0-SNAPSHOT~5302575dc8, baseline=1.48.0-SNAPSHOT~4f278de73a dateFormat X axisFormat %s section baseline no_agent (1.359 ms) : 1340, 1378 . : milestone, 1359, appsec (1.722 ms) : 1698, 1746 . : milestone, 1722, appsec_no_iast (1.724 ms) : 1700, 1749 . : milestone, 1724, code_origins (1.681 ms) : 1654, 1708 . : milestone, 1681, iast (1.499 ms) : 1475, 1524 . : milestone, 1499, profiling (1.549 ms) : 1524, 1574 . : milestone, 1549, tracing (1.489 ms) : 1466, 1513 . : milestone, 1489, section candidate no_agent (1.35 ms) : 1331, 1369 . : milestone, 1350, appsec (1.718 ms) : 1694, 1741 . : milestone, 1718, appsec_no_iast (1.734 ms) : 1710, 1757 . : milestone, 1734, code_origins (1.657 ms) : 1630, 1685 . : milestone, 1657, iast (1.511 ms) : 1486, 1535 . : milestone, 1511, profiling (1.522 ms) : 1499, 1545 . : milestone, 1522, tracing (1.483 ms) : 1457, 1508 . : milestone, 1483,
Request duration reports for insecure-bankgantt title insecure-bank - request duration [CI 0.99] : candidate=1.48.0-SNAPSHOT~5302575dc8, baseline=1.48.0-SNAPSHOT~4f278de73a dateFormat X axisFormat %s section baseline no_agent (378.009 µs) : 358, 398 . : milestone, 378, iast (513.492 µs) : 492, 535 . : milestone, 513, iast_FULL (731.792 µs) : 710, 754 . : milestone, 732, iast_GLOBAL (561.734 µs) : 539, 585 . : milestone, 562, iast_HARDCODED_SECRET_DISABLED (505.92 µs) : 484, 528 . : milestone, 506, iast_INACTIVE (462.397 µs) : 441, 484 . : milestone, 462, iast_TELEMETRY_OFF (490.312 µs) : 469, 512 . : milestone, 490, tracing (455.123 µs) : 434, 476 . : milestone, 455, section candidate no_agent (377.669 µs) : 358, 397 . : milestone, 378, iast (511.657 µs) : 489, 534 . : milestone, 512, iast_FULL (722.897 µs) : 701, 745 . : milestone, 723, iast_GLOBAL (554.436 µs) : 532, 576 . : milestone, 554, iast_HARDCODED_SECRET_DISABLED (509.868 µs) : 488, 532 . : milestone, 510, iast_INACTIVE (458.149 µs) : 437, 479 . : milestone, 458, iast_TELEMETRY_OFF (501.345 µs) : 479, 524 . : milestone, 501, tracing (454.419 µs) : 434, 475 . : milestone, 454,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics. Execution time for biojavagantt title biojava - execution time [CI 0.99] : candidate=1.48.0-SNAPSHOT~5302575dc8, baseline=1.48.0-SNAPSHOT~4f278de73a dateFormat X axisFormat %s section baseline no_agent (15.481 s) : 15481000, 15481000 . : milestone, 15481000, appsec (14.993 s) : 14993000, 14993000 . : milestone, 14993000, iast (18.598 s) : 18598000, 18598000 . : milestone, 18598000, iast_GLOBAL (17.758 s) : 17758000, 17758000 . : milestone, 17758000, profiling (15.26 s) : 15260000, 15260000 . : milestone, 15260000, tracing (15.219 s) : 15219000, 15219000 . : milestone, 15219000, section candidate no_agent (15.447 s) : 15447000, 15447000 . : milestone, 15447000, appsec (15.2 s) : 15200000, 15200000 . : milestone, 15200000, iast (18.303 s) : 18303000, 18303000 . : milestone, 18303000, iast_GLOBAL (17.957 s) : 17957000, 17957000 . : milestone, 17957000, profiling (15.775 s) : 15775000, 15775000 . : milestone, 15775000, tracing (14.999 s) : 14999000, 14999000 . : milestone, 14999000,
Execution time for tomcatgantt title tomcat - execution time [CI 0.99] : candidate=1.48.0-SNAPSHOT~5302575dc8, baseline=1.48.0-SNAPSHOT~4f278de73a dateFormat X axisFormat %s section baseline no_agent (1.463 ms) : 1452, 1475 . : milestone, 1463, appsec (2.327 ms) : 2283, 2370 . : milestone, 2327, iast (2.105 ms) : 2050, 2161 . : milestone, 2105, iast_GLOBAL (2.158 ms) : 2102, 2214 . : milestone, 2158, profiling (1.949 ms) : 1906, 1993 . : milestone, 1949, tracing (1.945 ms) : 1903, 1987 . : milestone, 1945, section candidate no_agent (1.465 ms) : 1453, 1476 . : milestone, 1465, appsec (2.328 ms) : 2284, 2371 . : milestone, 2328, iast (2.108 ms) : 2053, 2163 . : milestone, 2108, iast_GLOBAL (2.15 ms) : 2094, 2206 . : milestone, 2150, profiling (1.948 ms) : 1905, 1992 . : milestone, 1948, tracing (1.939 ms) : 1897, 1981 . : milestone, 1939,
|
manuel-alvarez-alvarez force-pushed the malvarez/waf-endpoint-discovery-spring branch from f1ad95d to e92e233 Compare manuel-alvarez-alvarez force-pushed the malvarez/waf-endpoint-discovery-spring branch from e92e233 to a4771b5 Compare ![datadog-datadog-prod-us1[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
manuel-alvarez-alvarez force-pushed the malvarez/waf-endpoint-discovery-spring branch from a4771b5 to 06c3e02 Compare manuel-alvarez-alvarez force-pushed the malvarez/waf-endpoint-discovery-spring branch 4 times, most recently from 899c81e to dac1cf6 Compare manuel-alvarez-alvarez force-pushed the malvarez/waf-endpoint-discovery-spring branch 3 times, most recently from 5e37c35 to f650159 Compare 
| Need to solve conflicts 😄 |
manuel-alvarez-alvarez force-pushed the malvarez/waf-endpoint-discovery-spring branch from 88a7978 to a8c0130 Compare 
Done, thanks! |
sezen-datadog approved these changes Mar 28, 2025
jandro996 reviewed Mar 28, 2025
| static final int DEFAULT_APPSEC_WAF_TIMEOUT = 100000; // 0.1 s | ||
| static final boolean DEFAULT_API_SECURITY_ENABLED = false; | ||
| static final float DEFAULT_API_SECURITY_SAMPLE_DELAY = 30.0f; | ||
| // TODO: change to true once the RFC is approved |
There was a problem hiding this comment.
Not sure if should be false or true by default, or maybe we need to remove this comment
The PR introduces a new configuration variable DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED (false by default) to enable/disable this new feature.
then
This pull request should not be merged until the following conditions are met:
Approval of the RFC regarding endpoint discovery
There was a problem hiding this comment.
RFC already approved, but the feature will be set as disabled by default for now.
jandro996 requested changes Mar 28, 2025
jandro996 approved these changes Mar 28, 2025
manuel-alvarez-alvarez force-pushed the malvarez/waf-endpoint-discovery-spring branch from 88b7281 to 5302575 Compare
Fixed, thanks for the heads up |
manuel-alvarez-alvarez deleted the malvarez/waf-endpoint-discovery-spring branch 
svc-squareup-copybara pushed a commit to cashapp/misk that referenced this pull request Apr 11, 2025
| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | org.flywaydb.flyway | plugin | misk/gradle/libs.versions.toml | gradle | minor | `11.6.0` -> `11.7.0` | | [com.squareup.okio:okio-fakefilesystem](https://github.com/square/okio) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `3.10.2` -> `3.11.0` | | [com.squareup.okio:okio](https://github.com/square/okio) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `3.10.2` -> `3.11.0` | | [com.autonomousapps.dependency-analysis](https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin) | plugin | misk/gradle/libs.versions.toml | gradle | minor | `2.15.0` -> `2.16.0` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.47.3` -> `1.48.1` | | [com.datadoghq:dd-trace-ot](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.47.3` -> `1.48.1` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.18` -> `2.31.20` | --- ### Release Notes <details> <summary>square/okio (com.squareup.okio:okio-fakefilesystem)</summary> ### [`v3.11.0`](https://github.com/square/okio/blob/HEAD/CHANGELOG.md#Version-3110) *2025-04-09* - Fix: Clear the deflater's byte array reference - New: Faster implementation of `String.decodeHex()` on Kotlin/JS. - New: Declare `EXACTLY_ONCE` execution for blocks like `Closeable.use {}` and `FileSystem.read {}`. - Upgrade: \[Kotlin 2.1.20]\[kotlin\_2\_1\_20]. </details> <details> <summary>autonomousapps/dependency-analysis-android-gradle-plugin (com.autonomousapps.dependency-analysis)</summary> ### [`v2.16.0`](https://github.com/autonomousapps/dependency-analysis-android-gradle-plugin/blob/HEAD/CHANGELOG.md#Version-2160) - \[Feat]: support `com.android.test` projects. - \[Feat]: support typesafe project accessors with opt-in. ```kotlin dependencyAnalysis { useTypesafeProjectAccessors(true) // false by default } ``` </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.48.1`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.48.1): 1.48.1 ### Components #### Tracer internal logging - 🐛 Remove print line causing unnecessary logs ([#​8687](DataDog/dd-trace-java#8687) - [@​sarahchen6](https://github.com/sarahchen6)) ### [`v1.48.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.48.0): 1.48.0 ### Known Bugs > \[!NOTE] > If you are experiencing issues with spamming timeout logs, please update to the [latest version](https://github.com/DataDog/dd-trace-java/releases/latest) or set [JDK_SOCKET_ENABLED](https://github.com/DataDog/dd-trace-java/blob/33fc3c9a9b7cda3beda88b8b3e5224ae2b10764a/dd-trace-api/src/main/java/datadog/trace/api/config/GeneralConfig.java#L98) to false. ### Components #### Application Security Management (IAST) - ✨ Fix vulnerability location org.jose4j.lang.HashUtil ([#​8610](DataDog/dd-trace-java#8610) - [@​jandro996](https://github.com/jandro996)) - ✨ Fix weak randomness in oracle.ucp.util.OpaqueString ([#​8609](DataDog/dd-trace-java#8609) - [@​jandro996](https://github.com/jandro996)) - ✨ Fix weak hash false positive in oracle.security.o5logon.O5Logon ([#​8608](DataDog/dd-trace-java#8608) - [@​jandro996](https://github.com/jandro996)) - 🐛 Prevent before callsites targeting constructors in super calls ([#​8549](DataDog/dd-trace-java#8549) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Application Security Management (WAF) - ✨ Update login events public SDK to V2 ([#​8620](DataDog/dd-trace-java#8620) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛 Send RASP LFI capability only when AppSec is statically enabled ([#​8573](DataDog/dd-trace-java#8573) - [@​jandro996](https://github.com/jandro996)) - ✨ Improve detection of missing request end events ([#​8510](DataDog/dd-trace-java#8510) - [@​smola](https://github.com/smola)) - 🧹 Remove remote configuration for API Security sampling rate ([#​8486](DataDog/dd-trace-java#8486) - [@​smola](https://github.com/smola)) - ✨ Add setUser to user monitoring SDK ([#​8482](DataDog/dd-trace-java#8482) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Add missing address for signup event ([#​8469](DataDog/dd-trace-java#8469) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Allow login events SDK to be used with appsec disabled ([#​8464](DataDog/dd-trace-java#8464) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Add support for endpoint discovery in spring mvc ([#​8352](DataDog/dd-trace-java#8352) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ New API Security sampling algorithm ([#​8178](DataDog/dd-trace-java#8178) - [@​ValentinZakharov](https://github.com/ValentinZakharov)) #### Build & Tooling - ✨ Add buffer size customizability to JDK UDS support ([#​8629](DataDog/dd-trace-java#8629) - [@​sarahchen6](https://github.com/sarahchen6)) - ✨ Add JDK built-in support for UDS on Java 16+ ([#​8314](DataDog/dd-trace-java#8314) - [@​sarahchen6](https://github.com/sarahchen6)) #### Configuration at Runtime - 🐛 Send RASP LFI capability only when AppSec is statically enabled ([#​8573](DataDog/dd-trace-java#8573) - [@​jandro996](https://github.com/jandro996)) #### Continuous Integration Visibility - 🐛 Prevent double reporting of Scalatest events when using SBT with test forking ([#​8682](DataDog/dd-trace-java#8682) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Shutdown CI Visibility test event handlers before tracer ([#​8677](DataDog/dd-trace-java#8677) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Do not apply JUnit 4 instrumentation to MUnit runners ([#​8675](DataDog/dd-trace-java#8675), [#​8683](DataDog/dd-trace-java#8683) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Remove error log when source path resolution fails on isModified check ([#​8663](DataDog/dd-trace-java#8663) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement tests reordering for JUnit 4 ([#​8650](DataDog/dd-trace-java#8650) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - 🐛 Set default Attempt to Fix retries if none provided from the backend ([#​8615](DataDog/dd-trace-java#8615) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Allow to manually set PR info ([#​8566](DataDog/dd-trace-java#8566) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix Test Optimization init when repo root cannot be determined ([#​8533](DataDog/dd-trace-java#8533) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add capabilities tagging ([#​8499](DataDog/dd-trace-java#8499), [#​8540](DataDog/dd-trace-java#8540) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) #### Crash tracking - 🐛 Remove dependency on bash from crash/oome uploder scripts ([#​8652](DataDog/dd-trace-java#8652) - [@​jbachorik](https://github.com/jbachorik)) #### Data Streams Monitoring - ✨ e2e pipeline configuration when data jobs is enabled ([#​8553](DataDog/dd-trace-java#8553) - [@​kr-igor](https://github.com/kr-igor)) #### Dynamic Instrumentation - 🐛 Fix In-Product when config is empty ([#​8679](DataDog/dd-trace-java#8679) - [@​jpbempel](https://github.com/jpbempel)) - ✨ Add support for filtering shaded third-party libs ([#​8612](DataDog/dd-trace-java#8612) - [@​jpbempel](https://github.com/jpbempel)) - ✨ Add In-Product Enablement ([#​8587](DataDog/dd-trace-java#8587) - [@​jpbempel](https://github.com/jpbempel)) - ✨⚡ Reduce footprint of SourceFile tracking ([#​8524](DataDog/dd-trace-java#8524) - [@​jpbempel](https://github.com/jpbempel)) - ✨⚡ Optimize the SourceFile tracking ([#​8520](DataDog/dd-trace-java#8520) - [@​jpbempel](https://github.com/jpbempel)) #### OpenTracing - 🧹 Remove activeScope() use in OpenTracing shim ([#​8478](DataDog/dd-trace-java#8478) - [@​mcculls](https://github.com/mcculls)) #### Profiling - ✨ Add profiler env check command to AgentCLI ([#​8671](DataDog/dd-trace-java#8671) - [@​jbachorik](https://github.com/jbachorik)) - ✨ Bump ddprof to 1.23.0 ([#​8668](DataDog/dd-trace-java#8668) - [@​jbachorik](https://github.com/jbachorik)) - Fix a crash related to ElfParser::loadSymbolTable ([#​191](DataDog/dd-trace-java#191)) by [@​yanglong1010](https://github.com/yanglong1010) in DataDog/java-profiler#192 - Unwind String.indexOf intrinsic on AArch64 by [@​MattAlp](https://github.com/MattAlp) in DataDog/java-profiler#193 - Fix Java 24 support by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#194 - A set of fixes related to clang, aarch64 and musl pecularities of vmstructs stack unwinder by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#199 - 🐛 Remove process information from JFR recording ([#​8661](DataDog/dd-trace-java#8661) - [@​r1viollet](https://github.com/r1viollet)) - 🐛 Make TempLocationManager USER aware ([#​8605](DataDog/dd-trace-java#8605) - [@​jbachorik](https://github.com/jbachorik)) - ✨ Extract git tags from embedded git.properties and datadog_git.properties ([#​8561](DataDog/dd-trace-java#8561) - [@​wmouchere](https://github.com/wmouchere)) #### Telemetry - 🐛 Fix appsec.rasp.error and appsec.waf.error telemetry metrics ([#​8624](DataDog/dd-trace-java#8624) - [@​jandro996](https://github.com/jandro996)) - ✨ Create metric: appsec.rasp.rule.skipped ([#​8618](DataDog/dd-trace-java#8618) - [@​jandro996](https://github.com/jandro996)) - ✨ Extract git tags from embedded git.properties and datadog_git.properties ([#​8561](DataDog/dd-trace-java#8561) - [@​wmouchere](https://github.com/wmouchere)) #### Testing - 🧹 Simplify ssi tests one-pipeline ([#​8558](DataDog/dd-trace-java#8558) - [@​robertomonteromiguel](https://github.com/robertomonteromiguel)) - ✨ Add smoke tests for java's concurrent API ([#​8438](DataDog/dd-trace-java#8438) - [@​sarahchen6](https://github.com/sarahchen6)) #### Trace context propagation - ✨ Adding Support for `TRACE_PROPAGATION_BEHAVIOR_EXTRACT` ([#​8535](DataDog/dd-trace-java#8535) - [@​mhlidd](https://github.com/mhlidd)) #### Tracer core - 🐛 Ensure shaded helpers have unique names ([#​8559](DataDog/dd-trace-java#8559) - [@​amarziali](https://github.com/amarziali)) - ✨ Support common config sources for user-provided git info ([#​8547](DataDog/dd-trace-java#8547) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Make the default config sources more robust when a security manager is installed ([#​8544](DataDog/dd-trace-java#8544) - [@​mcculls](https://github.com/mcculls)) - ✨ Support targeting services with configurations in stable configuration file ([#​8526](DataDog/dd-trace-java#8526) - [@​mtoffl01](https://github.com/mtoffl01)) - ✨ Add new parser for `DD_TAGS` and prioritizing `DD_SERVICE` ([#​8296](DataDog/dd-trace-java#8296) - [@​mhlidd](https://github.com/mhlidd)) #### Tracer internal logging - 🐛 Add missing debug log for the cloudPayloadTaggingServices config ([#​8600](DataDog/dd-trace-java#8600) - [@​ygree](https://github.com/ygree)) - ✨ Add the possibility to output the logs of the Java tracer in JSON ([#​8083](DataDog/dd-trace-java#8083) - [@​cecile75](https://github.com/cecile75)) #### Tracer public API - ✨ Introducing `DD_TRACE_EXPERIMENTAL_FEATURES_ENABLED` Config ([#​8536](DataDog/dd-trace-java#8536) - [@​mhlidd](https://github.com/mhlidd)) - ✨ Config Consistency Round 2 ([#​8489](DataDog/dd-trace-java#8489) - [@​mhlidd](https://github.com/mhlidd)) ### Instrumentations #### - 🐛 Fix NPE in getMdcCopy of LoggingEventInstrumentation ([#​8599](DataDog/dd-trace-java#8599) - [@​ygree](https://github.com/ygree)) #### Apache Spark instrumentation - ✨ Instrument Runtime.exit() to finish spark application spans ([#​8572](DataDog/dd-trace-java#8572) - [@​paul-laffon-dd](https://github.com/paul-laffon-dd)) - ✨ Configure OpenLineage if present in Spark instrumentation ([#​8541](DataDog/dd-trace-java#8541) - [@​mobuchowski](https://github.com/mobuchowski)) #### Armeria Instrumentation - ✨ Support armeria grpc 1.32.3 ([#​8606](DataDog/dd-trace-java#8606) - [@​github-actions](https://github.com/github-actions)\[bot]) #### AWS DynamoDB Instrumentation - ✨ Create DynamoDB instrumentation + add span pointers for `updateItem` and `deleteItem` ([#​8490](DataDog/dd-trace-java#8490) - [@​nhulston](https://github.com/nhulston)) #### AWS SDK instrumentation - ✨ Add DynamoDB in DEFAULT_TRACE_CLOUD_PAYLOAD_TAGGING_SERVICES ([#​8595](DataDog/dd-trace-java#8595) - [@​joeyzhao2018](https://github.com/joeyzhao2018)) #### Azure Functions instrumentation - ✨ Enable tracer computed trace metrics by default for Azure Functions ([#​8518](DataDog/dd-trace-java#8518) - [@​duncanpharvey](https://github.com/duncanpharvey)) - 💡 Add azure-functions instrumentation ([#​8432](DataDog/dd-trace-java#8432) - [@​duncanpharvey](https://github.com/duncanpharvey)) #### Core Java language instrumentation - 🐛 Fix ForkJoinPool.execute() instrumentation on Java 21+ ([#​8560](DataDog/dd-trace-java#8560) - [@​PerfectSlayer](https://github.com/PerfectSlayer)) #### Eclipse Vert.x instrumentation - ✨ Add vertx postgresql client instrumentation ([#​8471](DataDog/dd-trace-java#8471) - [@​vandonr](https://github.com/vandonr) - thanks for the contribution!) #### Kafka instrumentation - ✨ Support and test kafka-clients 4 ([#​8581](DataDog/dd-trace-java#8581) - [@​amarziali](https://github.com/amarziali)) #### Kotlin instrumentation - ✨ Avoid disconnected traces when using Kotlin flowOn ([#​8651](DataDog/dd-trace-java#8651) - [@​mcculls](https://github.com/mcculls)) #### OpenTelemetry instrumentation - 🧹 Migrate OtelContext wrapper to new internal Context API ([#​8645](DataDog/dd-trace-java#8645) - [@​mcculls](https://github.com/mcculls)) #### Spring instrumentation - 🐛 Support CompletableFuture on spring webmvc controllers ([#​8659](DataDog/dd-trace-java#8659) - [@​amarziali](https://github.com/amarziali)) - ✨ Add support for endpoint discovery in spring mvc ([#​8352](DataDog/dd-trace-java#8352) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### WebSocket Instrumentation - ✨ Instrument Jetty websocket pojo ([#​8562](DataDog/dd-trace-java#8562) - [@​amarziali](https://github.com/amarziali)) - 💡 Instrument Java Websocket API (JSR356) ([#​8440](DataDog/dd-trace-java#8440) - [@​amarziali](https://github.com/amarziali)) #### All other instrumentations - ✨ Introduce cache for peer.hostname lookup ([#​8601](DataDog/dd-trace-java#8601) - [@​mcculls](https://github.com/mcculls)) - ✨ Support pekko http 1.1 ([#​8532](DataDog/dd-trace-java#8532) - [@​amarziali](https://github.com/amarziali)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: 331314f71acaced3adc75ea5d7e855c248d593fc
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
What Does This Do
This update involves parsing all the endpoints defined by Spring MVC using
org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerMapping. The parsed endpoint data is then transmitted to the backend via telemetry to build an API catalog for the service, eliminating the need for any previous traffic.The PR introduces a new configuration variable
DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED(falseby default) to enable/disable this new feature.Motivation
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any usefull labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-56437