Propagation of translateEscapes of String class by sezen-datadog · Pull Request #8186 · DataDog/dd-trace-java

sezen-datadog · 2025-01-13T10:17:23Z

What Does This Do

Taints translateEscapes string

Motivation

This is a feature added to String class operations in Java 15 so we add a propagation for this method

Additional Notes

Contributor Checklist

Jira ticket: APPSEC-55380

github-actions · 2025-01-13T10:17:37Z

Hi! 👋 Thanks for your pull request! 🎉

To help us review it, please make sure to:

Add at least one type, and one component or instrumentation label to the pull request

If you need help, please check our contributing guidelines.

pr-commenter · 2025-01-13T10:56:15Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	sezen.leblay/APPSEC-55380-translateEscapes-propagation
git_commit_date	1737017707	1737017620
git_commit_sha	`9b06903`	`44f3db9`
release_version	1.46.0-SNAPSHOT~9b06903e18	1.46.0-SNAPSHOT~44f3db9c3a

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1737020130	1737020130
ci_job_id	768520198	768520198
ci_pipeline_id	53154263	53154263
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
module	Agent	Agent
parent	None	None
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 60 metrics, 3 unstable metrics.

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.058 s) : 0, 1057899
Total [baseline] (8.668 s) : 0, 8668464
Agent [candidate] (1.053 s) : 0, 1052559
Total [candidate] (8.618 s) : 0, 8617868
section iast
Agent [baseline] (1.183 s) : 0, 1182531
Total [baseline] (9.18 s) : 0, 9179899
Agent [candidate] (1.182 s) : 0, 1182080
Total [candidate] (9.192 s) : 0, 9191971
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.18 s) : 0, 1179823
Total [baseline] (9.148 s) : 0, 9147698
Agent [candidate] (1.181 s) : 0, 1181225
Total [candidate] (9.163 s) : 0, 9163381
section iast_TELEMETRY_OFF
Agent [baseline] (1.184 s) : 0, 1184008
Total [baseline] (9.198 s) : 0, 9197734
Agent [candidate] (1.179 s) : 0, 1178905
Total [candidate] (9.166 s) : 0, 9165519

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.058 s	-
Agent	iast	1.183 s	124.633 ms (11.8%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.18 s	121.924 ms (11.5%)
Agent	iast_TELEMETRY_OFF	1.184 s	126.109 ms (11.9%)
Total	tracing	8.668 s	-
Total	iast	9.18 s	511.435 ms (5.9%)
Total	iast_HARDCODED_SECRET_DISABLED	9.148 s	479.234 ms (5.5%)
Total	iast_TELEMETRY_OFF	9.198 s	529.27 ms (6.1%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.053 s	-
Agent	iast	1.182 s	129.521 ms (12.3%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.181 s	128.667 ms (12.2%)
Agent	iast_TELEMETRY_OFF	1.179 s	126.346 ms (12.0%)
Total	tracing	8.618 s	-
Total	iast	9.192 s	574.103 ms (6.7%)
Total	iast_HARDCODED_SECRET_DISABLED	9.163 s	545.513 ms (6.3%)
Total	iast_TELEMETRY_OFF	9.166 s	547.651 ms (6.4%)

gantt
    title insecure-bank - break down per module: candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (714.586 ms) : 0, 714586
BytebuddyAgent [candidate] (714.461 ms) : 0, 714461
GlobalTracer [baseline] (256.269 ms) : 0, 256269
GlobalTracer [candidate] (255.58 ms) : 0, 255580
AppSec [baseline] (56.997 ms) : 0, 56997
AppSec [candidate] (55.925 ms) : 0, 55925
Remote Config [baseline] (715.232 µs) : 0, 715
Remote Config [candidate] (723.661 µs) : 0, 724
Telemetry [baseline] (14.328 ms) : 0, 14328
Telemetry [candidate] (10.797 ms) : 0, 10797
section iast
BytebuddyAgent [baseline] (832.313 ms) : 0, 832313
BytebuddyAgent [candidate] (831.404 ms) : 0, 831404
GlobalTracer [baseline] (246.298 ms) : 0, 246298
GlobalTracer [candidate] (246.474 ms) : 0, 246474
AppSec [baseline] (57.903 ms) : 0, 57903
AppSec [candidate] (57.971 ms) : 0, 57971
IAST [baseline] (21.601 ms) : 0, 21601
IAST [candidate] (21.618 ms) : 0, 21618
Remote Config [baseline] (667.024 µs) : 0, 667
Remote Config [candidate] (692.242 µs) : 0, 692
Telemetry [baseline] (8.78 ms) : 0, 8780
Telemetry [candidate] (8.928 ms) : 0, 8928
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (829.77 ms) : 0, 829770
BytebuddyAgent [candidate] (830.541 ms) : 0, 830541
GlobalTracer [baseline] (246.14 ms) : 0, 246140
GlobalTracer [candidate] (246.329 ms) : 0, 246329
AppSec [baseline] (58.194 ms) : 0, 58194
AppSec [candidate] (58.427 ms) : 0, 58427
IAST [baseline] (21.363 ms) : 0, 21363
IAST [candidate] (21.494 ms) : 0, 21494
Remote Config [baseline] (660.563 µs) : 0, 661
Remote Config [candidate] (667.983 µs) : 0, 668
Telemetry [baseline] (8.729 ms) : 0, 8729
Telemetry [candidate] (8.798 ms) : 0, 8798
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (833.259 ms) : 0, 833259
BytebuddyAgent [candidate] (829.239 ms) : 0, 829239
GlobalTracer [baseline] (247.509 ms) : 0, 247509
GlobalTracer [candidate] (246.76 ms) : 0, 246760
AppSec [baseline] (58.074 ms) : 0, 58074
AppSec [candidate] (57.726 ms) : 0, 57726
IAST [baseline] (20.845 ms) : 0, 20845
IAST [candidate] (20.843 ms) : 0, 20843
Remote Config [baseline] (654.445 µs) : 0, 654
Remote Config [candidate] (662.298 µs) : 0, 662
Telemetry [baseline] (8.65 ms) : 0, 8650
Telemetry [candidate] (8.623 ms) : 0, 8623

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.06 s) : 0, 1059625
Total [baseline] (10.429 s) : 0, 10428629
Agent [candidate] (1.053 s) : 0, 1052741
Total [candidate] (10.433 s) : 0, 10432796
section appsec
Agent [baseline] (1.188 s) : 0, 1187757
Total [baseline] (10.72 s) : 0, 10720082
Agent [candidate] (1.189 s) : 0, 1188567
Total [candidate] (10.701 s) : 0, 10700827
section iast
Agent [baseline] (1.198 s) : 0, 1197645
Total [baseline] (10.959 s) : 0, 10958855
Agent [candidate] (1.183 s) : 0, 1182830
Total [candidate] (11.001 s) : 0, 11000770
section profiling
Agent [baseline] (1.252 s) : 0, 1252429
Total [baseline] (10.765 s) : 0, 10765017
Agent [candidate] (1.263 s) : 0, 1263297
Total [candidate] (10.947 s) : 0, 10946878

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.06 s	-
Agent	appsec	1.188 s	128.132 ms (12.1%)
Agent	iast	1.198 s	138.02 ms (13.0%)
Agent	profiling	1.252 s	192.803 ms (18.2%)
Total	tracing	10.429 s	-
Total	appsec	10.72 s	291.453 ms (2.8%)
Total	iast	10.959 s	530.226 ms (5.1%)
Total	profiling	10.765 s	336.388 ms (3.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.053 s	-
Agent	appsec	1.189 s	135.826 ms (12.9%)
Agent	iast	1.183 s	130.089 ms (12.4%)
Agent	profiling	1.263 s	210.556 ms (20.0%)
Total	tracing	10.433 s	-
Total	appsec	10.701 s	268.031 ms (2.6%)
Total	iast	11.001 s	567.974 ms (5.4%)
Total	profiling	10.947 s	514.082 ms (4.9%)

gantt
    title petclinic - break down per module: candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (716.914 ms) : 0, 716914
BytebuddyAgent [candidate] (712.42 ms) : 0, 712420
GlobalTracer [baseline] (256.602 ms) : 0, 256602
GlobalTracer [candidate] (255.227 ms) : 0, 255227
AppSec [baseline] (56.842 ms) : 0, 56842
AppSec [candidate] (55.766 ms) : 0, 55766
Remote Config [baseline] (731.586 µs) : 0, 732
Remote Config [candidate] (716.911 µs) : 0, 717
Telemetry [baseline] (13.485 ms) : 0, 13485
Telemetry [candidate] (13.661 ms) : 0, 13661
section appsec
BytebuddyAgent [baseline] (730.292 ms) : 0, 730292
BytebuddyAgent [candidate] (731.036 ms) : 0, 731036
GlobalTracer [baseline] (253.259 ms) : 0, 253259
GlobalTracer [candidate] (252.875 ms) : 0, 252875
AppSec [baseline] (170.679 ms) : 0, 170679
AppSec [candidate] (171.02 ms) : 0, 171020
Remote Config [baseline] (657.581 µs) : 0, 658
Remote Config [candidate] (670.777 µs) : 0, 671
Telemetry [baseline] (8.206 ms) : 0, 8206
Telemetry [candidate] (8.221 ms) : 0, 8221
IAST [baseline] (19.42 ms) : 0, 19420
IAST [candidate] (19.423 ms) : 0, 19423
section iast
BytebuddyAgent [baseline] (843.272 ms) : 0, 843272
BytebuddyAgent [candidate] (832.029 ms) : 0, 832029
GlobalTracer [baseline] (249.334 ms) : 0, 249334
GlobalTracer [candidate] (246.747 ms) : 0, 246747
AppSec [baseline] (58.488 ms) : 0, 58488
AppSec [candidate] (57.881 ms) : 0, 57881
Remote Config [baseline] (698.885 µs) : 0, 699
Remote Config [candidate] (655.999 µs) : 0, 656
Telemetry [baseline] (8.92 ms) : 0, 8920
Telemetry [candidate] (8.88 ms) : 0, 8880
IAST [baseline] (21.826 ms) : 0, 21826
IAST [candidate] (21.641 ms) : 0, 21641
section profiling
BytebuddyAgent [baseline] (702.657 ms) : 0, 702657
BytebuddyAgent [candidate] (708.609 ms) : 0, 708609
GlobalTracer [baseline] (349.166 ms) : 0, 349166
GlobalTracer [candidate] (352.053 ms) : 0, 352053
AppSec [baseline] (54.289 ms) : 0, 54289
AppSec [candidate] (54.789 ms) : 0, 54789
Remote Config [baseline] (652.803 µs) : 0, 653
Remote Config [candidate] (657.404 µs) : 0, 657
Telemetry [baseline] (8.805 ms) : 0, 8805
Telemetry [candidate] (8.947 ms) : 0, 8947
ProfilingAgent [baseline] (94.911 ms) : 0, 94911
ProfilingAgent [candidate] (96.012 ms) : 0, 96012
Profiling [baseline] (94.935 ms) : 0, 94935
Profiling [candidate] (96.036 ms) : 0, 96036

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
end_time	2025-01-16T09:05:32	2025-01-16T09:12:35
git_branch	master	sezen.leblay/APPSEC-55380-translateEscapes-propagation
git_commit_date	1737017707	1737017620
git_commit_sha	`9b06903`	`44f3db9`
release_version	1.46.0-SNAPSHOT~9b06903e18	1.46.0-SNAPSHOT~44f3db9c3a
start_time	2025-01-16T09:05:18	2025-01-16T09:12:21

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1737019110	1737019110
ci_job_id	768520199	768520199
ci_pipeline_id	53154263	53154263
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
variant	iast	iast

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 10 metrics, 17 unstable metrics.

scenario	Δ mean http_req_duration	Δ mean throughput	candidate mean http_req_duration	candidate mean throughput	baseline mean http_req_duration	baseline mean throughput
scenario:load:insecure-bank:iast_FULL	better [-105.728µs; -59.081µs] or [-14.329%; -8.007%]	unstable [-1064.157op/s; +1695.736op/s] or [-17.736%; +28.262%]	655.465µs	6315.789op/s	737.869µs	6000.000op/s

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
    dateFormat X
    axisFormat %s
section baseline
no_agent (386.278 µs) : 366, 406
.   : milestone, 386,
iast (510.915 µs) : 489, 533
.   : milestone, 511,
iast_FULL (737.869 µs) : 716, 760
.   : milestone, 738,
iast_GLOBAL (550.058 µs) : 529, 572
.   : milestone, 550,
iast_HARDCODED_SECRET_DISABLED (507.495 µs) : 486, 529
.   : milestone, 507,
iast_INACTIVE (460.294 µs) : 439, 482
.   : milestone, 460,
iast_TELEMETRY_OFF (492.965 µs) : 471, 515
.   : milestone, 493,
tracing (449.675 µs) : 429, 471
.   : milestone, 450,
section candidate
no_agent (377.126 µs) : 356, 398
.   : milestone, 377,
iast (492.837 µs) : 471, 514
.   : milestone, 493,
iast_FULL (655.465 µs) : 634, 677
.   : milestone, 655,
iast_GLOBAL (521.237 µs) : 499, 543
.   : milestone, 521,
iast_HARDCODED_SECRET_DISABLED (501.464 µs) : 480, 523
.   : milestone, 501,
iast_INACTIVE (463.084 µs) : 440, 486
.   : milestone, 463,
iast_TELEMETRY_OFF (481.471 µs) : 460, 503
.   : milestone, 481,
tracing (450.256 µs) : 429, 471
.   : milestone, 450,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	386.278 µs [366.405 µs, 406.151 µs]	-
iast	510.915 µs [488.701 µs, 533.129 µs]	124.637 µs (32.3%)
iast_FULL	737.869 µs [716.076 µs, 759.662 µs]	351.591 µs (91.0%)
iast_GLOBAL	550.058 µs [528.526 µs, 571.59 µs]	163.78 µs (42.4%)
iast_HARDCODED_SECRET_DISABLED	507.495 µs [485.836 µs, 529.153 µs]	121.216 µs (31.4%)
iast_INACTIVE	460.294 µs [439.048 µs, 481.539 µs]	74.016 µs (19.2%)
iast_TELEMETRY_OFF	492.965 µs [471.133 µs, 514.796 µs]	106.686 µs (27.6%)
tracing	449.675 µs [428.596 µs, 470.754 µs]	63.397 µs (16.4%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	377.126 µs [355.793 µs, 398.459 µs]	-
iast	492.837 µs [471.277 µs, 514.397 µs]	115.712 µs (30.7%)
iast_FULL	655.465 µs [633.91 µs, 677.02 µs]	278.339 µs (73.8%)
iast_GLOBAL	521.237 µs [499.216 µs, 543.258 µs]	144.111 µs (38.2%)
iast_HARDCODED_SECRET_DISABLED	501.464 µs [479.557 µs, 523.371 µs]	124.338 µs (33.0%)
iast_INACTIVE	463.084 µs [440.194 µs, 485.973 µs]	85.958 µs (22.8%)
iast_TELEMETRY_OFF	481.471 µs [460.193 µs, 502.748 µs]	104.345 µs (27.7%)
tracing	450.256 µs [429.051 µs, 471.462 µs]	73.131 µs (19.4%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.342 ms) : 1323, 1362
.   : milestone, 1342,
appsec (1.752 ms) : 1728, 1776
.   : milestone, 1752,
appsec_no_iast (1.748 ms) : 1724, 1772
.   : milestone, 1748,
iast (1.506 ms) : 1481, 1530
.   : milestone, 1506,
profiling (1.551 ms) : 1526, 1575
.   : milestone, 1551,
tracing (1.489 ms) : 1465, 1514
.   : milestone, 1489,
section candidate
no_agent (1.36 ms) : 1340, 1379
.   : milestone, 1360,
appsec (1.741 ms) : 1717, 1765
.   : milestone, 1741,
appsec_no_iast (1.743 ms) : 1720, 1766
.   : milestone, 1743,
iast (1.509 ms) : 1486, 1533
.   : milestone, 1509,
profiling (1.554 ms) : 1527, 1580
.   : milestone, 1554,
tracing (1.488 ms) : 1464, 1512
.   : milestone, 1488,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.342 ms [1.323 ms, 1.362 ms]	-
appsec	1.752 ms [1.728 ms, 1.776 ms]	409.929 µs (30.5%)
appsec_no_iast	1.748 ms [1.724 ms, 1.772 ms]	406.067 µs (30.3%)
iast	1.506 ms [1.481 ms, 1.53 ms]	163.609 µs (12.2%)
profiling	1.551 ms [1.526 ms, 1.575 ms]	208.48 µs (15.5%)
tracing	1.489 ms [1.465 ms, 1.514 ms]	147.268 µs (11.0%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.36 ms [1.34 ms, 1.379 ms]	-
appsec	1.741 ms [1.717 ms, 1.765 ms]	381.135 µs (28.0%)
appsec_no_iast	1.743 ms [1.72 ms, 1.766 ms]	383.422 µs (28.2%)
iast	1.509 ms [1.486 ms, 1.533 ms]	149.615 µs (11.0%)
profiling	1.554 ms [1.527 ms, 1.58 ms]	193.898 µs (14.3%)
tracing	1.488 ms [1.464 ms, 1.512 ms]	128.29 µs (9.4%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	sezen.leblay/APPSEC-55380-translateEscapes-propagation
git_commit_date	1737017707	1737017620
git_commit_sha	`9b06903`	`44f3db9`
release_version	1.46.0-SNAPSHOT~9b06903e18	1.46.0-SNAPSHOT~44f3db9c3a

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1737019640	1737019640
ci_job_id	768520200	768520200
ci_pipeline_id	53154263	53154263
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
variant	appsec	appsec

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 0 unstable metrics.

scenario	Δ mean execution_time	candidate mean execution_time	baseline mean execution_time
scenario:dacapo:tomcat:appsec	better [-1.371ms; -1.042ms] or [-38.437%; -29.194%]	2.361ms	3.568ms

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.468 ms) : 1457, 1480
.   : milestone, 1468,
appsec (3.568 ms) : 3355, 3780
.   : milestone, 3568,
iast (2.096 ms) : 2042, 2150
.   : milestone, 2096,
iast_GLOBAL (2.15 ms) : 2095, 2205
.   : milestone, 2150,
profiling (1.973 ms) : 1928, 2018
.   : milestone, 1973,
tracing (1.937 ms) : 1895, 1979
.   : milestone, 1937,
section candidate
no_agent (1.467 ms) : 1456, 1479
.   : milestone, 1467,
appsec (2.361 ms) : 2318, 2404
.   : milestone, 2361,
iast (2.106 ms) : 2052, 2160
.   : milestone, 2106,
iast_GLOBAL (2.153 ms) : 2097, 2208
.   : milestone, 2153,
profiling (1.971 ms) : 1928, 2015
.   : milestone, 1971,
tracing (1.945 ms) : 1903, 1987
.   : milestone, 1945,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.468 ms [1.457 ms, 1.48 ms]	-
appsec	3.568 ms [3.355 ms, 3.78 ms]	2.099 ms (143.0%)
iast	2.096 ms [2.042 ms, 2.15 ms]	627.827 µs (42.8%)
iast_GLOBAL	2.15 ms [2.095 ms, 2.205 ms]	681.753 µs (46.4%)
profiling	1.973 ms [1.928 ms, 2.018 ms]	504.626 µs (34.4%)
tracing	1.937 ms [1.895 ms, 1.979 ms]	468.676 µs (31.9%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.467 ms [1.456 ms, 1.479 ms]	-
appsec	2.361 ms [2.318 ms, 2.404 ms]	893.831 µs (60.9%)
iast	2.106 ms [2.052 ms, 2.16 ms]	638.614 µs (43.5%)
iast_GLOBAL	2.153 ms [2.097 ms, 2.208 ms]	685.235 µs (46.7%)
profiling	1.971 ms [1.928 ms, 2.015 ms]	504.051 µs (34.4%)
tracing	1.945 ms [1.903 ms, 1.987 ms]	477.963 µs (32.6%)

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.46.0-SNAPSHOT~44f3db9c3a, baseline=1.46.0-SNAPSHOT~9b06903e18
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.218 s) : 15218000, 15218000
.   : milestone, 15218000,
appsec (15.07 s) : 15070000, 15070000
.   : milestone, 15070000,
iast (18.943 s) : 18943000, 18943000
.   : milestone, 18943000,
iast_GLOBAL (18.095 s) : 18095000, 18095000
.   : milestone, 18095000,
profiling (15.074 s) : 15074000, 15074000
.   : milestone, 15074000,
tracing (15.208 s) : 15208000, 15208000
.   : milestone, 15208000,
section candidate
no_agent (14.876 s) : 14876000, 14876000
.   : milestone, 14876000,
appsec (15.2 s) : 15200000, 15200000
.   : milestone, 15200000,
iast (18.861 s) : 18861000, 18861000
.   : milestone, 18861000,
iast_GLOBAL (17.964 s) : 17964000, 17964000
.   : milestone, 17964000,
profiling (14.935 s) : 14935000, 14935000
.   : milestone, 14935000,
tracing (15.01 s) : 15010000, 15010000
.   : milestone, 15010000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.218 s [15.218 s, 15.218 s]	-
appsec	15.07 s [15.07 s, 15.07 s]	-148.0 ms (-1.0%)
iast	18.943 s [18.943 s, 18.943 s]	3.725 s (24.5%)
iast_GLOBAL	18.095 s [18.095 s, 18.095 s]	2.877 s (18.9%)
profiling	15.074 s [15.074 s, 15.074 s]	-144.0 ms (-0.9%)
tracing	15.208 s [15.208 s, 15.208 s]	-10.0 ms (-0.1%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	14.876 s [14.876 s, 14.876 s]	-
appsec	15.2 s [15.2 s, 15.2 s]	324.0 ms (2.2%)
iast	18.861 s [18.861 s, 18.861 s]	3.985 s (26.8%)
iast_GLOBAL	17.964 s [17.964 s, 17.964 s]	3.088 s (20.8%)
profiling	14.935 s [14.935 s, 14.935 s]	59.0 ms (0.4%)
tracing	15.01 s [15.01 s, 15.01 s]	134.0 ms (0.9%)

* Use env-entry to add tags per webapp deployment * fix gradle file * Migrate to hasmethodadvice * exclude classes from coverage * codenarc * add more repos * jacoco * Update internal-api/src/main/java/datadog/trace/api/ClassloaderConfigurationOverrides.java Co-authored-by: Bruce Bujon <PerfectSlayer@users.noreply.github.com> * review * use our named * more coverage * Update internal-api/src/main/java/datadog/trace/api/ClassloaderConfigurationOverrides.java Co-authored-by: Stuart McCulloch <stuart.mcculloch@datadoghq.com> * Update internal-api/src/main/java/datadog/trace/api/ClassloaderConfigurationOverrides.java Co-authored-by: Stuart McCulloch <stuart.mcculloch@datadoghq.com> * review * add jmh * optimize * widen muzzle excludes * exclude lazy from branch coverage * clean * Do not set contextual service name if jee-split-by-deployment is not enabled --------- Co-authored-by: Bruce Bujon <PerfectSlayer@users.noreply.github.com> Co-authored-by: Stuart McCulloch <stuart.mcculloch@datadoghq.com>

…-propagation

manuel-alvarez-alvarez · 2025-01-13T13:08:48Z

dd-java-agent/agent-iast/src/main/java/com/datadog/iast/propagation/StringModuleImpl.java

+    if (rangesSelf.length == 0) {
+      return; // original string is not tainted
+    }
+    final Range[] newRanges = Ranges.forSubstring(0, result.length(), rangesSelf);


AFAIK the translateEscapes never changes the length of the original string (it's a 1to1 mapping). So I think it will be safe to just reuse original ranges array (rangesSelf)

…-propagation

...g-15/src/test/groovy/datadog/trace/instrumentation/java/lang/jdk15/StringCallSiteTest.groovy

Mariovido

You have some jobs in the pipeline failing, they must be green before merging :)

…-propagation

...l/iast-util-17/src/testFixtures/groovy/datadog/smoketest/AbstractIast17SpringBootTest.groovy

...g-15/src/test/groovy/datadog/trace/instrumentation/java/lang/jdk15/StringCallSiteTest.groovy

Mariovido

LGTM

manuel-alvarez-alvarez · 2025-01-15T14:20:44Z

dd-java-agent/agent-iast/src/test/groovy/com/datadog/iast/propagation/StringModuleTest.groovy

+    given:
+    final taintedObjects = ctx.getTaintedObjects()
+    def self = addFromTaintFormat(taintedObjects, testString)
+    def result = self


Suggested change

def result = self

def result = self.translateEscapes()

manuel-alvarez-alvarez · 2025-01-15T14:22:12Z

dd-java-agent/agent-iast/src/main/java/com/datadog/iast/propagation/StringModuleImpl.java

+      return; // original string is not tainted
+    }
+    final Range[] rangesSelf = taintedSelf.getRanges();
+    if (rangesSelf.length == 0) {


Did you copy this from another method?, we shouldn't have tainted values without ranges (if it does not have ranges then it's not tainted 😓)

yes i did 😅

ValentinZakharov · 2025-01-15T16:57:30Z

...ringboot-java-17/src/test/groovy/datadog/smoketest/springboot/IastSpringBootSmokeTest.groovy

+import datadog.smoketest.AbstractIast17SpringBootTest
+
+class IastSpringBootSmokeTest extends AbstractIast17SpringBootTest {
+}


Do we need empty test class?

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.cloud:google-cloud-datastore](https://github.com/googleapis/java-datastore) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.25.4` -> `2.26.0` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.45.2` -> `1.46.0` | | [com.datadoghq:dd-trace-ot](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.45.2` -> `1.46.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.9` -> `2.30.10` | --- ### Release Notes <details> <summary>googleapis/java-datastore (com.google.cloud:google-cloud-datastore)</summary> ### [`v2.26.0`](https://github.com/googleapis/java-datastore/blob/HEAD/CHANGELOG.md#2260-2025-01-29) ##### Features - Add firestoreInDatastoreMode for datastore emulator ([#1698](googleapis/java-datastore#1698)) ([50f106d](googleapis/java-datastore@50f106d)) ##### Dependencies - Update dependency com.google.cloud:sdk-platform-java-config to v3.42.0 ([#1725](googleapis/java-datastore#1725)) ([1cbaf22](googleapis/java-datastore@1cbaf22)) </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.46.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.46.0): 1.46.0 ##### Breaking Changes > \[!WARNING] > jnr-unixsocket is now an external dependency of dd-trace-ot and must be included when deploying dd-trace-ot. > \[!NOTE] > The API `TracerScope.setAsync(boolean)`, used to manually control asynchronous span propagation, does no more apply to the scope instance but to the active span scope. ##### Components ##### Application Security Management (IAST) - 🐛 Fix String.replace instrumentation for IAST ([#8281](DataDog/dd-trace-java#8281) - [@Mariovido](https://github.com/Mariovido)) - ✨ Apply the standard nomenclature to the stacktrace configs ([#8244](DataDog/dd-trace-java#8244) - [@jandro996](https://github.com/jandro996)) - 🐛 Exclude false positive weak randomness ([#8232](DataDog/dd-trace-java#8232) - [@jandro996](https://github.com/jandro996)) - ✨ Propagation of translateEscapes of String class ([#8186](DataDog/dd-trace-java#8186) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Add security control metrics ([#8175](DataDog/dd-trace-java#8175) - [@jandro996](https://github.com/jandro996)) - ✨ Increase IAST propagation to StringBuffer setLength ([#8128](DataDog/dd-trace-java#8128) - [@Mariovido](https://github.com/Mariovido)) - ✨ Add IAST taint tracking for DB values ([#8072](DataDog/dd-trace-java#8072) - [@Mariovido](https://github.com/Mariovido)) ##### Application Security Management (WAF) - 🐛 Prevents a NPE when there is no subscriber for user events ([#8258](DataDog/dd-trace-java#8258) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Apply the standard nomenclature to the stacktrace configs ([#8244](DataDog/dd-trace-java#8244) - [@jandro996](https://github.com/jandro996)) - 🐛 Ensure cached subscriptions are cleared on reconfiguration via RC ([#8229](DataDog/dd-trace-java#8229) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Add support for session tracking in Vertx ([#8167](DataDog/dd-trace-java#8167) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Create span tag: \_dd.appsec.rasp.timeout ([#8269](DataDog/dd-trace-java#8269) - [@Mariovido](https://github.com/Mariovido)) ##### Build & Tooling - 🐛 Ensure shaded helpers have unique names when injected into class-loaders ([#8192](DataDog/dd-trace-java#8192) - [@mcculls](https://github.com/mcculls)) ##### Configuration at Runtime - 🐛 Remove filtering of `DD_SERVICE` and `DD_ENV` from the tracer ([#8176](DataDog/dd-trace-java#8176) - [@mhlidd](https://github.com/mhlidd)) ##### Continuous Integration Visibility - 🧹 Generalize TestRetryPolicy to TestExecutionPolicy ([#8302](DataDog/dd-trace-java#8302) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Parallelize CI Visibility settings requests ([#8299](DataDog/dd-trace-java#8299) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Generalize test retry logic ([#8289](DataDog/dd-trace-java#8289) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Generalize tests skipping logic ([#8288](DataDog/dd-trace-java#8288) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Remove skip and shouldBeSkipped methods from TestEventsHandler in favor of isSkippable ([#8286](DataDog/dd-trace-java#8286) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨⚡ Optimize Git repository information computation ([#8270](DataDog/dd-trace-java#8270) - [@dougqh](https://github.com/dougqh)) - ✨ Always request known tests from the backend ([#8268](DataDog/dd-trace-java#8268) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Fix NPE when trying to get retry analyzer in Test NG ([#8253](DataDog/dd-trace-java#8253) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Set test framework and test framework version tags atomically ([#8252](DataDog/dd-trace-java#8252) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add debug logging to Android Gradle module layout logic ([#8251](DataDog/dd-trace-java#8251) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix source and destination folders computation for Android Gradle projects ([#8190](DataDog/dd-trace-java#8190) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add basic Scala Weaver sbt support ([#8189](DataDog/dd-trace-java#8189) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement impacted tests detection ([#8188](DataDog/dd-trace-java#8188) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) ##### Data Streams Monitoring - ✨ Change hash computation for protobuf to better represent impacting changes + save proto number in schema ([#8201](DataDog/dd-trace-java#8201) - [@vandonr](https://github.com/vandonr)) ##### Database Monitoring - Add peer service tag in dbm sql commenter ([#7913](DataDog/dd-trace-java#7913) - [@jordan-wong](https://github.com/jordan-wong)) ##### Dynamic Instrumentation - ✨ Add support for SymDB to scan directories ([#8306](DataDog/dd-trace-java#8306) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add SymDB report for any jar scanning failures ([#8300](DataDog/dd-trace-java#8300) - [@jpbempel](https://github.com/jpbempel)) - ✨ Use two budgets depending on type ([#8283](DataDog/dd-trace-java#8283) - [@evanchooly](https://github.com/evanchooly)) - ✨ Institute a 10 snapshot per probe per trace budget ([#8277](DataDog/dd-trace-java#8277) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Avoid double snapshots for Exception Replay ([#8273](DataDog/dd-trace-java#8273) - [@jpbempel](https://github.com/jpbempel)) - ✨ Simplify code origins. Separate out snapshot generation. ([#8263](DataDog/dd-trace-java#8263) - [@evanchooly](https://github.com/evanchooly)) - ✨ Add Exception probe custom instrumentation ([#8230](DataDog/dd-trace-java#8230) - [@jpbempel](https://github.com/jpbempel)) - ✨ Enhance log probes to honor debug session tags ([#8215](DataDog/dd-trace-java#8215) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Don't redact env tokens from debugger probe snapshots ([#8211](DataDog/dd-trace-java#8211) - [@watson](https://github.com/watson)) - ✨⚡ Move Trace/SpanId capture at commit time ([#8184](DataDog/dd-trace-java#8184) - [@jpbempel](https://github.com/jpbempel)) - 🐛 Capture values at entry for method probe ([#8169](DataDog/dd-trace-java#8169) - [@jpbempel](https://github.com/jpbempel)) ##### JMX fetch - 🐛 Mute JMXFetch Shutdown in progress error ([#8068](DataDog/dd-trace-java#8068) - [@ygree](https://github.com/ygree)) ##### OpenTracing - ⚠️🧹 Make jnr-unixsocket an explicit dependency of dd-trace-ot ([#8307](DataDog/dd-trace-java#8307) - [@mcculls](https://github.com/mcculls)) ##### Profiling - 🐛 Avoid unsupported API call for creating folders on windows ([#8304](DataDog/dd-trace-java#8304) - [@jbachorik](https://github.com/jbachorik)) - ✨ Tag profiles for serverless ([#8279](DataDog/dd-trace-java#8279) - [@jbachorik](https://github.com/jbachorik)) - ✨ add queue type and length to queue events ([#8242](DataDog/dd-trace-java#8242) - [@richardstartin](https://github.com/richardstartin)) - 🐛 TempLocationManager Fixes and Improvements ([#8191](DataDog/dd-trace-java#8191) - [@jbachorik](https://github.com/jbachorik)) - ✨ Bump ddprof to 1.18.0 ([#8173](DataDog/dd-trace-java#8173) - [@jbachorik](https://github.com/jbachorik)) - ✨ Report profiler initialization and configuration errors to telemetry ([#8171](DataDog/dd-trace-java#8171) - [@jbachorik](https://github.com/jbachorik)) ##### Telemetry - ✨ Add pending traces report in tracer flares ([#8053](DataDog/dd-trace-java#8053) - [@mhlidd](https://github.com/mhlidd)) ##### Testing - ✨ Test http server requests in parallel ([#8222](DataDog/dd-trace-java#8222) - [@amarziali](https://github.com/amarziali)) ##### Trace context propagation - ✨ Add non default propagator registration ([#8310](DataDog/dd-trace-java#8310) - [@PerfectSlayer](https://github.com/PerfectSlayer)) ##### Tracer core - ✨ Probe for existence of IBMSASL or ACCP security providers ([#8276](DataDog/dd-trace-java#8276) - [@mcculls](https://github.com/mcculls)) - ✨⚡ Overhead improvement to agent feedback based sampling ([#8265](DataDog/dd-trace-java#8265) - [@dougqh](https://github.com/dougqh)) - 🧹 Move async propagation API from scope to tracer ([#8231](DataDog/dd-trace-java#8231) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Introduce context propagation API ([#8161](DataDog/dd-trace-java#8161) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨🧪 Use env-entry to add tags per webapp deployment ([#8138](DataDog/dd-trace-java#8138) - [@amarziali](https://github.com/amarziali)) - ✨ Introduce context helpers API ([#8134](DataDog/dd-trace-java#8134) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Support IPv6 values for `DD_AGENT_HOST` and `DD_TRACE_AGENT_URL` ([#7984](DataDog/dd-trace-java#7984) - [@mhlidd](https://github.com/mhlidd)) ##### Instrumentations ##### Apache HttpComponents - 🐛 Properly finish spans and support latest apache httpclient5 ([#8272](DataDog/dd-trace-java#8272) - [@amarziali](https://github.com/amarziali)) ##### AWS Lambda instrumentation - 🐛 Properly capture lambda payloads for all handler types. ([#8264](DataDog/dd-trace-java#8264) - [@purple4reina](https://github.com/purple4reina)) ##### AWS S3 instrumentation - 💡 Create S3 instrumentation + add span pointers ([#8075](DataDog/dd-trace-java#8075) - [@nhulston](https://github.com/nhulston)) ##### AWS SDK instrumentation - 🐛 Revert "Add avoid double instrumenting lambda non-streaming handlers." ([#8247](DataDog/dd-trace-java#8247) - [@nhulston](https://github.com/nhulston)) ##### Cassandra - ✨ Allow extracting keyspace from statement result ([#8239](DataDog/dd-trace-java#8239) - [@amarziali](https://github.com/amarziali)) ##### Core Java language instrumentation - ✨ Propagation of translateEscapes of String class ([#8186](DataDog/dd-trace-java#8186) - [@sezen-datadog](https://github.com/sezen-datadog)) ##### Eclipse Vert.x instrumentation - 🐛 Fix vertx worker propagation and error handling ([#8237](DataDog/dd-trace-java#8237) - [@amarziali](https://github.com/amarziali)) - ✨ Support vertx 5 ([#8220](DataDog/dd-trace-java#8220) - [@amarziali](https://github.com/amarziali)) - ✨ Add support for session tracking in Vertx ([#8167](DataDog/dd-trace-java#8167) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) ##### Kafka instrumentation - 🐛 Prevent possible NPE calculating Kafka record header size ([#8292](DataDog/dd-trace-java#8292) - [@ygree](https://github.com/ygree)) ##### Mule instrumentation - 🐛 Fix crash using Mule with JPMS ([#8187](DataDog/dd-trace-java#8187) - [@amarziali](https://github.com/amarziali)) ##### Protocol Buffer instrumentation - ✨ Change hash computation for protobuf to better represent impacting changes + save proto number in schema ([#8201](DataDog/dd-trace-java#8201) - [@vandonr](https://github.com/vandonr)) ##### Spring instrumentation - 🐛 Preserve getQualifier from spring scheduling runnables ([#8293](DataDog/dd-trace-java#8293) - [@amarziali](https://github.com/amarziali)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: bb09d47e4eed77a003f630273b4d0a84003eb899

sezen-datadog added 7 commits January 10, 2025 11:40

APPSEC-55380 String taint tracking: translateEscapes

fdda8e1

TU correction

edbd4c1

non null correction

91f4b56

builds

d794020

add module to StringCallSiteTest

1d28044

add module to StringCallSiteTest

e16856d

smoke test

fe5078c

sezen-datadog requested review from a team as code owners January 13, 2025 10:17

sezen-datadog requested review from ValentinZakharov and smola January 13, 2025 10:17

sezen-datadog requested review from Mariovido and manuel-alvarez-alvarez January 13, 2025 10:18

smola marked this pull request as draft January 13, 2025 10:19

sezen-datadog changed the title ~~DRAFT APPSEC-55380 Propagation of translateEscapes of String class~~ Propagation of translateEscapes of String class Jan 13, 2025

settings correction

33d3163

sezen-datadog and others added 5 commits January 13, 2025 12:14

test unicode added

94fb227

fix github issue creation (#8179)

00c8cd0

Skip jacoco coverage for internal class (#8183)

542f3b8

Merge branch 'master' into sezen.leblay/APPSEC-55380-translateEscapes…

19bafcb

…-propagation

manuel-alvarez-alvarez reviewed Jan 13, 2025

View reviewed changes

sezen-datadog added 2 commits January 13, 2025 14:57

smoke test spring boot for jv17

3c388a5

whoops

70db9f3

smola added the comp: asm iast Application Security Management (IAST) label Jan 13, 2025

unit test

1037009

sezen-datadog marked this pull request as ready for review January 13, 2025 16:00

sezen-datadog added inst: java Core Java language instrumentation type: enhancement Enhancements and improvements labels Jan 14, 2025

Merge branch 'master' into sezen.leblay/APPSEC-55380-translateEscapes…

977bff8

…-propagation

Mariovido reviewed Jan 14, 2025

View reviewed changes

...g-15/src/test/groovy/datadog/trace/instrumentation/java/lang/jdk15/StringCallSiteTest.groovy Outdated Show resolved Hide resolved

Mariovido requested changes Jan 14, 2025

View reviewed changes

sezen-datadog added 3 commits January 14, 2025 10:24

unit test suppression of equal

ca67979

mario's idea for j17 tests

b8c0685

mario's idea for j17 tests

30c46d4

sezen-datadog marked this pull request as draft January 14, 2025 13:30

sezen-datadog added 2 commits January 14, 2025 15:25

a few more tests

378bd84

Merge branch 'master' into sezen.leblay/APPSEC-55380-translateEscapes…

65ee3e0

…-propagation

sezen-datadog marked this pull request as ready for review January 15, 2025 10:11

Mariovido reviewed Jan 15, 2025

View reviewed changes

...l/iast-util-17/src/testFixtures/groovy/datadog/smoketest/AbstractIast17SpringBootTest.groovy Outdated Show resolved Hide resolved

Mariovido reviewed Jan 15, 2025

View reviewed changes

...g-15/src/test/groovy/datadog/trace/instrumentation/java/lang/jdk15/StringCallSiteTest.groovy Outdated Show resolved Hide resolved

Mariovido approved these changes Jan 15, 2025

View reviewed changes

sezen-datadog added 2 commits January 15, 2025 14:38

fix formatting

13965a7

fix formatting

4956aeb

manuel-alvarez-alvarez reviewed Jan 15, 2025

View reviewed changes

pr comments

6013e2a

ValentinZakharov reviewed Jan 15, 2025

View reviewed changes

sezen-datadog added 2 commits January 16, 2025 09:45

revert StringModuleTest.groovy

28db26f

add ignore to string translate escapes test if version less than 15

44f3db9

sezen-datadog added comp: api Tracer public API and removed comp: api Tracer public API labels Jan 16, 2025

manuel-alvarez-alvarez approved these changes Jan 16, 2025

View reviewed changes

sezen-datadog merged commit 679f9e2 into master Jan 16, 2025
173 of 174 checks passed

sezen-datadog deleted the sezen.leblay/APPSEC-55380-translateEscapes-propagation branch January 16, 2025 15:12

github-actions bot added this to the 1.46.0 milestone Jan 16, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Propagation of translateEscapes of String class#8186

Propagation of translateEscapes of String class#8186
sezen-datadog merged 27 commits intomasterfrom
sezen.leblay/APPSEC-55380-translateEscapes-propagation

sezen-datadog commented Jan 13, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jan 13, 2025 •

edited

Loading

Uh oh!

pr-commenter bot commented Jan 13, 2025 •

edited

Loading

Uh oh!

manuel-alvarez-alvarez Jan 13, 2025

Uh oh!

Uh oh!

Mariovido left a comment

Uh oh!

Uh oh!

Uh oh!

Mariovido left a comment

Uh oh!

manuel-alvarez-alvarez Jan 15, 2025

Uh oh!

manuel-alvarez-alvarez Jan 15, 2025

Uh oh!

sezen-datadog Jan 15, 2025

Uh oh!

ValentinZakharov Jan 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

Conversation

sezen-datadog commented Jan 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

github-actions bot commented Jan 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pr-commenter bot commented Jan 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

manuel-alvarez-alvarez Jan 13, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Mariovido left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Mariovido left a comment

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarez Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarez Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

sezen-datadog Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

ValentinZakharov Jan 15, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

sezen-datadog commented Jan 13, 2025 •

edited

Loading

github-actions bot commented Jan 13, 2025 •

edited

Loading

pr-commenter bot commented Jan 13, 2025 •

edited

Loading