Fix location for SSRF with Kong Unirest #8407
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 59 metrics, 4 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.47.0-SNAPSHOT~9a6673c29e, baseline=1.47.0-SNAPSHOT~e0242cfadc
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.043 s) : 0, 1042839
Total [baseline] (8.632 s) : 0, 8632170
Agent [candidate] (1.04 s) : 0, 1040239
Total [candidate] (8.678 s) : 0, 8677619
section iast
Agent [baseline] (1.169 s) : 0, 1169299
Total [baseline] (9.261 s) : 0, 9261188
Agent [candidate] (1.171 s) : 0, 1170819
Total [candidate] (9.235 s) : 0, 9235463
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.178 s) : 0, 1178027
Total [baseline] (9.233 s) : 0, 9233081
Agent [candidate] (1.175 s) : 0, 1174851
Total [candidate] (9.269 s) : 0, 9269294
section iast_TELEMETRY_OFF
Agent [baseline] (1.167 s) : 0, 1166556
Total [baseline] (9.22 s) : 0, 9219643
Agent [candidate] (1.167 s) : 0, 1167023
Total [candidate] (9.259 s) : 0, 9258630
gantt
title insecure-bank - break down per module: candidate=1.47.0-SNAPSHOT~9a6673c29e, baseline=1.47.0-SNAPSHOT~e0242cfadc
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (718.616 ms) : 0, 718616
BytebuddyAgent [candidate] (717.139 ms) : 0, 717139
GlobalTracer [baseline] (239.354 ms) : 0, 239354
GlobalTracer [candidate] (240.072 ms) : 0, 240072
AppSec [baseline] (55.374 ms) : 0, 55374
AppSec [candidate] (55.704 ms) : 0, 55704
Remote Config [baseline] (702.531 µs) : 0, 703
Remote Config [candidate] (702.874 µs) : 0, 703
Telemetry [baseline] (13.516 ms) : 0, 13516
Telemetry [candidate] (11.454 ms) : 0, 11454
section iast
BytebuddyAgent [baseline] (835.007 ms) : 0, 835007
BytebuddyAgent [candidate] (836.394 ms) : 0, 836394
GlobalTracer [baseline] (230.691 ms) : 0, 230691
GlobalTracer [candidate] (230.416 ms) : 0, 230416
IAST [baseline] (22.623 ms) : 0, 22623
IAST [candidate] (22.528 ms) : 0, 22528
AppSec [baseline] (56.544 ms) : 0, 56544
AppSec [candidate] (56.963 ms) : 0, 56963
Remote Config [baseline] (610.501 µs) : 0, 611
Remote Config [candidate] (598.499 µs) : 0, 598
Telemetry [baseline] (8.628 ms) : 0, 8628
Telemetry [candidate] (8.635 ms) : 0, 8635
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (841.21 ms) : 0, 841210
BytebuddyAgent [candidate] (838.384 ms) : 0, 838384
GlobalTracer [baseline] (231.637 ms) : 0, 231637
GlobalTracer [candidate] (231.798 ms) : 0, 231798
IAST [baseline] (22.966 ms) : 0, 22966
IAST [candidate] (22.899 ms) : 0, 22899
AppSec [baseline] (57.434 ms) : 0, 57434
AppSec [candidate] (57.145 ms) : 0, 57145
Remote Config [baseline] (605.663 µs) : 0, 606
Remote Config [candidate] (600.148 µs) : 0, 600
Telemetry [baseline] (8.794 ms) : 0, 8794
Telemetry [candidate] (8.706 ms) : 0, 8706
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (832.932 ms) : 0, 832932
BytebuddyAgent [candidate] (833.007 ms) : 0, 833007
GlobalTracer [baseline] (230.685 ms) : 0, 230685
GlobalTracer [candidate] (230.594 ms) : 0, 230594
IAST [baseline] (27.2 ms) : 0, 27200
IAST [candidate] (24.268 ms) : 0, 24268
AppSec [baseline] (51.386 ms) : 0, 51386
AppSec [candidate] (54.72 ms) : 0, 54720
Remote Config [baseline] (611.592 µs) : 0, 612
Remote Config [candidate] (608.961 µs) : 0, 609
Telemetry [baseline] (8.479 ms) : 0, 8479
Telemetry [candidate] (8.5 ms) : 0, 8500
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.47.0-SNAPSHOT~9a6673c29e, baseline=1.47.0-SNAPSHOT~e0242cfadc
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.057 s)
8000
: 0, 1057001
Total [baseline] (10.528 s) : 0, 10527980
Agent [candidate] (1.047 s) : 0, 1046659
Total [candidate] (10.498 s) : 0, 10497857
section appsec
Agent [baseline] (1.189 s) : 0, 1188651
Total [baseline] (10.767 s) : 0, 10767078
Agent [candidate] (1.186 s) : 0, 1185778
Total [candidate] (10.719 s) : 0, 10718745
section iast
Agent [baseline] (1.171 s) : 0, 1171435
Total [baseline] (11.022 s) : 0, 11021698
Agent [candidate] (1.179 s) : 0, 1178936
Total [candidate] (10.964 s) : 0, 10963616
section profiling
Agent [baseline] (1.261 s) : 0, 1261343
Total [baseline] (10.881 s) : 0, 10880694
Agent [candidate] (1.262 s) : 0, 1262471
Total [candidate] (10.865 s) : 0, 10865465
gantt
title petclinic - break down per module: candidate=1.47.0-SNAPSHOT~9a6673c29e, baseline=1.47.0-SNAPSHOT~e0242cfadc
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (728.349 ms) : 0, 728349
BytebuddyAgent [candidate] (722.011 ms) : 0, 722011
GlobalTracer [baseline] (243.181 ms) : 0, 243181
GlobalTracer [candidate] (241.015 ms) : 0, 241015
AppSec [baseline] (56.146 ms) : 0, 56146
AppSec [candidate] (55.646 ms) : 0, 55646
Remote Config [baseline] (712.087 µs) : 0, 712
Remote Config [candidate] (692.304 µs) : 0, 692
Telemetry [baseline] (13.14 ms) : 0, 13140
Telemetry [candidate] (11.868 ms) : 0, 11868
section appsec
BytebuddyAgent [baseline] (737.742 ms) : 0, 737742
BytebuddyAgent [candidate] (736.37 ms) : 0, 736370
GlobalTracer [baseline] (237.819 ms) : 0, 237819
GlobalTracer [candidate] (237.465 ms) : 0, 237465
IAST [baseline] (21.851 ms) : 0, 21851
IAST [candidate] (21.425 ms) : 0, 21425
AppSec [baseline] (177.853 ms) : 0, 177853
AppSec [candidate] (176.978 ms) : 0, 176978
Remote Config [baseline] (674.235 µs) : 0, 674
Remote Config [candidate] (663.755 µs) : 0, 664
Telemetry [baseline] (8.308 ms) : 0, 8308
Telemetry [candidate] (8.295 ms) : 0, 8295
section iast
BytebuddyAgent [baseline] (835.866 ms) : 0, 835866
BytebuddyAgent [candidate] (841.273 ms) : 0, 841273
GlobalTracer [baseline] (230.756 ms) : 0, 230756
GlobalTracer [candidate] (231.842 ms) : 0, 231842
IAST [baseline] (22.907 ms) : 0, 22907
IAST [candidate] (23.005 ms) : 0, 23005
AppSec [baseline] (57.306 ms) : 0, 57306
AppSec [candidate] (57.97 ms) : 0, 57970
Remote Config [baseline] (613.218 µs) : 0, 613
Remote Config [candidate] (627.985 µs) : 0, 628
Telemetry [baseline] (8.732 ms) : 0, 8732
Telemetry [candidate] (8.82 ms) : 0, 8820
section profiling
BytebuddyAgent [baseline] (707.64 ms) : 0, 707640
BytebuddyAgent [candidate] (708.344 ms) : 0, 708344
GlobalTracer [baseline] (350.391 ms) : 0, 350391
GlobalTracer [candidate] (351.136 ms) : 0, 351136
AppSec [baseline] (55.559 ms) : 0, 55559
AppSec [candidate] (54.736 ms) : 0, 54736
Remote Config [baseline] (670.315 µs) : 0, 670
Remote Config [candidate] (671.531 µs) : 0, 672
Telemetry [baseline] (8.827 ms) : 0, 8827
Telemetry [candidate] (8.924 ms) : 0, 8924
ProfilingAgent [baseline] (96.007 ms) : 0, 96007
ProfilingAgent [candidate] (96.253 ms) : 0, 96253
Profiling [baseline] (96.031 ms) : 0, 96031
Profiling [candidate] (96.277 ms) : 0, 96277
LoadParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 16 unstable metrics. Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.47.0-SNAPSHOT~9a6673c29e, baseline=1.47.0-SNAPSHOT~d8dc1f26a1
dateFormat X
axisFormat %s
section baseline
no_agent (1.367 ms) : 1347, 1386
. : milestone, 1367,
appsec (1.73 ms) : 1706, 1754
. : milestone, 1730,
appsec_no_iast (1.755 ms) : 1732, 1778
. : milestone, 1755,
iast (1.5 ms) : 1476, 1525
. : milestone, 1500,
profiling (1.537 ms) : 1512, 1562
. : milestone, 1537,
tracing (1.491 ms) : 1466, 1516
. : milestone, 1491,
section candidate
no_agent (1.34 ms) : 1320, 1360
. : milestone, 1340,
appsec (1.744 ms) : 1721, 1768
. : milestone, 1744,
appsec_no_iast (1.755 ms) : 1732, 1777
. : milestone, 1755,
iast (1.507 ms) : 1482, 1532
. : milestone, 1507,
profiling (1.507 ms) : 1484, 1531
. : milestone, 1507,
tracing (1.471 ms) : 1445, 1496
. : milestone, 1471,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.47.0-SNAPSHOT~9a6673c29e, baseline=1.47.0-SNAPSHOT~d8dc1f26a1
dateFormat X
axisFormat %s
section baseline
no_agent (377.539 µs) : 356, 399
. : milestone, 378,
iast (509.051 µs) : 487, 531
. : milestone, 509,
iast_FULL (724.031 µs) : 702, 746
. : milestone, 724,
iast_GLOBAL (561.505 µs) : 538, 585
. : milestone, 562,
iast_HARDCODED_SECRET_DISABLED (506.797 µs) : 483, 531
. : milestone, 507,
iast_INACTIVE (462.014 µs) : 441, 483
. : milestone, 462,
iast_TELEMETRY_OFF (499.0 µs) : 476, 522
. : milestone, 499,
tracing (452.883 µs) : 432, 474
. : milestone, 453,
section candidate
no_agent (377.813 µs) : 358, 398
. : milestone, 378,
iast (514.691 µs) : 491, 538
. : milestone, 515,
iast_FULL (745.1 µs) : 723, 767
. : milestone, 745,
iast_GLOBAL (558.402 µs) : 537, 580
. : milestone, 558,
iast_HARDCODED_SECRET_DISABLED (506.579 µs) : 485, 528
. : milestone, 507,
iast_INACTIVE (450.808 µs) : 430, 472
. : milestone, 451,
iast_TELEMETRY_OFF (494.913 µs) : 471, 519
. : milestone, 495,
tracing (454.023 µs) : 434, 475
. : milestone, 454,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.47.0-SNAPSHOT~9a6673c29e, baseline=1.47.0-SNAPSHOT~d8dc1f26a1
dateFormat X
axisFormat %s
section baseline
no_agent (14.961 s) : 14961000, 14961000
. : milestone, 14961000,
appsec (15.13 s) : 15130000, 15130000
. : milestone, 15130000,
iast (18.467 s) : 18467000, 18467000
. : milestone, 18467000,
iast_GLOBAL (17.932 s) : 17932000, 17932000
. : milestone, 17932000,
profiling (15.873 s) : 15873000, 15873000
. : milestone, 15873000,
tracing (15.075 s) : 15075000, 15075000
. : milestone, 15075000,
section candidate
no_agent (15.572 s) : 15572000, 15572000
. : milestone, 15572000,
appsec (15.187 s) : 15187000, 15187000
. : milestone, 15187000,
iast (18.463 s) : 18463000, 18463000
. : milestone, 18463000,
iast_GLOBAL (17.455 s) : 17455000, 17455000
. : milestone, 17455000,
profiling (15.522 s) : 15522000, 15522000
. : milestone, 15522000,
tracing (15.212 s) : 15212000, 15212000
. : milestone, 15212000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.47.0-SNAPSHOT~9a6673c29e, baseline=1.47.0-SNAPSHOT~d8dc1f26a1
dateFormat X
axisFormat %s
section baseline
no_agent (1.469 ms) : 1458, 1481
. : milestone, 1469,
appsec (2.371 ms) : 2327, 2414
. : milestone, 2371,
iast (2.108 ms) : 2053, 2164
. : milestone, 2108,
iast_GLOBAL (2.152 ms) : 2096, 2207
. : milestone, 2152,
profiling (2.401 ms) : 2222, 2580
. : milestone, 2401,
tracing (1.944 ms) : 1902, 1986
. : milestone, 1944,
section candidate
no_agent (1.474 ms) : 1463, 1486
. : milestone, 1474,
appsec (2.363 ms) : 2319, 2406
. : milestone, 2363,
iast (2.103 ms) : 2049, 2158
. : milestone, 2103,
iast_GLOBAL (2.157 ms) : 2102, 2213
. : milestone, 2157,
profiling (1.975 ms) : 1931, 2019
. : milestone, 1975,
tracing (1.951 ms) : 1909, 1994
. : milestone, 1951,
|
jandro996
approved these changes
Feb 18, 2025
jandro996
reviewed
Feb 18, 2025
| @@ -172,6 +172,7 @@ | |||
| 1 jva_cup.* | |||
| 1 liquibase.* | |||
| 1 kodo.* | |||
| 2 kong.unirest.* | |||
There was a problem hiding this comment.
Just to clarify... why 2 and not 1?
There was a problem hiding this comment.
# 2 = Iast Instrumenter allows and filter stacktrace
This is not really a false positive, just a location problem. We want to detect the SSRF vulnerability in the code that calls the HTTP client, not within the HTTP client itself. So propagation inside this code is good, but we want to filter out it from the stacktrace.
svc-squareup-copybara
pushed a commit
to cashapp/misk
that referenced
this pull request
Mar 6, 2025
| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.46.1` -> `1.47.0` | | [com.datadoghq:dd-trace-ot](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.46.1` -> `1.47.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | --- ### Release Notes <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.47.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.47.0): 1.47.0 ##### Components ##### Application Security Management (IAST) - 🐛 Exclude com.stripe.net.HttpURLConnectionClient to solve IAST SSRF vulnerability false positives ([#​8483](DataDog/dd-trace-java#8483) - [@​jandro996](https://github.com/jandro996)) - 🐛 Add exclusion to solve IAST weak randomness vulnerability false positives ([#​8462](DataDog/dd-trace-java#8462) - [@​jandro996](https://github.com/jandro996)) - ✨ Fix weak randomness false positive in Kafka client ([#​8408](DataDog/dd-trace-java#8408) - [@​smola](https://github.com/smola)) - ✨ Fix location for SSRF with Kong Unirest ([#​8407](DataDog/dd-trace-java#8407) - [@​smola](https://github.com/smola)) - ✨ Exclude IBM Instana from IAST ([#​8406](DataDog/dd-trace-java#8406) - [@​smola](https://github.com/smola)) - 🐛 Fix org.json iast instrumentation test for latest dependency ([#​8347](DataDog/dd-trace-java#8347) - [@​jandro996](https://github.com/jandro996)) - ✨ Configuration to Disable APM Tracing ([#​8219](DataDog/dd-trace-java#8219) - [@​jandro996](https://github.com/jandro996)) - ✨ Address cookie vulnerability cardinality issues ([#​8210](DataDog/dd-trace-java#8210) - [@​jandro996](https://github.com/jandro996)) - ✨ Email HTML Injection detection in IAST ([#​8205](DataDog/dd-trace-java#8205) - [@​sezen-datadog](https://github.com/sezen-datadog)) ##### Application Security Management (WAF) - 🐛✨ Ensure usr.exists tag is not overridden when UsernameNotFoundException is thrown ([#​8376](DataDog/dd-trace-java#8376) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛✨ Ensure usr.exists tag is not overridden by auto instrumentation ([#​8374](DataDog/dd-trace-java#8374) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Update appsec metrics with event_rules_version tag ([#​8354](DataDog/dd-trace-java#8354) - [@​sezen-datadog](https://github.com/sezen-datadog)) - ✨ Update metrics: appsec.waf.requests ([#​8353](DataDog/dd-trace-java#8353) - [@​Mariovido](https://github.com/Mariovido)) - ✨ Improve ASM support in vert.x 5.0 ([#​8285](DataDog/dd-trace-java#8285) - [@​manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Update metrics: appsec.waf.updates and appsec.waf.init ([#​8280](DataDog/dd-trace-java#8280) - [@​Mariovido](https://github.com/Mariovido)) - ✨ Configuration to Disable APM Tracing ([#​8219](DataDog/dd-trace-java#8219) - [@​jandro996](https://github.com/jandro996)) ##### Build & Tooling - 🐛 Do not generate Muzzle references for primitive arrays in method body ([#​8361](DataDog/dd-trace-java#8361) - [@​amarziali](https://github.com/amarziali)) - 📖 Improve dev env setup documentation for Windows ([#​8180](DataDog/dd-trace-java#8180) - [@​lucaspimentel](https://github.com/lucaspimentel)) ##### Continuous Integration Visibility - ✨ Add support for skip-EFD tagging ([#​8487](DataDog/dd-trace-java#8487) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix an NPE in Gradle Android instrumentation ([#​8484](DataDog/dd-trace-java#8484) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Consider modified tests when applying fail-fast tests ordering ([#​8474](DataDog/dd-trace-java#8474) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Implement tests reordering for TestNG ([#​8467](DataDog/dd-trace-java#8467) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix Gradle Launcher instrumentation to not interfere with Gradle Test Kit ([#​8465](DataDog/dd-trace-java#8465) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Use separate TestEventHandlers per framework in CI Vis instrumentations ([#​8451](DataDog/dd-trace-java#8451) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Remove warning log when JUnit 4 test method cannot be retrieved ([#​8445](DataDog/dd-trace-java#8445) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix Scalatest tracing for tests that are reported asynchronously ([#​8444](DataDog/dd-trace-java#8444) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Implement attempt to fix tests ([#​8393](DataDog/dd-trace-java#8393) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement test disabling ([#​8377](DataDog/dd-trace-java#8377) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Update CODEOWNERS parser to not log errors on comments with leading whitespace ([#​8349](DataDog/dd-trace-java#8349) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Request Test Management tests list ([#​8345](DataDog/dd-trace-java#8345) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Receive test management settings from CIVis settings request ([#​8331](DataDog/dd-trace-java#8331) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement quarantined tests tagging ([#​8326](DataDog/dd-trace-java#8326) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Implement tests quarantining ([#​8320](DataDog/dd-trace-java#8320) - [@​nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add tag to specify if the user is setting DD_SERVICE ([#​8318](DataDog/dd-trace-java#8318) - [@​daniel-mohedano](https://github.com/daniel-mohedano)) ##### Crash tracking - ✨ Only fork jps when required ([#​8419](DataDog/dd-trace-java#8419) - [@​mcculls](https://github.com/mcculls)) - 🐛 Use Java home of the crashed process to launch crash uploader ([#​8348](DataDog/dd-trace-java#8348) - [@​jbachorik](https://github.com/jbachorik)) ##### Data Streams Monitoring - 🐛 Fix error happening when sqs message attributes are readonly ([#​8473](DataDog/dd-trace-java#8473) - [@​vandonr](https://github.com/vandonr)) - 🐛 Fix bug on proto schema extraction ([#​8403](DataDog/dd-trace-java#8403) - [@​vandonr](https://github.com/vandonr)) - 🐛 Fix service name overrides in consumers ([#​8387](DataDog/dd-trace-java#8387) - [@​piochelepiotr](https://github.com/piochelepiotr)) ##### Database Monitoring - ✨ Add DBMTracePreparedStatements to tracer configuration log ([#​8508](DataDog/dd-trace-java#8508) - [@​cecile75](https://github.com/cecile75)) ##### Dynamic Instrumentation - ✨ Look in another location for grpc service methods ([#​8468](DataDog/dd-trace-java#8468) - [@​evanchooly](https://github.com/evanchooly)) - 🐛 Fix Exception Replay with Lambda proxy classes ([#​8452](DataDog/dd-trace-java#8452) - [@​jpbempel](https://github.com/jpbempel)) - ✨ Add code origin support for spring-webmvc ([#​8416](DataDog/dd-trace-java#8416) - [@​evanchooly](https://github.com/evanchooly)) - ✨ Add support for scanning jar from loaded class ([#​8370](DataDog/dd-trace-java#8370) - [@​jpbempel](https://github.com/jpbempel)) - 🐛 Disable capture of entry values ([#​8369](DataDog/dd-trace-java#8369) - [@​jpbempel](https://github.com/jpbempel)) - 🐛 Fix CodeOrigin for `@Trace` annotation ([#​8344](DataDog/dd-trace-java#8344) - [@​jpbempel](https://github.com/jpbempel)) - 🐛 Fix equals/hashCode for CodeOrigin probe ([#​8319](DataDog/dd-trace-java#8319) - [@​jpbempel](https://github.com/jpbempel)) - ✨ Add code origin support to kafka message listeners ([#​8301](DataDog/dd-trace-java#8301) - [@​evanchooly](https://github.com/evanchooly)) ##### Metrics - ✨ Create metric: appsec.waf.error ([#​8381](DataDog/dd-trace-java#8381) - [@​sezen-datadog](https://github.com/sezen-datadog)) - ✨ Create metric: appsec.rasp.error ([#​8364](DataDog/dd-trace-java#8364) - [@​sezen-datadog](https://github.com/sezen-datadog)) ##### Profiling - ✨ Bump ddprof library to 1.22.0 ([#​8463](DataDog/dd-trace-java#8463) - [@​jbachorik](https://github.com/jbachorik)) - IBM J9 8u361 corresponds to OpenJDK 8u362 by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#187 - Fix compatibility with musl libc 1.2.4 by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#189 - Modify version extraction by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#179 - Do not write null values to jvminfo event by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#184 - Productize VMStructs-based stack walker by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#177 - A few minor downport issues by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#180 - Enable ASGCT by default on fairly safe J9 JDK versions by [@​jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#181 - 🐛 Exclude OrderedThreadPoolExecutor from queue-time measurements ([#​8456](DataDog/dd-trace-java#8456) - [@​jbachorik](https://github.com/jbachorik)) - ✨ Record JVM info on JVMs without JFR ([#​8431](DataDog/dd-trace-java#8431) - [@​jbachorik](https://github.com/jbachorik)) - 🐛 Actually use CleanupTask in TempLocationManager ([#​8420](DataDog/dd-trace-java#8420) - [@​mcculls](https://github.com/mcculls)) - ✨ Only fork jps when required ([#​8419](DataDog/dd-trace-java#8419) - [@​mcculls](https://github.com/mcculls)) - 🐛 Adjust JFR checks for J9 ([#​8405](DataDog/dd-trace-java#8405) - [@​jbachorik](https://github.com/jbachorik)) - 🧹 Disable smap RSS parsing by default ([#​8342](DataDog/dd-trace-java#8342) - [@​MattAlp](https://github.com/MattAlp)) ##### Telemetry - 🐛 Add support for JBoss jar:file format to DependencyResolver ([#​8428](DataDog/dd-trace-java#8428) - [@​jandro996](https://github.com/jandro996)) - ✨ Update metrics: appsec.waf.requests ([#​8353](DataDog/dd-trace-java#8353) - [@​Mariovido](https://github.com/Mariovido)) ##### Trace context propagation - ✨ Introduce tracing propagator ([#​8313](DataDog/dd-trace-java#8313) - [@​PerfectSlayer](https://github.com/PerfectSlayer)) ##### Tracer core - 🐛 Fix Stable Config telemetry source names ([#​8460](DataDog 8000 /dd-trace-java#8460) - [@​BaptisteFoy](https://github.com/BaptisteFoy)) - ✨ Probe trace endpoints with a valid payload of empty arrays ([#​8414](DataDog/dd-trace-java#8414) - [@​mcculls](https://github.com/mcculls)) - ✨ Add 1 minute fail-safe to JUL/JMX class-loading callback ([#​8399](DataDog/dd-trace-java#8399) - [@​mcculls](https://github.com/mcculls)) - ✨ Migrate DSM injection calls to context-first APIs ([#​8383](DataDog/dd-trace-java#8383) - [@​PerfectSlayer](https://github.com/PerfectSlayer)) - 🧹 Move continuation capture methods from scope to tracer ([#​8371](DataDog/dd-trace-java#8371) - [@​mcculls](https://github.com/mcculls)) - ✨ Migrate context extraction calls to context-first APIs ([#​8368](DataDog/dd-trace-java#8368) - [@​PerfectSlayer](https://github.com/PerfectSlayer)) - 🧹 Migrate context injection calls to context-first APIs ([#​8358](DataDog/dd-trace-java#8358) - [@​PerfectSlayer](https://github.com/PerfectSlayer)) - 💡 Support reading configurations from files ([#​8338](DataDog/dd-trace-java#8338) - [@​mtoffl01](https://github.com/mtoffl01)) - 💡 Implementation of BaggagePropagator and BaggageContext ([#​8330](DataDog/dd-trace-java#8330) - [@​mhlidd](https://github.com/mhlidd)) - 🧹 Combine continuation implementations into one which supports multiple activations ([#​8324](DataDog/dd-trace-java#8324) - [@​mcculls](https://github.com/mcculls)) - ✨ Introduce tracing propagator ([#​8313](DataDog/dd-trace-java#8313) - [@​PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Remove old context propagation API ([#​8271](DataDog/dd-trace-java#8271) - [@​PerfectSlayer](https://github.com/PerfectSlayer)) ##### Instrumentations ##### AWS Lambda instrumentation - 🐛 Send error message and stack to Lambda extension ([#​8417](DataDog/dd-trace-java#8417) - [@​nhulston](https://github.com/nhulston)) ##### AWS SDK instrumentation - 🐛 Fix error happening when sqs message attributes are readonly ([#​8473](DataDog/dd-trace-java#8473) - [@​vandonr](https://github.com/vandonr)) - 💡 Inject trace context into AWS Step Functions input ([#​7585](DataDog/dd-trace-java#7585) - [@​DylanLovesCoffee](https://github.com/DylanLovesCoffee)) ##### Core Java language instrumentation - ✨ Look in another location for grpc service methods ([#​8468](DataDog/dd-trace-java#8468) - [@​evanchooly](https://github.com/evanchooly)) - ✨ Add code origin support for spring-webmvc ([#​8416](DataDog/dd-trace-java#8416) - [@​evanchooly](https://github.com/evanchooly)) - 💡 Implementation of BaggagePropagator and BaggageContext ([#​8330](DataDog/dd-trace-java#8330) - [@​mhlidd](https://github.com/mhlidd)) - ✨ Add code origin support to kafka message listeners ([#​8301](DataDog/dd-trace-java#8301) - [@​evanchooly](https://github.com/evanchooly)) ##### gRPC instrumentation - ✨ Look in another location for grpc service methods ([#​8468](DataDog/dd-trace-java#8468) - [@​evanchooly](https://github.com/evanchooly)) ##### Kafka instrumentation - ✨ Add messaging.destination.name tag to kafka integrations ([#​8366](DataDog/dd-trace-java#8366) - [@​rarguelloF](https://github.com/rarguelloF)) ##### Protocol Buffer instrumentation - 🐛 Fix bug on proto schema extraction ([#​8403](DataDog/dd-trace-java#8403) - [@​vandonr](https://github.com/vandonr)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: 108a0f86aa59ab4c938cbac0688dd4c19cb301fa
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
What Does This Do
Fix SSRF vuln location when using Kong Unirest.
Motivation
Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any usefull labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-56800