APM: do not replace tags on special dd tags (#25508) (#25567)

* APM: do not replace tags on special dd tags

* Add release note

* Update releasenotes/notes/noReplaceDD-5ea756d06f438f23.yaml

Co-authored-by: Alicia Scott <aliciascott@users.noreply.github.com>

* APM: replace_tags ignore all hidden tags not just _dd

---------

Co-authored-by: Alicia Scott <aliciascott@users.noreply.github.com>
(cherry picked from commit e8db66f)

Co-authored-by: Andrew Glaude <andrew.glaude@datadoghq.com>

pkg/trace/filters/replacer.go

@@ -8,6 +8,7 @@ package filters
 import (
 	"regexp"
 	"strconv"
+	"strings"
 
 	pb "github.com/DataDog/datadog-agent/pkg/proto/pbgo/trace"
 	"github.com/DataDog/datadog-agent/pkg/trace/config"
@@ -24,6 +25,8 @@ func NewReplacer(rules []*config.ReplaceRule) *Replacer {
 	return &Replacer{rules: rules}
 }
 
+const hiddenTagPrefix = "_"
+
 // Replace replaces all tags matching the Replacer's rules.
 func (f Replacer) Replace(trace pb.Trace) {
 	for _, rule := range f.rules {
@@ -32,10 +35,14 @@ func (f Replacer) Replace(trace pb.Trace) {
 			switch key {
 			case "*":
 				for k := range s.Meta {
-					s.Meta[k] = re.ReplaceAllString(s.Meta[k], str)
+					if !strings.HasPrefix(k, hiddenTagPrefix) {
+						s.Meta[k] = re.ReplaceAllString(s.Meta[k], str)
+					}
 				}
 				for k := range s.Metrics {
-					f.replaceNumericTag(re, s, k, str)
+					if !strings.HasPrefix(k, hiddenTagPrefix) {
+						f.replaceNumericTag(re, s, k, str)
+					}
 				}
 				s.Resource = re.ReplaceAllString(s.Resource, str)
 			case "resource.name":

pkg/trace/filters/replacer_test.go

@@ -52,12 +52,14 @@ func TestReplacer(t *testing.T) {
 					"http.url":      "some/[REDACTED]/token/abcdef/abc",
 					"other.url":     "some/guid/token/abcdef/abc",
 					"custom.tag":    "/foo/bar/foo",
+					"_special":      "this should not be changed",
 				},
 				want: map[string]string{
 					"resource.name": "that is stage",
 					"http.url":      "some/[REDACTED]/token/?/abc",
 					"other.url":     "some/guid/token/?/abc",
 					"custom.tag":    "/foo/bar/extra",
+					"_special":      "this should not be changed",
 				},
 			},
 		} {

releasenotes/notes/noReplaceDD-5ea756d06f438f23.yaml

@@ -0,0 +1,11 @@
+# Each section from every release note are combined when the
+# CHANGELOG.rst is rendered. So the text needs to be worded so that
+# it does not depend on any information only available in another
+# section. This may mean repeating some details, but each section
+# must be readable independently of the other.
+#
+# Each section note must be formatted as reStructuredText.
+---
+fixes:
+  - |
+    APM: Fixes issue where match-all replace tags rules could inadvertently affect required datadog tags. It is still possible to redact specific Datadog tags by targeting them explicitly.