🍒 10711 - Missing http.response.headers.content-type span tag on blocking responses#10884
Open
jandro996 wants to merge 1 commit intorelease/v1.60.xfrom
Open
🍒 10711 - Missing http.response.headers.content-type span tag on blocking responses#10884jandro996 wants to merge 1 commit intorelease/v1.60.xfrom
jandro996 wants to merge 1 commit intorelease/v1.60.xfrom
Conversation
…nses (#10711) fix(appsec): record blocking response content-type centrally in GatewayBridge When a WAF blocking action fires, the normal response-header IG callbacks are bypassed, so http.response.headers.content-type never reaches the span. Instead of patching every framework's blocking handler, intercept the blocking flow result in GatewayBridge.maybePublishRequestData / maybePublishResponseData, compute the deterministic content-type from RequestBlockingAction + accept header, store it on AppSecRequestContext, and write it as a span tag in onRequestEnded(). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Merge branch 'master' into alejandro.gonzalez/APPSEC-61447-bug-blocking Fix and more tests Fix and more tests Fix and more tests Merge branch 'master' into alejandro.gonzalez/APPSEC-61447-bug-blocking Merge branch 'master' into alejandro.gonzalez/APPSEC-61447-bug-blocking Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>
jandro996
added
type: bug
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8b3df9ff81
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java
Show resolved
Hide resolved
Kafka / consumer-benchmarkParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 3 metrics, 0 unstable metrics. See unchanged results
|
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 60 metrics, 11 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.61.0-SNAPSHOT~8b3df9ff81, baseline=1.60.0~0f5d84f2c4
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.072 s) : 0, 1071583
Total [baseline] (10.855 s) : 0, 10854932
Agent [candidate] (1.065 s) : 0, 1064726
Total [candidate] (10.959 s) : 0, 10959045
section appsec
Agent [baseline] (1.245 s) : 0, 1245235
Total [baseline] (11.179 s) : 0, 11178537
Agent [candidate] (1.233 s) : 0, 1233475
Total [candidate] (11.041 s) : 0, 11041040
section iast
Agent [baseline] (1.23 s) : 0, 1229718
Total [baseline] (11.141 s) : 0, 11141152
Agent [candidate] (1.231 s) : 0, 1230780
Total [candidate] (11.081 s) : 0, 11081198
section profiling
Agent [baseline] (1.189 s) : 0, 1188615
Total [baseline] (10.877 s) : 0, 10876663
Agent [candidate] (1.19 s) : 0, 1189602
Total [candidate] (10.957 s) : 0, 10957475
gantt
title petclinic - break down per module: candidate=1.61.0-SNAPSHOT~8b3df9ff81, baseline=1.60.0~0f5d84f2c4
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.194 ms) : 0, 1194
crashtracking [candidate] (1.178 ms) : 0, 1178
BytebuddyAgent [baseline] (632.062 ms) : 0, 632062
BytebuddyAgent [candidate] (626.656 ms) : 0, 626656
AgentMeter [baseline] (29.347 ms) : 0, 29347
AgentMeter [candidate] (29.133 ms) : 0, 29133
GlobalTracer [baseline] (258.026 ms) : 0, 258026
GlobalTracer [candidate] (257.614 ms) : 0, 257614
AppSec [baseline] (33.104 ms) : 0, 33104
AppSec [candidate] (32.859 ms) : 0, 32859
Debugger [baseline] (63.958 ms) : 0, 63958
Debugger [candidate] (66.858 ms) : 0, 66858
Remote Config [baseline] (627.918 µs) : 0, 628
Remote Config [candidate] (599.176 µs) : 0, 599
Telemetry [baseline] (11.66 ms) : 0, 11660
Telemetry [candidate] (9.833 ms) : 0, 9833
Flare Poller [baseline] (5.391 ms) : 0, 5391
Flare Poller [candidate] (3.785 ms) : 0, 3785
section appsec
crashtracking [baseline] (1.202 ms) : 0, 1202
crashtracking [candidate] (1.184 ms) : 0, 1184
BytebuddyAgent [baseline] (661.026 ms) : 0, 661026
BytebuddyAgent [candidate] (654.209 ms) : 0, 654209
AgentMeter [baseline] (12.052 ms) : 0, 12052
AgentMeter [candidate] (11.943 ms) : 0, 11943
GlobalTracer [baseline] (259.691 ms) : 0, 259691
GlobalTracer [candidate] (257.555 ms) : 0, 257555
AppSec [baseline] (168.095 ms) : 0, 168095
AppSec [candidate] (167.48 ms) : 0, 167480
Debugger [baseline] (67.697 ms) : 0, 67697
Debugger [candidate] (66.319 ms) : 0, 66319
Remote Config [baseline] (744.423 µs) : 0, 744
Remote Config [candidate] (678.462 µs) : 0, 678
Telemetry [baseline] (9.46 ms) : 0, 9460
Telemetry [candidate] (9.22 ms) : 0, 9220
Flare Poller [baseline] (3.739 ms) : 0, 3739
Flare Poller [candidate] (3.647 ms) : 0, 3647
IAST [baseline] (25.384 ms) : 0, 25384
IAST [candidate] (25.263 ms) : 0, 25263
section iast
crashtracking [baseline] (1.192 ms) : 0, 1192
crashtracking [candidate] (1.187 ms) : 0, 1187
BytebuddyAgent [baseline] (794.145 ms) : 0, 794145
BytebuddyAgent [candidate] (794.855 ms) : 0, 794855
AgentMeter [baseline] (11.294 ms) : 0, 11294
AgentMeter [candidate] (11.314 ms) : 0, 11314
GlobalTracer [baseline] (246.704 ms) : 0, 246704
GlobalTracer [candidate] (247.074 ms) : 0, 247074
AppSec [baseline] (33.162 ms) : 0, 33162
AppSec [candidate] (34.09 ms) : 0, 34090
Debugger [baseline] (67.649 ms) : 0, 67649
Debugger [candidate] (66.449 ms) : 0, 66449
Remote Config [baseline] (527.572 µs) : 0, 528
Remote Config [candidate] (531.363 µs) : 0, 531
Telemetry [baseline] (8.633 ms) : 0, 8633
Telemetry [candidate] (8.635 ms) : 0, 8635
Flare Poller [baseline] (3.488 ms) : 0, 3488
Flare Poller [candidate] (3.48 ms) : 0, 3480
IAST [baseline] (26.957 ms) : 0, 26957
IAST [candidate] (27.146 ms) : 0, 27146
section profiling
ProfilingAgent [baseline] (98.949 ms) : 0, 98949
ProfilingAgent [candidate] (99.075 ms) : 0, 99075
crashtracking [baseline] (1.158 ms) : 0, 1158
crashtracking [candidate] (1.157 ms) : 0, 1157
BytebuddyAgent [baseline] (680.955 ms) : 0, 680955
BytebuddyAgent [candidate] (681.026 ms) : 0, 681026
AgentMeter [baseline] (8.548 ms) : 0, 8548
AgentMeter [candidate] (8.598 ms) : 0, 8598
GlobalTracer [baseline] (215.431 ms) : 0, 215431
GlobalTracer [candidate] (216.0 ms) : 0, 216000
AppSec [baseline] (32.429 ms) : 0, 32429
AppSec [candidate] (32.52 ms) : 0, 32520
Debugger [baseline] (67.179 ms) : 0, 67179
Debugger [candidate] (67.266 ms) : 0, 67266
Remote Config [baseline] (621.197 µs) : 0, 621
Remote Config [candidate] (643.5 µs) : 0, 644
Telemetry [baseline] (8.871 ms) : 0, 8871
Telemetry [candidate] (8.796 ms) : 0, 8796
Flare Poller [baseline] (3.697 ms) : 0, 3697
Flare Poller [candidate] (3.715 ms) : 0, 3715
Profiling [baseline] (99.525 ms) : 0, 99525
Profiling [candidate] (99.648 ms) : 0, 99648
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.61.0-SNAPSHOT~8b3df9ff81, baseline=1.60.0~0f5d84f2c4
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.065 s) : 0, 1065098
Total [baseline] (8.754 s) : 0, 8753660
Agent [candidate] (1.065 s) : 0, 1064705
Total [candidate] (8.735 s) : 0, 8734781
section iast
Agent [baseline] (1.231 s) : 0, 1230798
Total [baseline] (9.386 s) : 0, 9386272
Agent [candidate] (1.232 s) : 0, 1231864
Total [candidate] (9.394 s) : 0, 9393842
gantt
title insecure-bank - break down per module: candidate=1.61.0-SNAPSHOT~8b3df9ff81, baseline=1.60.0~0f5d84f2c4
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.188 ms) : 0, 1188
crashtracking [candidate] (1.193 ms) : 0, 1193
BytebuddyAgent [baseline] (627.399 ms) : 0, 627399
BytebuddyAgent [candidate] (627.484 ms) : 0, 627484
AgentMeter [baseline] (28.992 ms) : 0, 28992
AgentMeter [candidate] (29.029 ms) : 0, 29029
GlobalTracer [baseline] (257.145 ms) : 0, 257145
GlobalTracer [candidate] (257.426 ms) : 0, 257426
AppSec [baseline] (33.051 ms) : 0, 33051
AppSec [candidate] (33.037 ms) : 0, 33037
Debugger [baseline] (63.008 ms) : 0, 63008
Debugger [candidate] (63.015 ms) : 0, 63015
Remote Config [baseline] (618.921 µs) : 0, 619
Remote Config [candidate] (624.639 µs) : 0, 625
Telemetry [baseline] (12.975 ms) : 0, 12975
Telemetry [candidate] (11.479 ms) : 0, 11479
Flare Poller [baseline] (4.607 ms) : 0, 4607
Flare Poller [candidate] (5.316 ms) : 0, 5316
section iast
crashtracking [baseline] (1.191 ms) : 0, 1191
crashtracking [candidate] (1.197 ms) : 0, 1197
BytebuddyAgent [baseline] (795.683 ms) : 0, 795683
BytebuddyAgent [candidate] (796.905 ms) : 0, 796905
AgentMeter [baseline] (11.323 ms) : 0, 11323
AgentMeter [candidate] (11.311 ms) : 0, 11311
GlobalTracer [baseline] (247.062 ms) : 0, 247062
GlobalTracer [candidate] (247.32 ms) : 0, 247320
AppSec [baseline] (32.381 ms) : 0, 32381
AppSec [candidate] (33.745 ms) : 0, 33745
Debugger [baseline] (67.4 ms) : 0, 67400
Debugger [candidate] (65.812 ms) : 0, 65812
Remote Config [baseline] (529.483 µs) : 0, 529
Remote Config [candidate] (526.1 µs) : 0, 526
Telemetry [baseline] (8.65 ms) : 0, 8650
Telemetry [candidate] (8.578 ms) : 0, 8578
Flare Poller [baseline] (3.491 ms) : 0, 3491
Flare Poller [candidate] (3.442 ms) : 0, 3442
IAST [baseline] (27.046 ms) : 0, 27046
IAST [candidate] (26.965 ms) : 0, 26965
LoadParameters
See matching parameters
SummaryFound 1 performance improvements and 0 performance regressions! Performance is the same for 19 metrics, 16 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~8b3df9ff81, baseline=1.60.0~0f5d84f2c4
dateFormat X
axisFormat %s
section baseline
no_agent (18.229 ms) : 18041, 18417
. : milestone, 18229,
appsec (18.675 ms) : 18482, 18867
. : milestone, 18675,
code_origins (18.101 ms) : 17920, 18283
. : milestone, 18101,
iast (18.348 ms) : 18164, 18533
. : milestone, 18348,
profiling (18.827 ms) : 18639, 19015
. : milestone, 18827,
tracing (18.445 ms) : 18261, 18630
. : milestone, 18445,
section candidate
no_agent (18.09 ms) : 17907, 18273
. : milestone, 18090,
appsec (18.417 ms) : 18228, 18605
. : milestone, 18417,
code_origins (17.624 ms) : 17449, 17799
. : milestone, 17624,
iast (18.028 ms) : 17848, 18207
. : milestone, 18028,
profiling (18.706 ms) : 18526, 18887
. : milestone, 18706,
tracing (17.934 ms) : 17758, 18110
. : milestone, 17934,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~8b3df9ff81, baseline=1.60.0~0f5d84f2c4
dateFormat X
axisFormat %s
section baseline
no_agent (1.181 ms) : 1169, 1193
. : milestone, 1181,
iast (3.239 ms) : 3193, 3284
. : milestone, 3239,
iast_FULL (6.075 ms) : 6012, 6138
. : milestone, 6075,
iast_GLOBAL (3.559 ms) : 3506, 3611
. : milestone, 3559,
profiling (2.261 ms) : 2239, 2283
. : milestone, 2261,
tracing (1.799 ms) : 1784, 1814
. : milestone, 1799,
section candidate
no_agent (1.193 ms) : 1181, 1205
. : milestone, 1193,
iast (3.263 ms) : 3220, 3306
. : milestone, 3263,
iast_FULL (5.868 ms) : 5810, 5927
. : milestone, 5868,
iast_GLOBAL (3.502 ms) : 3443, 3560
. : milestone, 3502,
profiling (1.998 ms) : 1979, 2016
. : milestone, 1998,
tracing (1.808 ms) : 1793, 1823
. : milestone, 1808,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~8b3df9ff81, baseline=1.60.0~0f5d84f2c4
dateFormat X
axisFormat %s
section baseline
no_agent (1.468 ms) : 1457, 1480
. : milestone, 1468,
appsec (3.77 ms) : 3549, 3992
. : milestone, 3770,
iast (2.243 ms) : 2175, 2312
. : milestone, 2243,
iast_GLOBAL (2.293 ms) : 2223, 2362
. : milestone, 2293,
profiling (2.061 ms) : 2007, 2115
. : milestone, 2061,
tracing (2.05 ms) : 1997, 2104
. : milestone, 2050,
section candidate
no_agent (1.473 ms) : 1461, 1484
. : milestone, 1473,
appsec (3.778 ms) : 3557, 3998
. : milestone, 3778,
iast (2.254 ms) : 2184, 2323
. : milestone, 2254,
iast_GLOBAL (2.288 ms) : 2219, 2358
. : milestone, 2288,
profiling (2.103 ms) : 2046, 2160
. : milestone, 2103,
tracing (2.04 ms) : 1987, 2093
. : milestone, 2040,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~8b3df9ff81, baseline=1.60.0~0f5d84f2c4
dateFormat X
axisFormat %s
section baseline
no_agent (14.948 s) : 14948000, 14948000
. : milestone, 14948000,
appsec (14.9 s) : 14900000, 14900000
. : milestone, 14900000,
iast (17.955 s) : 17955000, 17955000
. : milestone, 17955000,
iast_GLOBAL (17.599 s) : 17599000, 17599000
. : milestone, 17599000,
profiling (14.7 s) : 14700000, 14700000
. : milestone, 14700000,
tracing (15.058 s) : 15058000, 15058000
. : milestone, 15058000,
section candidate
no_agent (15.604 s) : 15604000, 15604000
. : milestone, 15604000,
appsec (14.927 s) : 14927000, 14927000
. : milestone, 14927000,
iast (17.972 s) : 17972000, 17972000
. : milestone, 17972000,
iast_GLOBAL (17.825 s) : 17825000, 17825000
. : milestone, 17825000,
profiling (14.729 s) : 14729000, 14729000
. : milestone, 14729000,
tracing (15.008 s) : 15008000, 15008000
. : milestone, 15008000,
|
PerfectSlayer
approved these changes
Mar 18, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport #10711 to release/v1.60.x