Skip to content

feat(servlet): add jakarta-servlet-6.0 instrumentation module#11584

Closed
wconti27 wants to merge 2 commits into
masterfrom
apm-ai-toolkit/execute/jakarta-servlet/20260606-034358
Closed

feat(servlet): add jakarta-servlet-6.0 instrumentation module#11584
wconti27 wants to merge 2 commits into
masterfrom
apm-ai-toolkit/execute/jakarta-servlet/20260606-034358

Conversation

@wconti27
Copy link
Copy Markdown
Contributor

@wconti27 wconti27 commented Jun 6, 2026

🤖 Generated with APM Instrumentation Toolkit

Summary

  • Adds a new jakarta-servlet-6.0 instrumentation module covering Jakarta Servlet 6.0/6.1 (required for Spring Boot 4 / Spring Framework 7 support)
  • Forks jakarta-servlet-5.0 into datadog.trace.instrumentation.servlet6, muzzle range [6.0,), compile target jakarta.servlet-api:6.1.0

Key changes vs jakarta-servlet-5.0

1. sendRedirect(String, int, boolean) IAST hook (critical)
In Servlet 6.1, this 3-arg overload became the new abstract; the 1-arg is now a default delegate. Tomcat 11/Jetty 12 implement only the 3-arg form — the existing IAST UnvalidatedRedirect hook silently misses all redirects on those containers. Added SendRedirect3ArgAdvice.

2. New Servlet 6.0 span tags (reads inside existing advice, no new hooks)

  • http.request_idgetRequestId()
  • network.protocol_request_idgetProtocolRequestId() (omitted when empty)
  • network.connection.id / network.protocol.namegetServletConnection()

3. IAST cookie RFC 6265bisAddCookieAdvice reads getAttribute("SameSite") / getAttribute("Partitioned")

4. RumHttpServletResponseWrapper60 — overrides sendRedirect(String, int, boolean) so RUM injection is not bypassed

Test plan

  • muzzle passes (6.0.0 and 6.1.0)
  • 112 unit tests pass
  • spotlessCheck clean
  • latestDepTest against jakarta.servlet-api:6.+ / spring-boot-starter-web:4.+ (CI)

Related

Part of Spring Boot 4 instrumentation: https://github.com/DataDog/apm-instrumentation-toolkit/issues/437

🤖 Generated with APM Instrumentation Toolkit

wconti27 and others added 2 commits June 5, 2026 23:49
…vlet 6.0/6.1 support

Adds a dedicated instrumentation module for Jakarta Servlet 6.0/6.1 (Spring Boot 4).
Key additions over the existing jakarta-servlet-5.0 module:
- New hook for sendRedirect(String, int, boolean) — the 3-arg abstract added in Servlet 6.1
- Span enrichment using Servlet 6.0 APIs: getRequestId(), getProtocolRequestId(), getServletConnection()
- IAST AddCookieAdvice reads RFC 6265bis SameSite/Partitioned attributes via Cookie.getAttribute()
- RumHttpServletResponseWrapper60 overrides the new 3-arg sendRedirect for correct RUM injection
- Muzzle range [6.0,), compiled against jakarta.servlet-api:6.1.0
- Renames servlet5 package to servlet6, adds Servlet6RequestBodyInstrumentation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@dd-octo-sts
Copy link
Copy Markdown
Contributor

dd-octo-sts Bot commented Jun 6, 2026

❌ New Groovy Files Detected

Please avoid introducing new .groovy files to this repository.

  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/test/groovy/IastJakartaServletInstrumentationTest.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/test/groovy/JakartaHttpServletRequestInstrumentationTest.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/test/groovy/JakartaHttpServletResponseInstrumentationTest.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/test/groovy/JakartaJspWriterCallsiteTest.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/test/groovy/JakartaJspWriterFullDetectionCallsiteTest.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/test/groovy/JakartaMultipartInstrumentationTest.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/test/groovy/RumHttpServletResponseWrapperTest.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/testFixtures/groovy/datadog/trace/instrumentation/servlet5/AsyncRumServlet.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/testFixtures/groovy/datadog/trace/instrumentation/servlet5/RumServlet.groovy
  • dd-java-agent/instrumentation/servlet/jakarta-servlet-6.0/src/testFixtures/groovy/datadog/trace/instrumentation/servlet5/TestServlet5.groovy

Instead, rewrite the new file(s) in Java / JUnit. See the How to Test With JUnit Guide for more details.

If this PR needs an exception, add the tag: override-groovy-enforcement label to bypass this workflow.

@datadog-datadog-prod-us1
Copy link
Copy Markdown
Contributor

datadog-datadog-prod-us1 Bot commented Jun 6, 2026

Pipelines

Fix all issues with BitsAI

⚠️ Warnings

🚦 78 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-java | test_inst: [8, 2/8]   View in Datadog   GitLab

DataDog/apm-reliability/dd-trace-java | test_smoke: [11, 1/8]   View in Datadog   GitLab

DataDog/apm-reliability/dd-trace-java | test_smoke: [11, 4/8]   View in Datadog   GitLab

View all 78 failed jobs.

Useful? React with 👍 / 👎

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d664b7f | Docs | Datadog PR Page | Give us feedback!

@dd-octo-sts
Copy link
Copy Markdown
Contributor

dd-octo-sts Bot commented Jun 6, 2026

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite Status
Startup 🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results
Scenario Candidate master Δ (95% CI of mean)
startup:insecure-bank:iast:Agent 13.43 s 13.83 s [-3.8%; -2.0%] (significantly better)
startup:insecure-bank:tracing:Agent 12.79 s 13.15 s [-4.1%; -1.5%] (significantly better)
startup:petclinic:appsec:Agent 16.49 s 16.41 s [-0.7%; +1.7%] (no difference)
startup:petclinic:iast:Agent 16.57 s 16.63 s [-1.8%; +1.2%] (no difference)
startup:petclinic:profiling:Agent 16.38 s 16.61 s [-2.7%; -0.1%] (maybe better)
startup:petclinic:tracing:Agent 15.75 s 15.75 s [-1.5%; +1.5%] (no difference)

Commit: d664b7f4 · CI Pipeline · Benchmarking Platform UI


Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant