Skip to content

feat(appsec): support for OWASP API10 monitoring#3983

Merged
dd-mergequeue[bot] merged 4 commits into
mainfrom
eliottness/api10
Sep 22, 2025
Merged

feat(appsec): support for OWASP API10 monitoring#3983
dd-mergequeue[bot] merged 4 commits into
mainfrom
eliottness/api10

Conversation

@eliottness

@eliottness eliottness commented Sep 19, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

RFC: https://docs.google.com/document/d/1DIGuCl1rkhx5swmGxKO7Je8Y4zvaobXBlgbm6C89yzU/edit?tab=t.0#heading=h.iq1hk9oclfxg

  • Register new addresses
  • Augment the RoundtripperOperation used for RASP SSRF
  • Move some entrypoints in internal/appsec/body
  • Divide the RASPRuleTypeSSRF RASPRuleType into RASPRuleTypeSSRFRequest and RASPRuleTypeSSRFResponse for better telemetry as in the RFC
  • Add 2 new config env vars
  • Connect the contrib to the new part of the httpsec operation
  • Test all addresses from the contrib
  • run go mod tidy everywhere

Reviewer's Checklist

  • Changed code has unit tests for its functionality at or near 100% coverage.
  • System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
  • There is a benchmark for any new code, or changes to existing code.
  • If this interacts with the agent in a new way, a system test has been added.
  • New code is free of linting errors. You can check this by running ./scripts/lint.sh locally.
  • Add an appropriate team label so this PR gets put in the right place for the release notes.
  • Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

@github-actions github-actions Bot added the apm:ecosystem contrib/* related feature requests or bugs label Sep 19, 2025
@pr-commenter

pr-commenter Bot commented Sep 19, 2025 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2025-09-22 13:08:02

Comparing candidate commit e3b034b in PR branch eliottness/api10 with baseline commit 3119b73 in branch main.

Found 0 performance improvements and 1 performance regressions! Performance is the same for 5 metrics, 0 unstable metrics.

scenario:BenchmarkConfig/scenario_WithStartSpanConfig-24

  • 🟥 execution_time [+2.015ns; +2.381ns] or [+2.086%; +2.464%]

@eliottness
fix lint issues
423da13 
Signed-off-by: Eliott Bouhana <[email protected]>
@eliottness
eliottness marked this pull request as ready for review September 22, 2025 11:53
@eliottness
eliottness requested review from a team as code owners September 22, 2025 11:53
@eliottness eliottness added appsec and removed apm:ecosystem contrib/* related feature requests or bugs labels Sep 22, 2025
RomainMuller
RomainMuller approved these changes Sep 22, 2025
View reviewed changes
Comment thread instrumentation/appsec/emitter/httpsec/http.go Outdated
Comment thread internal/appsec/body/json/simdjson.go
Comment thread internal/appsec/listener/httpsec/roundtripper.go Outdated
@eliottness
suggestions from @RomainMuller
e3b034b 
Signed-off-by: Eliott Bouhana <[email protected]>
@eliottness

eliottness commented Sep 22, 2025

Copy link
Copy Markdown
Contributor Author

/merge

@dd-devflow-routing-codex

dd-devflow-routing-codex Bot commented Sep 22, 2025 •
edited
Loading

Copy link
Copy Markdown

View all feedbacks in Devflow UI.

2025-09-22 15:28:16 UTC ℹ️ Start processing command /merge

2025-09-22 15:28:21 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in main is approximately 17m (p90).

2025-09-22 15:48:37 UTC ℹ️ MergeQueue: This merge request was merged

@dd-mergequeue
dd-mergequeue Bot merged commit eeed06c into main Sep 22, 2025
421 of 426 checks passed
@dd-mergequeue
dd-mergequeue Bot deleted the eliottness/api10 branch September 22, 2025 15:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@RomainMuller RomainMuller RomainMuller approved these changes
@kakkoyun kakkoyun kakkoyun approved these changes

Assignees

No one assigned

Labels

appsec mergequeue-status: done

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@eliottness @RomainMuller @kakkoyun