Skip to content

fix(appsec): body parsing depth limited to 1 and truncated body reader returned to the user#4005

Merged
dd-mergequeue[bot] merged 3 commits into
mainfrom
eliottness/fixes-api10/APPSEC-59444
Sep 30, 2025
Merged

fix(appsec): body parsing depth limited to 1 and truncated body reader returned to the user#4005
dd-mergequeue[bot] merged 3 commits into
mainfrom
eliottness/fixes-api10/APPSEC-59444

Conversation

@eliottness

@eliottness eliottness commented Sep 30, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

What does this PR do?

Fixes 2 issues detected with API10 system-tests

  • The body returned to the user commanding the downward requests was truncated in case of a big payload
  • Headers needs to be sent to the WAF as low case strings
  • body parsing was limited to a depth of 1 (one) because of a mishap of communication between was through as actual depth and remaining depth

Consolidated system-tests run

Reviewer's Checklist

  • Changed code has unit tests for its functionality at or near 100% coverage.
  • System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
  • There is a benchmark for any new code, or changes to existing code.
  • If this interacts with the agent in a new way, a system test has been added.
  • New code is free of linting errors. You can check this by running ./scripts/lint.sh locally.
  • Add an appropriate team label so this PR gets put in the right place for the release notes.
  • Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

@github-actions github-actions Bot added the apm:ecosystem contrib/* related feature requests or bugs label Sep 30, 2025
@eliottness
eliottness force-pushed the eliottness/fixes-api10/APPSEC-59444 branch from 5a3bc7a to 38403ce Compare September 30, 2025 10:21
@pr-commenter

pr-commenter Bot commented Sep 30, 2025 •
edited
Loading

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2025-09-30 13:16:56

Comparing candidate commit d25d64f in PR branch eliottness/fixes-api10/APPSEC-59444 with baseline commit f253255 in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 24 metrics, 0 unstable metrics.

@eliottness
eliottness force-pushed the eliottness/fixes-api10/APPSEC-59444 branch from 38403ce to 0e6f3cc Compare September 30, 2025 10:25
@eliottness
eliottness marked this pull request as ready for review September 30, 2025 10:25
@eliottness
eliottness requested a review from a team as a code owner September 30, 2025 10:25
@datadog-datadog-prod-us1

This comment has been minimized.

Sign in to view
e-n-0
e-n-0 approved these changes Sep 30, 2025
View reviewed changes

@e-n-0 e-n-0 left a comment •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM Thanks for the time spent debugging (Envoy + body part)

@eliottness
fix test ruleset path
7e77d56 
Signed-off-by: Eliott Bouhana <[email protected]>
@eliottness

eliottness commented Sep 30, 2025

Copy link
Copy Markdown
Contributor Author

/merge

@dd-devflow-routing-codex

dd-devflow-routing-codex Bot commented Sep 30, 2025 •
edited
Loading

Copy link
Copy Markdown

View all feedbacks in Devflow UI.

2025-09-30 12:19:40 UTC ℹ️ Start processing command /merge

2025-09-30 12:19:54 UTC ℹ️ MergeQueue: waiting for PR to be ready

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

2025-09-30 13:26:14 UTC ℹ️ MergeQueue: merge request added to the queue

The expected merge time in main is approximately 18m (p90).

2025-09-30 13:38:07 UTC ℹ️ MergeQueue: This merge request was merged

@eliottness
skip test when waf is not usable
d25d64f 
Signed-off-by: Eliott Bouhana <[email protected]>
@dd-mergequeue
dd-mergequeue Bot merged commit b060b07 into main Sep 30, 2025
259 checks passed
@dd-mergequeue
dd-mergequeue Bot deleted the eliottness/fixes-api10/APPSEC-59444 branch September 30, 2025 13:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@e-n-0 e-n-0 e-n-0 approved these changes

Assignees

No one assigned

Labels

apm:ecosystem contrib/* related feature requests or bugs mergequeue-status: done

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@eliottness @e-n-0