Skip to content

refactor(iast): remove dead code and fix stale comments in nosql mongodb analyzer#9168

Merged
CarlesDD merged 5 commits into
masterfrom
ccapell/refactor-iast-nosql
Jul 3, 2026
Merged

refactor(iast): remove dead code and fix stale comments in nosql mongodb analyzer#9168
CarlesDD merged 5 commits into
masterfrom
ccapell/refactor-iast-nosql

Conversation

@CarlesDD

@CarlesDD CarlesDD commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

Removes two dead code paths and corrects two stale comments left over from the original mquery instrumentation in nosql-injection-mongodb-analyzer.js and mongoose.js. No behavior change.

  • onStartAndBind eliminated. This wrapper called onStart(message) before returning markExecStore(). tracing:datadog:mquery:filter:start is published via tracingCh.tracePromise(exec, {}, ...), so message is always {} and onStart never found any filters to analyze. The addBind now references markExecStore directly, which is its only real responsibility.

  • return store removed from onStart. The return value was consumed by the old onStartAndEnterWithStore helper (removed in fix(iast): isolate the mongodb nosql-analysis marker per request #9076). None of the current call sites — three addSub subscriptions — use the return value.

  • Stale comment on the mquery section corrected. The previous comment stated that tracing:start is "the first place the filters are available", which has been incorrect since datadog:mquery:filter:prepare was added. The new comment describes the actual split of responsibilities between the two channels.

  • Inaccurate comment on execCh in mongoose.js corrected. The previous comment said "A subscriber returns the store", conflating addSub (subscriber, no store control) with addBind (transform, returns the new store). Reworded to use bindStore terminology, consistent with the markExecStore comment in the same area.

Motivation

Cleaning them up now reduces confusion for future maintainers, particularly the addSub/addBind terminology distinction, which is subtle but load-bearing in understanding how the analysis marker is scoped.

Additional Notes

No tests need updating. The existing unit tests in nosql-injection-mongodb-analyzer.spec.js and the integration suites for mongoose and mquery cover the unchanged runtime behavior.

@CarlesDD CarlesDD self-assigned this Jul 1, 2026
@dd-octo-sts

dd-octo-sts Bot commented Jul 1, 2026

Copy link
Copy Markdown
Contributor

Overall package size

Self size: 6.52 MB
Deduped: 7.59 MB
No deduping: 7.59 MB

Dependency sizes | name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.2.0 | 104.26 kB | 843.44 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |

🤖 This report was automatically generated by heaviest-objects-in-the-universe

@datadog-prod-us1-5

datadog-prod-us1-5 Bot commented Jul 1, 2026

Copy link
Copy Markdown

Tests

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
Patch Coverage: 100.00%
Overall Coverage: 87.83% (-0.03%)

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: fe7c74d | Docs | Datadog PR Page | Give us feedback!

@codecov

codecov Bot commented Jul 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.62%. Comparing base (cf39249) to head (fe7c74d).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #9168      +/-   ##
==========================================
- Coverage   93.64%   93.62%   -0.03%     
==========================================
  Files         898      898              
  Lines       52364    52360       -4     
  Branches    12324    12324              
==========================================
- Hits        49036    49021      -15     
- Misses       3328     3339      +11     
Flag Coverage Δ
aiguard 34.88% <ø> (-0.08%) ⬇️
aiguard-integration 41.96% <ø> (ø)
apm-bucket-0 34.84% <ø> (-0.08%) ⬇️
apm-bucket-1 40.51% <ø> (-0.07%) ⬇️
apm-bucket-2 37.50% <ø> (-0.07%) ⬇️
apm-capabilities-tracing 48.89% <0.00%> (+<0.01%) ⬆️
apm-integrations-aerospike 33.13% <ø> (-0.08%) ⬇️
apm-integrations-confluentinc-kafka-javascript 40.03% <ø> (-0.08%) ⬇️
apm-integrations-couchbase 33.25% <ø> (-0.08%) ⬇️
apm-integrations-http 42.05% <ø> (-0.07%) ⬇️
apm-integrations-kafkajs 40.27% <ø> (-0.08%) ⬇️
apm-integrations-next 29.63% <ø> (-0.08%) ⬇️
apm-integrations-prisma 35.18% <ø> (-0.07%) ⬇️
apm-integrations-tedious 34.05% <ø> (-0.08%) ⬇️
appsec 57.82% <100.00%> (-0.13%) ⬇️
appsec-express_fastify_graphql 53.85% <100.00%> (-0.04%) ⬇️
appsec-integration 35.68% <100.00%> (+<0.01%) ⬆️
appsec-kafka_ldapjs_lodash 43.76% <100.00%> (-0.14%) ⬇️
appsec-mongodb-core_mongoose_mysql 48.90% <100.00%> (-0.07%) ⬇️
appsec-next 28.11% <ø> (-0.07%) ⬇️
appsec-node-serialize_passport_postgres 48.09% <100.00%> (-0.10%) ⬇️
appsec-sourcing_stripe_template 45.64% <100.00%> (-0.06%) ⬇️
debugger 44.64% <ø> (ø)
instrumentations-bucket-0 28.17% <ø> (-0.08%) ⬇️
instrumentations-bucket-1 37.57% <ø> (-0.07%) ⬇️
instrumentations-bucket-10 40.52% <ø> (-0.07%) ⬇️
instrumentations-bucket-11 27.96% <ø> (-0.08%) ⬇️
instrumentations-bucket-12 28.79% <ø> (-0.08%) ⬇️
instrumentations-bucket-13 27.79% <ø> (-0.08%) ⬇️
instrumentations-bucket-2 30.36% <ø> (-0.08%) ⬇️
instrumentations-bucket-3 36.06% <ø> (-0.08%) ⬇️
instrumentations-bucket-4 28.58% <ø> (-0.08%) ⬇️
instrumentations-bucket-5 36.42% <ø> (-0.07%) ⬇️
instrumentations-bucket-6 38.43% <ø> (-0.08%) ⬇️
instrumentations-bucket-7 36.07% <ø> (-0.16%) ⬇️
instrumentations-bucket-8 37.11% <ø> (-0.07%) ⬇️
instrumentations-bucket-9 39.63% <ø> (-0.05%) ⬇️
instrumentations-instrumentation-couchbase 46.48% <ø> (ø)
instrumentations-integration-esbuild 24.51% <ø> (ø)
llmobs-ai_anthropic_bedrock 39.68% <ø> (-0.07%) ⬇️
llmobs-google-genai_langchain_vertex-ai 36.98% <ø> (-0.18%) ⬇️
llmobs-openai 39.74% <ø> (-0.07%) ⬇️
llmobs-sdk 43.59% <ø> (-0.08%) ⬇️
master-coverage 93.62% <100.00%> (?)
openfeature 37.94% <ø> (ø)
openfeature-unit 50.47% <ø> (ø)
platform-core_esbuild_instrumentations-misc 22.96% <ø> (ø)
platform-integration 47.59% <ø> (ø)
platform-shimmer_unit-guardrails_webpack 18.48% <ø> (ø)
plugins-bucket-0 36.52% <ø> (-0.07%) ⬇️
plugins-bucket-1 39.78% <ø> (ø)
plugins-bucket-11 38.63% <ø> (-0.08%) ⬇️
plugins-bucket-17 39.22% <ø> (+0.08%) ⬆️
plugins-bucket-18 42.18% <ø> (-0.07%) ⬇️
plugins-bucket-19 39.97% <ø> (-0.07%) ⬇️
plugins-bucket-20 43.44% <ø> (-0.07%) ⬇️
plugins-bucket-4 37.88% <ø> (-0.07%) ⬇️
plugins-bullmq_cassandra_cookie 39.93% <ø> (-0.07%) ⬇️
plugins-cookie-parser_crypto_dd-trace-api 33.23% <ø> (-0.08%) ⬇️
plugins-fetch_fs_generic-pool 36.21% <ø> (-0.08%) ⬇️
plugins-google-cloud-pubsub_grpc_handlebars 43.09% <ø> (-0.07%) ⬇️
plugins-hapi_hono_ioredis 37.96% <ø> (-0.06%) ⬇️
plugins-jest_knex_langgraph 32.61% <ø> (-0.08%) ⬇️
plugins-ldapjs_light-my-request_limitd-client 27.86% <ø> (-0.14%) ⬇️
plugins-lodash_mariadb_memcached 35.18% <ø> (-0.08%) ⬇️
plugins-mongodb_mongodb-core_mongoose 36.46% <ø> (-0.07%) ⬇️
plugins-multer_mysql_mysql2 35.15% <ø> (-0.08%) ⬇️
plugins-nats_node-serialize_opensearch 37.31% <ø> (-0.08%) ⬇️
plugins-passport-http_pino_postgres 35.53% <ø> (-0.08%) ⬇️
plugins-process_pug_redis 34.27% <ø> (-0.08%) ⬇️
plugins-undici_url_valkey 36.04% <ø> (-0.07%) ⬇️
plugins-vm_winston_ws 37.72% <ø> (-0.08%) ⬇️
profiling 43.81% <ø> (-0.07%) ⬇️
serverless-aws-sdk-aws-sdk 33.32% <ø> (-0.07%) ⬇️
serverless-aws-sdk-bedrockruntime 32.19% <ø> (-0.07%) ⬇️
serverless-aws-sdk-client 37.16% <ø> (ø)
serverless-aws-sdk-dynamodb 34.19% <ø> (-0.07%) ⬇️
serverless-aws-sdk-eventbridge 27.36% <ø> (-0.07%) ⬇️
serverless-aws-sdk-kinesis 37.55% <ø> (-0.07%) ⬇️
serverless-aws-sdk-lambda 34.64% <ø> (-0.07%) ⬇️
serverless-aws-sdk-s3 32.63% <ø> (-0.07%) ⬇️
serverless-aws-sdk-serverless-peer-service 39.65% <ø> (-0.08%) ⬇️
serverless-aws-sdk-sns 38.40% <ø> (-0.07%) ⬇️
serverless-aws-sdk-sqs 38.31% <ø> (+0.09%) ⬆️
serverless-aws-sdk-stepfunctions 33.22% <ø> (-0.07%) ⬇️
serverless-aws-sdk-util 47.95% <ø> (ø)
serverless-bucket-0 39.64% <ø> (ø)
serverless-lambda 34.34% <ø> (-0.09%) ⬇️
test-optimization-cucumber 52.48% <ø> (+0.05%) ⬆️
test-optimization-cypress 49.63% <ø> (+0.06%) ⬆️
test-optimization-jest 55.61% <ø> (+0.10%) ⬆️
test-optimization-mocha 53.61% <ø> (+0.08%) ⬆️
test-optimization-playwright-playwright-atr 43.53% <ø> (+0.08%) ⬆️
test-optimization-playwright-playwright-efd 43.81% <ø> (+0.08%) ⬆️
test-optimization-playwright-playwright-final-status 43.94% <ø> (+0.08%) ⬆️
test-optimization-playwright-playwright-impacted-tests 43.36% <ø> (ø)
test-optimization-playwright-playwright-reporting 43.47% <ø> (+0.08%) ⬆️
test-optimization-playwright-playwright-test-management 44.93% <ø> (+0.08%) ⬆️
test-optimization-playwright-playwright-test-span 44.72% <ø> (+0.08%) ⬆️
test-optimization-selenium 45.44% <ø> (+0.06%) ⬆️
test-optimization-testopt 46.82% <ø> (+0.08%) ⬆️
test-optimization-vitest 52.73% <ø> (+0.11%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@CarlesDD
CarlesDD marked this pull request as ready for review July 2, 2026 08:14
@CarlesDD
CarlesDD requested review from a team as code owners July 2, 2026 08:14
@CarlesDD
CarlesDD requested review from wconti27 and removed request for a team July 2, 2026 08:14
@pr-commenter

pr-commenter Bot commented Jul 2, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-07-03 06:22:06

Comparing candidate commit fe7c74d in PR branch ccapell/refactor-iast-nosql with baseline commit cf39249 in branch master.

📊 Benchmarking dashboard

Found 0 performance improvements and 0 performance regressions! Performance is the same for 2256 metrics, 30 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

Unstable benchmarks

These benchmarks have a confidence interval too wide to call a change; treat them as noise rather than signal.

scenario:appsec-appsec-enabled-24

  • unstable execution_time [-182.805ms; +185.765ms] or [-6.915%; +7.027%]

scenario:appsec-appsec-enabled-26

  • unstable execution_time [-204.700ms; +210.211ms] or [-8.174%; +8.394%]

scenario:appsec-appsec-enabled-with-attacks-26

  • unstable execution_time [-163.008ms; +153.122ms] or [-5.674%; +5.330%]

scenario:appsec-control-20

  • unstable execution_time [-119.141ms; +112.631ms] or [-7.283%; +6.885%]

scenario:appsec-control-24

  • unstable execution_time [-103.473ms; +106.277ms] or [-8.503%; +8.733%]

scenario:appsec-control-26

  • unstable execution_time [-112.674ms; +110.663ms] or [-9.337%; +9.170%]

scenario:appsec-iast-no-vulnerability-control-20

  • unstable execution_time [-8.386ms; +16.324ms] or [-3.399%; +6.616%]

scenario:debugger-line-probe-with-snapshot-default-24

  • unstable cpu_user_time [-1668.654ms; +2682.765ms] or [-19.814%; +31.855%]
  • unstable execution_time [-1684.749ms; +2701.740ms] or [-18.485%; +29.643%]
  • unstable instructions [-14.0G instructions; +22.6G instructions] or [-20.392%; +32.827%]
  • unstable max_rss_usage [-7.250MB; +11.363MB] or [-4.611%; +7.227%]
  • unstable throughput [-778.736op/s; +492.475op/s] or [-21.654%; +13.694%]

scenario:debugger-line-probe-with-snapshot-minimal-24

  • unstable cpu_user_time [-2964.739ms; +1762.284ms] or [-31.211%; +18.552%]
  • unstable execution_time [-3008.317ms; +1782.804ms] or [-29.525%; +17.497%]
  • unstable instructions [-24.4G instructions; +14.9G instructions] or [-31.123%; +19.068%]
  • unstable max_rss_usage [-12.913MB; +7.917MB] or [-8.015%; +4.914%]
  • unstable throughput [-473.539op/s; +864.644op/s] or [-14.480%; +26.439%]

scenario:debugger-line-probe-with-snapshot-minimal-26

  • unstable cpu_user_time [-2910.945ms; +4100.658ms] or [-27.549%; +38.808%]
  • unstable execution_time [-2931.419ms; +4098.030ms] or [-26.042%; +36.406%]
  • unstable instructions [-26.3G instructions; +36.5G instructions] or [-29.614%; +41.113%]
  • unstable max_rss_usage [-7.805MB; +12.384MB] or [-4.791%; +7.602%]
  • unstable throughput [-903.347op/s; +652.205op/s] or [-30.015%; +21.671%]

scenario:debugger-line-probe-without-snapshot-24

  • unstable cpu_user_time [-1626.650ms; +555.365ms] or [-20.504%; +7.000%]
  • unstable execution_time [-1643.006ms; +558.356ms] or [-19.069%; +6.481%]
  • unstable instructions [-14.2G instructions; +4.7G instructions] or [-21.951%; +7.213%]
  • unstable throughput [-169.399op/s; +481.543op/s] or [-4.424%; +12.576%]

scenario:dogstatsd-with-tags-20

  • unstable cpu_user_time [-271.241ms; +416.149ms] or [-5.648%; +8.666%]
  • unstable execution_time [-266.719ms; +417.392ms] or [-5.466%; +8.553%]
  • unstable throughput [-144140.429op/s; +89817.012op/s] or [-8.378%; +5.221%]

scenario:plugin-graphql-long-with-depth-off-20

  • unstable max_rss_usage [-8.133MB; +4.780MB] or [-6.306%; +3.706%]

@CarlesDD
CarlesDD enabled auto-merge (squash) July 3, 2026 06:07
@CarlesDD
CarlesDD merged commit 08c2104 into master Jul 3, 2026
652 checks passed
@CarlesDD
CarlesDD deleted the ccapell/refactor-iast-nosql branch July 3, 2026 06:23
dd-octo-sts Bot pushed a commit that referenced this pull request Jul 6, 2026
@dd-octo-sts dd-octo-sts Bot mentioned this pull request Jul 6, 2026
dd-octo-sts Bot pushed a commit that referenced this pull request Jul 6, 2026
This was referenced Jul 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants