[APPSEC-60450] Add parsed body address to downstream request analysis by Strech · Pull Request #5320 · DataDog/dd-trace-rb

Strech · 2026-02-05T14:26:01Z

What does this PR do?

Add request/response body parsing into Faraday/Excon/RestClient contribs
Add new utility class for handling body parsing
Add counter sampler for downstream requests analysis
Replace inhouse rack query parsing with Rack-based parsing
And some more refactoring

Motivation:

This is a second batch of changes for http libraries instrumentations that brings a request/response body analysis based on sampling/limit settings.

Change log entry

Yes. AppSec: Add downstream request body analysis.

Additional Notes:

This is 2/3 of the original RFC and the announcement will come with a third one. You can spot that all contribs changes look-a-like and it's known issue due to the lack of events system we slowly moving to (i.e will be refactored one day)

How to test the change?

CI + ST

github-actions · 2026-02-05T14:28:29Z

Typing analysis

Note: Ignored files are excluded from the next sections.

`steep:ignore` comments

This PR introduces 8 steep:ignore comments, and clears 6 steep:ignore comments.

steep:ignore comments (+8-6)

❌ Introduced:

lib/datadog/appsec/context.rb:19
lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb:90
lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb:91
lib/datadog/appsec/utils/http/body.rb:17
lib/datadog/appsec/utils/http/body.rb:19
lib/datadog/appsec/utils/http/body.rb:20
lib/datadog/appsec/utils/http/media_type.rb:68
lib/datadog/appsec/utils/http/media_type.rb:72

✅ Cleared:

lib/datadog/appsec/context.rb:18
lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb:57
lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb:58
lib/datadog/appsec/utils/http/media_type.rb:13
lib/datadog/appsec/utils/http/media_type.rb:84
lib/datadog/appsec/utils/http/media_type.rb:88

Untyped other declarations

This PR clears 1 partially typed other declaration. It increases the percentage of typed other declarations from 76.49% to 76.75% (+0.26%).

Partially typed other declarations (+0-1)

✅ Cleared:

sig/datadog/appsec/security_engine/runner.rbs:5
└── type input_data = ::Hash[::String, untyped]

pr-commenter · 2026-02-05T14:48:45Z

Benchmarks

Benchmark execution time: 2026-02-10 11:40:17

Comparing candidate commit ff906db in PR branch appsec-60450-add-parsed-body-address-to-downstream-request with baseline commit 1fdc59c in branch master.

Found 0 performance improvements and 2 performance regressions! Performance is the same for 42 metrics, 2 unstable metrics.

scenario:profiling - Allocations ()

🟥 throughput [-247460.130op/s; -240111.180op/s] or [-7.410%; -7.190%]

scenario:tracing - Propagation - Datadog

🟥 throughput [-2926.631op/s; -2853.298op/s] or [-9.274%; -9.042%]

datadog-datadog-prod-us1 · 2026-02-05T16:53:26Z

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage
• Patch Coverage: 90.48%
• Overall Coverage: 95.14% (-0.04%)

View detailed report

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: ff906db | Docs | Datadog PR Page | Was this helpful? Give us feedback!}

y9v

great job!

* Update Faraday contrib with body analysis conditions * Update Faraday vendor RBS stab

Strech requested review from a team as code owners February 5, 2026 14:26

github-actions Bot added core Involves Datadog core libraries integrations Involves tracing integrations appsec Application Security monitoring product labels Feb 5, 2026

Strech force-pushed the appsec-60450-add-parsed-body-address-to-downstream-request branch 2 times, most recently from 7f6cab6 to bf94d2d Compare February 5, 2026 16:34

Strech commented Feb 5, 2026

View reviewed changes

Comment thread spec/datadog/appsec/contrib/excon/ssrf_detection_middleware_spec.rb Outdated

y9v approved these changes Feb 9, 2026

View reviewed changes

Strech added 18 commits February 10, 2026 12:07

Add parsed body to the excon client

cc19c6c

Add response body parsing

5d5d91c

Add new helpers into MediaType class

006e334

Remove multipart/form-data from supported types

731d299

Add Utils::HTTP::URLEncoded module

c2cc77d

Add Utils::HTTP::Body module

6f96535

Add Utils::HTTP::MediaRange.parse method

b183641

Update Rack request query parsing

78bde1f

Add body parsing to excon contrib

8da1b55

Add request body processing to faraday contrib

fd8aef2

Add request body processing to rest_client contrib

691ef7e

Add AppSec::CounterSampler with counter

85ef015

Add downstream body analysis configuration

e599af8

Add simple registry into AppSec::Context

f86ee6e

Add downstream request body sampler into Context

e8d4732

* Update Faraday contrib with body analysis conditions * Update Faraday vendor RBS stab

Update MediaType and MediaRange typespecs

fb86b76

Add body sampling into excon and rest_client

cbabb1f

Update RestClient RBS stab

34c26b5

Strech added 4 commits February 10, 2026 12:08

Refactor http libraries contribs to look the same

4e16d7f

Correct typing for ephemeral data

1a9da98

Remove certain "anything" checks in tests

e02be42

Fix wrong type of the ENV variable

ff906db

Strech force-pushed the appsec-60450-add-parsed-body-address-to-downstream-request branch from b3d873b to ff906db Compare February 10, 2026 11:08

Strech merged commit 476256d into master Feb 10, 2026
619 checks passed

Strech deleted the appsec-60450-add-parsed-body-address-to-downstream-request branch February 10, 2026 11:42

github-actions Bot added this to the 2.29.0 milestone Feb 10, 2026

y9v mentioned this pull request Feb 20, 2026

Bump to version 2.29.0 #5383

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[APPSEC-60450] Add parsed body address to downstream request analysis#5320

[APPSEC-60450] Add parsed body address to downstream request analysis#5320
Strech merged 22 commits into
masterfrom
appsec-60450-add-parsed-body-address-to-downstream-request

Strech commented Feb 5, 2026

Uh oh!

github-actions Bot commented Feb 5, 2026 •

edited

Loading

Uh oh!

pr-commenter Bot commented Feb 5, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1 Bot commented Feb 5, 2026 •

edited

Loading

Uh oh!

Uh oh!

y9v left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

Strech commented Feb 5, 2026

Uh oh!

github-actions Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Typing analysis

steep:ignore comments

Untyped other declarations

Uh oh!

pr-commenter Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

scenario:profiling - Allocations ()

scenario:tracing - Propagation - Datadog

Uh oh!

datadog-datadog-prod-us1 Bot commented Feb 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

y9v left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Feb 5, 2026 •

edited

Loading

`steep:ignore` comments

pr-commenter Bot commented Feb 5, 2026 •

edited

Loading

datadog-datadog-prod-us1 Bot commented Feb 5, 2026 •

edited

Loading