Add IAST code injection detection for BeanShell

[claponcet]

What Does This Do

Adds IAST code injection detection for BeanShell:

• New CODE_INJECTION vulnerability type.
• New beanshell-2.0 instrumentation flagging untrusted input reaching Interpreter.eval(String) / eval(Reader) and Remote.eval, plus SSRF on Remote.eval's outbound URL.

Motivation

BeanShell evaluates arbitrary Java-like scripts, so untrusted input reaching eval is a code-injection (RCE) risk. There was no IAST coverage for it.

Additional Notes

A few non-obvious decisions:

• We inspect the String argument of eval, not the Reader BeanShell builds internally. bsh.* is in the IAST call-site exclusion trie, so new StringReader(...) built inside bsh.Interpreter is never tainted. Method advice (unlike call-site) still applies to bsh.*, so inspecting the argument directly works. We deliberately did not remove bsh.* from the exclusion trie (global change, re-enables call-site rewriting across all BeanShell internals for the benefit of one sink).
• Reader path (eval(Reader)) covers caller-supplied tainted StringReader/InputStreamReader. A coverage boundary that depends on the caller building the Reader through an instrumented propagation path — not a bug.
• Remote.eval reports SSRF for both connecting schemes (http: and bsh:). The http: branch is not covered by the existing URL/URLConnection sink: that sink is call-site based and bsh.Remote is excluded, so it never fires inside BeanShell.
• Supported floor is 2.0b4 (first stable Remote.eval(String, String) signature). Muzzle covers both Maven coordinates (org.beanshell:bsh, org.apache-extras.beanshell:bsh); latestDepTest runs against 2.0b6 (newest on Central).

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue; use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Once approved, use merge queue to merge the PR

Jira ticket: APPSEC-68816

[datadog-prod-us1-4]

The new BeanShell SSRF advice only recognizes lowercase http: and bsh: prefixes. A valid mixed-case URL such as HTTP://localhost:1/ is accepted by Java URL handling but bypasses this guard, so tainted Remote.eval requests can execute without an SSRF report; the fix is to compare schemes case-insensitively.

_{📊 Validated against 1 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit e6bd5f6 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.00 s	13.97 s	[-0.5%; +0.9%] (no difference)
startup:insecure-bank:tracing:Agent	12.86 s	12.96 s	[-1.4%; -0.2%] (maybe better)
startup:petclinic:appsec:Agent	16.90 s	16.72 s	[+0.2%; +2.0%] (maybe worse)
startup:petclinic:iast:Agent	16.85 s	16.96 s	[-1.4%; +0.1%] (no difference)
startup:petclinic:profiling:Agent	16.80 s	16.84 s	[-1.3%; +0.8%] (no difference)
startup:petclinic:sca:Agent	16.11 s	16.43 s	[-6.3%; +2.5%] (no difference)
startup:petclinic:tracing:Agent	15.70 s	16.07 s	[-6.3%; +1.7%] (no difference)

Commit: 8150f1b7 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e6bd5f6a0a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[claponcet]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a748317efe

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[jandro996]

#12113 (comment) and #12113 (comment) comments related with groovy test migration are optional as both extend Groovy-only Spock base classes so they aren't trivially usable from JUnit5/Java tests. Given that, staying in Groovy here seems reasonable rather than a violation to fix, but the tag: override groovy enforcement label should probably be added so the check reflects that explicitly, instead of just failing silently

[jandro996]

We need to add CODEOWNERS entry for dd-java-agent/instrumentation/beanshell-2.0/ under the ASM/IAST ownership section

[jandro996]

LGTM! just make sure that this PR pass the new ST before merge :)

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-08-05 09:51:25 UTC ℹ️ Start processing command /merge

---

2026-08-05 09:51:29 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-08-05 10:21:03 UTC ❌ MergeQueue: The build pipeline contains failing jobs for this merge request

Build pipeline has failing jobs for e94a1d7:

• test_smoke: [17, 5/8]

⚠️ Do NOT retry failed jobs directly (why?).

What to do next?

• Investigate the failures and when ready, re-add your pull request to the queue!
• If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
• Any question, go check the FAQ.

Details

Since those jobs are not marked as being allowed to fail, the pipeline will most likely fail.
Therefore, and to allow other builds to be processed, this merge request has been rejected and the pipeline got canceled.

[dd-octo-sts]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-08-05 11:49:50 UTC ℹ️ Start processing command /merge

---

2026-08-05 11:49:55 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-08-05 13:14:48 UTC ℹ️ MergeQueue: This merge request was merged