Skip to content

Replace direct servlet advice tests with instrumentation coverage - #12696

Open
ygree wants to merge 1 commit into
dougqh/iast-session-advice-null-contextfrom
ygree/servlet-null-context-test
Open

ygree wants to merge 1 commit into
dougqh/iast-session-advice-null-contextfrom
ygree/servlet-null-context-test

Conversation

@ygree

@ygree ygree commented Sep 30, 2026 •

Copy link
Copy Markdown
Contributor

What Does This Do

Replace direct advice calls in #12692 with calls to getSession() on instrumented requests that return a null servlet context. Verify that the session is returned and no instrumentation errors occur.

Motivation

Exercise the same path used at runtime, verifying that the null guard works when the agent applies the advice to a servlet request.

Additional Notes

Contributor Checklist

Jira ticket: [PROJ-IDENT]

@ygree ygree self-assigned this Sep 30, 2026
@ygree ygree added tag: ai generated Largely based on code generated by an AI or LLM tag: no release notes Changes to exclude from release notes inst:servlet Servlet instrumentation labels Sep 30, 2026
@datadog-datadog-prod-us1-2

This comment has been minimized.

@dd-octo-sts

dd-octo-sts Bot commented Sep 30, 2026

Copy link
Copy Markdown
Contributor

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite Status
Startup 🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results
Scenario Candidate master Δ (95% CI of mean)
startup:insecure-bank:iast:Agent 13.99 s 13.88 s [+0.1%; +1.5%] (maybe worse)
startup:insecure-bank:tracing:Agent 12.94 s 13.06 s [-1.5%; -0.3%] (maybe better)
startup:petclinic:appsec:Agent 17.07 s 16.94 s [-0.1%; +1.7%] (no difference)
startup:petclinic:iast:Agent 17.03 s 17.15 s [-1.5%; +0.1%] (no difference)
startup:petclinic:profiling:Agent 16.61 s 16.12 s [-1.3%; +7.3%] (no difference)
startup:petclinic:sca:Agent 16.83 s 16.77 s [-0.6%; +1.3%] (no difference)
startup:petclinic:tracing:Agent 16.28 s 15.68 s [-0.3%; +8.0%] (no difference)

Commit: 739dc55b · CI Pipeline · Benchmarking Platform UI


Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

@ygree
ygree marked this pull request as ready for review September 30, 2026 03:47
@ygree
ygree requested a review from a team as a code owner September 30, 2026 03:47
@ygree
ygree requested review from vandonr and removed request for a team September 30, 2026 03:47
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 30, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-30T03:51:27.735864Z 739dc55 Draft marked ready
🔒 Security Review ✅ Completed 2026-09-30T03:50:39.670924Z 739dc55 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 739dc55b78

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

final request = new CustomRequest(request: delegate)

when:
final result = request.getSession()

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep a test that exposes null-context advice failures

This instrumented call cannot detect the regression the deleted direct-advice test covered: GetHttpSessionAdvice uses @Advice.OnMethodExit(suppress = Throwable.class), so if the null guard is removed and the context store again throws on get(null), Byte Buddy suppresses that exception and this test still receives the session, observes getServletContext(), and sees no module calls. The equivalent javax test at JettyServlet3Test.groovy:583 has the same blind spot; retain a direct advice invocation or otherwise assert that the advice body completes past the potentially throwing context-store access.

Useful? React with 👍 / 👎.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That reasoning overlooks the test harness: suppressed advice exceptions are recorded in InstrumentationErrors, and InstrumentationSpecification checks for those errors during cleanup. Removing the guard therefore fails the replacement tests even if the session is returned and the module remains untouched.

Starting test: getSession tolerates a null servlet context from JakartaHttpServletRequestInstrumentationTest
09:18:52.859 [Test worker] DEBUG datadog.trace.bootstrap.ExceptionLogger - Failed to handle exception in instrumentation for JakartaHttpServletRequestInstrumentationTest$CustomRequest - datadog.trace.instrumentation.servlet5.IastOptOutJakartaHttpServletRequestInstrumentation$GetHttpSessionAdvice
java.lang.NullPointerException: null
	at com.blogspot.mydailyjava.weaklockfree.WeakConcurrentMap.get(WeakConcurrentMap.java:109)
	at datadog.trace.agent.tooling.WeakMaps$Adapter.get(WeakMaps.java:69)
	at datadog.trace.bootstrap.WeakMapPerStore.get(WeakMapPerStore.java:33)
	at datadog.trace.bootstrap.FieldBackedContextStore.get(FieldBackedContextStore.java:26)
	at JakartaHttpServletRequestInstrumentationTest$CustomRequest.getSession(JakartaHttpServletRequestInstrumentationTest.groovy:515)

@datadog-datadog-prod-us1-2 datadog-datadog-prod-us1-2 Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bits Code Review: FAIL

The replacement servlet 3/5 tests still return the session if null-context advice throws because Byte Buddy suppresses advice exceptions. Deleting the direct advice tests therefore removes the only assertion that the null guard itself does not fail.

Open Bits AI session

🤖 Bits Code Review · Commit 739dc55 · @DataDog review to ask questions

then:
result.is(session)
1 * delegate.getSession() >> session
1 * delegate.getServletContext() >> null

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Replacement test cannot observe suppressed advice failures

If the null-context guard regresses, the context-store access throws, but @Advice.OnMethodExit(suppress = Throwable.class) swallows that failure. The request still returns the session and the module remains untouched, so both replacement tests pass despite the regression; deleting the direct advice tests therefore removes the effective check that the guard prevents an instrumentation error.

Was this helpful? React 👍 or 👎
🤖 Bits Code Review · @DataDog review to ask questions · Open Bits AI session

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That reasoning overlooks the test harness: suppressed advice exceptions are recorded in InstrumentationErrors, and InstrumentationSpecification checks for those errors during cleanup. Removing the guard therefore fails the replacement tests even if the session is returned and the module remains untouched.

Starting test: getSession tolerates a null servlet context from IastJettyServlet3ForkedTest
09:22:25.972 [Test worker] DEBUG datadog.trace.bootstrap.ExceptionLogger - Failed to handle exception in instrumentation for IastJettyServlet3ForkedTest$CustomRequest - datadog.trace.instrumentation.servlet3.IastOptOutHttpServletRequest3Instrumentation$GetHttpSessionAdvice
java.lang.NullPointerException: null
	at com.blogspot.mydailyjava.weaklockfree.WeakConcurrentMap.get(WeakConcurrentMap.java:109)
	at datadog.trace.agent.tooling.WeakMaps$Adapter.get(WeakMaps.java:69)
	at datadog.trace.bootstrap.WeakMapPerStore.get(WeakMapPerStore.java:33)
	at datadog.trace.bootstrap.FieldBackedContextStore.get(FieldBackedContextStore.java:26)
	at IastJettyServlet3ForkedTest$CustomRequest.getSession(JettyServlet3Test.groovy:596)

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

inst:servlet Servlet instrumentation tag: ai generated Largely based on code generated by an AI or LLM tag: no release notes Changes to exclude from release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant