add IAST code injection tests for java by claponcet · Pull Request #7445 · DataDog/system-tests

claponcet · 2026-08-04T14:49:12Z

Motivation

The IAST CODE_INJECTION sink was not covered by system-tests for the Java tracer. This adds the weblog endpoints and enables the existing test_code_injection.py tests so the Java library's code-injection detection (BeanShell sink) is validated end-to-end.

Jira: APPSEC-68921
Tracer support: DataDog/dd-trace-java#12113

Changes

Add a shared CodeInjectionExamples helper in iast-common that triggers the sink by evaluating input through BeanShell (bsh.Interpreter.eval), with an insecure (tainted input) and secure (hardcoded literal) variant.
Expose POST /iast/code_injection/test_insecure and POST /iast/code_injection/test_secure in the weblogs that carry the full IAST sink surface: akka-http, jersey-grizzly2, resteasy-netty3, spring-boot, vertx3, vertx4.
Add the bsh dependency to iast-common (optional) and to each weblog that implements the endpoint.
Enable TestCodeInjection and TestCodeInjection_StackTrace in manifests/java.yml from v1.66.0-SNAPSHOT:
- play / ratpack: incomplete_test_app (endpoint not implemented) — these weblogs do not implement the IAST sink endpoints.
- spring-boot-3-native: irrelevant (GraalVM. Tracing support only).

Workflow

⚠️ Create your PR as draft ⚠️
Work on you PR until the CI passes
Mark it as ready for review
- Test logic is modified? -> Get a review from RFC owner.
- Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
A docker base image is modified?
- the relevant build-XXX-image label is present
A scenario is added, removed or renamed?
- Get a review from R&P team

github-actions · 2026-08-04T14:49:48Z

CODEOWNERS have been resolved as:

utils/build/docker/java/iast-common/src/main/java/com/datadoghq/system_tests/iast/utils/CodeInjectionExamples.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
manifests/java.yml                                                      @DataDog/asm-java @DataDog/apm-java
tests/appsec/iast/sink/test_code_injection.py                           @DataDog/asm-libraries @DataDog/system-tests-core
utils/build/docker/java/akka-http/pom.xml                               @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/akka-http/src/main/scala/com/datadoghq/akka_http/IastRoutes.scala  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/iast-common/pom.xml                             @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/jersey-grizzly2/pom.xml                         @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/jersey-grizzly2/src/main/java/com/datadoghq/jersey/IastSinkResource.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/play/pom.xml                                    @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/ratpack/pom.xml                                 @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/resteasy-netty3/pom.xml                         @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/resteasy-netty3/src/main/java/com/datadoghq/resteasy/IastSinkResource.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/spring-boot/pom.xml                             @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/AppSecIast.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/vertx3/pom.xml                                  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/vertx3/src/main/java/com/datadoghq/vertx3/iast/routes/IastSinkRouteProvider.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/vertx4/pom.xml                                  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/vertx4/src/main/java/com/datadoghq/vertx4/iast/routes/IastSinkRouteProvider.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java_otel/spring-boot/pom.xml                        @DataDog/opentelemetry @DataDog/system-tests-core

datadog-prod-us1-5 · 2026-08-04T15:00:52Z

⚠️ Warnings

🚦 2 Pipeline jobs failed

Testing the test | System Tests (php, dev) / End-to-end #2 / laravel11x 2

See error
1 failed test. Assertion Error at tests/appsec/test_asm_standalone.py:250: assertion failed.
🧪 1 Test failed · 🎯 related to the job error above
🎯 ❄️ Known flaky: tests.appsec.test_asm_standalone.Test_APISecurityStandalone.test_no_appsec_upstream__no_asm_event__is_kept_with_priority_1__from_1[laravel11x] from system_tests_suite
AssertionError: assert False
 &#43;  where False = assert_tags(&lt;utils.dd_types._datadog_library_trace.DataDogLibrarySpanLegacy object at 0x7f50bdaad640&gt;, &lt;utils.dd_types._datadog_library_trace.DataDogLibrarySpanLegacy object at 0x7f50bdaad640&gt;, &#39;meta&#39;, {&#39;_dd.p.other&#39;: &#39;1&#39;, &#39;_dd.p.ts&#39;: None})

self = &lt;tests.appsec.test_asm_standalone.Test_APISecurityStandalone object at 0x7f50e1d96000&gt;

    def test_no_appsec_upstream__no_asm_event__is_kept_with_priority_1__from_1(self):
        self.assert_product_is_enabled(self.check_r, self.tested_product)
        spans_checked = 0
        tested_meta: dict[str, str | Callable | None] = {self.propagated_tag(): None, &#34;_dd.p.other&#34;: &#34;1&#34;}
        tested_metrics: dict[str, str | Callable | None] = {SAMPLING_PRIORITY_KEY: lambda x: x &lt; 2}
...
Not introduced in this PR.
Testing the test | all-jobs-are-green

See error
Multiple system tests failed across various environments: java_lambda, dotnet, php, and java.

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 2d16bac | Docs | Datadog PR Page | Give us feedback!}

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2dac0de616

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

nccatoni

LGTM (for @DataDog/system-tests-core) but you should get a review from someone more familiar with the feature and the tracer

jandro996

Reviewed with Claude + an independent Codex pass (read-only, no edits). No blocking findings — CI is green and the implementation correctly follows dd-trace-java's method-advice contract for BeanShell (Interpreter.eval(String), matching sink #12113). Two minor notes:

Non-blocking — see inline comment on manifests/java.yml about a missing location_map["java"] entry in test_code_injection.py.
Nit — the PR description says tests are enabled "from v1.65.0-SNAPSHOT", but the manifests/java.yml diff actually targets v1.66.0-SNAPSHOT. Likely a stale description from a rebase — worth a quick update for anyone using the description as a changelog reference.

Also confirmed: the earlier bot comment about the missing bsh dependency in java_otel/spring-boot's pom.xml is already resolved by the tip commit (89915c1c8).

jandro996

LGTM!

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

add IAST code injection tests for java

7a107cc

claponcet and others added 2 commits August 4, 2026 17:27

fix(java): restore bsh dependency for play and ratpack weblogs

8559e02

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

upgrade minimum tracer version

2dac0de

claponcet marked this pull request as ready for review August 5, 2026 13:43

claponcet requested review from a team as code owners August 5, 2026 13:43

claponcet requested review from jandro996 and manuel-alvarez-alvarez August 5, 2026 13:43

chatgpt-codex-connector Bot reviewed Aug 5, 2026

View reviewed changes

Comment thread ...a/iast-common/src/main/java/com/datadoghq/system_tests/iast/utils/CodeInjectionExamples.java

claponcet and others added 2 commits August 5, 2026 16:41

Merge branch 'main' into clara.poncet/java-iast-code-injection

962bc0f

fix(java): add bsh dependency to java_otel spring-boot weblog

89915c1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

claponcet requested a review from a team as a code owner August 5, 2026 15:12

claponcet requested a review from peschinskiy August 5, 2026 15:12

nccatoni reviewed Aug 7, 2026

View reviewed changes

jandro996 reviewed Aug 10, 2026

View reviewed changes

Comment thread manifests/java.yml

jandro996 approved these changes Aug 10, 2026

View reviewed changes

test(java): assert code injection vulnerability location

e2957de

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

claponcet requested a review from a team as a code owner August 10, 2026 12:27

claponcet enabled auto-merge (squash) August 10, 2026 12:30

claponcet added 3 commits August 10, 2026 14:51

Merge branch 'main' into clara.poncet/java-iast-code-injection

8debc72

Merge branch 'main' into clara.poncet/java-iast-code-injection

7b94723

Merge branch 'main' into clara.poncet/java-iast-code-injection

2d16bac

claponcet merged commit 5dc5af5 into main Aug 11, 2026
1389 of 1394 checks passed

claponcet deleted the clara.poncet/java-iast-code-injection branch August 11, 2026 13:39

Navigation Menu

Uh oh!

add IAST code injection tests for java - #7445

add IAST code injection tests for java#7445
claponcet merged 9 commits into
mainfrom
clara.poncet/java-iast-code-injection

claponcet commented Aug 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

datadog-prod-us1-5 Bot commented Aug 4, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

nccatoni left a comment

Uh oh!

jandro996 left a comment

Uh oh!

Uh oh!

jandro996 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

claponcet commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Changes

Workflow

Reviewer checklist

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datadog-prod-us1-5 Bot commented Aug 4, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

nccatoni left a comment

Choose a reason for hiding this comment

Uh oh!

jandro996 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jandro996 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

claponcet commented Aug 4, 2026 •

edited

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading

datadog-prod-us1-5 Bot commented Aug 4, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading