Uh oh!
There was an error while loading. Please reload this page.
🪞 10671 - Fix platform-dependent String.getBytes() calls to use explicit UTF-8 charset - #11149
Merged
Merged
Conversation
mcculls
requested review from
claponcet, evanchooly and manuel-alvarez-alvarez
and removed request for
a teamApril 17, 2026 14:47
Contributor
Hi! 👋 Thanks for your pull request! 🎉 To help us review it, please make sure to:
If you need help, please check our contributing guidelines. |
mccullsforce-pushed
the
community-pr-10671
branch
from
April 17, 2026 14:49
f2ad8aa to
157ef83Compare…charset Specify StandardCharsets.UTF_8 in String.getBytes() calls used with MessageDigest and other encoding-sensitive APIs. Without an explicit charset, getBytes() uses the platform's default charset, which can vary across systems and produce inconsistent results. Files changed: - AppSecEventTracker: user ID anonymization hash now uses UTF-8, ensuring consistent hashing across all platforms. Also resolved the TODO about MessageDigest caching with a clarifying comment referencing micro-benchmark data showing negligible overhead. - Fingerprinter: exception fingerprint hashes now use UTF-8. - JsonStreamParser: JSON byte conversion now uses UTF-8 (JSON spec). - LLMObsSpanMapper: writeUTF8() now receives actual UTF-8 bytes.
mccullsforce-pushed
the
community-pr-10671
branch
from
April 17, 2026 14:50
157ef83 to
484cf97CompareDebugger benchmarksParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 10 metrics, 5 unstable metrics. See unchanged results
Request duration reports for reportsgantt
title reports - request duration [CI 0.99] : candidate=None, baseline=None
dateFormat X
axisFormat %s
section baseline
noprobe (343.676 µs) : 297, 390
. : milestone, 344,
basic (296.151 µs) : 288, 304
. : milestone, 296,
loop (8.975 ms) : 8969, 8980
. : milestone, 8975,
section candidate
noprobe (329.497 µs) : 308, 351
. : milestone, 329,
basic (293.782 µs) : 287, 301
. : milestone, 294,
loop (8.973 ms) : 8967, 8978
. : milestone, 8973,
|
dougqh
approved these changes
Apr 17, 2026
dougqh
left a comment
Contributor
There was a problem hiding this comment.
I think we should add String.getBytes(no args) to the forbidden APIs list.
Although, I'd be fine with doing that in a separate PR.
…rm's default charset, which may not be UTF-8, and can lead to inconsistent results across systems
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 61 metrics, 10 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~31256a0f08, baseline=1.62.0-SNAPSHOT~c13e82148e
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.058 s) : 0, 1057782
Total [baseline] (8.82 s) : 0, 8819676
Agent [candidate] (1.055 s) : 0, 1055495
Total [candidate] (8.834 s) : 0, 8834347
section iast
Agent [baseline] (1.229 s) : 0, 1228724
Total [baseline] (9.598 s) : 0, 9597629
Agent [candidate] (1.222 s) : 0, 1222489
Total [candidate] (9.554 s) : 0, 9553559
gantt
title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~31256a0f08, baseline=1.62.0-SNAPSHOT~c13e82148e
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.23 ms) : 0, 1230
crashtracking [candidate] (1.226 ms) : 0, 1226
BytebuddyAgent [baseline] (632.804 ms) : 0, 632804
BytebuddyAgent [candidate] (631.536 ms) : 0, 631536
AgentMeter [baseline] (29.681 ms) : 0, 29681
AgentMeter [candidate] (29.539 ms) : 0, 29539
GlobalTracer [baseline] (249.145 ms) : 0, 249145
GlobalTracer [candidate] (247.927 ms) : 0, 247927
AppSec [baseline] (32.582 ms) : 0, 32582
AppSec [candidate] (32.467 ms) : 0, 32467
Debugger [baseline] (59.432 ms) : 0, 59432
Debugger [candidate] (59.078 ms) : 0, 59078
Remote Config [baseline] (601.695 µs) : 0, 602
Remote Config [candidate] (587.459 µs) : 0, 587
Telemetry [baseline] (8.008 ms) : 0, 8008
Telemetry [candidate] (8.764 ms) : 0, 8764
Flare Poller [baseline] (8.151 ms) : 0, 8151
Flare Poller [candidate] (8.292 ms) : 0, 8292
section iast
crashtracking [baseline] (1.256 ms) : 0, 1256
crashtracking [candidate] (1.238 ms) : 0, 1238
BytebuddyAgent [baseline] (804.495 ms) : 0, 804495
BytebuddyAgent [candidate] (800.021 ms) : 0, 800021
AgentMeter [baseline] (11.683 ms) : 0, 11683
AgentMeter [candidate] (11.583 ms) : 0, 11583
GlobalTracer [baseline] (239.736 ms) : 0, 239736
GlobalTracer [candidate] (238.933 ms) : 0, 238933
AppSec [baseline] (32.905 ms) : 0, 32905
AppSec [candidate] (31.928 ms) : 0, 31928
Debugger [baseline] (63.084 ms) : 0, 63084
Debugger [candidate] (63.52 ms) : 0, 63520
Remote Config [baseline] (534.007 µs) : 0, 534
Remote Config [candidate] (538.811 µs) : 0, 539
Telemetry [baseline] (9.362 ms) : 0, 9362
Telemetry [candidate] (9.248 ms) : 0, 9248
Flare Poller [baseline] (3.574 ms) : 0, 3574
Flare Poller [candidate] (3.548 ms) : 0, 3548
IAST [baseline] (25.914 ms) : 0, 25914
IAST [candidate] (25.888 ms) : 0, 25888
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~31256a0f08, baseline=1.62.0-SNAPSHOT~c13e82148e
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.066 s) : 0, 1065515
Total [baseline] (11.109 s) : 0, 11108864
Agent [candidate] (1.067 s) : 0, 1067098
Total [candidate] (11.023 s) : 0, 11022855
section appsec
Agent [baseline] (1.248 s) : 0, 1247608
Total [baseline] (11.112 s) : 0, 11111945
Agent [candidate] (1.246 s) : 0, 1246146
Total [candidate] (11.02 s) : 0, 11020023
section iast
Agent [baseline] (1.223 s) : 0, 1223082
Total [baseline] (11.362 s) : 0, 11362446
Agent [candidate] (1.224 s) : 0, 1224392
Total [candidate] (11.279 s) : 0, 11279317
section profiling
Agent [baseline] (1.194 s) : 0, 1194288
Total [baseline] (11.008 s) : 0, 11008014
Agent [candidate] (1.183 s) : 0, 1183468
Total [candidate] (11.086 s) : 0, 11085908
gantt
title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~31256a0f08, baseline=1.62.0-SNAPSHOT~c13e82148e
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.236 ms) : 0, 1236
crashtracking [candidate] (1.226 ms) : 0, 1226
BytebuddyAgent [baseline] (637.301 ms) : 0, 637301
BytebuddyAgent [candidate] (639.09 ms) : 0, 639090
AgentMeter [baseline] (29.777 ms) : 0, 29777
AgentMeter [candidate] (30.015 ms) : 0, 30015
GlobalTracer [baseline] (250.153 ms) : 0, 250153
GlobalTracer [candidate] (250.842 ms) : 0, 250842
AppSec [baseline] (32.627 ms) : 0, 32627
AppSec [candidate] (32.767 ms) : 0, 32767
Debugger [baseline] (60.309 ms) : 0, 60309
Debugger [candidate] (60.549 ms) : 0, 60549
Remote Config [baseline] (598.193 µs) : 0, 598
Remote Config [candidate] (596.049 µs) : 0, 596
Telemetry [baseline] (9.596 ms) : 0, 9596
Telemetry [candidate] (8.182 ms) : 0, 8182
Flare Poller [baseline] (7.65 ms) : 0, 7650
Flare Poller [candidate] (7.504 ms) : 0, 7504
section appsec
crashtracking [baseline] (1.22 ms) : 0, 1220
crashtracking [candidate] (1.211 ms) : 0, 1211
BytebuddyAgent [baseline] (662.227 ms) : 0, 662227
BytebuddyAgent [candidate] (660.55 ms) : 0, 660550
AgentMeter [baseline] (12.268 ms) : 0, 12268
AgentMeter [candidate] (12.175 ms) : 0, 12175
GlobalTracer [baseline] (248.255 ms) : 0, 248255
GlobalTracer [candidate] (247.757 ms) : 0, 247757
AppSec [baseline] (184.857 ms) : 0, 184857
AppSec [candidate] (185.022 ms) : 0, 185022
Debugger [baseline] (65.513 ms) : 0, 65513
Debugger [candidate] (66.123 ms) : 0, 66123
Remote Config [baseline] (600.81 µs) : 0, 601
Remote Config [candidate] (612.105 µs) : 0, 612
Telemetry [baseline] (8.359 ms) : 0, 8359
Telemetry [candidate] (8.42 ms) : 0, 8420
Flare Poller [baseline] (3.509 ms) : 0, 3509
Flare Poller [candidate] (3.505 ms) : 0, 3505
IAST [baseline] (24.448 ms) : 0, 24448
IAST [candidate] (24.537 ms) : 0, 24537
section iast
crashtracking [baseline] (1.238 ms) : 0, 1238
crashtracking [candidate] (1.227 ms) : 0, 1227
BytebuddyAgent [baseline] (799.868 ms) : 0, 799868
BytebuddyAgent [candidate] (800.871 ms) : 0, 800871
AgentMeter [baseline] (11.578 ms) : 0, 11578
AgentMeter [candidate] (11.583 ms) : 0, 11583
GlobalTracer [baseline] (238.684 ms) : 0, 238684
GlobalTracer [candidate] (238.739 ms) : 0, 238739
AppSec [baseline] (31.092 ms) : 0, 31092
AppSec [candidate] (30.381 ms) : 0, 30381
Debugger [baseline] (63.715 ms) : 0, 63715
Debugger [candidate] (66.14 ms) : 0, 66140
Remote Config [baseline] (539.72 µs) : 0, 540
Remote Config [candidate] (533.384 µs) : 0, 533
Telemetry [baseline] (9.368 ms) : 0, 9368
Telemetry [candidate] (9.409 ms) : 0, 9409
Flare Poller [baseline] (3.569 ms) : 0, 3569
Flare Poller [candidate] (3.593 ms) : 0, 3593
IAST [baseline] (27.362 ms) : 0, 27362
IAST [candidate] (25.773 ms) : 0, 25773
section profiling
crashtracking [baseline] (1.186 ms) : 0, 1186
crashtracking [candidate] (1.183 ms) : 0, 1183
BytebuddyAgent [baseline] (697.279 ms) : 0, 697279
BytebuddyAgent [candidate] (690.447 ms) : 0, 690447
AgentMeter [baseline] (9.315 ms) : 0, 9315
AgentMeter [candidate] (9.194 ms) : 0, 9194
GlobalTracer [baseline] (208.513 ms) : 0, 208513
GlobalTracer [candidate] (206.729 ms) : 0, 206729
AppSec [baseline] (33.043 ms) : 0, 33043
AppSec [candidate] (32.904 ms) : 0, 32904
Debugger [baseline] (66.442 ms) : 0, 66442
Debugger [candidate] (65.899 ms) : 0, 65899
Remote Config [baseline] (599.197 µs) : 0, 599
Remote Config [candidate] (591.727 µs) : 0, 592
Telemetry [baseline] (7.851 ms) : 0, 7851
Telemetry [candidate] (7.735 ms) : 0, 7735
Flare Poller [baseline] (3.568 ms) : 0, 3568
Flare Poller [candidate] (3.524 ms) : 0, 3524
ProfilingAgent [baseline] (94.675 ms) : 0, 94675
ProfilingAgent [candidate] (94.125 ms) : 0, 94125
Profiling [baseline] (95.238 ms) : 0, 95238
Profiling [candidate] (94.697 ms) : 0, 94697
LoadParameters
See matching parameters
SummaryFound 2 performance improvements and 5 performance regressions! Performance is the same for 13 metrics, 16 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~31256a0f08, baseline=1.62.0-SNAPSHOT~c13e82148e
dateFormat X
axisFormat %s
section baseline
no_agent (17.064 ms) : 16895, 17233
. : milestone, 17064,
appsec (18.379 ms) : 18192, 18566
. : milestone, 18379,
code_origins (18.088 ms) : 17904, 18271
. : milestone, 18088,
iast (18.182 ms) : 17999, 18366
. : milestone, 18182,
profiling (18.06 ms) : 17884, 18236
. : milestone, 18060,
tracing (18.031 ms) : 17848, 18213
. : milestone, 18031,
section candidate
no_agent (19.207 ms) : 19015, 19398
. : milestone, 19207,
appsec (18.566 ms) : 18377, 18756
. : milestone, 18566,
code_origins (18.286 ms) : 18104, 18469
. : milestone, 18286,
iast (18.04 ms) : 17863, 18218
. : milestone, 18040,
profiling (18.453 ms) : 18268, 18638
. : milestone, 18453,
tracing (17.913 ms) : 17737, 18088
. : milestone, 17913,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~31256a0f08, baseline=1.62.0-SNAPSHOT~c13e82148e
dateFormat X
axisFormat %s
section baseline
no_agent (1.32 ms) : 1307, 1333
. : milestone, 1320,
iast (3.196 ms) : 3152, 3240
. : milestone, 3196,
iast_FULL (5.967 ms) : 5904, 6029
. : milestone, 5967,
iast_GLOBAL (3.607 ms) : 3551, 3662
. : milestone, 3607,
profiling (2.556 ms) : 2531, 2582
. : milestone, 2556,
tracing (1.903 ms) : 1887, 1919
. : milestone, 1903,
section candidate
no_agent (1.236 ms) : 1224, 1248
. : milestone, 1236,
iast (3.45 ms) : 3405, 3495
. : milestone, 3450,
iast_FULL (6.156 ms) : 6093, 6219
. : milestone, 6156,
iast_GLOBAL (3.829 ms) : 3763, 3895
. : milestone, 3829,
profiling (2.083 ms) : 2065, 2101
. : milestone, 2083,
tracing (1.924 ms) : 1907, 1941
. : milestone, 1924,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 10 metrics, 2 unstable metrics. Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~31256a0f08, baseline=1.62.0-SNAPSHOT~c13e82148e
dateFormat X
axisFormat %s
section baseline
no_agent (1.486 ms) : 1474, 1498
. : milestone, 1486,
appsec (3.82 ms) : 3597, 4043
. : milestone, 3820,
iast (2.263 ms) : 2193, 2332
. : milestone, 2263,
iast_GLOBAL (2.305 ms) : 2235, 2374
. : milestone, 2305,
profiling (2.104 ms) : 2049, 2159
. : milestone, 2104,
tracing (2.071 ms) : 2018, 2125
. : milestone, 2071,
section candidate
no_agent (1.486 ms) : 1474, 1497
. : milestone, 1486,
appsec (3.833 ms) : 3609, 4056
. : milestone, 3833,
iast (2.265 ms) : 2195, 2334
. : milestone, 2265,
iast_GLOBAL (2.314 ms) : 2244, 2384
. : milestone, 2314,
profiling (2.51 ms) : 2298, 2722
. : milestone, 2510,
tracing (2.078 ms) : 2024, 2131
. : milestone, 2078,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~31256a0f08, baseline=1.62.0-SNAPSHOT~c13e82148e
dateFormat X
axisFormat %s
section baseline
no_agent (14.889 s) : 14889000, 14889000
. : milestone, 14889000,
appsec (14.881 s) : 14881000, 14881000
. : milestone, 14881000,
iast (18.001 s) : 18001000, 18001000
. : milestone, 18001000,
iast_GLOBAL (18.222 s) : 18222000, 18222000
. : milestone, 18222000,
profiling (14.928 s) : 14928000, 14928000
. : milestone, 14928000,
tracing (15.32 s) : 15320000, 15320000
. : milestone, 15320000,
section candidate
no_agent (15.735 s) : 15735000, 15735000
. : milestone, 15735000,
appsec (14.637 s) : 14637000, 14637000
. : milestone, 14637000,
iast (18.441 s) : 18441000, 18441000
. : milestone, 18441000,
iast_GLOBAL (18.064 s) : 18064000, 18064000
. : milestone, 18064000,
profiling (15.084 s) : 15084000, 15084000
. : milestone, 15084000,
tracing (14.86 s) : 14860000, 14860000
. : milestone, 14860000,
|
bric3
approved these changes
Apr 17, 2026
bric3
left a comment
Contributor
There was a problem hiding this comment.
Thanks for looking into that PR :)
ContributorAuthor
agree: 31256a0 |
Contributor
/merge |
View all feedbacks in Devflow UI.
The expected merge time in
|
github-merge-queueBot
removed this pull request from the merge queue due to failed status checks
Apr 17, 2026
Uh oh!
There was an error while loading. Please reload this page.
gh-worker-dd-mergequeue-cf854dBot
merged commit Apr 17, 2026
d149028
into
master
586 of 592 checks passed
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR mirrors the changes from the original community contribution to enable CI testing with maintainer privileges.
Original PR:#10671
Original Author:@saravadeo
Original Branch: saravadeo/dd-trace-java:fix/explicit-charset-in-getbytes-calls
Closes#10671
This is an automated mirror created to run CI checks. See tooling/mirror-community-pull-request.sh for details.