Add support for JBoss jar:file format to DependencyResolver by jandro996 · Pull Request #8428 · DataDog/dd-trace-java

jandro996 · 2025-02-20T11:32:40Z

What Does This Do

Add support for JBoss jar:file format to DependencyResolver
improve tests

Motivation

The current implementation only considered dependency analysis with the jar:file format for nested jars. However, thanks to the bug reported in APPSEC-56111, we discovered that this format is also used in JBoss to reference jar files instead of nested jars

Additional Notes

Contributor Checklist

Format the title according the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any usefull labels
Don't use close, fix or any linking keywords when referencing an issue.
Use solves instead, and assign the PR milestone to the issue
Update the public documentation in case of new configuration flag or behavior

Jira ticket: APPSEC-56111

… nested jars

pr-commenter · 2025-02-20T12:08:10Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	alejandro.gonzalez/jboss-jar-file-dependency-resolver
git_commit_date	1740041131	1740050930
git_commit_sha	`74ee62c`	`3d53b70`
release_version	1.47.0-SNAPSHOT~74ee62c6d5	1.47.0-SNAPSHOT~3d53b70c6f

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1740053242	1740053242
ci_job_id	815668958	815668958
ci_pipeline_id	56411165	56411165
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-eueesxqk-project-304-concurrent-0-jxk2k69a 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-eueesxqk-project-304-concurrent-0-jxk2k69a 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 59 metrics, 4 unstable metrics.

Startup time reports for petclinic

gantt
title petclinic - global startup overhead: candidate=1.47.0-SNAPSHOT~3d53b70c6f, baseline=1.47.0-SNAPSHOT~74ee62c6d5
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.042 s) : 0, 1041574
Total [baseline] (10.419 s) : 0, 10419303
Agent [candidate] (1.045 s) : 0, 1044832
Total [candidate] (10.461 s) : 0, 10460547
section appsec
Agent [baseline] (1.186 s) : 0, 1185650
Total [baseline] (10.769 s) : 0, 10769019
Agent [candidate] (1.185 s) : 0, 1185424
Total [candidate] (10.752 s) : 0, 10751766
section iast
Agent [baseline] (1.168 s) : 0, 1168124
Total [baseline] (10.983 s) : 0, 10982908
Agent [candidate] (1.173 s) : 0, 1173270
Total [candidate] (11.032 s) : 0, 11032031
section profiling
Agent [baseline] (1.262 s) : 0, 1262335
Total [baseline] (10.842 s) : 0, 10842306
Agent [candidate] (1.258 s) : 0, 1258496
Total [candidate] (10.809 s) : 0, 10808845

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.042 s	-
Agent	appsec	1.186 s	144.076 ms (13.8%)
Agent	iast	1.168 s	126.55 ms (12.1%)
Agent	profiling	1.262 s	220.761 ms (21.2%)
Total	tracing	10.419 s	-
Total	appsec	10.769 s	349.716 ms (3.4%)
Total	iast	10.983 s	563.606 ms (5.4%)
Total	profiling	10.842 s	423.003 ms (4.1%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.045 s	-
Agent	appsec	1.185 s	140.592 ms (13.5%)
Agent	iast	1.173 s	128.438 ms (12.3%)
Agent	profiling	1.258 s	213.663 ms (20.4%)
Total	tracing	10.461 s	-
Total	appsec	10.752 s	291.219 ms (2.8%)
Total	iast	11.032 s	571.484 ms (5.5%)
Total	profiling	10.809 s	348.299 ms (3.3%)

gantt
title petclinic - break down per module: candidate=1.47.0-SNAPSHOT~3d53b70c6f, baseline=1.47.0-SNAPSHOT~74ee62c6d5
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (718.367 ms) : 0, 718367
BytebuddyAgent [candidate] (719.068 ms) : 0, 719068
GlobalTracer [baseline] (239.634 ms) : 0, 239634
GlobalTracer [candidate] (240.259 ms) : 0, 240259
AppSec [baseline] (56.174 ms) : 0, 56174
AppSec [candidate] (55.963 ms) : 0, 55963
Remote Config [baseline] (696.773 µs) : 0, 697
Remote Config [candidate] (699.166 µs) : 0, 699
Telemetry [baseline] (11.493 ms) : 0, 11493
Telemetry [candidate] (13.75 ms) : 0, 13750
section appsec
BytebuddyAgent [baseline] (736.654 ms) : 0, 736654
BytebuddyAgent [candidate] (736.268 ms) : 0, 736268
GlobalTracer [baseline] (237.15 ms) : 0, 237150
GlobalTracer [candidate] (237.111 ms) : 0, 237111
AppSec [baseline] (176.856 ms) : 0, 176856
AppSec [candidate] (177.198 ms) : 0, 177198
Remote Config [baseline] (661.207 µs) : 0, 661
Remote Config [candidate] (664.186 µs) : 0, 664
Telemetry [baseline] (8.297 ms) : 0, 8297
Telemetry [candidate] (8.295 ms) : 0, 8295
IAST [baseline] (21.46 ms) : 0, 21460
IAST [candidate] (21.372 ms) : 0, 21372
section iast
BytebuddyAgent [baseline] (834.337 ms) : 0, 834337
BytebuddyAgent [candidate] (837.368 ms) : 0, 837368
GlobalTracer [baseline] (229.981 ms) : 0, 229981
GlobalTracer [candidate] (230.751 ms) : 0, 230751
AppSec [baseline] (56.725 ms) : 0, 56725
AppSec [candidate] (57.497 ms) : 0, 57497
Remote Config [baseline] (624.773 µs) : 0, 625
Remote Config [candidate] (619.216 µs) : 0, 619
Telemetry [baseline] (8.645 ms) : 0, 8645
Telemetry [candidate] (8.761 ms) : 0, 8761
IAST [baseline] (22.614 ms) : 0, 22614
IAST [candidate] (22.969 ms) : 0, 22969
section profiling
ProfilingAgent [baseline] (96.127 ms) : 0, 96127
ProfilingAgent [candidate] (95.791 ms) : 0, 95791
BytebuddyAgent [baseline] (708.538 ms) : 0, 708538
BytebuddyAgent [candidate] (707.24 ms) : 0, 707240
GlobalTracer [baseline] (350.133 ms) : 0, 350133
GlobalTracer [candidate] (349.16 ms) : 0, 349160
AppSec [baseline] (55.451 ms) : 0, 55451
AppSec [candidate] (54.541 ms) : 0, 54541
Remote Config [baseline] (670.696 µs) : 0, 671
Remote Config [candidate] (676.762 µs) : 0, 677
Telemetry [baseline] (9.03 ms) : 0, 9030
Telemetry [candidate] (8.926 ms) : 0, 8926
Profiling [baseline] (96.151 ms) : 0, 96151
Profiling [candidate] (95.815 ms) : 0, 95815

Startup time reports for insecure-bank

gantt
title insecure-bank - global startup overhead: candidate=1.47.0-SNAPSHOT~3d53b70c6f, baseline=1.47.0-SNAPSHOT~74ee62c6d5
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.042 s) : 0, 1041792
Total [baseline] (8.663 s) : 0, 8662682
Agent [candidate] (1.049 s) : 0, 1049083
Total [candidate] (8.664 s) : 0, 8663911
section iast
Agent [baseline] (1.179 s) : 0, 1179051
Total [baseline] (9.219 s) : 0, 9219104
Agent [candidate] (1.173 s) : 0, 1173003
Total [candidate] (9.229 s) : 0, 9229368
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.176 s) : 0, 1176101
Total [baseline] (9.19 s) : 0, 9189621
Agent [candidate] (1.173 s) : 0, 1172877
Total [candidate] (9.174 s) : 0, 9174261
section iast_TELEMETRY_OFF
Agent [baseline] (1.167 s) : 0, 1166984
Total [baseline] (9.271 s) : 0, 9271062
Agent [candidate] (1.174 s) : 0, 1174318
Total [candidate] (9.244 s) : 0, 9244369

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.042 s	-
Agent	iast	1.179 s	137.26 ms (13.2%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.176 s	134.31 ms (12.9%)
Agent	iast_TELEMETRY_OFF	1.167 s	125.193 ms (12.0%)
Total	tracing	8.663 s	-
Total	iast	9.219 s	556.423 ms (6.4%)
Total	iast_HARDCODED_SECRET_DISABLED	9.19 s	526.939 ms (6.1%)
Total	iast_TELEMETRY_OFF	9.271 s	608.381 ms (7.0%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.049 s	-
Agent	iast	1.173 s	123.921 ms (11.8%)
Agent	iast_HARDCODED_SECRET_DISABLED	1.173 s	123.794 ms (11.8%)
Agent	iast_TELEMETRY_OFF	1.174 s	125.235 ms (11.9%)
Total	tracing	8.664 s	-
Total	iast	9.229 s	565.457 ms (6.5%)
Total	iast_HARDCODED_SECRET_DISABLED	9.174 s	510.35 ms (5.9%)
Total	iast_TELEMETRY_OFF	9.244 s	580.458 ms (6.7%)

gantt
title insecure-bank - break down per module: candidate=1.47.0-SNAPSHOT~3d53b70c6f, baseline=1.47.0-SNAPSHOT~74ee62c6d5
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (717.665 ms) : 0, 717665
BytebuddyAgent [candidate] (722.674 ms) : 0, 722674
GlobalTracer [baseline] (239.529 ms) : 0, 239529
GlobalTracer [candidate] (241.624 ms) : 0, 241624
AppSec [baseline] (55.324 ms) : 0, 55324
AppSec [candidate] (55.78 ms) : 0, 55780
Remote Config [baseline] (692.102 µs) : 0, 692
Remote Config [candidate] (703.81 µs) : 0, 704
Telemetry [baseline] (13.43 ms) : 0, 13430
Telemetry [candidate] (13.042 ms) : 0, 13042
section iast
BytebuddyAgent [baseline] (842.196 ms) : 0, 842196
BytebuddyAgent [candidate] (836.592 ms) : 0, 836592
GlobalTracer [baseline] (231.271 ms) : 0, 231271
GlobalTracer [candidate] (230.768 ms) : 0, 230768
IAST [baseline] (22.999 ms) : 0, 22999
IAST [candidate] (22.976 ms) : 0, 22976
AppSec [baseline] (57.777 ms) : 0, 57777
AppSec [candidate] (57.906 ms) : 0, 57906
Remote Config [baseline] (623.616 µs) : 0, 624
Remote Config [candidate] (624.464 µs) : 0, 624
Telemetry [baseline] (8.801 ms) : 0, 8801
Telemetry [candidate] (8.802 ms) : 0, 8802
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (839.557 ms) : 0, 839557
BytebuddyAgent [candidate] (837.284 ms) : 0, 837284
GlobalTracer [baseline] (231.109 ms) : 0, 231109
GlobalTracer [candidate] (230.954 ms) : 0, 230954
IAST [baseline] (23.066 ms) : 0, 23066
IAST [candidate] (22.68 ms) : 0, 22680
AppSec [baseline] (57.55 ms) : 0, 57550
AppSec [candidate] (57.295 ms) : 0, 57295
Remote Config [baseline] (621.481 µs) : 0, 621
Remote Config [candidate] (616.554 µs) : 0, 617
Telemetry [baseline] (8.876 ms) : 0, 8876
Telemetry [candidate] (8.726 ms) : 0, 8726
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (833.207 ms) : 0, 833207
BytebuddyAgent [candidate] (836.916 ms) : 0, 836916
GlobalTracer [baseline] (230.486 ms) : 0, 230486
GlobalTracer [candidate] (232.111 ms) : 0, 232111
IAST [baseline] (28.225 ms) : 0, 28225
IAST [candidate] (24.336 ms) : 0, 24336
AppSec [baseline] (50.638 ms) : 0, 50638
AppSec [candidate] (56.311 ms) : 0, 56311
Remote Config [baseline] (613.334 µs) : 0, 613
Remote Config [candidate] (624.458 µs) : 0, 624
Telemetry [baseline] (8.567 ms) : 0, 8567
Telemetry [candidate] (8.719 ms) : 0, 8719

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
end_time	2025-02-20T11:39:44	2025-02-20T11:46:50
git_branch	master	alejandro.gonzalez/jboss-jar-file-dependency-resolver
git_commit_date	1740041131	1740050930
git_commit_sha	`74ee62c`	`3d53b70`
release_version	1.47.0-SNAPSHOT~74ee62c6d5	1.47.0-SNAPSHOT~3d53b70c6f
start_time	2025-02-20T11:39:30	2025-02-20T11:46:36

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1740052367	1740052367
ci_job_id	815668959	815668959
ci_pipeline_id	56411165	56411165
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-73qxdqtd-project-304-concurrent-0-dxtozgif 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-73qxdqtd-project-304-concurrent-0-dxtozgif 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
variant	iast	iast

Summary

Found 1 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 15 unstable metrics.

scenario	Δ mean http_req_duration	Δ mean throughput	candidate mean http_req_duration	candidate mean throughput	baseline mean http_req_duration	baseline mean throughput
scenario:load:petclinic:profiling	better [-88.726µs; -36.512µs] or [-5.592%; -2.301%]	unstable [-416.348op/s; +644.269op/s] or [-14.052%; +21.744%]	1.524ms	3076.923op/s	1.587ms	2962.963op/s

Request duration reports for petclinic

gantt
title petclinic - request duration [CI 0.99] : candidate=1.47.0-SNAPSHOT~3d53b70c6f, baseline=1.47.0-SNAPSHOT~74ee62c6d5
dateFormat X
axisFormat %s
section baseline
no_agent (1.356 ms) : 1336, 1376
. : milestone, 1356,
appsec (1.778 ms) : 1754, 1802
. : milestone, 1778,
appsec_no_iast (1.763 ms) : 1740, 1787
. : milestone, 1763,
iast (1.506 ms) : 1481, 1530
. : milestone, 1506,
profiling (1.587 ms) : 1562, 1612
. : milestone, 1587,
tracing (1.528 ms) : 1504, 1553
. : milestone, 1528,
section candidate
no_agent (1.356 ms) : 1337, 1376
. : milestone, 1356,
appsec (1.747 ms) : 1723, 1771
. : milestone, 1747,
appsec_no_iast (1.771 ms) : 1746, 1796
. : milestone, 1771,
iast (1.503 ms) : 1479, 1527
. : milestone, 1503,
profiling (1.524 ms) : 1500, 1548
. : milestone, 1524,
tracing (1.495 ms) : 1471, 1519
. : milestone, 1495,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.356 ms [1.336 ms, 1.376 ms]	-
appsec	1.778 ms [1.754 ms, 1.802 ms]	421.915 µs (31.1%)
appsec_no_iast	1.763 ms [1.74 ms, 1.787 ms]	407.601 µs (30.1%)
iast	1.506 ms [1.481 ms, 1.53 ms]	149.665 µs (11.0%)
profiling	1.587 ms [1.562 ms, 1.612 ms]	230.832 µs (17.0%)
tracing	1.528 ms [1.504 ms, 1.553 ms]	172.147 µs (12.7%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.356 ms [1.337 ms, 1.376 ms]	-
appsec	1.747 ms [1.723 ms, 1.771 ms]	390.687 µs (28.8%)
appsec_no_iast	1.771 ms [1.746 ms, 1.796 ms]	415.025 µs (30.6%)
iast	1.503 ms [1.479 ms, 1.527 ms]	146.376 µs (10.8%)
profiling	1.524 ms [1.5 ms, 1.548 ms]	167.795 µs (12.4%)
tracing	1.495 ms [1.471 ms, 1.519 ms]	138.78 µs (10.2%)

Request duration reports for insecure-bank

gantt
title insecure-bank - request duration [CI 0.99] : candidate=1.47.0-SNAPSHOT~3d53b70c6f, baseline=1.47.0-SNAPSHOT~74ee62c6d5
dateFormat X
axisFormat %s
section baseline
no_agent (385.479 µs) : 365, 406
. : milestone, 385,
iast (511.719 µs) : 490, 533
. : milestone, 512,
iast_FULL (733.126 µs) : 711, 755
. : milestone, 733,
iast_GLOBAL (561.921 µs) : 540, 584
. : milestone, 562,
iast_HARDCODED_SECRET_DISABLED (516.248 µs) : 493, 540
. : milestone, 516,
iast_INACTIVE (461.433 µs) : 440, 482
. : milestone, 461,
iast_TELEMETRY_OFF (505.232 µs) : 482, 529
. : milestone, 505,
tracing (460.944 µs) : 440, 482
. : milestone, 461,
section candidate
no_agent (380.254 µs) : 361, 400
. : milestone, 380,
iast (509.36 µs) : 487, 531
. : milestone, 509,
iast_FULL (727.843 µs) : 706, 750
. : milestone, 728,
iast_GLOBAL (558.056 µs) : 536, 580
. : milestone, 558,
iast_HARDCODED_SECRET_DISABLED (512.809 µs) : 491, 535
. : milestone, 513,
iast_INACTIVE (468.907 µs) : 447, 490
. : milestone, 469,
iast_TELEMETRY_OFF (500.228 µs) : 477, 523
. : milestone, 500,
tracing (452.235 µs) : 432, 473
. : milestone, 452,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	385.479 µs [365.055 µs, 405.904 µs]	-
iast	511.719 µs [490.173 µs, 533.265 µs]	126.24 µs (32.7%)
iast_FULL	733.126 µs [710.932 µs, 755.319 µs]	347.647 µs (90.2%)
iast_GLOBAL	561.921 µs [540.081 µs, 583.761 µs]	176.442 µs (45.8%)
iast_HARDCODED_SECRET_DISABLED	516.248 µs [492.987 µs, 539.509 µs]	130.769 µs (33.9%)
iast_INACTIVE	461.433 µs [440.448 µs, 482.418 µs]	75.954 µs (19.7%)
iast_TELEMETRY_OFF	505.232 µs [481.712 µs, 528.753 µs]	119.753 µs (31.1%)
tracing	460.944 µs [439.792 µs, 482.097 µs]	75.465 µs (19.6%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	380.254 µs [360.7 µs, 399.807 µs]	-
iast	509.36 µs [487.452 µs, 531.268 µs]	129.106 µs (34.0%)
iast_FULL	727.843 µs [705.962 µs, 749.725 µs]	347.59 µs (91.4%)
iast_GLOBAL	558.056 µs [535.796 µs, 580.316 µs]	177.802 µs (46.8%)
iast_HARDCODED_SECRET_DISABLED	512.809 µs [491.034 µs, 534.584 µs]	132.555 µs (34.9%)
iast_INACTIVE	468.907 µs [447.456 µs, 490.357 µs]	88.653 µs (23.3%)
iast_TELEMETRY_OFF	500.228 µs [477.007 µs, 523.449 µs]	119.974 µs (31.6%)
tracing	452.235 µs [431.535 µs, 472.936 µs]	71.981 µs (18.9%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	alejandro.gonzalez/jboss-jar-file-dependency-resolver
git_commit_date	1740041131	1740050930
git_commit_sha	`74ee62c`	`3d53b70`
release_version	1.47.0-SNAPSHOT~74ee62c6d5	1.47.0-SNAPSHOT~3d53b70c6f

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1740052949	1740052949
ci_job_id	815668960	815668960
ci_pipeline_id	56411165	56411165
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-9mvrc7fk-project-304-concurrent-0-4do2cb87 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-9mvrc7fk-project-304-concurrent-0-4do2cb87 6.8.0-1021-aws #23~22.04.1-Ubuntu SMP Tue Dec 10 16:50:46 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
variant	appsec	appsec

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

Execution time for biojava

gantt
title biojava - execution time [CI 0.99] : candidate=1.47.0-SNAPSHOT~3d53b70c6f, baseline=1.47.0-SNAPSHOT~74ee62c6d5
dateFormat X
axisFormat %s
section baseline
no_agent (14.944 s) : 14944000, 14944000
. : milestone, 14944000,
appsec (15.103 s) : 15103000, 15103000
. : milestone, 15103000,
iast (18.683 s) : 18683000, 18683000
. : milestone, 18683000,
iast_GLOBAL (17.728 s) : 17728000, 17728000
. : milestone, 17728000,
profiling (15.134 s) : 15134000, 15134000
. : milestone, 15134000,
tracing (15.061 s) : 15061000, 15061000
. : milestone, 15061000,
section candidate
no_agent (15.269 s) : 15269000, 15269000
. : milestone, 15269000,
appsec (15.143 s) : 15143000, 15143000
. : milestone, 15143000,
iast (19.051 s) : 19051000, 19051000
. : milestone, 19051000,
iast_GLOBAL (18.046 s) : 18046000, 18046000
. : milestone, 18046000,
profiling (15.582 s) : 15582000, 15582000
. : milestone, 15582000,
tracing (15.139 s) : 15139000, 15139000
. : milestone, 15139000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	14.944 s [14.944 s, 14.944 s]	-
appsec	15.103 s [15.103 s, 15.103 s]	159.0 ms (1.1%)
iast	18.683 s [18.683 s, 18.683 s]	3.739 s (25.0%)
iast_GLOBAL	17.728 s [17.728 s, 17.728 s]	2.784 s (18.6%)
profiling	15.134 s [15.134 s, 15.134 s]	190.0 ms (1.3%)
tracing	15.061 s [15.061 s, 15.061 s]	117.0 ms (0.8%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.269 s [15.269 s, 15.269 s]	-
appsec	15.143 s [15.143 s, 15.143 s]	-126.0 ms (-0.8%)
iast	19.051 s [19.051 s, 19.051 s]	3.782 s (24.8%)
iast_GLOBAL	18.046 s [18.046 s, 18.046 s]	2.777 s (18.2%)
profiling	15.582 s [15.582 s, 15.582 s]	313.0 ms (2.0%)
tracing	15.139 s [15.139 s, 15.139 s]	-130.0 ms (-0.9%)

Execution time for tomcat

gantt
title tomcat - execution time [CI 0.99] : candidate=1.47.0-SNAPSHOT~3d53b70c6f, baseline=1.47.0-SNAPSHOT~74ee62c6d5
dateFormat X
axisFormat %s
section baseline
no_agent (1.478 ms) : 1466, 1490
. : milestone, 1478,
appsec (2.362 ms) : 2318, 2405
. : milestone, 2362,
iast (2.102 ms) : 2047, 2157
. : milestone, 2102,
iast_GLOBAL (2.155 ms) : 2099, 2210
. : milestone, 2155,
profiling (1.986 ms) : 1941, 2031
. : milestone, 1986,
tracing (1.951 ms) : 1909, 1994
. : milestone, 1951,
section candidate
no_agent (1.471 ms) : 1460, 1482
. : milestone, 1471,
appsec (2.354 ms) : 2311, 2398
. : milestone, 2354,
iast (2.115 ms) : 2060, 2170
. : milestone, 2115,
iast_GLOBAL (2.149 ms) : 2094, 2204
. : milestone, 2149,
profiling (1.972 ms) : 1928, 2015
. : milestone, 1972,
tracing (1.949 ms) : 1907, 1991
. : milestone, 1949,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.478 ms [1.466 ms, 1.49 ms]	-
appsec	2.362 ms [2.318 ms, 2.405 ms]	883.654 µs (59.8%)
iast	2.102 ms [2.047 ms, 2.157 ms]	624.072 µs (42.2%)
iast_GLOBAL	2.155 ms [2.099 ms, 2.21 ms]	676.47 µs (45.8%)
profiling	1.986 ms [1.941 ms, 2.031 ms]	507.93 µs (34.4%)
tracing	1.951 ms [1.909 ms, 1.994 ms]	473.347 µs (32.0%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.471 ms [1.46 ms, 1.482 ms]	-
appsec	2.354 ms [2.311 ms, 2.398 ms]	883.502 µs (60.1%)
iast	2.115 ms [2.06 ms, 2.17 ms]	644.208 µs (43.8%)
iast_GLOBAL	2.149 ms [2.094 ms, 2.204 ms]	678.113 µs (46.1%)
profiling	1.972 ms [1.928 ms, 2.015 ms]	500.863 µs (34.1%)
tracing	1.949 ms [1.907 ms, 1.991 ms]	477.928 µs (32.5%)

github-actions · 2025-02-20T12:11:18Z

Hi! 👋 Thanks for your pull request! 🎉

To help us review it, please make sure to:

Add at least one type, and one component or instrumentation label to the pull request

If you need help, please check our contributing guidelines.

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.46.1` -> `1.47.0` | | [com.datadoghq:dd-trace-ot](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.46.1` -> `1.47.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.30.33` -> `2.30.34` | --- ### Release Notes <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.47.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.47.0): 1.47.0 ##### Components ##### Application Security Management (IAST) - 🐛 Exclude com.stripe.net.HttpURLConnectionClient to solve IAST SSRF vulnerability false positives ([#8483](DataDog/dd-trace-java#8483) - [@jandro996](https://github.com/jandro996)) - 🐛 Add exclusion to solve IAST weak randomness vulnerability false positives ([#8462](DataDog/dd-trace-java#8462) - [@jandro996](https://github.com/jandro996)) - ✨ Fix weak randomness false positive in Kafka client ([#8408](DataDog/dd-trace-java#8408) - [@smola](https://github.com/smola)) - ✨ Fix location for SSRF with Kong Unirest ([#8407](DataDog/dd-trace-java#8407) - [@smola](https://github.com/smola)) - ✨ Exclude IBM Instana from IAST ([#8406](DataDog/dd-trace-java#8406) - [@smola](https://github.com/smola)) - 🐛 Fix org.json iast instrumentation test for latest dependency ([#8347](DataDog/dd-trace-java#8347) - [@jandro996](https://github.com/jandro996)) - ✨ Configuration to Disable APM Tracing ([#8219](DataDog/dd-trace-java#8219) - [@jandro996](https://github.com/jandro996)) - ✨ Address cookie vulnerability cardinality issues ([#8210](DataDog/dd-trace-java#8210) - [@jandro996](https://github.com/jandro996)) - ✨ Email HTML Injection detection in IAST ([#8205](DataDog/dd-trace-java#8205) - [@sezen-datadog](https://github.com/sezen-datadog)) ##### Application Security Management (WAF) - 🐛✨ Ensure usr.exists tag is not overridden when UsernameNotFoundException is thrown ([#8376](DataDog/dd-trace-java#8376) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛✨ Ensure usr.exists tag is not overridden by auto instrumentation ([#8374](DataDog/dd-trace-java#8374) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Update appsec metrics with event_rules_version tag ([#8354](DataDog/dd-trace-java#8354) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Update metrics: appsec.waf.requests ([#8353](DataDog/dd-trace-java#8353) - [@Mariovido](https://github.com/Mariovido)) - ✨ Improve ASM support in vert.x 5.0 ([#8285](DataDog/dd-trace-java#8285) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Update metrics: appsec.waf.updates and appsec.waf.init ([#8280](DataDog/dd-trace-java#8280) - [@Mariovido](https://github.com/Mariovido)) - ✨ Configuration to Disable APM Tracing ([#8219](DataDog/dd-trace-java#8219) - [@jandro996](https://github.com/jandro996)) ##### Build & Tooling - 🐛 Do not generate Muzzle references for primitive arrays in method body ([#8361](DataDog/dd-trace-java#8361) - [@amarziali](https://github.com/amarziali)) - 📖 Improve dev env setup documentation for Windows ([#8180](DataDog/dd-trace-java#8180) - [@lucaspimentel](https://github.com/lucaspimentel)) ##### Continuous Integration Visibility - ✨ Add support for skip-EFD tagging ([#8487](DataDog/dd-trace-java#8487) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix an NPE in Gradle Android instrumentation ([#8484](DataDog/dd-trace-java#8484) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Consider modified tests when applying fail-fast tests ordering ([#8474](DataDog/dd-trace-java#8474) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Implement tests reordering for TestNG ([#8467](DataDog/dd-trace-java#8467) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix Gradle Launcher instrumentation to not interfere with Gradle Test Kit ([#8465](DataDog/dd-trace-java#8465) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🧹 Use separate TestEventHandlers per framework in CI Vis instrumentations ([#8451](DataDog/dd-trace-java#8451) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Remove warning log when JUnit 4 test method cannot be retrieved ([#8445](DataDog/dd-trace-java#8445) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - 🐛 Fix Scalatest tracing for tests that are reported asynchronously ([#8444](DataDog/dd-trace-java#8444) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Implement attempt to fix tests ([#8393](DataDog/dd-trace-java#8393) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement test disabling ([#8377](DataDog/dd-trace-java#8377) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Update CODEOWNERS parser to not log errors on comments with leading whitespace ([#8349](DataDog/dd-trace-java#8349) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Request Test Management tests list ([#8345](DataDog/dd-trace-java#8345) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Receive test management settings from CIVis settings request ([#8331](DataDog/dd-trace-java#8331) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Implement quarantined tests tagging ([#8326](DataDog/dd-trace-java#8326) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Implement tests quarantining ([#8320](DataDog/dd-trace-java#8320) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add tag to specify if the user is setting DD_SERVICE ([#8318](DataDog/dd-trace-java#8318) - [@daniel-mohedano](https://github.com/daniel-mohedano)) ##### Crash tracking - ✨ Only fork jps when required ([#8419](DataDog/dd-trace-java#8419) - [@mcculls](https://github.com/mcculls)) - 🐛 Use Java home of the crashed process to launch crash uploader ([#8348](DataDog/dd-trace-java#8348) - [@jbachorik](https://github.com/jbachorik)) ##### Data Streams Monitoring - 🐛 Fix error happening when sqs message attributes are readonly ([#8473](DataDog/dd-trace-java#8473) - [@vandonr](https://github.com/vandonr)) - 🐛 Fix bug on proto schema extraction ([#8403](DataDog/dd-trace-java#8403) - [@vandonr](https://github.com/vandonr)) - 🐛 Fix service name overrides in consumers ([#8387](DataDog/dd-trace-java#8387) - [@piochelepiotr](https://github.com/piochelepiotr)) ##### Database Monitoring - ✨ Add DBMTracePreparedStatements to tracer configuration log ([#8508](DataDog/dd-trace-java#8508) - [@cecile75](https://github.com/cecile75)) ##### Dynamic Instrumentation - ✨ Look in another location for grpc service methods ([#8468](DataDog/dd-trace-java#8468) - [@evanchooly](https://github.com/evanchooly)) - 🐛 Fix Exception Replay with Lambda proxy classes ([#8452](DataDog/dd-trace-java#8452) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add code origin support for spring-webmvc ([#8416](DataDog/dd-trace-java#8416) - [@evanchooly](https://github.com/evanchooly)) - ✨ Add support for scanning jar from loaded class ([#8370](DataDog/dd-trace-java#8370) - [@jpbempel](https://github.com/jpbempel)) - 🐛 Disable capture of entry values ([#8369](DataDog/dd-trace-java#8369) - [@jpbempel](https://github.com/jpbempel)) - 🐛 Fix CodeOrigin for `@Trace` annotation ([#8344](DataDog/dd-trace-java#8344) - [@jpbempel](https://github.com/jpbempel)) - 🐛 Fix equals/hashCode for CodeOrigin probe ([#8319](DataDog/dd-trace-java#8319) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add code origin support to kafka message listeners ([#8301](DataDog/dd-trace-java#8301) - [@evanchooly](https://github.com/evanchooly)) ##### Metrics - ✨ Create metric: appsec.waf.error ([#8381](DataDog/dd-trace-java#8381) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Create metric: appsec.rasp.error ([#8364](DataDog/dd-trace-java#8364) - [@sezen-datadog](https://github.com/sezen-datadog)) ##### Profiling - ✨ Bump ddprof library to 1.22.0 ([#8463](DataDog/dd-trace-java#8463) - [@jbachorik](https://github.com/jbachorik)) - IBM J9 8u361 corresponds to OpenJDK 8u362 by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#187 - Fix compatibility with musl libc 1.2.4 by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#189 - Modify version extraction by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#179 - Do not write null values to jvminfo event by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#184 - Productize VMStructs-based stack walker by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#177 - A few minor downport issues by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#180 - Enable ASGCT by default on fairly safe J9 JDK versions by [@jbachorik](https://github.com/jbachorik) in DataDog/java-profiler#181 - 🐛 Exclude OrderedThreadPoolExecutor from queue-time measurements ([#8456](DataDog/dd-trace-java#8456) - [@jbachorik](https://github.com/jbachorik)) - ✨ Record JVM info on JVMs without JFR ([#8431](DataDog/dd-trace-java#8431) - [@jbachorik](https://github.com/jbachorik)) - 🐛 Actually use CleanupTask in TempLocationManager ([#8420](DataDog/dd-trace-java#8420) - [@mcculls](https://github.com/mcculls)) - ✨ Only fork jps when required ([#8419](DataDog/dd-trace-java#8419) - [@mcculls](https://github.com/mcculls)) - 🐛 Adjust JFR checks for J9 ([#8405](DataDog/dd-trace-java#8405) - [@jbachorik](https://github.com/jbachorik)) - 🧹 Disable smap RSS parsing by default ([#8342](DataDog/dd-trace-java#8342) - [@MattAlp](https://github.com/MattAlp)) ##### Telemetry - 🐛 Add support for JBoss jar:file format to DependencyResolver ([#8428](DataDog/dd-trace-java#8428) - [@jandro996](https://github.com/jandro996)) - ✨ Update metrics: appsec.waf.requests ([#8353](DataDog/dd-trace-java#8353) - [@Mariovido](https://github.com/Mariovido)) ##### Trace context propagation - ✨ Introduce tracing propagator ([#8313](DataDog/dd-trace-java#8313) - [@PerfectSlayer](https://github.com/PerfectSlayer)) ##### Tracer core - 🐛 Fix Stable Config telemetry source names ([#8460](DataDog/dd-trace-java#8460) - [@BaptisteFoy](https://github.com/BaptisteFoy)) - ✨ Probe trace endpoints with a valid payload of empty arrays ([#8414](DataDog/dd-trace-java#8414) - [@mcculls](https://github.com/mcculls)) - ✨ Add 1 minute fail-safe to JUL/JMX class-loading callback ([#8399](DataDog/dd-trace-java#8399) - [@mcculls](https://github.com/mcculls)) - ✨ Migrate DSM injection calls to context-first APIs ([#8383](DataDog/dd-trace-java#8383) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - 🧹 Move continuation capture methods from scope to tracer ([#8371](DataDog/dd-trace-java#8371) - [@mcculls](https://github.com/mcculls)) - ✨ Migrate context extraction calls to context-first APIs ([#8368](DataDog/dd-trace-java#8368) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - 🧹 Migrate context injection calls to context-first APIs ([#8358](DataDog/dd-trace-java#8358) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - 💡 Support reading configurations from files ([#8338](DataDog/dd-trace-java#8338) - [@mtoffl01](https://github.com/mtoffl01)) - 💡 Implementation of BaggagePropagator and BaggageContext ([#8330](DataDog/dd-trace-java#8330) - [@mhlidd](https://github.com/mhlidd)) - 🧹 Combine continuation implementations into one which supports multiple activations ([#8324](DataDog/dd-trace-java#8324) - [@mcculls](https://github.com/mcculls)) - ✨ Introduce tracing propagator ([#8313](DataDog/dd-trace-java#8313) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Remove old context propagation API ([#8271](DataDog/dd-trace-java#8271) - [@PerfectSlayer](https://github.com/PerfectSlayer)) ##### Instrumentations ##### AWS Lambda instrumentation - 🐛 Send error message and stack to Lambda extension ([#8417](DataDog/dd-trace-java#8417) - [@nhulston](https://github.com/nhulston)) ##### AWS SDK instrumentation - 🐛 Fix error happening when sqs message attributes are readonly ([#8473](DataDog/dd-trace-java#8473) - [@vandonr](https://github.com/vandonr)) - 💡 Inject trace context into AWS Step Functions input ([#7585](DataDog/dd-trace-java#7585) - [@DylanLovesCoffee](https://github.com/DylanLovesCoffee)) ##### Core Java language instrumentation - ✨ Look in another location for grpc service methods ([#8468](DataDog/dd-trace-java#8468) - [@evanchooly](https://github.com/evanchooly)) - ✨ Add code origin support for spring-webmvc ([#8416](DataDog/dd-trace-java#8416) - [@evanchooly](https://github.com/evanchooly)) - 💡 Implementation of BaggagePropagator and BaggageContext ([#8330](DataDog/dd-trace-java#8330) - [@mhlidd](https://github.com/mhlidd)) - ✨ Add code origin support to kafka message listeners ([#8301](DataDog/dd-trace-java#8301) - [@evanchooly](https://github.com/evanchooly)) ##### gRPC instrumentation - ✨ Look in another location for grpc service methods ([#8468](DataDog/dd-trace-java#8468) - [@evanchooly](https://github.com/evanchooly)) ##### Kafka instrumentation - ✨ Add messaging.destination.name tag to kafka integrations ([#8366](DataDog/dd-trace-java#8366) - [@rarguelloF](https://github.com/rarguelloF)) ##### Protocol Buffer instrumentation - 🐛 Fix bug on proto schema extraction ([#8403](DataDog/dd-trace-java#8403) - [@vandonr](https://github.com/vandonr)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: 108a0f86aa59ab4c938cbac0688dd4c19cb301fa

JBoss may use the "jar:file" format to reference jar files instead of…
3d53b70
… nested jars

jandro996 added type: bug fix Bug fix tag: no release notes Changes to exclude from release notes comp: asm waf Application Security Management (WAF) labels Feb 20, 2025

jandro996 requested a review from a team as a code owner February 20, 2025 11:32

jandro996 requested review from amarziali and smola February 20, 2025 11:32

smola added comp: telemetry Telemetry and removed tag: no release notes Changes to exclude from release notes comp: asm waf Application Security Management (WAF) labels Feb 20, 2025

smola approved these changes Feb 20, 2025
View reviewed changes

jandro996 added comp: telemetry Telemetry and removed comp: telemetry Telemetry labels Feb 20, 2025

jandro996 merged commit dcb835a into masterFeb 20, 2025

jandro996 deleted the alejandro.gonzalez/jboss-jar-file-dependency-resolver branch February 20, 2025 12:12

github-actionsBot added this to the 1.47.0 milestone Feb 20, 2025

Navigation Menu

Uh oh!

Add support for JBoss jar:file format to DependencyResolver - #8428

Add support for JBoss jar:file format to DependencyResolver#8428
jandro996 merged 1 commit into
masterfrom
alejandro.gonzalez/jboss-jar-file-dependency-resolver

jandro996 commented Feb 20, 2025•
edited
Loading

Uh oh!

pr-commenterBot commented Feb 20, 2025

Uh oh!

github-actionsBot commented Feb 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

jandro996 commented Feb 20, 2025• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

pr-commenterBot commented Feb 20, 2025

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

github-actionsBot commented Feb 20, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

jandro996 commented Feb 20, 2025•
edited
Loading