add IAST code injection tests for java by claponcet · Pull Request #7445 · DataDog/system-tests

claponcet · 2026-08-04T14:49:12Z

Motivation

The IAST CODE_INJECTION sink was not covered by system-tests for the Java tracer. This adds the weblog endpoints and enables the existing test_code_injection.py tests so the Java library's code-injection detection (BeanShell sink) is validated end-to-end.

Jira: APPSEC-68921
Tracer support: DataDog/dd-trace-java#12113

Changes

Add a shared CodeInjectionExamples helper in iast-common that triggers the sink by evaluating input through BeanShell (bsh.Interpreter.eval), with an insecure (tainted input) and secure (hardcoded literal) variant.
Expose POST /iast/code_injection/test_insecure and POST /iast/code_injection/test_secure in the weblogs that carry the full IAST sink surface: akka-http, jersey-grizzly2, resteasy-netty3, spring-boot, vertx3, vertx4.
Add the bsh dependency to iast-common (optional) and to each weblog that implements the endpoint.
Enable TestCodeInjection and TestCodeInjection_StackTrace in manifests/java.yml from v1.65.0-SNAPSHOT:
- play / ratpack: incomplete_test_app (endpoint not implemented) — these weblogs do not implement the IAST sink endpoints.
- spring-boot-3-native: irrelevant (GraalVM. Tracing support only).

Workflow

⚠️ Create your PR as draft ⚠️
Work on you PR until the CI passes
Mark it as ready for review
- Test logic is modified? -> Get a review from RFC owner.
- Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
A docker base image is modified?
- the relevant build-XXX-image label is present
A scenario is added, removed or renamed?
- Get a review from R&P team

github-actions · 2026-08-04T14:49:48Z

CODEOWNERS have been resolved as:

utils/build/docker/java/iast-common/src/main/java/com/datadoghq/system_tests/iast/utils/CodeInjectionExamples.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
manifests/java.yml                                                      @DataDog/asm-java @DataDog/apm-java
utils/build/docker/java/akka-http/pom.xml                               @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/akka-http/src/main/scala/com/datadoghq/akka_http/IastRoutes.scala  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/iast-common/pom.xml                             @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/jersey-grizzly2/pom.xml                         @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/jersey-grizzly2/src/main/java/com/datadoghq/jersey/IastSinkResource.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/play/pom.xml                                    @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/ratpack/pom.xml                                 @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/resteasy-netty3/pom.xml                         @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/resteasy-netty3/src/main/java/com/datadoghq/resteasy/IastSinkResource.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/spring-boot/pom.xml                             @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/AppSecIast.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/vertx3/pom.xml                                  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/vertx3/src/main/java/com/datadoghq/vertx3/iast/routes/IastSinkRouteProvider.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/vertx4/pom.xml                                  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java/vertx4/src/main/java/com/datadoghq/vertx4/iast/routes/IastSinkRouteProvider.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java_otel/spring-boot/pom.xml                        @DataDog/opentelemetry @DataDog/system-tests-core

datadog-prod-us1-5 · 2026-08-04T15:00:52Z

⚠️ Warnings

🚦 2 Pipeline jobs failed

Testing the test | System Tests (java, prod) / End-to-end #1 / spring-boot-openliberty 1

See error
1 failed test. Assertion Error: Unexpected log found: '[dd.trace 2026-08-05 15:29:25:583 +0000] [dd-jmx-collector] WARN org.datadog.jmxfetch.tasks.TaskProcessor - JMXFetch...'
🧪 1 Test failed

All test failures are known flaky.
❄️ Known flaky: tests.test_library_logs.Test_NoExceptions.test_java_logs[spring-boot-openliberty] from system_tests_suite
self = &lt;tests.test_library_logs.Test_NoExceptions object at 0x7fa0844ab020&gt;

    def test_java_logs(self):
        &#34;&#34;&#34;Test Java logs for unexpected errors.&#34;&#34;&#34;
        disallowed_patterns = [
            r&#34;.*ERROR.*&#34;,
        ]
        allowed_patterns = [
            r&#34;.*&#34;
            &#43; re.escape(
...
Not introduced in this PR.
Testing the test | all-jobs-are-green

See error
Check run failed: System Tests (java, prod) / End-to-end #1 / spring-boot-openliberty 1

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 89915c1 | Docs | Datadog PR Page | Give us feedback!}

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2dac0de616

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-08-05T13:52:44Z

+package com.datadoghq.system_tests.iast.utils;
+
+import bsh.EvalError;
+import bsh.Interpreter;


Add BeanShell to the OTel Spring Boot build

When the java_otel Spring Boot image is built, utils/build/docker/java_otel/spring-boot-otel.Dockerfile copies the shared iast-common sources and that POM adds ../iast-common/src/main/java/ as compile sources, but utils/build/docker/java_otel/spring-boot/pom.xml does not declare the new BeanShell dependency. This new import therefore makes that supported weblog fail compilation with package bsh does not exist; add the same org.apache-extras.beanshell:bsh dependency there or keep this helper out of sources used by the OTel weblog.

Useful? React with 👍 / 👎.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

add IAST code injection tests for java

7a107cc

claponcet and others added 2 commits August 4, 2026 17:27

fix(java): restore bsh dependency for play and ratpack weblogs

8559e02

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

upgrade minimum tracer version

2dac0de

claponcet marked this pull request as ready for review August 5, 2026 13:43

claponcet requested review from a team as code owners August 5, 2026 13:43

claponcet requested review from jandro996 and manuel-alvarez-alvarez August 5, 2026 13:43

chatgpt-codex-connector Bot reviewed Aug 5, 2026

View reviewed changes

claponcet and others added 2 commits August 5, 2026 16:41

Merge branch 'main' into clara.poncet/java-iast-code-injection

962bc0f

fix(java): add bsh dependency to java_otel spring-boot weblog

89915c1

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

claponcet requested a review from a team as a code owner August 5, 2026 15:12

claponcet requested a review from peschinskiy August 5, 2026 15:12

Navigation Menu

Uh oh!

add IAST code injection tests for java - #7445

add IAST code injection tests for java#7445
claponcet wants to merge 5 commits into
mainfrom
clara.poncet/java-iast-code-injection

claponcet commented Aug 4, 2026 •

edited by atlassian Bot

Loading

Uh oh!

github-actions Bot commented Aug 4, 2026 •

edited

Loading

Uh oh!

datadog-prod-us1-5 Bot commented Aug 4, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

claponcet commented Aug 4, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation

Changes

Workflow

Reviewer checklist

Uh oh!

github-actions Bot commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

datadog-prod-us1-5 Bot commented Aug 4, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

claponcet commented Aug 4, 2026 •

edited by atlassian Bot

Loading

github-actions Bot commented Aug 4, 2026 •

edited

Loading

datadog-prod-us1-5 Bot commented Aug 4, 2026 •

edited by datadog-prod-us1-4 Bot

Loading