Merge branch 'master' into sezen.leblay/APPSEC-57259-extract-schema-spring

Author: sezen-datadog

.gitlab-ci.yml

@@ -30,7 +30,7 @@ variables:
   GRADLE_PLUGIN_PROXY: "http://artifactual.artifactual.all-clusters.local-dc.fabric.dog:8081/repository/gradle-plugin-portal-proxy/"
   BUILDER_IMAGE_VERSION_PREFIX: "v25.06-" # use either an empty string (e.g. "") for latest images or a version followed by a hyphen (e.g. "v25.05-")
   REPO_NOTIFICATION_CHANNEL: "#apm-java-escalations"
-  DEFAULT_TEST_JVMS: /^(8|11|17|21)$/
+  DEFAULT_TEST_JVMS: /^(8|11|17|21|stable)$/
   PROFILE_TESTS:
     description: "Enable profiling of tests"
     value: "false"
@@ -63,6 +63,7 @@ workflow:
       - "11"
       - "17"
       - "21"
+      - "stable"
       - "semeru11"
       - "oracle8"
       - "zulu8"
@@ -560,7 +561,7 @@ test_inst_latest:
     CACHE_TYPE: "latestDep"
   parallel:
     matrix:
-      - testJvm: ["8", "17", "21" ]
+      - testJvm: ["8", "17", "21", "stable"]
         # Gitlab doesn't support "parallel" and "parallel:matrix" at the same time
         # This emulates "parallel" by including it in the matrix
         CI_SPLIT: [ "1/6", "2/6", "3/6", "4/6", "5/6", "6/6"]
@@ -612,7 +613,7 @@ test_debugger:
   variables:
     GRADLE_TARGET: ":debuggerTest"
     CACHE_TYPE: "base"
-    DEFAULT_TEST_JVMS: /^(8|11|17|21|semeru8)$/
+    DEFAULT_TEST_JVMS: /^(8|11|17|21|stable|semeru8)$/
   parallel:
     matrix: *test_matrix
 

.gitlab/benchmarks.yml

@@ -68,6 +68,36 @@ benchmarks-post-results:
     - job: benchmarks-dacapo
       artifacts: true
 
+check-big-regressions:
+  extends: .benchmarks
+  needs:
+    - job: benchmarks-startup
+      artifacts: true
+    - job: benchmarks-load
+      artifacts: true
+  when: on_success
+  tags: ["arch:amd64"]
+  # ARTIFACTS_DIR /go/src/github.com/DataDog/apm-reliability/dd-trace-java/reports/
+  # need to convert them
+  script:
+    - !reference [ .benchmarks, script ]
+    - | 
+      for benchmarkType in startup load; do
+          find "$ARTIFACTS_DIR/$benchmarkType" -name "benchmark-baseline.json" -o -name "benchmark-candidate.json" | while read file; do
+            relpath="${file#$ARTIFACTS_DIR/$benchmarkType/}"
+            prefix="${relpath%/benchmark-*}" # Remove the trailing /benchmark-(baseline|candidate).json
+            prefix="${prefix#./}" # Remove any leading ./
+            prefix="${prefix//\//-}" # Replace / with -
+            case "$file" in
+              *benchmark-baseline.json) type="baseline" ;;
+              *benchmark-candidate.json) type="candidate" ;;
+            esac
+            echo "Moving $file to $ARTIFACTS_DIR/${type}-${prefix}.converted.json"
+            cp "$file" "$ARTIFACTS_DIR/${type}-${prefix}.converted.json"
+          done
+      done
+    - bp-runner $CI_PROJECT_DIR/.gitlab/benchmarks/bp-runner.fail-on-regression.yml --debug
+
 .dsm-kafka-benchmarks:
   stage: benchmarks
   rules:

.gitlab/benchmarks/bp-runner.fail-on-regression.yml

@@ -0,0 +1,7 @@
+experiments:
+  - name: Run regression check
+    steps:
+      - name: Regression Check
+        run: fail_on_regression
+        # Applies on all scenarios
+        regression_threshold: 10.0 # percents

BUILDING.md

@@ -28,13 +28,14 @@ or on Windows:
 Your output should look something like the following:
 
 ```
-ℹ️ Checking required JVM:
-✅ JAVA_HOME is set to /Users/datadog/.sdkman/candidates/java/8.0.402-zulu.
-✅ JAVA_8_HOME is set to /Users/datadog/.sdkman/candidates/java/8.0.402-zulu.
-✅ JAVA_11_HOME is set to /Users/datadog/.sdkman/candidates/java/11.0.22-zulu.
-✅ JAVA_17_HOME is set to /Users/datadog/.sdkman/candidates/java/17.0.10-zulu.
-✅ JAVA_21_HOME is set to /Users/datadog/.sdkman/candidates/java/21.0.2-zulu.
-✅ JAVA_GRAALVM17_HOME is set to /Users/datadog/.sdkman/candidates/java/17.0.9-graalce.
+ℹ️ Checking required JVMs:
+✅ JAVA_HOME is set to /Library/Java/JavaVirtualMachines/zulu-8.jdk/Contents/Home.
+✅ JAVA_8_HOME is set to /Library/Java/JavaVirtualMachines/zulu-8.jdk/Contents/Home.
+✅ JAVA_11_HOME is set to /Library/Java/JavaVirtualMachines/zulu-11.jdk/Contents/Home.
+✅ JAVA_17_HOME is set to /Library/Java/JavaVirtualMachines/zulu-17.jdk/Contents/Home.
+✅ JAVA_21_HOME is set to /Library/Java/JavaVirtualMachines/zulu-21.jdk/Contents/Home.
+✅ JAVA_24_HOME is set to /Library/Java/JavaVirtualMachines/zulu-24.jdk/Contents/Home.
+✅ JAVA_GRAALVM17_HOME is set to /Library/Java/JavaVirtualMachines/graalvm-ce-java17-22.3.1/Contents/Home.
 ℹ️ Checking git configuration:
 ✅ The git command line is installed.
 ✅ pre-commit hook is installed in repository.
@@ -51,22 +52,22 @@ If there is any issue with your output, check the requirements above and use the
 
 Requirements to build the full project:
 
-* The JDK versions 8, 11, 17 and 21 must be installed.
-* The `JAVA_8_HOME`, `JAVA_11_HOME`, `JAVA_17_HOME`, `JAVA_21_HOME`, and `JAVA_GRAALVM17_HOME` must point to their respective JDK location.
+* The JDK versions 8, 11, 17, 21, and 24 must be installed.
+* The `JAVA_8_HOME`, `JAVA_11_HOME`, `JAVA_17_HOME`, `JAVA_21_HOME`, `JAVA_24_HOME`, and `JAVA_GRAALVM17_HOME` must point to their respective JDK location.
 * The JDK 8 `bin` directory must be the only JDK on the PATH (e.g. `$JAVA_8_HOME/bin`).
 * The `JAVA_HOME` environment variable may be unset. If set, it must point to the JDK 8 location (same as `JAVA_8_HOME`).
 * The `git` command line must be installed.
 * A container runtime environment must be available to run all tests (e.g. Docker Desktop).
 
 ### Install the required JDKs
 
-Download and install JDK versions 8, 11, 17 and 21, and GraalVM 17 for your OS.
+Download and install JDK versions 8, 11, 17, 21 and 24, and GraalVM 17 for your OS.
 
 #### macOS
 
 * Install the required JDKs using `brew`:
   ```shell
-  brew install --cask zulu@8 zulu@11 zulu@17 zulu@21 graalvm/tap/graalvm-ce-java17
+  brew install --cask zulu@8 zulu@11 zulu@17 zulu@21 zulu graalvm/tap/graalvm-ce-java17
   ```
 * Fix the GraalVM installation by [removing the quarantine flag](https://www.graalvm.org/latest/docs/getting-started/macos/):
   ```
@@ -78,6 +79,7 @@ Download and install JDK versions 8, 11, 17 and 21, and GraalVM 17 for your OS.
   export JAVA_11_HOME=/Library/Java/JavaVirtualMachines/zulu-11.jdk/Contents/Home
   export JAVA_17_HOME=/Library/Java/JavaVirtualMachines/zulu-17.jdk/Contents/Home
   export JAVA_21_HOME=/Library/Java/JavaVirtualMachines/zulu-21.jdk/Contents/Home
+  export JAVA_24_HOME=/Library/Java/JavaVirtualMachines/zulu-24.jdk/Contents/Home
   export JAVA_GRAALVM17_HOME=/Library/Java/JavaVirtualMachines/graalvm-<current version of graalvm>/Contents/Home
   export JAVA_HOME=$JAVA_8_HOME
   ```
@@ -93,22 +95,23 @@ Download and install JDK versions 8, 11, 17 and 21, and GraalVM 17 for your OS.
 
 #### Linux
 
-* Download and extract JDK 8, 11, 17, and 21 from [Eclipse Temurin releases](https://adoptium.net/temurin/releases/) and GraalVM 17 from [Oracle downloads](https://www.graalvm.org/downloads/).
+* Download and extract JDK 8, 11, 17, 21, and 24 from [Eclipse Temurin releases](https://adoptium.net/temurin/releases/) and GraalVM 17 from [Oracle downloads](https://www.graalvm.org/downloads/).
 * Install the GraalVM native image requirements for native builds by following [the GraalVM official documentation](https://www.graalvm.org/latest/reference-manual/native-image/#prerequisites).
 * Add the required environment variables to your shell using the `export` command. You can permanently install the environment variables by appending the `export` commands into your shell configuration file `~/.zshrc` or `~/.bashrc` or other.
   ```shell
   export JAVA_8_HOME=/<path to extracted archive>/jdk8u<current version of JDK 8>
   export JAVA_11_HOME=/<path to extracted archive>/jdk-11.<current version of JDK 11>
   export JAVA_17_HOME=/<path to extracted archive>/jdk-17.<current version of JDK 17>
   export JAVA_21_HOME=/<path to extracted archive>/jdk-21.<current version of JDK 21>
+  export JAVA_24_HOME=/<path to extracted archive>/jdk-24.<current version of JDK 24>
   export JAVA_GRAALVM17_HOME=/<path to extracted archive>/graalvm-jdk-17.<current version of graalvm>/Contents/Home
   export JAVA_HOME=$JAVA_8_HOME
   ```
 * Restart your shell after applying the changes if you appended the commands to your shell configuration file.
 
 #### Windows
 
-* Download and install JDK 8, 11, 17, and 21 [Eclipse Temurin releases](https://adoptium.net/temurin/releases/).
+* Download and install JDK 8, 11, 17, 21, and 24 [Eclipse Temurin releases](https://adoptium.net/temurin/releases/).
 
   <details>
   <summary>Alternatively, install JDKs using winget or scoop. (click here to expand)</summary>
@@ -118,6 +121,7 @@ Download and install JDK versions 8, 11, 17 and 21, and GraalVM 17 for your OS.
     winget install --id EclipseAdoptium.Temurin.11.JDK
     winget install --id EclipseAdoptium.Temurin.17.JDK
     winget install --id EclipseAdoptium.Temurin.21.JDK
+    winget install --id EclipseAdoptium.Temurin.24.JDK
     ```
 
   ```pwsh
@@ -126,6 +130,7 @@ Download and install JDK versions 8, 11, 17 and 21, and GraalVM 17 for your OS.
   scoop install temurin11-jdk
   scoop install temurin17-jdk
   scoop install temurin21-jdk
+  scoop install temurin24-jdk
   ```
 
   </details>
@@ -136,6 +141,7 @@ Download and install JDK versions 8, 11, 17 and 21, and GraalVM 17 for your OS.
   [Environment]::SetEnvironmentVariable("JAVA_11_HOME", "C:\Program Files\Eclipse Adoptium\jdk-11.0.25.9-hotspot", [EnvironmentVariableTarget]::User)
   [Environment]::SetEnvironmentVariable("JAVA_17_HOME", "C:\Program Files\Eclipse Adoptium\jdk-17.0.12.7-hotspot", [EnvironmentVariableTarget]::User)
   [Environment]::SetEnvironmentVariable("JAVA_21_HOME", "C:\Program Files\Eclipse Adoptium\jdk-21.0.5.11-hotspot", [EnvironmentVariableTarget]::User)
+  [Environment]::SetEnvironmentVariable("JAVA_24_HOME", "C:\Program Files\Eclipse Adoptium\jdk-24.0.1.9-hotspot", [EnvironmentVariableTarget]::User)
 
   # JAVA_HOME = JAVA_8_HOME
   [Environment]::SetEnvironmentVariable("JAVA_HOME",    "C:\Program Files\Eclipse Adoptium\jdk-8.0.432.6-hotspot", [EnvironmentVariableTarget]::User)

dd-java-agent/appsec/src/main/java/com/datadog/appsec/config/AppSecConfigServiceImpl.java

@@ -48,6 +48,7 @@
 import datadog.trace.api.ProductActivation;
 import datadog.trace.api.UserIdCollectionMode;
 import datadog.trace.api.telemetry.LogCollector;
+import datadog.trace.api.telemetry.WafMetricCollector;
 import java.io.ByteArrayInputStream;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
@@ -263,7 +264,9 @@ private void handleWafUpdateResultReport(String configKey, Map<String, Object> r
           "Invalid rule during waf config update for config key {}: {}",
           configKey,
           e.wafDiagnostics);
-
+      if (e.wafDiagnostics.getNumConfigError() > 0) {
+        WafMetricCollector.get().addWafConfigError(e.wafDiagnostics.getNumConfigError());
+      }
       // TODO: Propagate diagostics back to remote config apply_error
 
       initReporter.setReportForPublication(e.wafDiagnostics);

dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/config/AppSecConfigServiceImplSpecification.groovy

@@ -13,6 +13,7 @@ import datadog.remoteconfig.state.ProductListener
 import datadog.trace.api.Config
 import datadog.trace.api.ProductActivation
 import datadog.trace.api.UserIdCollectionMode
+import datadog.trace.api.telemetry.WafMetricCollector
 import datadog.trace.test.util.DDSpecification
 
 import java.nio.file.Files
@@ -50,6 +51,7 @@ class AppSecConfigServiceImplSpecification extends DDSpecification {
   AppSecModuleConfigurer.Reconfiguration reconf = Stub()
   AppSecConfigServiceImpl appSecConfigService
   SavedListeners listeners
+  protected static final ORIGINAL_METRIC_COLLECTOR = WafMetricCollector.get()
 
   void cleanup() {
     appSecConfigService?.close()
@@ -712,6 +714,51 @@ class AppSecConfigServiceImplSpecification extends DDSpecification {
     AppSecSystem.active = true
   }
 
+  void 'InvalidRuleSetException is thrown when rules are not configured correctly' () {
+    setup:
+    // Mock WafMetricCollector
+    WafMetricCollector wafMetricCollector = Mock(WafMetricCollector)
+    WafMetricCollector.INSTANCE = wafMetricCollector
+
+    // Create a temporary file with invalid WAF configuration
+    Path p = Files.createTempFile('appsec', '.json')
+    p.toFile() << '''{
+      "version": "2.2",
+      "rules": [
+        {
+          "id": "invalid-rule",
+          "name": "Invalid Rule",
+          "tags": {
+            "type": "invalid_type",
+            "category": "invalid_category"
+          },
+          "conditions": [
+            {
+              "operator": "invalid_operator",
+              "parameters": {
+                "invalid_param": "invalid_value"
+              }
+            }
+          ],
+          "type": "invalid_type",
+          "data": []
+        }
+      ]
+    }'''
+
+    when:
+    appSecConfigService.init()
+
+    then:
+    1 * config.getAppSecRulesFile() >> (p as String)
+    1 * wafMetricCollector.addWafConfigError(_ as Integer)
+    thrown RuntimeException
+
+    cleanup:
+    WafMetricCollector.INSTANCE = ORIGINAL_METRIC_COLLECTOR
+    p.toFile().delete()
+  }
+
   private static AppSecFeatures autoUserInstrum(String mode) {
     return new AppSecFeatures().tap { features ->
       features.autoUserInstrum = new AppSecFeatures.AutoUserInstrum().tap { instrum ->

dd-java-agent/instrumentation/java-concurrent/src/test/groovy/QueueTimingForkedTest.groovy

@@ -31,17 +31,20 @@ class QueueTimingForkedTest extends AgentTestRunner {
     })
 
     then:
-    verify(LinkedBlockingQueue.name)
+    verify(LinkedBlockingQueue.name, 'TestRunnable')
 
     when:
     runUnderTrace("parent", {
       fjp.submit(new TestRunnable()).get()
     })
 
     then:
+    // Starting from Java 24, ForkJoinPool will wrap a Runnable with the {@code java.util.concurrent.ForkJoinTask$AdaptedInterruptibleRunnable} class
+    String expectedTaskClassName = Platform.isJavaVersionAtLeast(24) ? 'AdaptedInterruptibleRunnable' : 'TestRunnable'
+
     // flaky before JDK21
     if (Platform.isJavaVersionAtLeast(21)) {
-      verify("java.util.concurrent.ForkJoinPool\$WorkQueue")
+      verify("java.util.concurrent.ForkJoinPool\$WorkQueue", expectedTaskClassName)
     }
 
     cleanup:
@@ -50,15 +53,15 @@ class QueueTimingForkedTest extends AgentTestRunner {
     TEST_PROFILING_CONTEXT_INTEGRATION.closedTimings.clear()
   }
 
-  void verify(expectedQueueType) {
+  void verify(expectedQueueType, expectedTaskClassName) {
     assert TEST_PROFILING_CONTEXT_INTEGRATION.isBalanced()
     assert !TEST_PROFILING_CONTEXT_INTEGRATION.closedTimings.isEmpty()
     int numAsserts = 0
     while (!TEST_PROFILING_CONTEXT_INTEGRATION.closedTimings.isEmpty()) {
       def timing = TEST_PROFILING_CONTEXT_INTEGRATION.closedTimings.takeFirst() as TestProfilingContextIntegration.TestQueueTiming
       if (!(timing.task as Class).simpleName.isEmpty()) {
         assert timing != null
-        assert timing.task == TestRunnable
+        assert timing.task.simpleName == expectedTaskClassName
         assert timing.scheduler != null
         assert timing.origin == Thread.currentThread()
         assert timing.queueLength >= 0

dd-java-agent/instrumentation/jax-ws-annotations-1/src/main/java/datadog/trace/instrumentation/jaxws1/WebServiceInstrumentation.java

@@ -36,11 +36,6 @@ public WebServiceInstrumentation() {
     super("jax-ws");
   }
 
-  @Override
-  protected boolean defaultEnabled() {
-    return false;
-  }
-
   @Override
   public String hierarchyMarkerType() {
     return null; // bootstrap type

dd-java-agent/instrumentation/jax-ws-annotations-2/src/main/java/datadog/trace/instrumentation/jaxws2/WebServiceProviderInstrumentation.java

@@ -34,11 +34,6 @@ public WebServiceProviderInstrumentation() {
     super("jax-ws");
   }
 
-  @Override
-  protected boolean defaultEnabled() {
-    return false;
-  }
-
   @Override
   public String hierarchyMarkerType() {
     return null; // bootstrap type

dd-java-agent/instrumentation/karate/src/test/groovy/KarateTest.groovy

@@ -1,6 +1,7 @@
 import datadog.trace.api.DisableTestTrace
 import datadog.trace.api.civisibility.config.TestFQN
 import datadog.trace.api.civisibility.config.TestIdentifier
+import datadog.trace.api.Platform
 import datadog.trace.civisibility.CiVisibilityInstrumentationTest
 import datadog.trace.instrumentation.karate.KarateUtils
 import datadog.trace.instrumentation.karate.TestEventsHandlerHolder
@@ -13,12 +14,16 @@ import org.junit.platform.launcher.TestExecutionListener
 import org.junit.platform.launcher.core.LauncherConfig
 import org.junit.platform.launcher.core.LauncherDiscoveryRequestBuilder
 import org.junit.platform.launcher.core.LauncherFactory
+import spock.lang.IgnoreIf
 
 import java.util.concurrent.ConcurrentHashMap
 import java.util.concurrent.CopyOnWriteArrayList
 
 import static org.junit.platform.engine.discovery.DiscoverySelectors.selectClass
 
+@IgnoreIf(reason = "Karate instrumentation is creating an unclosed span of kind test_suite_end specifically for Java 24. Skip until we have a fix.", value = {
+  Platform.isJavaVersionAtLeast(24)
+})
 @DisableTestTrace(reason = "avoid self-tracing")
 class KarateTest extends CiVisibilityInstrumentationTest {