Merge branch 'master' into munir/otlp-trace-metrics-fixes

Author: mabdinur

.github/CODEOWNERS

@@ -78,6 +78,7 @@
 /dd-java-agent/instrumentation/snakeyaml-1.33/                  @DataDog/asm-java
 /dd-java-agent/instrumentation/velocity-1.5/                    @DataDog/asm-java
 /dd-java-agent/instrumentation/freemarker/                      @DataDog/asm-java
+/dd-java-agent/instrumentation/beanshell-2.0/                   @DataDog/asm-java
 /dd-java-agent/instrumentation/datadog/asm/                     @DataDog/asm-java
 /dd-smoke-tests/apm-tracing-disabled/                           @DataDog/asm-java
 /dd-smoke-tests/appsec/                                         @DataDog/asm-java

.github/workflows/analyze-changes.yaml

@@ -30,7 +30,7 @@ jobs:
             ${{ runner.os }}-gradle-
         
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: 'java'
           build-mode: 'manual'
@@ -43,7 +43,7 @@ jobs:
           ./gradlew clean :dd-java-agent:shadowJar --build-cache --parallel --stacktrace --no-daemon --max-workers=4
 
       - name: Perform CodeQL Analysis and upload results to GitHub Security tab
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
 
   trivy:
     name: Analyze changes with Trivy
@@ -104,7 +104,7 @@ jobs:
           TRIVY_JAVA_DB_REPOSITORY: ghcr.io/aquasecurity/trivy-java-db,public.ecr.aws/aquasecurity/trivy-java-db
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'

.github/workflows/prune-old-pull-requests.yaml

@@ -13,7 +13,7 @@ jobs:
       pull-requests: write
     steps:
     - name: Prune old pull requests
-      uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
+      uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
       with:
         days-before-stale: -1 # Disable general stale bot
         days-before-pr-stale: 90 # Only enable stale bot for PRs with no activity for 90 days

.github/workflows/update-gradle-dependencies.yaml

@@ -25,7 +25,7 @@ jobs:
         with:
           submodules: "recursive"
 
-      - uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+      - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: 'temurin'
           java-version: '21'

.gitlab/exploration-tests.yml

@@ -7,8 +7,19 @@ build-exploration-tests-image:
   needs: []
   tags: [ "arch:amd64" ]
   image: $REGISTRY/docker:27.3.1
+  id_tokens:
+    DDSIGN_ID_TOKEN:
+      aud: image-integrity
   script:
-    - docker buildx build --tag $EXPLORATION_TESTS_IMAGE -f dd-java-agent/agent-debugger/exploration-tests/Dockerfile.exploration-tests --push dd-java-agent/agent-debugger/exploration-tests
+    - METADATA_FILE=$(mktemp)
+    - >
+      docker buildx build 
+      --tag $EXPLORATION_TESTS_IMAGE 
+      --file dd-java-agent/agent-debugger/exploration-tests/Dockerfile.exploration-tests 
+      --push 
+      --metadata-file ${METADATA_FILE}
+      dd-java-agent/agent-debugger/exploration-tests
+    - ddsign sign $EXPLORATION_TESTS_IMAGE --docker-metadata-file ${METADATA_FILE}
 
 .common-exploration-tests: &common-exploration-tests
   rules:

dd-java-agent/agent-debugger/src/main/java/com/datadog/debugger/symbol/SymbolAggregator.java

@@ -4,6 +4,7 @@
 
 import com.datadog.debugger.sink.SymbolSink;
 import datadog.instrument.utils.ClassNameTrie;
+import datadog.trace.api.internal.VisibleForTesting;
 import datadog.trace.bootstrap.debugger.DebuggerContext;
 import datadog.trace.util.AgentTaskScheduler;
 import datadog.trace.util.Strings;
@@ -28,6 +29,7 @@
 import java.util.concurrent.TimeUnit;
 import java.util.jar.JarEntry;
 import java.util.jar.JarFile;
+import java.util.stream.Stream;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -206,7 +208,7 @@ public void scanJar(
       scanDirectory(jarPath, alreadyScannedJars, baos, buffer, symDBReport);
     } else {
       try {
-        try (JarFile jarFile = new JarFile(jarPathFile)) {
+        try (JarFile jarFile = openJarFile(jarPathFile)) {
           jarFile.stream()
               .filter(jarEntry -> jarEntry.getName().endsWith(".class"))
               .filter(
@@ -225,14 +227,19 @@ public void scanJar(
     alreadyScannedJars.add(jarPath.toString());
   }
 
+  @VisibleForTesting
+  JarFile openJarFile(File file) throws IOException {
+    return new JarFile(file);
+  }
+
   private void scanDirectory(
       Path jarPath,
       Set<String> alreadyScannedJars,
       ByteArrayOutputStream baos,
       byte[] buffer,
       SymDBReport symDBReport) {
-    try {
-      Files.walk(jarPath)
+    try (Stream<Path> paths = Files.walk(jarPath)) {
+      paths
           // explicitly no follow links walking the directory to avoid cycles
           .filter(path -> Files.isRegularFile(path, LinkOption.NOFOLLOW_LINKS))
           .filter(path -> path.toString().endsWith(".class"))
@@ -276,11 +283,14 @@ private void parseJarEntry(
       byte[] buffer) {
     LOGGER.debug("parsing jarEntry class: {}", jarEntry.getName());
     try {
-      InputStream inputStream = jarFile.getInputStream(jarEntry);
-      int readBytes;
-      baos.reset();
-      while ((readBytes = inputStream.read(buffer)) != -1) {
-        baos.write(buffer, 0, readBytes);
+      // must be closed so the JarFile returns its Inflater to the cache instead of allocating a
+      // new native zlib context per entry
+      try (InputStream inputStream = jarFile.getInputStream(jarEntry)) {
+        int readBytes;
+        baos.reset();
+        while ((readBytes = inputStream.read(buffer)) != -1) {
+          baos.write(buffer, 0, readBytes);
+        }
       }
       parseClass(symDBReport, jarEntry.getName(), baos.toByteArray(), jarPath.toString());
     } catch (IOException ex) {

dd-java-agent/agent-debugger/src/test/java/com/datadog/debugger/symbol/SymbolAggregatorTest.java

@@ -15,9 +15,19 @@
 
 import com.datadog.debugger.sink.SymbolSink;
 import com.datadog.debugger.util.ClassNameFiltering;
+import java.io.ByteArrayOutputStream;
+import java.io.File;
+import java.io.FilterInputStream;
+import java.io.IOException;
+import java.io.InputStream;
 import java.net.URL;
+import java.nio.file.Path;
+import java.nio.file.Paths;
 import java.security.CodeSource;
 import java.security.ProtectionDomain;
+import java.util.concurrent.atomic.AtomicInteger;
+import java.util.jar.JarFile;
+import java.util.zip.ZipEntry;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.condition.DisabledIf;
 import org.mockito.ArgumentCaptor;
@@ -76,6 +86,45 @@ void testScanQueuedCorruptedJars() {
         captor.getAllValues().get(2));
   }
 
+  @Test
+  void testScanJarClosesEntryStreams() throws Exception {
+    SymbolSink symbolSink = mock(SymbolSink.class);
+    CountingJarFile[] holder = new CountingJarFile[1];
+    SymbolAggregator symbolAggregator =
+        new SymbolAggregator(ClassNameFiltering.allowAll(), emptyList(), symbolSink, 1) {
+          @Override
+          JarFile openJarFile(File file) throws IOException {
+            return holder[0] = new CountingJarFile(file);
+          }
+        };
+    Path jarPath = Paths.get(getClass().getResource("/debugger-symbol.jar").toURI());
+    symbolAggregator.scanJar(
+        SymDBReport.NO_OP, jarPath, new ByteArrayOutputStream(8192), new byte[4096]);
+    assertTrue(holder[0].opened.get() > 0);
+    assertEquals(holder[0].opened.get(), holder[0].closed.get());
+  }
+
+  private static class CountingJarFile extends JarFile {
+    final AtomicInteger opened = new AtomicInteger();
+    final AtomicInteger closed = new AtomicInteger();
+
+    CountingJarFile(File file) throws IOException {
+      super(file);
+    }
+
+    @Override
+    public synchronized InputStream getInputStream(ZipEntry ze) throws IOException {
+      opened.incrementAndGet();
+      return new FilterInputStream(super.getInputStream(ze)) {
+        @Override
+        public void close() throws IOException {
+          closed.incrementAndGet();
+          super.close();
+        }
+      };
+    }
+  }
+
   @Test
   @DisabledIf(
       value = "datadog.environment.JavaVirtualMachine#isJ9",

dd-java-agent/agent-iast/build.gradle

@@ -51,6 +51,7 @@ dependencies {
   testImplementation project(':dd-java-agent:agent-bootstrap')
   testImplementation('org.skyscreamer:jsonassert:1.5.1')
   testImplementation(libs.bytebuddy)
+  testImplementation libs.bundles.mockito
 
   testImplementation(libs.groovy.yaml)
 

dd-java-agent/agent-iast/src/main/java/com/datadog/iast/IastSystem.java

@@ -10,6 +10,7 @@
 import com.datadog.iast.propagation.StringModuleImpl;
 import com.datadog.iast.securitycontrol.IastSecurityControlTransformer;
 import com.datadog.iast.sink.ApplicationModuleImpl;
+import com.datadog.iast.sink.CodeInjectionModuleImpl;
 import com.datadog.iast.sink.CommandInjectionModuleImpl;
 import com.datadog.iast.sink.EmailInjectionModuleImpl;
 import com.datadog.iast.sink.HardcodedSecretModuleImpl;
@@ -187,7 +188,8 @@ private static Stream<IastModule> iastModules(
             InsecureAuthProtocolModuleImpl.class,
             ReflectionInjectionModuleImpl.class,
             UntrustedDeserializationModuleImpl.class,
-            EmailInjectionModuleImpl.class);
+            EmailInjectionModuleImpl.class,
+            CodeInjectionModuleImpl.class);
     if (iast != FULLY_ENABLED) {
       modules = modules.filter(IastSystem::isOptOut);
     }

dd-java-agent/agent-iast/src/main/java/com/datadog/iast/model/VulnerabilityType.java

@@ -1,6 +1,7 @@
 package com.datadog.iast.model;
 
 import static com.datadog.iast.util.CRCUtils.update;
+import static datadog.trace.api.iast.VulnerabilityMarks.CODE_INJECTION_MARK;
 import static datadog.trace.api.iast.VulnerabilityMarks.COMMAND_INJECTION_MARK;
 import static datadog.trace.api.iast.VulnerabilityMarks.EMAIL_HTML_INJECTION_MARK;
 import static datadog.trace.api.iast.VulnerabilityMarks.HEADER_INJECTION_MARK;
@@ -171,6 +172,9 @@ public interface VulnerabilityType {
           .excludedSources(Builder.DB_EXCLUDED)
           .build();
 
+  VulnerabilityType CODE_INJECTION =
+      type(VulnerabilityTypes.CODE_INJECTION).mark(CODE_INJECTION_MARK).build();
+
   /* All vulnerability types that have a mark. Should be updated if new vulnerabilityType with mark is added */
   VulnerabilityType[] MARKED_VULNERABILITIES = {
     SQL_INJECTION,
@@ -185,7 +189,8 @@ public interface VulnerabilityType {
     HEADER_INJECTION,
     REFLECTION_INJECTION,
     UNTRUSTED_DESERIALIZATION,
-    EMAIL_HTML_INJECTION
+    EMAIL_HTML_INJECTION,
+    CODE_INJECTION
   };
 
   String name();