Skip to content

RUM: Prevent any Content-Length header from being set upon injection #10081

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
amarziali merged 2 commits into from
Dec 4, 2025
Merged

RUM: Prevent any Content-Length header from being set upon injection #10081

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a76f69c
RUM: Prevent any Content-Length header from being set upon injection
amarziali Dec 4, 2025
50c7b67
avoid null checks
amarziali Dec 4, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 18 additions & 6 deletions ...0/src/main/java/datadog/trace/instrumentation/servlet5/RumHttpServletResponseWrapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,21 +103,33 @@ public PrintWriter getWriter() throws IOException {

@Override
public void setHeader(String name, String value) {
checkForContentSecurityPolicy(name);
if (shouldInject) {
if (isContentLengthHeader(name)) {
return;
}
checkForContentSecurityPolicy(name);
}
super.setHeader(name, value);
}

@Override
public void addHeader(String name, String value) {
checkForContentSecurityPolicy(name);
if (shouldInject) {
if (isContentLengthHeader(name)) {
return;
}
checkForContentSecurityPolicy(name);
}
super.addHeader(name, value);
}

private boolean isContentLengthHeader(String name) {
return "content-length".equalsIgnoreCase(name);
}

private void checkForContentSecurityPolicy(String name) {
if (name != null) {
if (name.startsWith("Content-Security-Policy")) {
RumInjector.getTelemetryCollector().onContentSecurityPolicyDetected(servletVersion);
}
if ("content-security-policy".equalsIgnoreCase(name)) {
RumInjector.getTelemetryCollector().onContentSecurityPolicyDetected(servletVersion);
}
}

Expand Down
24 changes: 18 additions & 6 deletions ...0/src/main/java/datadog/trace/instrumentation/servlet3/RumHttpServletResponseWrapper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,21 +122,33 @@ public PrintWriter getWriter() throws IOException {

@Override
public void setHeader(String name, String value) {
checkForContentSecurityPolicy(name);
if (shouldInject) {
if (isContentLengthHeader(name)) {
return;
}
checkForContentSecurityPolicy(name);
}
super.setHeader(name, value);
}

@Override
public void addHeader(String name, String value) {
checkForContentSecurityPolicy(name);
if (shouldInject) {
if (isContentLengthHeader(name)) {
return;
}
checkForContentSecurityPolicy(name);
}
super.addHeader(name, value);
}

private boolean isContentLengthHeader(String name) {
return "content-length".equalsIgnoreCase(name);
}

private void checkForContentSecurityPolicy(String name) {
if (name != null) {
if (name.startsWith("Content-Security-Policy")) {
RumInjector.getTelemetryCollector().onContentSecurityPolicyDetected(servletVersion);
}
if ("content-security-policy".equalsIgnoreCase(name)) {
RumInjector.getTelemetryCollector().onContentSecurityPolicyDetected(servletVersion);
}
}

Expand Down
5 changes: 5 additions & 0 deletions ...ng-webmvc/spring-webmvc-3.1/src/latestDepTest/groovy/test/boot/SpringBootBasedTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,11 @@ class SpringBootBasedTest extends HttpServerTest<ConfigurableApplicationContext>
true
}

@Override
boolean testRumInjection() {
true
}

@Override
Serializable expectedServerSpanRoute(ServerEndpoint endpoint) {
switch (endpoint) {
Expand Down
21 changes: 21 additions & 0 deletions .../spring-webmvc/spring-webmvc-3.1/src/latestDepTest/groovy/test/boot/TestController.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,27 @@ class TestController {
}
}

@RequestMapping(value = "/gimme-xml", produces = "text/xml")
@ResponseBody
String gimmeXml() {
"<test/>"
}

@RequestMapping(value = "/gimme-html", produces = "text/html")
@ResponseBody
String gimmeHtml() {
"\n" +
"<!doctype html>\n" +
"<html>\n" +
" <head>\n" +
" <title>This is the title of the webpage!</title>\n" +
" </head>\n" +
" <body>\n" +
" <p>This is an example paragraph. Anything in the <strong>body</strong> tag will appear on the page, just like this <strong>p</strong> tag and its contents.</p>\n" +
" </body>\n" +
"</html>"
}

@ExceptionHandler
ResponseEntity handleException(Throwable throwable) {
new ResponseEntity(throwable.message, HttpStatus.INTERNAL_SERVER_ERROR)
Expand Down
5 changes: 5 additions & 0 deletions ...ring/spring-webmvc/spring-webmvc-3.1/src/test/groovy/test/boot/SpringBootBasedTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,11 @@ class SpringBootBasedTest extends HttpServerTest<ConfigurableApplicationContext>
true
}

@Override
boolean testRumInjection() {
true
}

@Override
void assertEndpointDiscovery(final List<?> endpoints) {
final discovered = endpoints.collectEntries { [(it.method): it] } as Map<String, Endpoint>
Expand Down
21 changes: 21 additions & 0 deletions ...on/spring/spring-webmvc/spring-webmvc-3.1/src/test/groovy/test/boot/TestController.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,6 +162,27 @@ class TestController {
}
}

@RequestMapping(value = "/gimme-xml", produces = "text/xml")
@ResponseBody
String gimmeXml() {
"<test/>"
}

@RequestMapping(value = "/gimme-html", produces = "text/html")
@ResponseBody
String gimmeHtml() {
"\n" +
"<!doctype html>\n" +
"<html>\n" +
" <head>\n" +
" <title>This is the title of the webpage!</title>\n" +
" </head>\n" +
" <body>\n" +
" <p>This is an example paragraph. Anything in the <strong>body</strong> tag will appear on the page, just like this <strong>p</strong> tag and its contents.</p>\n" +
" </body>\n" +
"</html>"
}

@RequestMapping(value = "/discovery",
method = [RequestMethod.POST, RequestMethod.PATCH, RequestMethod.PUT],
consumes = MediaType.APPLICATION_JSON_VALUE,
Expand Down
5 changes: 5 additions & 0 deletions .../src/test/groovy/datadog/trace/instrumentation/springweb6/boot/SpringBootBasedTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -221,6 +221,11 @@ class SpringBootBasedTest extends HttpServerTest<ConfigurableApplicationContext>
true
}

@Override
boolean testRumInjection() {
true
}

@Override
Map<String, Serializable> expectedExtraErrorInformation(ServerEndpoint endpoint) {
// latest DispatcherServlet throws if no handlers have been found
Expand Down
21 changes: 21 additions & 0 deletions ...c-6.0/src/test/groovy/datadog/trace/instrumentation/springweb6/boot/TestController.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,27 @@ class TestController {
}
}

@RequestMapping(value = "/gimme-xml", produces = "text/xml")
@ResponseBody
String gimmeXml() {
"<test/>"
}

@RequestMapping(value = "/gimme-html", produces = "text/html")
@ResponseBody
String gimmeHtml() {
"\n" +
"<!doctype html>\n" +
"<html>\n" +
" <head>\n" +
" <title>This is the title of the webpage!</title>\n" +
" </head>\n" +
" <body>\n" +
" <p>This is an example paragraph. Anything in the <strong>body</strong> tag will appear on the page, just like this <strong>p</strong> tag and its contents.</p>\n" +
" </body>\n" +
"</html>"
}

@ExceptionHandler
ResponseEntity handleException(Throwable throwable) {
new ResponseEntity(throwable.message, HttpStatus.INTERNAL_SERVER_ERROR)
Expand Down