Fixing ArrayIndexOutOfBoundsException in PercentEscaper #9032

mhlidd · 2025-06-25T01:00:29Z

What Does This Do

Fixes ArrayIndexOutOfBoundsException from false array bounds check.

Motivation

Additional Notes

Contributor Checklist

Format the title according the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any usefull labels
Don't use close, fix or any linking keywords when referencing an issue.
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, move, or deletion
Update the public documentation in case of new configuration flag or behavior

Jira ticket: [PROJ-IDENT]

github-actions · 2025-06-25T01:00:39Z

Hi! 👋 Thanks for your pull request! 🎉

To help us review it, please make sure to:

Add at least one type, and one component or instrumentation label to the pull request

If you need help, please check our contributing guidelines.

pr-commenter · 2025-06-25T01:38:23Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mhlidd/percent_escaper_fix
git_commit_date	1750788935	1750813172
git_commit_sha	`faeb62c`	`7f6f769`
release_version	1.51.0-SNAPSHOT~faeb62cfb1	1.51.0-SNAPSHOT~7f6f769e58

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1750815056	1750815056
ci_job_id	997176543	997176543
ci_pipeline_id	68685256	68685256
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-bziamzy-project-304-concurrent-0-ni5smat5 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-bziamzy-project-304-concurrent-0-ni5smat5 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 46 metrics, 7 unstable metrics.

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.51.0-SNAPSHOT~7f6f769e58, baseline=1.51.0-SNAPSHOT~faeb62cfb1

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.005 s) : 0, 1005138
Total [baseline] (8.526 s) : 0, 8526403
Agent [candidate] (992.775 ms) : 0, 992775
Total [candidate] (8.521 s) : 0, 8520991
section iast
Agent [baseline] (1.125 s) : 0, 1125278
Total [baseline] (9.213 s) : 0, 9212843
Agent [candidate] (1.128 s) : 0, 1128047
Total [candidate] (9.24 s) : 0, 9240100

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.005 s	-
Agent	iast	1.125 s	120.14 ms (12.0%)
Total	tracing	8.526 s	-
Total	iast	9.213 s	686.44 ms (8.1%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	992.775 ms	-
Agent	iast	1.128 s	135.272 ms (13.6%)
Total	tracing	8.521 s	-
Total	iast	9.24 s	719.109 ms (8.4%)

gantt
    title insecure-bank - break down per module: candidate=1.51.0-SNAPSHOT~7f6f769e58, baseline=1.51.0-SNAPSHOT~faeb62cfb1

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (693.704 ms) : 0, 693704
BytebuddyAgent [candidate] (685.417 ms) : 0, 685417
GlobalTracer [baseline] (244.681 ms) : 0, 244681
GlobalTracer [candidate] (241.595 ms) : 0, 241595
AppSec [baseline] (30.566 ms) : 0, 30566
AppSec [candidate] (29.945 ms) : 0, 29945
Debugger [baseline] (6.105 ms) : 0, 6105
Debugger [candidate] (6.083 ms) : 0, 6083
Remote Config [baseline] (650.127 µs) : 0, 650
Remote Config [candidate] (644.565 µs) : 0, 645
Telemetry [baseline] (8.254 ms) : 0, 8254
Telemetry [candidate] (8.175 ms) : 0, 8175
section iast
BytebuddyAgent [baseline] (804.295 ms) : 0, 804295
BytebuddyAgent [candidate] (806.474 ms) : 0, 806474
GlobalTracer [baseline] (231.007 ms) : 0, 231007
GlobalTracer [candidate] (231.814 ms) : 0, 231814
AppSec [baseline] (29.211 ms) : 0, 29211
AppSec [candidate] (25.679 ms) : 0, 25679
Debugger [baseline] (5.723 ms) : 0, 5723
Debugger [candidate] (5.815 ms) : 0, 5815
Remote Config [baseline] (572.141 µs) : 0, 572
Remote Config [candidate] (578.032 µs) : 0, 578
Telemetry [baseline] (7.829 ms) : 0, 7829
Telemetry [candidate] (7.848 ms) : 0, 7848
IAST [baseline] (25.881 ms) : 0, 25881
IAST [candidate] (29.032 ms) : 0, 29032

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.51.0-SNAPSHOT~7f6f769e58, baseline=1.51.0-SNAPSHOT~faeb62cfb1

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.013 s) : 0, 1013282
Total [baseline] (10.658 s) : 0, 10657552
Agent [candidate] (991.888 ms) : 0, 991888
Total [candidate] (10.635 s) : 0, 10635442
section appsec
Agent [baseline] (1.166 s) : 0, 1166430
Total [baseline] (10.629 s) : 0, 10628829
Agent [candidate] (1.169 s) : 0, 1169427
Total [candidate] (10.664 s) : 0, 10663887
section iast
Agent [baseline] (1.133 s) : 0, 1133077
Total [baseline] (10.861 s) : 0, 10860520
Agent [candidate] (1.136 s) : 0, 1135521
Total [candidate] (10.805 s) : 0, 10805126
section profiling
Agent [baseline] (1.245 s) : 0, 1244655
Total [baseline] (11.1 s) : 0, 11099952
Agent [candidate] (1.245 s) : 0, 1245119
Total [candidate] (10.907 s) : 0, 10906761

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.013 s	-
Agent	appsec	1.166 s	153.149 ms (15.1%)
Agent	iast	1.133 s	119.796 ms (11.8%)
Agent	profiling	1.245 s	231.373 ms (22.8%)
Total	tracing	10.658 s	-
Total	appsec	10.629 s	-28.723 ms (-0.3%)
Total	iast	10.861 s	202.967 ms (1.9%)
Total	profiling	11.1 s	442.399 ms (4.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	991.888 ms	-
Agent	appsec	1.169 s	177.539 ms (17.9%)
Agent	iast	1.136 s	143.633 ms (14.5%)
Agent	profiling	1.245 s	253.231 ms (25.5%)
Total	tracing	10.635 s	-
Total	appsec	10.664 s	28.445 ms (0.3%)
Total	iast	10.805 s	169.684 ms (1.6%)
Total	profiling	10.907 s	271.318 ms (2.6%)

gantt
    title petclinic - break down per module: candidate=1.51.0-SNAPSHOT~7f6f769e58, baseline=1.51.0-SNAPSHOT~faeb62cfb1

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (700.048 ms) : 0, 700048
BytebuddyAgent [candidate] (684.691 ms) : 0, 684691
GlobalTracer [baseline] (245.992 ms) : 0, 245992
GlobalTracer [candidate] (241.582 ms) : 0, 241582
AppSec [baseline] (30.856 ms) : 0, 30856
AppSec [candidate] (29.877 ms) : 0, 29877
Debugger [baseline] (6.184 ms) : 0, 6184
Debugger [candidate] (6.047 ms) : 0, 6047
Remote Config [baseline] (665.932 µs) : 0, 666
Remote Config [candidate] (649.323 µs) : 0, 649
Telemetry [baseline] (8.452 ms) : 0, 8452
Telemetry [candidate] (8.148 ms) : 0, 8148
section appsec
BytebuddyAgent [baseline] (707.177 ms) : 0, 707177
BytebuddyAgent [candidate] (708.6 ms) : 0, 708600
GlobalTracer [baseline] (234.295 ms) : 0, 234295
GlobalTracer [candidate] (235.087 ms) : 0, 235087
AppSec [baseline] (167.896 ms) : 0, 167896
AppSec [candidate] (168.621 ms) : 0, 168621
Debugger [baseline] (5.816 ms) : 0, 5816
Debugger [candidate] (5.856 ms) : 0, 5856
Remote Config [baseline] (596.416 µs) : 0, 596
Remote Config [candidate] (598.675 µs) : 0, 599
Telemetry [baseline] (8.069 ms) : 0, 8069
Telemetry [candidate] (8.089 ms) : 0, 8089
IAST [baseline] (21.882 ms) : 0, 21882
IAST [candidate] (21.853 ms) : 0, 21853
section iast
BytebuddyAgent [baseline] (810.345 ms) : 0, 810345
BytebuddyAgent [candidate] (812.133 ms) : 0, 812133
GlobalTracer [baseline] (232.629 ms) : 0, 232629
GlobalTracer [candidate] (232.96 ms) : 0, 232960
AppSec [baseline] (28.366 ms) : 0, 28366
AppSec [candidate] (28.18 ms) : 0, 28180
Debugger [baseline] (5.737 ms) : 0, 5737
Debugger [candidate] (5.817 ms) : 0, 5817
Remote Config [baseline] (562.703 µs) : 0, 563
Remote Config [candidate] (576.237 µs) : 0, 576
Telemetry [baseline] (7.841 ms) : 0, 7841
Telemetry [candidate] (7.91 ms) : 0, 7910
IAST [baseline] (26.753 ms) : 0, 26753
IAST [candidate] (27.01 ms) : 0, 27010
section profiling
ProfilingAgent [baseline] (102.673 ms) : 0, 102673
ProfilingAgent [candidate] (102.663 ms) : 0, 102663
BytebuddyAgent [baseline] (679.428 ms) : 0, 679428
BytebuddyAgent [candidate] (679.197 ms) : 0, 679197
GlobalTracer [baseline] (361.682 ms) : 0, 361682
GlobalTracer [candidate] (362.163 ms) : 0, 362163
AppSec [baseline] (31.607 ms) : 0, 31607
AppSec [candidate] (32.539 ms) : 0, 32539
Debugger [baseline] (11.853 ms) : 0, 11853
Debugger [candidate] (7.516 ms) : 0, 7516
Remote Config [baseline] (666.114 µs) : 0, 666
Remote Config [candidate] (679.537 µs) : 0, 680
Telemetry [baseline] (7.931 ms) : 0, 7931
Telemetry [candidate] (11.558 ms) : 0, 11558
Profiling [baseline] (102.697 ms) : 0, 102697
Profiling [candidate] (102.689 ms) : 0, 102689

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mhlidd/percent_escaper_fix
git_commit_date	1750788935	1750813172
git_commit_sha	`faeb62c`	`7f6f769`
release_version	1.51.0-SNAPSHOT~faeb62cfb1	1.51.0-SNAPSHOT~7f6f769e58

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1750814739	1750814739
ci_job_id	997176544	997176544
ci_pipeline_id	68685256	68685256
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-vaym2f8s-project-304-concurrent-0-xcr20tie 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-vaym2f8s-project-304-concurrent-0-xcr20tie 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 1 performance improvements and 2 performance regressions! Performance is the same for 9 metrics, 12 unstable metrics.

scenario	Δ mean http_req_duration	Δ mean throughput	candidate mean http_req_duration	candidate mean throughput	baseline mean http_req_duration	baseline mean throughput
scenario:load:insecure-bank:profiling:high_load	better [-520.322µs; -216.580µs] or [-5.771%; -2.402%]	unstable [-48.279op/s; +91.592op/s] or [-9.382%; +17.799%]	8.648ms	536.250op/s	9.016ms	514.594op/s
scenario:load:petclinic:no_agent:high_load	worse [+2.588ms; +3.223ms] or [+7.341%; +9.140%]	unstable [-18.732op/s; -1.368op/s] or [-14.128%; -1.031%]	38.167ms	122.537op/s	35.261ms	132.588op/s
scenario:load:petclinic:appsec:high_load	worse [+2.024ms; +2.912ms] or [+4.381%; +6.304%]	unstable [-12.206op/s; +2.031op/s] or [-12.050%; +2.005%]	48.667ms	96.200op/s	46.198ms	101.287op/s

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.51.0-SNAPSHOT~7f6f769e58, baseline=1.51.0-SNAPSHOT~faeb62cfb1
    dateFormat X
    axisFormat %s
section baseline
no_agent (4.325 ms) : 4272, 4378
.   : milestone, 4325,
iast (8.998 ms) : 8852, 9144
.   : milestone, 8998,
iast_FULL (13.692 ms) : 13423, 13961
.   : milestone, 13692,
iast_GLOBAL (9.981 ms) : 9795, 10167
.   : milestone, 9981,
profiling (9.016 ms) : 8869, 9163
.   : milestone, 9016,
tracing (7.784 ms) : 7669, 7898
.   : milestone, 7784,
section candidate
no_agent (4.313 ms) : 4259, 4366
.   : milestone, 4313,
iast (8.987 ms) : 8825, 9149
.   : milestone, 8987,
iast_FULL (13.66 ms) : 13394, 13927
.   : milestone, 13660,
iast_GLOBAL (9.886 ms) : 9703, 10070
.   : milestone, 9886,
profiling (8.648 ms) : 8512, 8783
.   : milestone, 8648,
tracing (7.662 ms) : 7546, 7777
.   : milestone, 7662,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	4.325 ms [4.272 ms, 4.378 ms]	-
iast	8.998 ms [8.852 ms, 9.144 ms]	4.673 ms (108.0%)
iast_FULL	13.692 ms [13.423 ms, 13.961 ms]	9.367 ms (216.6%)
iast_GLOBAL	9.981 ms [9.795 ms, 10.167 ms]	5.656 ms (130.8%)
profiling	9.016 ms [8.869 ms, 9.163 ms]	4.691 ms (108.5%)
tracing	7.784 ms [7.669 ms, 7.898 ms]	3.459 ms (80.0%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	4.313 ms [4.259 ms, 4.366 ms]	-
iast	8.987 ms [8.825 ms, 9.149 ms]	4.674 ms (108.4%)
iast_FULL	13.66 ms [13.394 ms, 13.927 ms]	9.348 ms (216.8%)
iast_GLOBAL	9.886 ms [9.703 ms, 10.07 ms]	5.574 ms (129.2%)
profiling	8.648 ms [8.512 ms, 8.783 ms]	4.335 ms (100.5%)
tracing	7.662 ms [7.546 ms, 7.777 ms]	3.349 ms (77.7%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.51.0-SNAPSHOT~7f6f769e58, baseline=1.51.0-SNAPSHOT~faeb62cfb1
    dateFormat X
    axisFormat %s
section baseline
no_agent (35.261 ms) : 34980, 35542
.   : milestone, 35261,
appsec (46.198 ms) : 45797, 46600
.   : milestone, 46198,
code_origins (46.033 ms) : 45660, 46406
.   : milestone, 46033,
iast (43.125 ms) : 42755, 43496
.   : milestone, 43125,
profiling (46.929 ms) : 46515, 47343
.   : milestone, 46929,
tracing (44.077 ms) : 43701, 44452
.   : milestone, 44077,
section candidate
no_agent (38.167 ms) : 37859, 38475
.   : milestone, 38167,
appsec (48.667 ms) : 48243, 49090
.   : milestone, 48667,
code_origins (45.408 ms) : 45049, 45767
.   : milestone, 45408,
iast (42.96 ms) : 42596, 43324
.   : milestone, 42960,
profiling (47.54 ms) : 47103, 47977
.   : milestone, 47540,
tracing (44.482 ms) : 44119, 44845
.   : milestone, 44482,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	35.261 ms [34.98 ms, 35.542 ms]	-
appsec	46.198 ms [45.797 ms, 46.6 ms]	10.937 ms (31.0%)
code_origins	46.033 ms [45.66 ms, 46.406 ms]	10.772 ms (30.5%)
iast	43.125 ms [42.755 ms, 43.496 ms]	7.864 ms (22.3%)
profiling	46.929 ms [46.515 ms, 47.343 ms]	11.667 ms (33.1%)
tracing	44.077 ms [43.701 ms, 44.452 ms]	8.815 ms (25.0%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	38.167 ms [37.859 ms, 38.475 ms]	-
appsec	48.667 ms [48.243 ms, 49.09 ms]	10.499 ms (27.5%)
code_origins	45.408 ms [45.049 ms, 45.767 ms]	7.241 ms (19.0%)
iast	42.96 ms [42.596 ms, 43.324 ms]	4.793 ms (12.6%)
profiling	47.54 ms [47.103 ms, 47.977 ms]	9.373 ms (24.6%)
tracing	44.482 ms [44.119 ms, 44.845 ms]	6.315 ms (16.5%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	mhlidd/percent_escaper_fix
git_commit_date	1750788935	1750813172
git_commit_sha	`faeb62c`	`7f6f769`
release_version	1.51.0-SNAPSHOT~faeb62cfb1	1.51.0-SNAPSHOT~7f6f769e58

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1750815269	1750815269
ci_job_id	997176545	997176545
ci_pipeline_id	68685256	68685256
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-6z7wq9aq-project-304-concurrent-0-37rvqpjc 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-6z7wq9aq-project-304-concurrent-0-37rvqpjc 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.51.0-SNAPSHOT~7f6f769e58, baseline=1.51.0-SNAPSHOT~faeb62cfb1
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.478 ms) : 1467, 1490
.   : milestone, 1478,
appsec (2.398 ms) : 2350, 2447
.   : milestone, 2398,
iast (2.186 ms) : 2125, 2247
.   : milestone, 2186,
iast_GLOBAL (2.222 ms) : 2161, 2283
.   : milestone, 2222,
profiling (2.034 ms) : 1984, 2083
.   : milestone, 2034,
tracing (2.014 ms) : 1967, 2061
.   : milestone, 2014,
section candidate
no_agent (1.479 ms) : 1468, 1491
.   : milestone, 1479,
appsec (2.394 ms) : 2346, 2442
.   : milestone, 2394,
iast (2.183 ms) : 2122, 2244
.   : milestone, 2183,
iast_GLOBAL (2.222 ms) : 2161, 2283
.   : milestone, 2222,
profiling (2.047 ms) : 1997, 2097
.   : milestone, 2047,
tracing (2.003 ms) : 1955, 2051
.   : milestone, 2003,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.478 ms [1.467 ms, 1.49 ms]	-
appsec	2.398 ms [2.35 ms, 2.447 ms]	920.173 µs (62.3%)
iast	2.186 ms [2.125 ms, 2.247 ms]	707.606 µs (47.9%)
iast_GLOBAL	2.222 ms [2.161 ms, 2.283 ms]	743.607 µs (50.3%)
profiling	2.034 ms [1.984 ms, 2.083 ms]	555.821 µs (37.6%)
tracing	2.014 ms [1.967 ms, 2.061 ms]	535.887 µs (36.3%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.479 ms [1.468 ms, 1.491 ms]	-
appsec	2.394 ms [2.346 ms, 2.442 ms]	914.717 µs (61.8%)
iast	2.183 ms [2.122 ms, 2.244 ms]	704.208 µs (47.6%)
iast_GLOBAL	2.222 ms [2.161 ms, 2.283 ms]	742.872 µs (50.2%)
profiling	2.047 ms [1.997 ms, 2.097 ms]	567.848 µs (38.4%)
tracing	2.003 ms [1.955 ms, 2.051 ms]	523.773 µs (35.4%)

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.51.0-SNAPSHOT~7f6f769e58, baseline=1.51.0-SNAPSHOT~faeb62cfb1
    dateFormat X
    axisFormat %s
section baseline
no_agent (14.964 s) : 14964000, 14964000
.   : milestone, 14964000,
appsec (14.973 s) : 14973000, 14973000
.   : milestone, 14973000,
iast (18.142 s) : 18142000, 18142000
.   : milestone, 18142000,
iast_GLOBAL (17.929 s) : 17929000, 17929000
.   : milestone, 17929000,
profiling (15.272 s) : 15272000, 15272000
.   : milestone, 15272000,
tracing (14.596 s) : 14596000, 14596000
.   : milestone, 14596000,
section candidate
no_agent (15.0 s) : 15000000, 15000000
.   : milestone, 15000000,
appsec (14.935 s) : 14935000, 14935000
.   : milestone, 14935000,
iast (18.516 s) : 18516000, 18516000
.   : milestone, 18516000,
iast_GLOBAL (17.929 s) : 17929000, 17929000
.   : milestone, 17929000,
profiling (15.295 s) : 15295000, 15295000
.   : milestone, 15295000,
tracing (14.784 s) : 14784000, 14784000
.   : milestone, 14784000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	14.964 s [14.964 s, 14.964 s]	-
appsec	14.973 s [14.973 s, 14.973 s]	9.0 ms (0.1%)
iast	18.142 s [18.142 s, 18.142 s]	3.178 s (21.2%)
iast_GLOBAL	17.929 s [17.929 s, 17.929 s]	2.965 s (19.8%)
profiling	15.272 s [15.272 s, 15.272 s]	308.0 ms (2.1%)
tracing	14.596 s [14.596 s, 14.596 s]	-368.0 ms (-2.5%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.0 s [15.0 s, 15.0 s]	-
appsec	14.935 s [14.935 s, 14.935 s]	-65.0 ms (-0.4%)
iast	18.516 s [18.516 s, 18.516 s]	3.516 s (23.4%)
iast_GLOBAL	17.929 s [17.929 s, 17.929 s]	2.929 s (19.5%)
profiling	15.295 s [15.295 s, 15.295 s]	295.0 ms (2.0%)
tracing	14.784 s [14.784 s, 14.784 s]	-216.0 ms (-1.4%)

smola · 2025-06-27T10:12:06Z

@PerfectSlayer @mhlidd I think this should not have tag: no release notes. It's a critical bug escalated by multiple users, and so it should be visible in release notes.

PerfectSlayer · 2025-06-27T10:22:52Z

Thanks for the heads-up, I removed id. I did not think it would be trigger in prod.
As it was, I really would like to have some tests around it to make sure we won't re-introduce the issue.

mhlidd · 2025-06-27T13:03:45Z

As it was, I really would like to have some tests around it to make sure we won't re-introduce the issue.

I agree. There were no tests for this initially because the escaper code was taken directly from OTEL, but was then modified because our use case was slightly different. The only time this is currently tested is through BaggagePropagatorTest when injecting/extracting headers but I can add unit tests for the PercentEscaper itself in a future PR.

cc: @PerfectSlayer

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.errorprone:error_prone_annotations](https://errorprone.info) ([source](https://github.com/google/error-prone)) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.39.0` -> `2.40.0` | | [org.apache.commons:commons-lang3](https://commons.apache.org/proper/commons-lang/) ([source](https://gitbox.apache.org/repos/asf/commons-lang.git)) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `3.17.0` -> `3.18.0` | | [org.jetbrains.kotlinx.binary-compatibility-validator](https://github.com/Kotlin/binary-compatibility-validator) | plugin | misk/gradle/libs.versions.toml | gradle | patch | `0.18.0` -> `0.18.1` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.50.1` -> `1.51.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | --- ### Release Notes <details> <summary>google/error-prone (com.google.errorprone:error_prone_annotations)</summary> ### [`v2.40.0`](https://github.com/google/error-prone/releases/tag/v2.40.0): Error Prone 2.40.0 Changes: - Bug fixes and improvements - Releases (including snapshots) have migrated from [OSSRH to the Central Publisher Portal](https://central.sonatype.org/pages/ossrh-eol/#process-to-migrate) Full changelog: google/error-prone@v2.39.0...v2.40.0 </details> <details> <summary>Kotlin/binary-compatibility-validator (org.jetbrains.kotlinx.binary-compatibility-validator)</summary> ### [`v0.18.1`](https://github.com/Kotlin/binary-compatibility-validator/releases/tag/0.18.1) [Compare Source](Kotlin/binary-compatibility-validator@0.18.0...0.18.1) #### What's Changed - Fixed a bug preventing use of cross-compilation support during KLIB dump validation \[[#304](https://github.com/Kotlin/binary-compatibility-validator/issues/304)]\[[#306](https://github.com/Kotlin/binary-compatibility-validator/issues/306)] </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.51.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.51.0): 1.51.0 ### Components #### Application Security Management (IAST) - 🐛 Fix verify error when ctor params are used after a call site ([#9083](DataDog/dd-trace-java#9083) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛 Limit the maximum size of the location path in IAST vulnerabilities ([#9028](DataDog/dd-trace-java#9028) - [@jandro996](https://github.com/jandro996)) - 🐛 Fix IAST gRPC handler with null superclass ([#8984](DataDog/dd-trace-java#8984) - [@smola](https://github.com/smola)) - ✨ Optimize IAST Vulnerability Detection ([#8885](DataDog/dd-trace-java#8885) - [@jandro996](https://github.com/jandro996)) #### Application Security Management (WAF) - ✨ Upgrade libddwaf-java to 15.0.0 ([#9022](DataDog/dd-trace-java#9022) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Extract RestEasy json body response schemas ([#9015](DataDog/dd-trace-java#9015) - [@jandro996](https://github.com/jandro996)) - ✨ Extract Jersey json body response schemas ([#9014](DataDog/dd-trace-java#9014) - [@jandro996](https://github.com/jandro996)) - ✨ Extract Ratpack json body response schemas ([#9013](DataDog/dd-trace-java#9013) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Enable API Security by default and make it lazy loading ([#9009](DataDog/dd-trace-java#9009) - [@smola](https://github.com/smola)) - ✨ Extract Vert.x json body response schemas ([#9001](DataDog/dd-trace-java#9001) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Extract Play json body response schemas ([#8995](DataDog/dd-trace-java#8995) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛 Fix Jackson nodes introspection for request/response schema extraction ([#8980](DataDog/dd-trace-java#8980) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Extract Spring json body response schemas ([#8938](DataDog/dd-trace-java#8938) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Default obfuscation regexp update ([#8937](DataDog/dd-trace-java#8937) - [@sezen-datadog](https://github.com/sezen-datadog)) #### Build & Tooling - ✨ Cancel GitLab running pipeline on new PR push ([#9023](DataDog/dd-trace-java#9023) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Migrate publishing to Maven Central Portal ([#8807](DataDog/dd-trace-java#8807) - [@sarahchen6](https://github.com/sarahchen6)) #### Continuous Integration Visibility - 🐛 Fix Test Optimization to work with JDK 24 ([#9114](DataDog/dd-trace-java#9114) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add repo root as safe directory on git client creation ([#9033](DataDog/dd-trace-java#9033) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Add PR number tag and improve PR information building ([#8990](DataDog/dd-trace-java#8990) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Update impacted tests logic ([#8923](DataDog/dd-trace-java#8923) - [@daniel-mohedano](https://github.com/daniel-mohedano)) #### Data Streams Monitoring - 🧹 Clean up DSM context injection ([#8776](DataDog/dd-trace-java#8776) - [@PerfectSlayer](https://github.com/PerfectSlayer)) #### Database Monitoring - 🐛 Set trace\_injected in try block ([#9025](DataDog/dd-trace-java#9025) - [@natashadada](https://github.com/natashadada)) #### Dynamic Instrumentation - 🐛 Add source file tracking enable option ([#9115](DataDog/dd-trace-java#9115) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add java.util.Date support ([#9111](DataDog/dd-trace-java#9111) - [@jpbempel](https://github.com/jpbempel)) - ✨ Update file probe format ([#9047](DataDog/dd-trace-java#9047) - [@jpbempel](https://github.com/jpbempel)) - ✨ add safe local var hoisting ([#9034](DataDog/dd-trace-java#9034) - [@jpbempel](https://github.com/jpbempel)) - 🧹 Add new config for debugger upload interval ([#8959](DataDog/dd-trace-java#8959) - [@jpbempel](https://github.com/jpbempel)) - ✨ Enable Code Origin with Dynamic instrumentation ([#8940](DataDog/dd-trace-java#8940) - [@jpbempel](https://github.com/jpbempel)) #### ML Observability (LLMObs) - 💡 LLM Observability SDK ([#8781](DataDog/dd-trace-java#8781) - [@gary-huang](https://github.com/gary-huang), [@nayeem-kamal](https://github.com/nayeem-kamal)) #### Metrics - 🐛 Ensure client stat reporter is started when the agent is not available at bootstrap ([#9082](DataDog/dd-trace-java#9082) - [@amarziali](https://github.com/amarziali)) - ✨ Create metric: appsec.waf.config\_errors ([#8394](DataDog/dd-trace-java#8394) - [@sezen-datadog](https://github.com/sezen-datadog)) #### Platform components - ✨ Introduce environment component ([#9071](DataDog/dd-trace-java#9071) - [@PerfectSlayer](https://github.com/PerfectSlayer)) #### Profiling - 🐛 Remove annoying warning for smap event parsing ([#9119](DataDog/dd-trace-java#9119) - [@jbachorik](https://github.com/jbachorik)) - 🐛 Fix ByteCountingInputStream when reading past EOF ([#8988](DataDog/dd-trace-java#8988) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Realtime User Monitoring - ✨ Add RUM SDK injection for servlet based web servers ([#9110](DataDog/dd-trace-java#9110) - [@PerfectSlayer](https://github.com/PerfectSlayer) [@amarziali](https://github.com/amarziali)) #### Telemetry - ✨ Update the config origin metric to match what it's mapping ([#9045](DataDog/dd-trace-java#9045) - [@sezen-datadog](https://github.com/sezen-datadog)) #### Testing - ✨ Add testing for latest stable version (JDK 24) ([#8875](DataDog/dd-trace-java#8875) - [@sarahchen6](https://github.com/sarahchen6)) #### Trace context propagation - 🐛 Fix bug with dropping baggage when `TracePropagationBehaviorExtract=IGNORE` ([#9037](DataDog/dd-trace-java#9037) - [@mhlidd](https://github.com/mhlidd)) - 🐛 Fix ArrayIndexOutOfBoundsException in PercentEscaper ([#9032](DataDog/dd-trace-java#9032) - [@mhlidd](https://github.com/mhlidd)) #### Tracer core - 🐛 Fix `Error` handling for trace interceptors ([#9097](DataDog/dd-trace-java#9097) - [@AlexeyKuznetsov-DD](https://github.com/AlexeyKuznetsov-DD)) - 💡 Add wildcard feature for `DD_TRACE_HEADER_TAGS` and enabling for Http Response headers ([#9067](DataDog/dd-trace-java#9067) - [@mhlidd](https://github.com/mhlidd)) #### Tracer public API - 💡 Add LLM Observability SDK ([#8781](DataDog/dd-trace-java#8781) - [@gary-huang](https://github.com/gary-huang)) ### Instrumentations #### Akka instrumentation - 🐛 Fix NPE in akka-http and pekko-http integrations ([#9019](DataDog/dd-trace-java#9019) - [@mcculls](https://github.com/mcculls)) #### Eclipse Vert.x instrumentation - ✨ Extract Vert.x json body response schemas ([#9001](DataDog/dd-trace-java#9001) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Write http.route tag as soon as possible in vert.x ([#8952](DataDog/dd-trace-java#8952) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### JAX-WS instrumentation - 💡⚠️ Enable jax-ws integration by default ([#9030](DataDog/dd-trace-java#9030) - [@bm1549](https://github.com/bm1549)) - ✨ Extract Jersey json body response schemas ([#9014](DataDog/dd-trace-java#9014) - [@jandro996](https://github.com/jandro996)) #### Mule instrumentation - 🐛 Propagate grizzly http span in filters if nothing is active ([#9016](DataDog/dd-trace-java#9016) - [@amarziali](https://github.com/amarziali)) #### Play Framework instrumentation - ✨ Extract Play json body response schemas ([#8995](DataDog/dd-trace-java#8995) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Ratpack instrumentation - ✨ Extract Ratpack json body response schemas ([#9013](DataDog/dd-trace-java#9013) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Spring instrumentation - ✨ Extract Spring json body response schemas ([#8938](DataDog/dd-trace-java#8938) - [@sezen-datadog](https://github.com/sezen-datadog)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: 649b690d4c9d7dcb572c457f0802b42b8e3e682e

fixing NPE in PercentEscaper

7f6f769

mhlidd requested a review from a team as a code owner June 25, 2025 01:00

mhlidd requested a review from mcculls June 25, 2025 01:00

mhlidd added the type: bug Bug report and fix label Jun 25, 2025

mhlidd added the comp: api Tracer public API label Jun 25, 2025

PerfectSlayer approved these changes Jun 25, 2025

View reviewed changes

PerfectSlayer added the tag: no release notes Changes to exclude from release notes label Jun 25, 2025

mhlidd merged commit cb3d992 into master Jun 25, 2025
488 of 490 checks passed

mhlidd deleted the mhlidd/percent_escaper_fix branch June 25, 2025 14:27

github-actions bot added this to the 1.51.0 milestone Jun 25, 2025

PerfectSlayer mentioned this pull request Jun 27, 2025

java.lang.ArrayIndexOutOfBoundsException: Index 93 out of bounds for length 93 #9044

Closed

PerfectSlayer removed the tag: no release notes Changes to exclude from release notes label Jun 27, 2025

mhlidd mentioned this pull request Jun 27, 2025

🍒 9032 - Fix ArrayIndexOutOfBoundsException in PercentEscaper #9050

Merged

mcculls changed the title ~~Fixing NPE in PercentEscaper~~ Fixing ArrayIndexOutOfBoundsException in PercentEscaper Jun 28, 2025

PerfectSlayer added comp: context propagation Trace context propagation and removed comp: api Tracer public API labels Jun 30, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fixing ArrayIndexOutOfBoundsException in PercentEscaper #9032

Fixing ArrayIndexOutOfBoundsException in PercentEscaper #9032

Uh oh!

mhlidd commented Jun 25, 2025 •

edited by mcculls

Loading

Uh oh!

github-actions bot commented Jun 25, 2025 •

edited

Loading

Uh oh!

pr-commenter bot commented Jun 25, 2025

Uh oh!

Uh oh!

smola commented Jun 27, 2025

Uh oh!

PerfectSlayer commented Jun 27, 2025 •

edited

Loading

Uh oh!

mhlidd commented Jun 27, 2025 •

edited

Loading

Uh oh!

Uh oh!

Fixing ArrayIndexOutOfBoundsException in PercentEscaper #9032

Fixing ArrayIndexOutOfBoundsException in PercentEscaper #9032

Uh oh!

Conversation

mhlidd commented Jun 25, 2025 • edited by mcculls Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

github-actions bot commented Jun 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pr-commenter bot commented Jun 25, 2025

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

Uh oh!

smola commented Jun 27, 2025

Uh oh!

PerfectSlayer commented Jun 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mhlidd commented Jun 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

mhlidd commented Jun 25, 2025 •

edited by mcculls

Loading

github-actions bot commented Jun 25, 2025 •

edited

Loading

PerfectSlayer commented Jun 27, 2025 •

edited

Loading

mhlidd commented Jun 27, 2025 •

edited

Loading