[debugger] Test PII redaction in log probe messages

[watson]

Motivation

Dynamic Instrumentation / Live Debugger already redacts PII in snapshots, but rendered log-probe messages use separate evaluation and serialization paths that can expose secrets or emit non-canonical placeholders. We need end-to-end coverage that verifies every sensitive expression emits the exact lowercase {redacted} placeholder and never includes the raw value.

Changes

• Add separate rendered-message tests for sensitive identifiers and object members, whole-map rendering, literal map keys, computed map keys, and configured sensitive types.
• Validate excluded identifiers and a non-sensitive control while checking every emitted message for raw-secret leakage.
• Preserve existing workload locals and add the required password, map, and CustomPii fixtures across Java, Java OTel, Python, .NET, and Node.js weblogs.
• Replace the shared hardcoded PII line number with language-specific mappings while preserving all existing downstream line-probe locations.
• Record confirmed implementation bugs in DEBUG-5958, DEBUG-5959, DEBUG-5960, DEBUG-5961, DEBUG-5962, and DEBUG-5963.
• Keep currently unimplemented Node.js and Ruby capabilities independently gated so they can be activated incrementally.

Validation

• ./format.sh
• Java: PII class, full expression-language class, and representative budget/snapshot line probes.
• Python: PII class, full expression-language class, and representative budget/snapshot line probes.
• .NET: PII class, full expression-language class, and representative budget/snapshot line probes.
• Node.js and Ruby: existing excluded-identifiers coverage passes, with unsupported new capabilities skipped by manifests.

Workflow

1. ⚠️ Create your PR as draft ⚠️
2. Work on you PR until the CI passes
3. Mark it as ready for review
   • Test logic is modified? -> Get a review from RFC owner.
   • Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

• Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
• A docker base image is modified?
  • the relevant build-XXX-image label is present
• A scenario is added, removed or renamed?
  • Get a review from R&P team

[github-actions]

CODEOWNERS have been resolved as:

manifests/dotnet.yml                                                    @DataDog/apm-dotnet @DataDog/asm-dotnet
manifests/java.yml                                                      @DataDog/asm-java @DataDog/apm-java
manifests/nodejs.yml                                                    @DataDog/dd-trace-js
manifests/python.yml                                                    @DataDog/apm-python @DataDog/asm-python
manifests/ruby.yml                                                      @DataDog/ruby-guild @DataDog/asm-ruby
tests/debugger/test_debugger_pii.py                                     @DataDog/debugger @DataDog/system-tests-core
tests/debugger/utils.py                                                 @DataDog/debugger @DataDog/system-tests-core
tests/debugger/utils/probes/pii_line.json                               @DataDog/debugger @DataDog/system-tests-core
tests/test_the_test/scenarios.json                                      @DataDog/system-tests-core
utils/build/docker/dotnet/weblog/Controllers/DebuggerController.cs      @DataDog/apm-dotnet @DataDog/asm-dotnet @DataDog/system-tests-core
utils/build/docker/java/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/debugger/DebuggerController.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
utils/build/docker/java_otel/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/debugger/DebuggerController.java  @DataDog/opentelemetry @DataDog/system-tests-core
utils/build/docker/nodejs/express/debugger/index.js                     @DataDog/dd-trace-js @DataDog/system-tests-core
utils/build/docker/nodejs/express/debugger/pii.js                       @DataDog/dd-trace-js @DataDog/system-tests-core
utils/build/docker/nodejs/express4-typescript/debugger/index.ts         @DataDog/dd-trace-js @DataDog/system-tests-core
utils/build/docker/nodejs/express4-typescript/debugger/pii.ts           @DataDog/dd-trace-js @DataDog/system-tests-core
utils/build/docker/nodejs/fastify/debugger/index.js                     @DataDog/dd-trace-js @DataDog/system-tests-core
utils/build/docker/nodejs/fastify/debugger/pii.js                       @DataDog/dd-trace-js @DataDog/system-tests-core
utils/build/docker/python/flask/debugger/debugger_controller.py         @DataDog/apm-python @DataDog/asm-python @DataDog/system-tests-core
utils/build/docker/ruby/shared/rails/app/controllers/debugger_controller.rb  @DataDog/ruby-guild @DataDog/asm-ruby @DataDog/system-tests-core

[datadog-prod-us1-6]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 144e82e | Docs | View more details | Give us feedback!}

[datadog-prod-us1-6]

More details

The updated PII workloads and line-probe mappings resolve consistently across the enabled Java, .NET, Python, Ruby, and Node.js fixtures, and the new rendered-message checks cover the introduced secret shapes without exposing a diff-only regression.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit d1fe4f2 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d1fe4f2fb2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-prod-us1-6]

View session in Datadog

Bits Code status: ✅ Done

Comment @DataDog to request changes

[datadog-prod-us1-6]

More details

The PII message tests use language-specific probe lines, check exact redaction, block raw secret values, and disable unsupported cases through manifests. No concrete defect appears in these changes.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 144e82e · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}