AppSec Lambda: Analyze HTTP response (#11750)

refactor + add appsec data to span

unit tests

add better support for query parameters

apply spotless

fix test crash

remove unused var

forwarded headers parsing + downgrade log level

formatting

WIP

wip

AppSec Lambda: HTTP trigger type detection + resource name fix for extension dedup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

PR review fixes: revert broken startSpan calls + test quality cleanup

spotlessApply

Normalise content-type casing before JSON detection

spotlessApply

Address review: narrow throws, add IAST slot and null appSecContext assertions

Use assertDoesNotThrow for no-op method assertions, remove throws Exception

Add coverage tests for LambdaAppSecHandler edge cases

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Address review: hoist isHttp() guard, skip notifyAppSecEnd on throwable, remove FQNs

URL-encode query param keys/values in LambdaAppSecHandler.buildFullPath

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Propagate ASM_KEEP for Lambda traces kept by trace-tagging rules with no WAF events

Test percent-encoding of special characters in query params

Guard AppSecContext cast in processRequestEnd to prevent ClassCastException

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Merge branch 'master' into clara.poncet/appsec-lambda-response

Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>

Author: claponcet

dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/AppSecRequestContext.java

@@ -11,6 +11,7 @@
 import com.datadog.ddwaf.WafHandle;
 import com.datadog.ddwaf.WafMetrics;
 import datadog.trace.api.Config;
+import datadog.trace.api.appsec.AppSecContext;
 import datadog.trace.api.endpoint.EndpointResolver;
 import datadog.trace.api.http.StoredBodySupplier;
 import datadog.trace.api.internal.TraceSegment;
@@ -45,7 +46,7 @@
 // TODO: different methods to be called by different parts perhaps splitting it would make sense
 // or at least create separate interfaces
 @SuppressFBWarnings("AT_STALE_THREAD_WRITE_OF_PRIMITIVE")
-public class AppSecRequestContext implements DataBundle, Closeable {
+public class AppSecRequestContext implements DataBundle, Closeable, AppSecContext {
   private static final Logger log = LoggerFactory.getLogger(AppSecRequestContext.class);
 
   public static final int DEFAULT_EXTENDED_DATA_COLLECTION_MAX_HEADERS = 50;

dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/main/java/datadog/trace/instrumentation/aws/v1/lambda/LambdaHandlerInstrumentation.java

@@ -126,7 +126,9 @@ static void exit(
         }
         String lambdaRequestId = awsContext.getAwsRequestId();
 
-        AgentTracer.get().notifyAppSecEnd(span);
+        if (throwable == null) {
+          AgentTracer.get().notifyAppSecEnd(span, result);
+        }
         // Force the resource name back to the literal placeholder marker right
         // before finish so that the Datadog Lambda Extension's filter
         // (filter_span_from_lambda_library_or_runtime in

dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/groovy/LambdaHandlerInstrumentationTest.groovy

@@ -0,0 +1,24 @@
+import com.amazonaws.services.lambda.runtime.Context;
+import com.amazonaws.services.lambda.runtime.RequestStreamHandler;
+import java.io.BufferedWriter;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
+
+public class HandlerStreamingWith404Response implements RequestStreamHandler {
+  @Override
+  public void handleRequest(InputStream inputStream, OutputStream outputStream, Context context)
+      throws IOException {
+    PrintWriter writer =
+        new PrintWriter(
+            new BufferedWriter(new OutputStreamWriter(outputStream, StandardCharsets.UTF_8)));
+    writer.write(
+        "{\"statusCode\": 404, "
+            + "\"headers\": {\"content-type\": \"text/html\"}, "
+            + "\"body\": \"Not Found\"}");
+    writer.close();
+  }
+}

….2/src/test/groovy/HandlerStreaming.java …-1.2/src/test/java/HandlerStreaming.javadd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/groovy/HandlerStreaming.java renamed to dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/java/HandlerStreaming.java dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/groovy/HandlerStreaming.java renamed to dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/java/HandlerStreaming.java

@@ -0,0 +1,24 @@
+import com.amazonaws.services.lambda.runtime.Context;
+import com.amazonaws.services.lambda.runtime.RequestStreamHandler;
+import java.io.BufferedWriter;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.io.OutputStreamWriter;
+import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
+
+public class HandlerStreamingWithApiGwResponse implements RequestStreamHandler {
+  @Override
+  public void handleRequest(InputStream inputStream, OutputStream outputStream, Context context)
+      throws IOException {
+    PrintWriter writer =
+        new PrintWriter(
+            new BufferedWriter(new OutputStreamWriter(outputStream, StandardCharsets.UTF_8)));
+    writer.write(
+        "{\"statusCode\": 200, "
+            + "\"headers\": {\"content-type\": \"application/json\", \"x-custom\": \"custom-val\"}, "
+            + "\"body\": \"{\\\"result\\\": \\\"ok\\\"}\"}");
+    writer.close();
+  }
+}

…amingSimulatesHttpFrameworkResource.java …amingSimulatesHttpFrameworkResource.javadd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/groovy/HandlerStreamingSimulatesHttpFrameworkResource.java renamed to dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/java/HandlerStreamingSimulatesHttpFrameworkResource.java dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/groovy/HandlerStreamingSimulatesHttpFrameworkResource.java renamed to dd-java-agent/instrumentation/aws-java/aws-java-lambda-handler-1.2/src/test/java/HandlerStreamingSimulatesHttpFrameworkResource.java

@@ -0,0 +1,15 @@
+import com.amazonaws.services.lambda.runtime.Context;
+import com.amazonaws.services.lambda.runtime.RequestStreamHandler;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.OutputStream;
+import java.nio.charset.StandardCharsets;
+
+/** Writes valid JSON that is not in API Gateway response format (no statusCode/headers/body). */
+public class HandlerStreamingWithRawJson implements RequestStreamHandler {
+  @Override
+  public void handleRequest(InputStream inputStream, OutputStream outputStream, Context context)
+      throws IOException {
+    outputStream.write("{\"result\": \"hello\"}".getBytes(StandardCharsets.UTF_8));
+  }
+}