Skip to content

Commit 71d0ff9

Browse files
committed
fix(appsec/jetty8): guard GetPartAdvice against repeated getPart() calls
The Part.class depth check only prevents re-entry within a single getPart() invocation; after the call returns the depth is 0 again, so a second getPart("file") call on the same request would re-fire requestBodyProcessed and requestFilesFilenames with the same cached parts. Add the same _multiPartInputStream == null guard that GetFilenamesAdvice already uses: once the field is set the multipart body was parsed and events were already dispatched — skip.
1 parent fb89f9f commit 71d0ff9

1 file changed

Lines changed: 7 additions & 2 deletions

File tree

dd-java-agent/instrumentation/jetty/jetty-appsec/jetty-appsec-8.1.3/src/main/java/datadog/trace/instrumentation/jetty8/RequestGetPartsInstrumentation.java

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -164,8 +164,13 @@ static void after(
164164
@RequiresRequestContext(RequestContextSlot.APPSEC)
165165
public static class GetPartAdvice {
166166
@Advice.OnMethodEnter(suppress = Throwable.class)
167-
static boolean before() {
168-
return CallDepthThreadLocalMap.incrementCallDepth(Part.class) == 0;
167+
static boolean before(
168+
@Advice.FieldValue(value = "_multiPartInputStream", typing = Assigner.Typing.DYNAMIC)
169+
Object multiPartInputStream) {
170+
// _multiPartInputStream is null before the first parse. Once set, all parts are cached and
171+
// events have already fired (either here or in GetFilenamesAdvice). Skip on repeat calls.
172+
return CallDepthThreadLocalMap.incrementCallDepth(Part.class) == 0
173+
&& multiPartInputStream == null;
169174
}
170175

171176
@Advice.OnMethodExit(suppress = Throwable.class, onThrowable = Throwable.class)

0 commit comments

Comments
 (0)