Skip to content

Commit d1573f8

Browse files
jandro996jandro996
committed
refactor(appsec): unify file content limits via Config for DD_APPSEC_MAX_FILE_CONTENT_BYTES/COUNT
Replace hardcoded constants MAX_CONTENT_BYTES=4096 and MAX_FILES_TO_INSPECT=25 (duplicated across commons-fileupload, Netty, and Tomcat) with two Config-backed variables: appsec.max.file-content.bytes and appsec.max.file-content.count.
1 parent 37a5915 commit d1573f8

8 files changed

Lines changed: 36 additions & 8 deletions

File tree

‎dd-java-agent/instrumentation-testing/src/main/groovy/datadog/trace/agent/test/base/HttpServerTest.groovy‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1683,7 +1683,7 @@ abstract class HttpServerTest<SERVER> extends WithHttpServer<SERVER> {
16831683
def 'test instrumentation gateway file upload content truncated at max size'() {
16841684
setup:
16851685
assumeTrue(testBodyFilesContent())
1686-
def maxContentBytes = 4096
1686+
def maxContentBytes = Config.get().getAppSecMaxFileContentBytes()
16871687
def body = new MultipartBody.Builder()
16881688
.setType(MultipartBody.FORM)
16891689
.addFormDataPart('file', 'large.bin',
@@ -1708,7 +1708,7 @@ abstract class HttpServerTest<SERVER> extends WithHttpServer<SERVER> {
17081708
def 'test instrumentation gateway file upload content max files limit'() {
17091709
setup:
17101710
assumeTrue(testBodyFilesContent())
1711-
def maxFilesToInspect = 25
1711+
def maxFilesToInspect = Config.get().getAppSecMaxFileContentCount()
17121712
def bodyBuilder = new MultipartBody.Builder().setType(MultipartBody.FORM)
17131713
(1..maxFilesToInspect + 1).each {
17141714
i ->

‎dd-java-agent/instrumentation/commons-fileupload-1.5/src/main/java/datadog/trace/instrumentation/commons/fileupload/FileItemContentReader.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
package datadog.trace.instrumentation.commons.fileupload;
22

3+
import datadog.trace.api.Config;
34
import datadog.trace.api.http.MultipartContentDecoder;
45
import java.io.IOException;
56
import java.io.InputStream;
67
import org.apache.commons.fileupload.FileItem;
78

89
/** Reads uploaded file content for WAF inspection. */
910
public final class FileItemContentReader {
10-
public static final int MAX_CONTENT_BYTES = 4096;
11-
public static final int MAX_FILES_TO_INSPECT = 25;
11+
public static final int MAX_CONTENT_BYTES = Config.get().getAppSecMaxFileContentBytes();
12+
public static final int MAX_FILES_TO_INSPECT = Config.get().getAppSecMaxFileContentCount();
1213

1314
public static String readContent(FileItem fileItem) {
1415
try (InputStream is = fileItem.getInputStream()) {

‎dd-java-agent/instrumentation/netty/netty-4.1/src/main/java/datadog/trace/instrumentation/netty41/HttpPostRequestDecoderInstrumentation.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import datadog.trace.agent.tooling.Instrumenter;
1313
import datadog.trace.agent.tooling.InstrumenterModule;
1414
import datadog.trace.agent.tooling.muzzle.Reference;
15+
import datadog.trace.api.Config;
1516
import datadog.trace.api.gateway.BlockResponseFunction;
1617
import datadog.trace.api.gateway.CallbackProvider;
1718
import datadog.trace.api.gateway.Flow;
@@ -87,7 +88,7 @@ public void methodAdvice(MethodTransformer transformer) {
8788

8889
@RequiresRequestContext(RequestContextSlot.APPSEC)
8990
static class ParseBodyAdvice {
90-
private static final int MAX_FILES_TO_INSPECT = 25;
91+
private static final int MAX_FILES_TO_INSPECT = Config.get().getAppSecMaxFileContentCount();
9192

9293
@Advice.OnMethodExit(suppress = Throwable.class, onThrowable = Throwable.class)
9394
static void after(

‎dd-java-agent/instrumentation/netty/netty-4.1/src/main/java/datadog/trace/instrumentation/netty41/NettyFileUploadContentReader.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
11
package datadog.trace.instrumentation.netty41;
22

3+
import datadog.trace.api.Config;
34
import io.netty.buffer.ByteBuf;
45
import io.netty.handler.codec.http.multipart.FileUpload;
56
import java.io.FileInputStream;
67
import java.nio.charset.StandardCharsets;
78

89
/** Reads uploaded file content from a Netty {@link FileUpload} for WAF inspection. */
910
public final class NettyFileUploadContentReader {
10-
public static final int MAX_CONTENT_BYTES = 4096;
11+
public static final int MAX_CONTENT_BYTES = Config.get().getAppSecMaxFileContentBytes();
1112

1213
public static String readContent(FileUpload fileUpload) {
1314
try {

‎dd-java-agent/instrumentation/tomcat/tomcat-appsec/tomcat-appsec-7.0/src/main/java/datadog/trace/instrumentation/tomcat7/ParameterCollector.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
package datadog.trace.instrumentation.tomcat7;
22

3+
import datadog.trace.api.Config;
34
import java.io.InputStream;
45
import java.lang.reflect.Method;
56
import java.nio.charset.StandardCharsets;
@@ -59,8 +60,8 @@ public List<String> getContents() {
5960
}
6061

6162
class ParameterCollectorImpl implements ParameterCollector {
62-
private static final int MAX_CONTENT_BYTES = 4096;
63-
private static final int MAX_FILES_TO_INSPECT = 25;
63+
private static final int MAX_CONTENT_BYTES = Config.get().getAppSecMaxFileContentBytes();
64+
private static final int MAX_FILES_TO_INSPECT = Config.get().getAppSecMaxFileContentCount();
6465

6566
private final boolean inspectContent;
6667
private Map<String, List<String>> map;

‎dd-trace-api/src/main/java/datadog/trace/api/ConfigDefaults.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,6 +144,8 @@ public final class ConfigDefaults {
144144
static final int DEFAULT_APPSEC_MAX_STACK_TRACE_DEPTH = 32;
145145
static final int DEFAULT_APPSEC_MAX_COLLECTED_HEADERS = 50;
146146
static final int DEFAULT_APPSEC_BODY_PARSING_SIZE_LIMIT = 10_000_000;
147+
static final int DEFAULT_APPSEC_MAX_FILE_CONTENT_BYTES = 4096;
148+
static final int DEFAULT_APPSEC_MAX_FILE_CONTENT_COUNT = 25;
147149
static final String DEFAULT_IAST_ENABLED = "false";
148150
static final boolean DEFAULT_IAST_DEBUG_ENABLED = false;
149151
public static final int DEFAULT_IAST_MAX_CONCURRENT_REQUESTS = 4;

‎dd-trace-api/src/main/java/datadog/trace/api/config/AppSecConfig.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ public final class AppSecConfig {
5050
public static final String APPSEC_MAX_STACK_TRACE_DEPTH = "appsec.max.stack-trace.depth";
5151
public static final String APPSEC_MAX_STACKTRACE_DEPTH_DEPRECATED =
5252
"appsec.max.stacktrace.depth"; // old non-standard as a fallback alias
53+
public static final String APPSEC_MAX_FILE_CONTENT_BYTES = "appsec.max.file-content.bytes";
54+
public static final String APPSEC_MAX_FILE_CONTENT_COUNT = "appsec.max.file-content.count";
5355

5456
private AppSecConfig() {}
5557
}

‎internal-api/src/main/java/datadog/trace/api/Config.java‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
import static datadog.trace.api.ConfigDefaults.DEFAULT_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS;
1313
import static datadog.trace.api.ConfigDefaults.DEFAULT_API_SECURITY_SAMPLE_DELAY;
1414
import static datadog.trace.api.ConfigDefaults.DEFAULT_APPSEC_BODY_PARSING_SIZE_LIMIT;
15+
import static datadog.trace.api.ConfigDefaults.DEFAULT_APPSEC_MAX_FILE_CONTENT_BYTES;
16+
import static datadog.trace.api.ConfigDefaults.DEFAULT_APPSEC_MAX_FILE_CONTENT_COUNT;
1517
import static datadog.trace.api.ConfigDefaults.DEFAULT_APPSEC_MAX_STACK_TRACES;
1618
import static datadog.trace.api.ConfigDefaults.DEFAULT_APPSEC_MAX_STACK_TRACE_DEPTH;
1719
import static datadog.trace.api.ConfigDefaults.DEFAULT_APPSEC_REPORTING_INBAND;
@@ -215,6 +217,8 @@
215217
import static datadog.trace.api.config.AppSecConfig.APPSEC_HTTP_BLOCKED_TEMPLATE_HTML;
216218
import static datadog.trace.api.config.AppSecConfig.APPSEC_HTTP_BLOCKED_TEMPLATE_JSON;
217219
import static datadog.trace.api.config.AppSecConfig.APPSEC_IP_ADDR_HEADER;
220+
import static datadog.trace.api.config.AppSecConfig.APPSEC_MAX_FILE_CONTENT_BYTES;
221+
import static datadog.trace.api.config.AppSecConfig.APPSEC_MAX_FILE_CONTENT_COUNT;
218222
import static datadog.trace.api.config.AppSecConfig.APPSEC_MAX_STACKTRACES_DEPRECATED;
219223
import static datadog.trace.api.config.AppSecConfig.APPSEC_MAX_STACKTRACE_DEPTH_DEPRECATED;
220224
import static datadog.trace.api.config.AppSecConfig.APPSEC_MAX_STACK_TRACES;
@@ -1030,6 +1034,8 @@ public static String getHostName() {
10301034
private final int appSecMaxStackTraces;
10311035
private final int appSecMaxStackTraceDepth;
10321036
private final int appSecBodyParsingSizeLimit;
1037+
private final int appSecMaxFileContentBytes;
1038+
private final int appSecMaxFileContentCount;
10331039
private final boolean apiSecurityEnabled;
10341040
private final float apiSecuritySampleDelay;
10351041
private final int apiSecurityEndpointCollectionMessageLimit;
@@ -2333,6 +2339,12 @@ PROFILING_DATADOG_PROFILER_ENABLED, isDatadogProfilerSafeInCurrentEnvironment())
23332339
appSecBodyParsingSizeLimit =
23342340
configProvider.getInteger(
23352341
APPSEC_BODY_PARSING_SIZE_LIMIT, DEFAULT_APPSEC_BODY_PARSING_SIZE_LIMIT);
2342+
appSecMaxFileContentBytes =
2343+
configProvider.getInteger(
2344+
APPSEC_MAX_FILE_CONTENT_BYTES, DEFAULT_APPSEC_MAX_FILE_CONTENT_BYTES);
2345+
appSecMaxFileContentCount =
2346+
configProvider.getInteger(
2347+
APPSEC_MAX_FILE_CONTENT_COUNT, DEFAULT_APPSEC_MAX_FILE_CONTENT_COUNT);
23362348
apiSecurityEnabled =
23372349
configProvider.getBoolean(
23382350
API_SECURITY_ENABLED, DEFAULT_API_SECURITY_ENABLED, API_SECURITY_ENABLED_EXPERIMENTAL);
@@ -5618,6 +5630,14 @@ public int getAppSecBodyParsingSizeLimit() {
56185630
return appSecBodyParsingSizeLimit;
56195631
}
56205632

5633+
public int getAppSecMaxFileContentBytes() {
5634+
return appSecMaxFileContentBytes;
5635+
}
5636+
5637+
public int getAppSecMaxFileContentCount() {
5638+
return appSecMaxFileContentCount;
5639+
}
5640+
56215641
public boolean isCloudPayloadTaggingEnabledFor(String serviceName) {
56225642
return cloudPayloadTaggingServices.contains(serviceName);
56235643
}

0 commit comments

Comments
 (0)