test(appsec): Add system tests for server.io.fs.file_write address#6740
Merged
Conversation
…s.file_write) New test class Test_Lfi_Write_UrlQuery verifies that file write operations via FileOutputStream are intercepted by RASP and block LFI attacks. The test checks the server.io.fs.file_write address which is the new address published by the Java agent on file write instrumentation. - Add Test_Lfi_Write_UrlQuery to tests/appsec/rasp/test_lfi.py - Add /rasp/lfi_write endpoint (FileOutputStream) to spring-boot weblog - Mark as missing_feature for Java (APPSEC-61874): requires ddwaf support for server.io.fs.file_write as a RASP ephemeral address - Mark as irrelevant for all other languages (Java-only address)
Add Test_IoFsFileWrite to test_addresses.py to verify that the WAF evaluates dog-920-110 (Zipslip Attack) against the server.io.fs.file_write address published by Java's RASP file-write hook. - Add dog_920_110 constant to waf_rules.lfi StrEnum - Add Test_IoFsFileWrite test class using /rasp/lfi_write endpoint with x-filename: archive.zip header to satisfy both dog-920-110 conditions - Mark as missing_feature for Java (APPSEC-61874: ddwaf must evaluate WAF rules against ephemeral server.io.fs.file_write data) - Mark as irrelevant for all other languages (Java-only address)
jandro996
requested review from
brettlangdon,
claponcet,
mabdinur and
manuel-alvarez-alvarez
and removed request for
a team
April 14, 2026 08:51
Contributor
|
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1dbb0a22a2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…r Zipslip test - Add GET /rasp/lfi_write and POST /rasp/lfi_write endpoints to all Java weblog variants (akka-http, jersey-grizzly2, play, ratpack, resteasy-netty3, spring-boot, vertx3, vertx4) using FileOutputStream to trigger server.io.fs.file_write RASP address - Replace Test_IoFsFileWrite with Test_Zipslip in test_addresses.py: uses multipart POST with evil.zip filename to trigger server.request.body.filenames alongside server.io.fs.file_write, asserting dog-920-110 (Zipslip) rule - Update all language manifests: Test_Zipslip is missing_feature for Java (APPSEC-61874), irrelevant for all other languages
jandro996
changed the title
nccatoni
reviewed
Apr 14, 2026
nccatoni
left a comment
nccatoni
left a comment
Collaborator
There was a problem hiding this comment.
LGTM (for @DataDog/system-tests-core) but you should get a review from someone familiar with the feature
jandro996
marked this pull request as draft
April 15, 2026 14:46
…Zipslip - Add POST /waf/zipslip multipart endpoint to spring-boot, akka-http, jersey-grizzly2, ratpack, resteasy-netty3, vertx3, vertx4, and play - Add dog-920-110 WAF rule (Zipslip Attack) to rasp_ruleset.json and rasp_non_blocking_ruleset.json with server.request.body.filenames and server.io.fs.file_write conditions - Add Test_Zipslip test in tests/appsec/waf/test_addresses.py - Remove Test_Lfi_Write_UrlQuery from test_lfi.py and all language manifests - Update manifests/java.yml: only spring-boot enabled for Test_Zipslip (other weblogs missing_feature, matching Test_Blocking_request_body_filenames pattern)
…server.io.fs.file_write Testing server.io.fs.file_write via a custom WAF rule is simpler and works on all weblogs: use existing /rasp/lfi_write?file=../../evil.txt endpoint instead of requiring a multipart ZIP upload endpoint on every framework. - Add custom-test-file-write rule to custom_rules.json (single condition: server.io.fs.file_write matches path traversal) - Replace Test_Zipslip (appsec_rasp + multipart /waf/zipslip) with Test_IoFsFileWrite (appsec_custom_rules + GET /rasp/lfi_write) - Remove /waf/zipslip endpoints from all Java weblogs (akka-http, jersey-grizzly2, play, ratpack, resteasy-netty3, spring-boot, vertx3, vertx4) and related multipart dependencies - Remove dog-920-110 from rasp_ruleset.json and rasp_non_blocking_ruleset.json - Enable Test_IoFsFileWrite for all Java weblogs in manifests/java.yml - Rename Test_Zipslip -> Test_IoFsFileWrite in all other language manifests
…amlfmt - Add missing irrelevant entries for Test_IoFsFileWrite in ruby.yml and cpp_nginx.yml (Java-only address: server.io.fs.file_write) - Apply yamlfmt ordering to all affected manifests
rasp_ruleset.json and rasp_non_blocking_ruleset.json had cosmetic JSON formatting changes from the add/remove cycle of dog-920-110. vertx4/Main.java had unused File/FileInputStream imports left over from the zipslip endpoint cycle.
🎉 All green!❄️ No new flaky tests detected 🔗 Commit SHA: 628da20 | Docs | Datadog PR Page | Give us feedback! |
jandro996
marked this pull request as ready for review
April 20, 2026 12:25
jandro996
requested review from
xlamorlette-datadog
and removed request for
a team
April 20, 2026 12:25
…tch conflict
pathPrefix("lfi") was matching /rasp/lfi_write requests because "lfi_write"
starts with "lfi", causing executeFli (FileInputStream) to be called instead
of executeLfiWrite (FileOutputStream). This prevented the server.io.fs.file_write
RASP address from being populated, making Test_IoFsFileWrite fail on akka-http.
jandro996
enabled auto-merge (squash)
April 20, 2026 14:32
nccatoni
approved these changes
Apr 20, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
server.io.fs.file_writeaddress