Update default AppSec ruleset to release 1.18.2 by jandro996 · Pull Request #12099 · DataDog/dd-trace-java

jandro996 · 2026-07-29T10:10:37Z

What Does This Do

Syncs dd-java-agent/appsec/src/main/resources/default_config.json (the bundled AppSec/WAF ruleset) with the upstream ASM_DD 1.18.2 release, as an exact copy of the upstream recommended.json.

Bumps metadata.rules_version from 1.13.3 to 1.18.2.
Adds 45 new rules and updates the content (regex/confidence/inputs) of 17 existing rules from the upstream recommended.json.
Adds the new top-level rules_compat key (17 entries, gated by min_version: "1.25.0") — covers new JWT/API-security business-logic rules with output.attributes derivative tags such as _dd.appsec.api.jwt.no_expiry.
Replaces processors[] (8 entries, adds decode-auth-jwt and extract-auth) and scanners[] (37 entries, adds a Password credentials scanner) wholesale.
Four fingerprint processors (http-network-fingerprint, http-endpoint-fingerprint, http-header-fingerprint, session-fingerprint) switch from evaluate: false + login-gated conditions to evaluate: true + conditions: [], matching upstream — they now run on every request instead of only on login events.
Removes dog-920-100 ("File upload with double extension") and dog-942-001 ("Blind XSS callback domains"), two stale rule IDs left over from old commits (Add file upload WAF rules from appsec-event-rules#277 #11093 and the 1.5.2 sync) that predate the current test-rule injection strategy (runtime helpers in the smoke tests). They were never part of the official ASM ruleset and had no reason to keep diverging from it. crs-944-140, previously added the same way as dog-920-100, is now upstream with new content and is treated as a normal synced rule.

default_config.json is now byte-for-byte deep-equal to the official recommended.json for release 1.18.2.

AppSecConfigServiceImpl deserializes this file generically via Moshi into a Map<String, Object> with no typed schema, so the new top-level key and per-rule min_version/max_version fields require no Java-side changes.

Follow-up fix: noisy debug log

Because the fingerprint processors above now evaluate on every request, WAFModule.buildEvents() started hitting its actionWithData.data == null branch on ordinary traffic instead of only in rare edge cases, logging "WAF result data is null" at DEBUG on every request and breaking system-tests' Test_NoExceptions::test_java_telemetry_logs (unexpected-log assertion) on several end-to-end CI jobs.

Removed that log.debug(...) call (and the now-unused SEND_TELEMETRY import), replacing it with a comment explaining why a MATCH-with-no-data result is expected now.
Verified dd-trace-py and dd-trace-go don't log in this case either — both separate real rule "events"/"data" from fingerprint "attributes"/"derivatives" and gate their equivalent debug log on non-empty events, never on the raw WAF return code (MATCH/OK). This change brings dd-trace-java's behavior in line with the other two tracers.

Motivation

Keeps the bundled default ruleset current with the latest published ASM event rules release, closing the gap between the tracer's 1.13.3 and the current 1.18.2.

Additional Notes

The always-on fingerprint processors are a real behavior change inherited from upstream (not introduced by this PR) — flagged for /perf-review since they now evaluate on every request rather than only login events. That same behavior change is what surfaced the pre-existing noisy debug log fixed in the second commit.

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors

Jira ticket: APPSEC-69446

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

Sync dd-java-agent's bundled default_config.json with the upstream ASM_DD 1.18.2 ruleset (merged by rule id, preserving the two tracer-only rules dog-920-100 and dog-942-001). Adds rules_compat, new fingerprint/JWT processors, and the password credentials scanner. APPSEC-69446

jandro996 · 2026-07-29T10:11:00Z

@codex review

chatgpt-codex-connector · 2026-07-29T10:16:21Z

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 490efe10ed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

datadog-official · 2026-07-29T10:24:59Z

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 55.93% (-1.85%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: dc1ce33 | Docs | Datadog PR Page | Give us feedback!}

dd-octo-sts · 2026-07-29T10:32:39Z

🟡 Java Benchmark SLOs — Performance SLO warning (near threshold)

Suite	Status
Startup	🟡 warning

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.92 s	13.98 s	[-1.1%; +0.2%] (no difference)
startup:insecure-bank:tracing:Agent	12.87 s	13.02 s	[-1.9%; -0.4%] (maybe better)
startup:petclinic:appsec:Agent	17.07 s	16.80 s	[+0.3%; +2.9%] (maybe worse)
startup:petclinic:iast:Agent	16.98 s	17.04 s	[-1.3%; +0.5%] (no difference)
startup:petclinic:profiling:Agent	16.78 s	16.97 s	[-2.4%; +0.2%] (no difference)
startup:petclinic:sca:Agent	17.02 s	16.72 s	[+0.8%; +2.8%] (maybe worse)
startup:petclinic:tracing:Agent	15.71 s	15.63 s	[-5.4%; +6.4%] (unstable)

Commit: dc1ce338 · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

Ruleset 1.14.1 made fingerprint processors evaluate unconditionally, so every ordinary request now returns MATCH with no data, breaking system-tests' no-unexpected-logs check. dd-trace-py/dd-trace-go don't log in this case either (both gate on non-empty events, not on the WAF return code).

datadog-official

More details

The bundled ruleset passed adversarial checks for newly added exploit detections, file-upload extensions, zipslip paths, scanner matching, compatibility gates, and preservation of tracer-only rules. The focused Java test suite could not start because this environment lacks the repository's required Java 25 toolchain and cannot download Gradle.

Was this helpful? React 👍 or 👎

_{📊 Validated against 9 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit 0700a5b · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0700a5bcda

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

These two rule IDs were leftovers from old commits (#11093 and the 1.5.2 sync) that predate the switch to runtime test-rule injection via smoke test helpers. They were never part of the official ASM ruleset and had no reason to keep diverging from upstream. default_config.json is now an exact copy of the 1.18.2 recommended.json.

…e-default-rules

dd-octo-sts · 2026-07-30T11:06:34Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-07-30T11:06:38Z

View all feedbacks in Devflow UI.

2026-07-30 11:06:38 UTC ℹ️ Start processing command /merge

2026-07-30 11:06:43 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

2026-07-30 11:57:46 UTC ℹ️ MergeQueue: This merge request was merged

jandro996 added type: feature Enhancements and improvements comp: asm waf Application Security Management (WAF) labels Jul 29, 2026

jandro996 added 4 commits July 29, 2026 13:41

Merge branch 'master' into update-default-rules

56c4831

Merge branch 'master' into update-default-rules

98a907d

Merge branch 'master' into update-default-rules

0700a5b

jandro996 marked this pull request as ready for review July 30, 2026 08:42

jandro996 requested a review from a team as a code owner July 30, 2026 08:42

jandro996 requested review from Taiki-San, claponcet, dromanol, manuel-alvarez-alvarez and smola July 30, 2026 08:42

datadog-official Bot reviewed Jul 30, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Jul 30, 2026

View reviewed changes

Comment thread dd-java-agent/appsec/src/main/resources/default_config.json

Comment thread dd-java-agent/appsec/src/main/resources/default_config.json

Taiki-San approved these changes Jul 30, 2026

View reviewed changes

jandro996 added 3 commits July 30, 2026 10:58

Merge remote-tracking branch 'origin/update-default-rules' into updat…

e669635

…e-default-rules

Merge branch 'master' into update-default-rules

dc1ce33

smola approved these changes Jul 30, 2026

View reviewed changes

jandro996 added this pull request to the merge queue Jul 30, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 30, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit 4335051 into master Jul 30, 2026
587 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the update-default-rules branch July 30, 2026 11:57

github-actions Bot added this to the 1.65.0 milestone Jul 30, 2026

Navigation Menu

Uh oh!

Update default AppSec ruleset to release 1.18.2 - #12099

Update default AppSec ruleset to release 1.18.2#12099
gh-worker-dd-mergequeue-cf854d[bot] merged 8 commits into
masterfrom
update-default-rules

jandro996 commented Jul 29, 2026 •

edited by atlassian Bot

Loading

Uh oh!

jandro996 commented Jul 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 29, 2026

Uh oh!

datadog-official Bot commented Jul 29, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

Uh oh!

dd-octo-sts Bot commented Jul 29, 2026 •

edited

Loading

Uh oh!

datadog-official Bot left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jul 30, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jandro996 commented Jul 29, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Follow-up fix: noisy debug log

Motivation

Additional Notes

Contributor Checklist

Uh oh!

jandro996 commented Jul 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 29, 2026

Uh oh!

datadog-official Bot commented Jul 29, 2026 • edited by datadog-datadog-prod-us1 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jul 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟡 Java Benchmark SLOs — Performance SLO warning (near threshold)

Uh oh!

datadog-official Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

dd-octo-sts Bot commented Jul 30, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jandro996 commented Jul 29, 2026 •

edited by atlassian Bot

Loading

datadog-official Bot commented Jul 29, 2026 •

edited by datadog-datadog-prod-us1 Bot

Loading

dd-octo-sts Bot commented Jul 29, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Jul 30, 2026 •

edited

Loading