Skip to content

Consult AppSec trace rate limiter only when the WAF requests trace retention #12482

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
claponcet wants to merge 2 commits into
base: master
Choose a base branch
from
+25 −13
Open

Consult AppSec trace rate limiter only when the WAF requests trace retention #12482

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
945bcc4
Consult AppSec trace rate limiter only when the WAF requests trace re…
claponcet Sep 14, 2026
b40f2e9
Merge branch 'master' into clara.poncet/rate-limiter-bug
claponcet Sep 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 8 additions & 11 deletions dd-java-agent/appsec/src/main/java/com/datadog/appsec/ddwaf/WAFModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -437,10 +437,10 @@ public void onDataAvailable(
WafMetricCollector.get().raspRuleMatch(gwCtx.raspRuleType, flow.isBlocking());
}
Collection<AppSecEvent> events = buildEvents(resultWithData, securityResponseId);
boolean isThrottled = reqCtx.isThrottled(rateLimiter);

if (!isThrottled) {
if (resultWithData.keep) {
// The limiter gates force-keeping the trace, not WAF execution or event reporting.
if (resultWithData.keep) {
boolean isThrottled = reqCtx.isThrottled(rateLimiter);
if (!isThrottled) {
reqCtx.setManuallyKept(true);
AgentSpan activeSpan = AgentTracer.get().activeSpan();
if (activeSpan != null) {
Expand All @@ -456,13 +456,10 @@ public void onDataAvailable(
.setTag(Tags.PROPAGATED_TRACE_SOURCE, ProductTraceSource.ASM);
}
} else {
// If active span is not available then we need to set manual keep in GatewayBridge
log.debug("There is no active span available");
}
} else {
log.debug("Rate limited WAF events");
if (!gwCtx.isRasp) {
reqCtx.setWafRateLimited();
log.debug("Rate limited AppSec trace");
if (!gwCtx.isRasp) {
reqCtx.setWafRateLimited();
}
}
}

Expand Down
19 changes: 17 additions & 2 deletions dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/ddwaf/WAFModuleSpecification.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2006,7 +2006,6 @@ class WAFModuleSpecification extends DDSpecification {
1 * ctx.isWafContextClosed() >> false
1 * ctx.closeWafContext()
1 * ctx.reportDerivatives(['_dd.appsec.trace.agent':'RulesCompat/v1', '_dd.appsec.trace.integer': 123456789])
1 * ctx.isThrottled(null)
// libddwaf 2.0.1: ResultWithData.events now reflects the real "events" array, so attributes-only matches don't call reportEvents().
0 * ctx.reportEvents(_)
0 * ctx._(*_)
Expand Down Expand Up @@ -2050,6 +2049,23 @@ class WAFModuleSpecification extends DDSpecification {
1 * ctx.setManuallyKept(true)
0 * ctx._(*_)
!flow3.blocking

when: 'test rate-limited rules_compat rule with attributes, keep and event'
def flow4 = new ChangeableFlow()
dataListener.onDataAvailable(flow4, ctx, bundle3, gwCtx)
ctx.closeWafContext()

then:
1 * ctx.getOrCreateWafContext(_, true, false) >> { wafContext = new WafContext(it[0]) }
2 * ctx.getWafMetrics() >> metrics
1 * ctx.isWafContextClosed() >> false
1 * ctx.closeWafContext()
1 * ctx.reportDerivatives(['_dd.appsec.trace.agent':'RulesCompat/v3', '_dd.appsec.trace.integer': 555666777])
1 * ctx.reportEvents(_ as Collection<AppSecEvent>)
1 * ctx.isThrottled(null) >> true
1 * ctx.setWafRateLimited()
0 * ctx._(*_)
!flow4.blocking
}

void 'test trace tagging rule with attributes, no keep and event (dynamic value extraction)'() {
Expand Down Expand Up @@ -2150,7 +2166,6 @@ class WAFModuleSpecification extends DDSpecification {
// Should report derivatives with dynamic value extraction - the user-agent value should be extracted
1 * ctx.reportDerivatives(['_dd.appsec.trace.agent':'TraceTagging/v4', '_dd.appsec.trace.integer': 1729])
1 * ctx.reportEvents(_ as Collection<AppSecEvent>)
1 * ctx.isThrottled(null)
0 * ctx._(*_)
!flow.blocking // Should not block since keep: false
}
Expand Down