Skip to content

Add server.request.body.filenames support for Akka HTTP, Grizzly, and Spring Boot #11173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
jandro996 wants to merge 4 commits into
base: master
Choose a base branch
from
Draft

Add server.request.body.filenames support for Akka HTTP, Grizzly, and Spring Boot #11173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d54df84
Add server.request.body.filenames support for Akka HTTP
jandro996 Mar 23, 2026
4ca7fa0
Enable testBodyFilenames() in test suites for instrumented frameworks
jandro996 Mar 23, 2026
89592b0
Add server.request.body.filenames support for Grizzly and Akka formFi…
jandro996 Apr 21, 2026
9aac562
Remove testBodyFilenames override from Play 2.5/2.6 test suites
jandro996 Apr 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions ...kka/akka-http/akka-http-10.0/src/baseTest/groovy/AkkaHttpServerInstrumentationTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,11 @@ abstract class AkkaHttpServerInstrumentationTest extends HttpServerTest<AkkaHttp
true
}

@Override
boolean testBodyFilenames() {
true
}

@Override
boolean testBodyJson() {
true
Expand Down Expand Up @@ -223,6 +228,11 @@ abstract class AkkaHttpServerInstrumentationSyncTest extends AkkaHttpServerInstr
false
}

@Override
boolean testBodyFilenames() {
false
}

@Override
boolean testBodyJson() {
false
Expand Down Expand Up @@ -283,6 +293,11 @@ class AkkaHttpServerInstrumentationBindAndHandleTest extends AkkaHttpServerInstr
akkaHttpVersion != '10.0.10'
}

@Override
boolean testBodyFilenames() {
akkaHttpVersion != '10.0.10'
}

@Override
boolean testBodyUrlencoded() {
akkaHttpVersion != '10.0.10'
Expand All @@ -309,6 +324,11 @@ class AkkaHttpServerInstrumentationBindAndHandleAsyncWithRouteAsyncHandlerTest e
akkaHttpVersion != '10.0.10'
}

@Override
boolean testBodyFilenames() {
akkaHttpVersion != '10.0.10'
}

@Override
boolean testBodyUrlencoded() {
akkaHttpVersion != '10.0.10'
Expand Down
5 changes: 5 additions & 0 deletions ...http/akka-http-10.0/src/latestDepTest/groovy/AkkaHttp102ServerInstrumentationTests.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,11 @@ class AkkaHttp102ServerInstrumentationBindSyncTest extends AkkaHttpServerInstrum
false
}

@Override
boolean testBodyFilenames() {
false
}

@Override
boolean testBodyJson() {
false
Expand Down
76 changes: 73 additions & 3 deletions ...10.0/src/main/java/datadog/trace/instrumentation/akkahttp/appsec/UnmarshallerHelpers.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,7 @@
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.WeakHashMap;
import java.util.function.BiFunction;
import org.slf4j.Logger;
Expand Down Expand Up @@ -234,6 +235,40 @@ private static void handleMultipartStrictFormData(

// callback execution
executeCallback(reqCtx, callback, conv, "multipartFormDataUnmarshaller");

BiFunction<RequestContext, List<String>, Flow<Void>> filenamesCallback =
cbp.getCallback(EVENTS.requestFilesFilenames());
if (filenamesCallback == null) {
return;
}
List<String> filenames = new ArrayList<>();
for (akka.http.javadsl.model.Multipart.FormData.BodyPart.Strict part : strictParts) {
Optional<String> filenameOpt = part.getFilename();
if (filenameOpt.isPresent()) {
String filename = filenameOpt.get();
if (!filename.isEmpty()) {
filenames.add(filename);
}
}
}
if (filenames.isEmpty()) {
return;
}
Flow<Void> filenamesFlow = filenamesCallback.apply(reqCtx, filenames);
Flow.Action filenamesAction = filenamesFlow.getAction();
if (filenamesAction instanceof Flow.Action.RequestBlockingAction) {
Flow.Action.RequestBlockingAction rba = (Flow.Action.RequestBlockingAction) filenamesAction;
BlockResponseFunction brf = reqCtx.getBlockResponseFunction();
if (brf != null) {
boolean success = brf.tryCommitBlockingResponse(reqCtx.getTraceSegment(), rba);
if (success) {
if (brf instanceof AkkaBlockResponseFunction) {
((AkkaBlockResponseFunction) brf).setUnmarshallBlock(true);
}
throw new BlockingException("Blocked request (multipart file upload)");
}
}
}
}

public static Unmarshaller<HttpEntity, String> transformStringUnmarshaller(
Expand Down Expand Up @@ -389,6 +424,7 @@ public static Unmarshaller<HttpEntity, StrictForm> transformStrictFormUnmarshall
private static void handleStrictFormData(StrictForm sf) {
Iterator<Tuple2<String, StrictForm.Field>> iterator = sf.fields().iterator();
Map<String, List<String>> conv = new HashMap<>();
List<String> filenames = new ArrayList<>();
while (iterator.hasNext()) {
Tuple2<String, StrictForm.Field> next = iterator.next();
String fieldName = next._1();
Expand All @@ -413,9 +449,13 @@ private static void handleStrictFormData(StrictForm sf) {
strings.add((String) strictFieldValue);
} else if (strictFieldValue
instanceof akka.http.scaladsl.model.Multipart$FormData$BodyPart$Strict) {
HttpEntity.Strict sentity =
((akka.http.scaladsl.model.Multipart$FormData$BodyPart$Strict) strictFieldValue)
.entity();
akka.http.scaladsl.model.Multipart$FormData$BodyPart$Strict bodyPart =
(akka.http.scaladsl.model.Multipart$FormData$BodyPart$Strict) strictFieldValue;
Optional<String> filenameOpt = bodyPart.getFilename();
if (filenameOpt.isPresent() && !filenameOpt.get().isEmpty()) {
filenames.add(filenameOpt.get());
}
HttpEntity.Strict sentity = bodyPart.entity();
String s =
sentity
.getData()
Expand All @@ -426,6 +466,36 @@ private static void handleStrictFormData(StrictForm sf) {
}

handleArbitraryPostData(conv, "HttpEntity -> StrictForm unmarshaller");

if (!filenames.isEmpty()) {
AgentSpan span = activeSpan();
RequestContext reqCtx;
if (span != null
&& (reqCtx = span.getRequestContext()) != null
&& reqCtx.getData(RequestContextSlot.APPSEC) != null) {
CallbackProvider cbp = AgentTracer.get().getCallbackProvider(RequestContextSlot.APPSEC);
BiFunction<RequestContext, List<String>, Flow<Void>> filenamesCb =
cbp.getCallback(EVENTS.requestFilesFilenames());
if (filenamesCb != null) {
Flow<Void> filenamesFlow = filenamesCb.apply(reqCtx, filenames);
Flow.Action filenamesAction = filenamesFlow.getAction();
if (filenamesAction instanceof Flow.Action.RequestBlockingAction) {
Flow.Action.RequestBlockingAction rba =
(Flow.Action.RequestBlockingAction) filenamesAction;
BlockResponseFunction brf = reqCtx.getBlockResponseFunction();
if (brf != null) {
boolean success = brf.tryCommitBlockingResponse(reqCtx.getTraceSegment(), rba);
if (success) {
if (brf instanceof AkkaBlockResponseFunction) {
((AkkaBlockResponseFunction) brf).setUnmarshallBlock(true);
}
throw new BlockingException("Blocked request (multipart file upload)");
}
}
}
}
}
}
}

private static Object tryConvertingScalaContainers(Object obj, int depth) {
Expand Down
5 changes: 5 additions & 0 deletions ...kka/akka-http/akka-http-10.6/src/test/groovy/AkkaHttp102ServerInstrumentationTests.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,11 @@ class AkkaHttp102ServerInstrumentationBindSyncTest extends AkkaHttpServerInstrum
false
}

@Override
boolean testBodyFilenames() {
false
}

@Override
boolean testBodyJson() {
false
Expand Down
20 changes: 20 additions & 0 deletions ...on/akka/akka-http/akka-http-10.6/src/test/groovy/AkkaHttpServerInstrumentationTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,11 @@ abstract class AkkaHttpServerInstrumentationTest extends HttpServerTest<AkkaHttp
true
}

@Override
boolean testBodyFilenames() {
true
}

@Override
boolean testBodyJson() {
true
Expand Down Expand Up @@ -223,6 +228,11 @@ abstract class AkkaHttpServerInstrumentationSyncTest extends AkkaHttpServerInstr
false
}

@Override
boolean testBodyFilenames() {
false
}

@Override
boolean testBodyJson() {
false
Expand Down Expand Up @@ -279,6 +289,11 @@ class AkkaHttpServerInstrumentationBindAndHandleTest extends AkkaHttpServerInstr
true
}

@Override
boolean testBodyFilenames() {
true
}

@Override
boolean testBodyUrlencoded() {
true
Expand All @@ -305,6 +320,11 @@ class AkkaHttpServerInstrumentationBindAndHandleAsyncWithRouteAsyncHandlerTest e
true
}

@Override
boolean testBodyFilenames() {
true
}

@Override
boolean testBodyUrlencoded() {
true
Expand Down
5 changes: 5 additions & 0 deletions dd-java-agent/instrumentation/grizzly/grizzly-http-2.3.20/src/test/groovy/GrizzlyTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,11 @@ class GrizzlyTest extends HttpServerTest<HttpServer> {
true
}

@Override
boolean testBodyFilenames() {
true
}

@Override
boolean testBodyJson() {
true
Expand Down
24 changes: 24 additions & 0 deletions .../java/datadog/trace/instrumentation/jersey2/MultiPartReaderServerSideInstrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,11 +77,16 @@ static void after(
}

Map<String, List<String>> map = new HashMap<>();
List<String> filenames = new ArrayList<>();
for (BodyPart bodyPart : ret.getBodyParts()) {
if (!(bodyPart instanceof FormDataBodyPart)) {
continue;
}
FormDataBodyPart dataBodyPart = (FormDataBodyPart) bodyPart;
String filename = dataBodyPart.getContentDisposition().getFileName();
if (filename != null && !filename.isEmpty()) {
filenames.add(filename);
}
if (!MediaTypes.typeEqual(MediaType.TEXT_PLAIN_TYPE, dataBodyPart.getMediaType())) {
continue;
}
Expand Down Expand Up @@ -110,6 +115,25 @@ static void after(
reqCtx.getTraceSegment().effectivelyBlocked();
}
}

if (!filenames.isEmpty()) {
BiFunction<RequestContext, List<String>, Flow<Void>> filenamesCb =
cbp.getCallback(EVENTS.requestFilesFilenames());
Comment thread
jandro996 marked this conversation as resolved.
if (filenamesCb != null) {
Flow<Void> filenamesFlow = filenamesCb.apply(reqCtx, filenames);
Flow.Action filenamesAction = filenamesFlow.getAction();
if (t == null && filenamesAction instanceof Flow.Action.RequestBlockingAction) {
Flow.Action.RequestBlockingAction rba =
(Flow.Action.RequestBlockingAction) filenamesAction;
BlockResponseFunction brf = reqCtx.getBlockResponseFunction();
if (brf != null) {
brf.tryCommitBlockingResponse(reqCtx.getTraceSegment(), rba);
}
t = new BlockingException("Blocked request (multipart file upload)");
reqCtx.getTraceSegment().effectivelyBlocked();
}
}
}
}
}
}
24 changes: 24 additions & 0 deletions .../java/datadog/trace/instrumentation/jersey3/MultiPartReaderServerSideInstrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,11 +77,16 @@ static void after(
}

Map<String, List<String>> map = new HashMap<>();
List<String> filenames = new ArrayList<>();
for (BodyPart bodyPart : ret.getBodyParts()) {
if (!(bodyPart instanceof FormDataBodyPart)) {
continue;
}
FormDataBodyPart dataBodyPart = (FormDataBodyPart) bodyPart;
String filename = dataBodyPart.getContentDisposition().getFileName();
if (filename != null && !filename.isEmpty()) {
filenames.add(filename);
}
if (!MediaTypes.typeEqual(MediaType.TEXT_PLAIN_TYPE, dataBodyPart.getMediaType())) {
continue;
}
Expand Down Expand Up @@ -110,6 +115,25 @@ static void after(
reqCtx.getTraceSegment().effectivelyBlocked();
}
}

if (!filenames.isEmpty()) {
BiFunction<RequestContext, List<String>, Flow<Void>> filenamesCb =
cbp.getCallback(EVENTS.requestFilesFilenames());
if (filenamesCb != null) {
Flow<Void> filenamesFlow = filenamesCb.apply(reqCtx, filenames);
Flow.Action filenamesAction = filenamesFlow.getAction();
if (t == null && filenamesAction instanceof Flow.Action.RequestBlockingAction) {
Flow.Action.RequestBlockingAction rba =
(Flow.Action.RequestBlockingAction) filenamesAction;
BlockResponseFunction brf = reqCtx.getBlockResponseFunction();
if (brf != null) {
brf.tryCommitBlockingResponse(reqCtx.getTraceSegment(), rba);
}
t = new BlockingException("Blocked request (multipart file upload)");
reqCtx.getTraceSegment().effectivelyBlocked();
}
}
}
}
}
}
5 changes: 5 additions & 0 deletions ...ng-webmvc/spring-webmvc-3.1/src/latestDepTest/groovy/test/boot/SpringBootBasedTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,6 +109,11 @@ class SpringBootBasedTest extends HttpServerTest<ConfigurableApplicationContext>
true
}

@Override
boolean testBodyFilenames() {
true
}

@Override
boolean testBodyJson() {
true
Expand Down
5 changes: 5 additions & 0 deletions ...ring/spring-webmvc/spring-webmvc-3.1/src/test/groovy/test/boot/SpringBootBasedTest.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,6 +119,11 @@ class SpringBootBasedTest extends HttpServerTest<ConfigurableApplicationContext>
true
}

@Override
boolean testBodyFilenames() {
true
}

@Override
boolean testBodyJson() {
true
Expand Down
Loading