iframe-proxy

manuel-alvarez-alvarez · 2025-06-19T15:50:58Z

What Does This Do

Adds response body extraction for Ratpack JSON endpoints to enable automatic API schema discovery and protection by the Web Application Firewall (WAF).

Motivation

Additional Notes

Contributor Checklist

Format the title according the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any usefull labels
Don't use close, fix or any linking keywords when referencing an issue.
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, move, or deletion
Update the public documentation in case of new configuration flag or behavior

Jira ticket: APPSEC-57915

pr-commenter · 2025-06-19T16:26:25Z

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	malvarez/ratpack-response-extraction
git_commit_date	1750920169	1750921416
git_commit_sha	`becbf2a`	`d9a0fb0`
release_version	1.51.0-SNAPSHOT~becbf2a03c	1.51.0-SNAPSHOT~d9a0fb0e76

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1750923234	1750923234
ci_job_id	999446515	999446515
ci_pipeline_id	68817122	68817122
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-ltijhv1y-project-304-concurrent-1-ejpamdx8 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-ltijhv1y-project-304-concurrent-1-ejpamdx8 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 45 metrics, 8 unstable metrics.

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.51.0-SNAPSHOT~d9a0fb0e76, baseline=1.51.0-SNAPSHOT~becbf2a03c

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.001 s) : 0, 1001492
Total [baseline] (10.817 s) : 0, 10816517
Agent [candidate] (1.005 s) : 0, 1005367
Total [candidate] (10.739 s) : 0, 10738985
section appsec
Agent [baseline] (1.184 s) : 0, 1184059
Total [baseline] (10.809 s) : 0, 10808818
Agent [candidate] (1.184 s) : 0, 1184267
Total [candidate] (10.753 s) : 0, 10753165
section iast
Agent [baseline] (1.134 s) : 0, 1134483
Total [baseline] (10.815 s) : 0, 10815176
Agent [candidate] (1.135 s) : 0, 1135477
Total [candidate] (10.876 s) : 0, 10875971
section profiling
Agent [baseline] (1.249 s) : 0, 1248607
Total [baseline] (11.204 s) : 0, 11204232
Agent [candidate] (1.246 s) : 0, 1246437
Total [candidate] (10.919 s) : 0, 10918608

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.001 s	-
Agent	appsec	1.184 s	182.566 ms (18.2%)
Agent	iast	1.134 s	132.991 ms (13.3%)
Agent	profiling	1.249 s	247.114 ms (24.7%)
Total	tracing	10.817 s	-
Total	appsec	10.809 s	-7.699 ms (-0.1%)
Total	iast	10.815 s	-1.341 ms (-0.0%)
Total	profiling	11.204 s	387.716 ms (3.6%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.005 s	-
Agent	appsec	1.184 s	178.9 ms (17.8%)
Agent	iast	1.135 s	130.11 ms (12.9%)
Agent	profiling	1.246 s	241.071 ms (24.0%)
Total	tracing	10.739 s	-
Total	appsec	10.753 s	14.181 ms (0.1%)
Total	iast	10.876 s	136.986 ms (1.3%)
Total	profiling	10.919 s	179.623 ms (1.7%)

gantt
    title petclinic - break down per module: candidate=1.51.0-SNAPSHOT~d9a0fb0e76, baseline=1.51.0-SNAPSHOT~becbf2a03c

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (690.023 ms) : 0, 690023
BytebuddyAgent [candidate] (694.072 ms) : 0, 694072
GlobalTracer [baseline] (244.671 ms) : 0, 244671
GlobalTracer [candidate] (244.497 ms) : 0, 244497
AppSec [baseline] (30.678 ms) : 0, 30678
AppSec [candidate] (30.711 ms) : 0, 30711
Debugger [baseline] (6.131 ms) : 0, 6131
Debugger [candidate] (6.117 ms) : 0, 6117
Remote Config [baseline] (688.534 µs) : 0, 689
Remote Config [candidate] (678.685 µs) : 0, 679
Telemetry [baseline] (8.367 ms) : 0, 8367
Telemetry [candidate] (8.3 ms) : 0, 8300
section appsec
BytebuddyAgent [baseline] (717.309 ms) : 0, 717309
BytebuddyAgent [candidate] (717.558 ms) : 0, 717558
GlobalTracer [baseline] (237.9 ms) : 0, 237900
GlobalTracer [candidate] (237.897 ms) : 0, 237897
AppSec [baseline] (170.848 ms) : 0, 170848
AppSec [candidate] (170.937 ms) : 0, 170937
Debugger [baseline] (5.828 ms) : 0, 5828
Debugger [candidate] (5.824 ms) : 0, 5824
Remote Config [baseline] (617.182 µs) : 0, 617
Remote Config [candidate] (625.837 µs) : 0, 626
Telemetry [baseline] (8.22 ms) : 0, 8220
Telemetry [candidate] (8.196 ms) : 0, 8196
IAST [baseline] (22.338 ms) : 0, 22338
IAST [candidate] (22.273 ms) : 0, 22273
section iast
BytebuddyAgent [baseline] (809.853 ms) : 0, 809853
BytebuddyAgent [candidate] (810.66 ms) : 0, 810660
GlobalTracer [baseline] (233.877 ms) : 0, 233877
GlobalTracer [candidate] (233.581 ms) : 0, 233581
AppSec [baseline] (29.252 ms) : 0, 29252
AppSec [candidate] (29.535 ms) : 0, 29535
Debugger [baseline] (5.819 ms) : 0, 5819
Debugger [candidate] (5.794 ms) : 0, 5794
Remote Config [baseline] (580.94 µs) : 0, 581
Remote Config [candidate] (579.936 µs) : 0, 580
Telemetry [baseline] (7.941 ms) : 0, 7941
Telemetry [candidate] (7.957 ms) : 0, 7957
IAST [baseline] (26.262 ms) : 0, 26262
IAST [candidate] (26.409 ms) : 0, 26409
section profiling
BytebuddyAgent [baseline] (678.723 ms) : 0, 678723
BytebuddyAgent [candidate] (679.043 ms) : 0, 679043
GlobalTracer [baseline] (363.606 ms) : 0, 363606
GlobalTracer [candidate] (361.924 ms) : 0, 361924
AppSec [baseline] (33.279 ms) : 0, 33279
AppSec [candidate] (30.888 ms) : 0, 30888
Debugger [baseline] (9.912 ms) : 0, 9912
Debugger [candidate] (12.176 ms) : 0, 12176
Remote Config [baseline] (1.434 ms) : 0, 1434
Remote Config [candidate] (654.373 µs) : 0, 654
Telemetry [baseline] (8.894 ms) : 0, 8894
Telemetry [candidate] (8.839 ms) : 0, 8839
ProfilingAgent [baseline] (103.933 ms) : 0, 103933
ProfilingAgent [candidate] (103.346 ms) : 0, 103346
Profiling [baseline] (103.959 ms) : 0, 103959
Profiling [candidate] (103.371 ms) : 0, 103371

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.51.0-SNAPSHOT~d9a0fb0e76, baseline=1.51.0-SNAPSHOT~becbf2a03c

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.006 s) : 0, 1006308
Total [baseline] (8.599 s) : 0, 8598938
Agent [candidate] (999.423 ms) : 0, 999423
Total [candidate] (8.571 s) : 0, 8570738
section iast
Agent [baseline] (1.135 s) : 0, 1135467
Total [baseline] (9.282 s) : 0, 9282105
Agent [candidate] (1.139 s) : 0, 1139450
Total [candidate] (9.299 s) : 0, 9299216

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.006 s	-
Agent	iast	1.135 s	129.159 ms (12.8%)
Total	tracing	8.599 s	-
Total	iast	9.282 s	683.167 ms (7.9%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	999.423 ms	-
Agent	iast	1.139 s	140.027 ms (14.0%)
Total	tracing	8.571 s	-
Total	iast	9.299 s	728.478 ms (8.5%)

gantt
    title insecure-bank - break down per module: candidate=1.51.0-SNAPSHOT~d9a0fb0e76, baseline=1.51.0-SNAPSHOT~becbf2a03c

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (696.132 ms) : 0, 696132
BytebuddyAgent [candidate] (689.329 ms) : 0, 689329
GlobalTracer [baseline] (243.525 ms) : 0, 243525
GlobalTracer [candidate] (243.809 ms) : 0, 243809
AppSec [baseline] (30.62 ms) : 0, 30620
AppSec [candidate] (30.352 ms) : 0, 30352
Debugger [baseline] (6.09 ms) : 0, 6090
Debugger [candidate] (6.049 ms) : 0, 6049
Remote Config [baseline] (674.071 µs) : 0, 674
Remote Config [candidate] (668.812 µs) : 0, 669
Telemetry [baseline] (8.254 ms) : 0, 8254
Telemetry [candidate] (8.273 ms) : 0, 8273
section iast
BytebuddyAgent [baseline] (812.263 ms) : 0, 812263
BytebuddyAgent [candidate] (814.417 ms) : 0, 814417
GlobalTracer [baseline] (232.472 ms) : 0, 232472
GlobalTracer [candidate] (234.425 ms) : 0, 234425
AppSec [baseline] (26.992 ms) : 0, 26992
AppSec [candidate] (25.929 ms) : 0, 25929
Debugger [baseline] (5.842 ms) : 0, 5842
Debugger [candidate] (5.821 ms) : 0, 5821
Remote Config [baseline] (586.512 µs) : 0, 587
Remote Config [candidate] (583.073 µs) : 0, 583
Telemetry [baseline] (7.93 ms) : 0, 7930
Telemetry [candidate] (7.883 ms) : 0, 7883
IAST [baseline] (28.619 ms) : 0, 28619
IAST [candidate] (29.54 ms) : 0, 29540

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	malvarez/ratpack-response-extraction
git_commit_date	1750920169	1750921416
git_commit_sha	`becbf2a`	`d9a0fb0`
release_version	1.51.0-SNAPSHOT~becbf2a03c	1.51.0-SNAPSHOT~d9a0fb0e76

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1750922987	1750922987
ci_job_id	999446516	999446516
ci_pipeline_id	68817122	68817122
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-iun2vzqu-project-304-concurrent-3-lkitratq 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-iun2vzqu-project-304-concurrent-3-lkitratq 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 4 performance improvements and 1 performance regressions! Performance is the same for 7 metrics, 12 unstable metrics.

scenario	Δ mean http_req_duration	Δ mean throughput	candidate mean http_req_duration	candidate mean throughput	baseline mean http_req_duration	baseline mean throughput
scenario:load:insecure-bank:tracing:high_load	better [-456.689µs; -210.106µs] or [-5.803%; -2.670%]	unstable [-50.391op/s; +101.953op/s] or [-8.560%; +17.320%]	7.536ms	614.438op/s	7.870ms	588.656op/s
scenario:load:insecure-bank:profiling:high_load	better [-690.062µs; -382.654µs] or [-7.575%; -4.200%]	unstable [-35.170op/s; +97.983op/s] or [-6.904%; +19.233%]	8.574ms	540.844op/s	9.110ms	509.438op/s
scenario:load:petclinic:iast:high_load	better [-1.722ms; -0.920ms] or [-3.966%; -2.119%]	unstable [-4.673op/s; +11.423op/s] or [-4.338%; +10.604%]	42.104ms	111.100op/s	43.425ms	107.725op/s
scenario:load:petclinic:code_origins:high_load	worse [+1.300ms; +2.060ms] or [+3.020%; +4.784%]	unstable [-11.916op/s; +3.841op/s] or [-10.965%; +3.534%]	44.731ms	104.638op/s	43.051ms	108.675op/s
scenario:load:petclinic:profiling:high_load	better [-3.192ms; -2.239ms] or [-6.392%; -4.484%]	unstable [-1.969op/s; +12.669op/s] or [-2.100%; +13.515%]	47.224ms	99.088op/s	49.940ms	93.737op/s

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.51.0-SNAPSHOT~d9a0fb0e76, baseline=1.51.0-SNAPSHOT~becbf2a03c
    dateFormat X
    axisFormat %s
section baseline
no_agent (37.14 ms) : 36835, 37445
.   : milestone, 37140,
appsec (48.119 ms) : 47686, 48553
.   : milestone, 48119,
code_origins (43.051 ms) : 42701, 43401
.   : milestone, 43051,
iast (43.425 ms) : 43037, 43814
.   : milestone, 43425,
profiling (49.94 ms) : 49466, 50414
.   : milestone, 49940,
tracing (42.746 ms) : 42381, 43110
.   : milestone, 42746,
section candidate
no_agent (36.807 ms) : 36520, 37095
.   : milestone, 36807,
appsec (47.434 ms) : 47011, 47857
.   : milestone, 47434,
code_origins (44.731 ms) : 44375, 45086
.   : milestone, 44731,
iast (42.104 ms) : 41748, 42460
.   : milestone, 42104,
profiling (47.224 ms) : 46815, 47634
.   : milestone, 47224,
tracing (43.126 ms) : 42775, 43477
.   : milestone, 43126,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	37.14 ms [36.835 ms, 37.445 ms]	-
appsec	48.119 ms [47.686 ms, 48.553 ms]	10.979 ms (29.6%)
code_origins	43.051 ms [42.701 ms, 43.401 ms]	5.911 ms (15.9%)
iast	43.425 ms [43.037 ms, 43.814 ms]	6.285 ms (16.9%)
profiling	49.94 ms [49.466 ms, 50.414 ms]	12.8 ms (34.5%)
tracing	42.746 ms [42.381 ms, 43.11 ms]	5.606 ms (15.1%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	36.807 ms [36.52 ms, 37.095 ms]	-
appsec	47.434 ms [47.011 ms, 47.857 ms]	10.626 ms (28.9%)
code_origins	44.731 ms [44.375 ms, 45.086 ms]	7.923 ms (21.5%)
iast	42.104 ms [41.748 ms, 42.46 ms]	5.297 ms (14.4%)
profiling	47.224 ms [46.815 ms, 47.634 ms]	10.417 ms (28.3%)
tracing	43.126 ms [42.775 ms, 43.477 ms]	6.319 ms (17.2%)

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.51.0-SNAPSHOT~d9a0fb0e76, baseline=1.51.0-SNAPSHOT~becbf2a03c
    dateFormat X
    axisFormat %s
section baseline
no_agent (4.381 ms) : 4331, 4431
.   : milestone, 4381,
iast (9.271 ms) : 9112, 9430
.   : milestone, 9271,
iast_FULL (13.445 ms) : 13184, 13706
.   : milestone, 13445,
iast_GLOBAL (10.065 ms) : 9886, 10244
.   : milestone, 10065,
profiling (9.11 ms) : 8958, 9263
.   : milestone, 9110,
tracing (7.87 ms) : 7749, 7991
.   : milestone, 7870,
section candidate
no_agent (4.487 ms) : 4435, 4539
.   : milestone, 4487,
iast (9.375 ms) : 9223, 9527
.   : milestone, 9375,
iast_FULL (13.681 ms) : 13415, 13947
.   : milestone, 13681,
iast_GLOBAL (10.243 ms) : 10059, 10426
.   : milestone, 10243,
profiling (8.574 ms) : 8441, 8707
.   : milestone, 8574,
tracing (7.536 ms) : 7429, 7644
.   : milestone, 7536,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	4.381 ms [4.331 ms, 4.431 ms]	-
iast	9.271 ms [9.112 ms, 9.43 ms]	4.89 ms (111.6%)
iast_FULL	13.445 ms [13.184 ms, 13.706 ms]	9.064 ms (206.9%)
iast_GLOBAL	10.065 ms [9.886 ms, 10.244 ms]	5.684 ms (129.7%)
profiling	9.11 ms [8.958 ms, 9.263 ms]	4.729 ms (108.0%)
tracing	7.87 ms [7.749 ms, 7.991 ms]	3.489 ms (79.6%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	4.487 ms [4.435 ms, 4.539 ms]	-
iast	9.375 ms [9.223 ms, 9.527 ms]	4.888 ms (108.9%)
iast_FULL	13.681 ms [13.415 ms, 13.947 ms]	9.194 ms (204.9%)
iast_GLOBAL	10.243 ms [10.059 ms, 10.426 ms]	5.755 ms (128.3%)
profiling	8.574 ms [8.441 ms, 8.707 ms]	4.087 ms (91.1%)
tracing	7.536 ms [7.429 ms, 7.644 ms]	3.049 ms (68.0%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	malvarez/ratpack-response-extraction
git_commit_date	1750920169	1750921416
git_commit_sha	`becbf2a`	`d9a0fb0`
release_version	1.51.0-SNAPSHOT~becbf2a03c	1.51.0-SNAPSHOT~d9a0fb0e76

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1750923438	1750923438
ci_job_id	999446517	999446517
ci_pipeline_id	68817122	68817122
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-cpksuxk1-project-304-concurrent-1-hutlvb2f 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-cpksuxk1-project-304-concurrent-1-hutlvb2f 6.8.0-1029-aws #31~22.04.1-Ubuntu SMP Thu Apr 24 21:16:18 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.51.0-SNAPSHOT~d9a0fb0e76, baseline=1.51.0-SNAPSHOT~becbf2a03c
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.481 ms) : 1470, 1493
.   : milestone, 1481,
appsec (2.406 ms) : 2358, 2455
.   : milestone, 2406,
iast (2.188 ms) : 2127, 2250
.   : milestone, 2188,
iast_GLOBAL (2.235 ms) : 2173, 2297
.   : milestone, 2235,
profiling (2.051 ms) : 2001, 2101
.   : milestone, 2051,
tracing (2.012 ms) : 1965, 2060
.   : milestone, 2012,
section candidate
no_agent (1.479 ms) : 1468, 1491
.   : milestone, 1479,
appsec (2.413 ms) : 2364, 2462
.   : milestone, 2413,
iast (2.185 ms) : 2123, 2246
.   : milestone, 2185,
iast_GLOBAL (2.234 ms) : 2172, 2296
.   : milestone, 2234,
profiling (2.039 ms) : 1989, 2088
.   : milestone, 2039,
tracing (2.014 ms) : 1967, 2062
.   : milestone, 2014,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.481 ms [1.47 ms, 1.493 ms]	-
appsec	2.406 ms [2.358 ms, 2.455 ms]	924.721 µs (62.4%)
iast	2.188 ms [2.127 ms, 2.25 ms]	706.716 µs (47.7%)
iast_GLOBAL	2.235 ms [2.173 ms, 2.297 ms]	753.21 µs (50.8%)
profiling	2.051 ms [2.001 ms, 2.101 ms]	569.398 µs (38.4%)
tracing	2.012 ms [1.965 ms, 2.06 ms]	530.926 µs (35.8%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.479 ms [1.468 ms, 1.491 ms]	-
appsec	2.413 ms [2.364 ms, 2.462 ms]	933.661 µs (63.1%)
iast	2.185 ms [2.123 ms, 2.246 ms]	705.337 µs (47.7%)
iast_GLOBAL	2.234 ms [2.172 ms, 2.296 ms]	754.483 µs (51.0%)
profiling	2.039 ms [1.989 ms, 2.088 ms]	559.155 µs (37.8%)
tracing	2.014 ms [1.967 ms, 2.062 ms]	534.941 µs (36.2%)

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.51.0-SNAPSHOT~d9a0fb0e76, baseline=1.51.0-SNAPSHOT~becbf2a03c
    dateFormat X
    axisFormat %s
section baseline
no_agent (15.494 s) : 15494000, 15494000
.   : milestone, 15494000,
appsec (14.934 s) : 14934000, 14934000
.   : milestone, 14934000,
iast (18.514 s) : 18514000, 18514000
.   : milestone, 18514000,
iast_GLOBAL (17.918 s) : 17918000, 17918000
.   : milestone, 17918000,
profiling (15.322 s) : 15322000, 15322000
.   : milestone, 15322000,
tracing (14.803 s) : 14803000, 14803000
.   : milestone, 14803000,
section candidate
no_agent (15.361 s) : 15361000, 15361000
.   : milestone, 15361000,
appsec (14.685 s) : 14685000, 14685000
.   : milestone, 14685000,
iast (19.163 s) : 19163000, 19163000
.   : milestone, 19163000,
iast_GLOBAL (18.169 s) : 18169000, 18169000
.   : milestone, 18169000,
profiling (15.835 s) : 15835000, 15835000
.   : milestone, 15835000,
tracing (14.796 s) : 14796000, 14796000
.   : milestone, 14796000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.494 s [15.494 s, 15.494 s]	-
appsec	14.934 s [14.934 s, 14.934 s]	-560.0 ms (-3.6%)
iast	18.514 s [18.514 s, 18.514 s]	3.02 s (19.5%)
iast_GLOBAL	17.918 s [17.918 s, 17.918 s]	2.424 s (15.6%)
profiling	15.322 s [15.322 s, 15.322 s]	-172.0 ms (-1.1%)
tracing	14.803 s [14.803 s, 14.803 s]	-691.0 ms (-4.5%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.361 s [15.361 s, 15.361 s]	-
appsec	14.685 s [14.685 s, 14.685 s]	-676.0 ms (-4.4%)
iast	19.163 s [19.163 s, 19.163 s]	3.802 s (24.8%)
iast_GLOBAL	18.169 s [18.169 s, 18.169 s]	2.808 s (18.3%)
profiling	15.835 s [15.835 s, 15.835 s]	474.0 ms (3.1%)
tracing	14.796 s [14.796 s, 14.796 s]	-565.0 ms (-3.7%)

jandro996

LGTM! just one question, Do we only give support to Ratpack 1.5 or grater?

manuel-alvarez-alvarez · 2025-06-25T13:43:54Z

| Package | Type | Package file | Manager | Update | Change | |---|---|---|---|---|---| | [com.google.errorprone:error_prone_annotations](https://errorprone.info) ([source](https://github.com/google/error-prone)) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `2.39.0` -> `2.40.0` | | [org.apache.commons:commons-lang3](https://commons.apache.org/proper/commons-lang/) ([source](https://gitbox.apache.org/repos/asf/commons-lang.git)) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `3.17.0` -> `3.18.0` | | [org.jetbrains.kotlinx.binary-compatibility-validator](https://github.com/Kotlin/binary-compatibility-validator) | plugin | misk/gradle/libs.versions.toml | gradle | patch | `0.18.0` -> `0.18.1` | | [com.datadoghq:dd-trace-api](https://github.com/datadog/dd-trace-java) | dependencies | misk/gradle/libs.versions.toml | gradle | minor | `1.50.1` -> `1.51.0` | | [software.amazon.awssdk:sdk-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:sqs](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:dynamodb-enhanced](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:dynamodb](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:aws-core](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:bom](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | | [software.amazon.awssdk:auth](https://aws.amazon.com/sdkforjava) | dependencies | misk/gradle/libs.versions.toml | gradle | patch | `2.31.77` -> `2.31.78` | --- ### Release Notes <details> <summary>google/error-prone (com.google.errorprone:error_prone_annotations)</summary> ### [`v2.40.0`](https://github.com/google/error-prone/releases/tag/v2.40.0): Error Prone 2.40.0 Changes: - Bug fixes and improvements - Releases (including snapshots) have migrated from [OSSRH to the Central Publisher Portal](https://central.sonatype.org/pages/ossrh-eol/#process-to-migrate) Full changelog: google/error-prone@v2.39.0...v2.40.0 </details> <details> <summary>Kotlin/binary-compatibility-validator (org.jetbrains.kotlinx.binary-compatibility-validator)</summary> ### [`v0.18.1`](https://github.com/Kotlin/binary-compatibility-validator/releases/tag/0.18.1) [Compare Source](Kotlin/binary-compatibility-validator@0.18.0...0.18.1) #### What's Changed - Fixed a bug preventing use of cross-compilation support during KLIB dump validation \[[#304](https://github.com/Kotlin/binary-compatibility-validator/issues/304)]\[[#306](https://github.com/Kotlin/binary-compatibility-validator/issues/306)] </details> <details> <summary>datadog/dd-trace-java (com.datadoghq:dd-trace-api)</summary> ### [`v1.51.0`](https://github.com/DataDog/dd-trace-java/releases/tag/v1.51.0): 1.51.0 ### Components #### Application Security Management (IAST) - 🐛 Fix verify error when ctor params are used after a call site ([#9083](DataDog/dd-trace-java#9083) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛 Limit the maximum size of the location path in IAST vulnerabilities ([#9028](DataDog/dd-trace-java#9028) - [@jandro996](https://github.com/jandro996)) - 🐛 Fix IAST gRPC handler with null superclass ([#8984](DataDog/dd-trace-java#8984) - [@smola](https://github.com/smola)) - ✨ Optimize IAST Vulnerability Detection ([#8885](DataDog/dd-trace-java#8885) - [@jandro996](https://github.com/jandro996)) #### Application Security Management (WAF) - ✨ Upgrade libddwaf-java to 15.0.0 ([#9022](DataDog/dd-trace-java#9022) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Extract RestEasy json body response schemas ([#9015](DataDog/dd-trace-java#9015) - [@jandro996](https://github.com/jandro996)) - ✨ Extract Jersey json body response schemas ([#9014](DataDog/dd-trace-java#9014) - [@jandro996](https://github.com/jandro996)) - ✨ Extract Ratpack json body response schemas ([#9013](DataDog/dd-trace-java#9013) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Enable API Security by default and make it lazy loading ([#9009](DataDog/dd-trace-java#9009) - [@smola](https://github.com/smola)) - ✨ Extract Vert.x json body response schemas ([#9001](DataDog/dd-trace-java#9001) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Extract Play json body response schemas ([#8995](DataDog/dd-trace-java#8995) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - 🐛 Fix Jackson nodes introspection for request/response schema extraction ([#8980](DataDog/dd-trace-java#8980) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Extract Spring json body response schemas ([#8938](DataDog/dd-trace-java#8938) - [@sezen-datadog](https://github.com/sezen-datadog)) - ✨ Default obfuscation regexp update ([#8937](DataDog/dd-trace-java#8937) - [@sezen-datadog](https://github.com/sezen-datadog)) #### Build & Tooling - ✨ Cancel GitLab running pipeline on new PR push ([#9023](DataDog/dd-trace-java#9023) - [@PerfectSlayer](https://github.com/PerfectSlayer)) - ✨ Migrate publishing to Maven Central Portal ([#8807](DataDog/dd-trace-java#8807) - [@sarahchen6](https://github.com/sarahchen6)) #### Continuous Integration Visibility - 🐛 Fix Test Optimization to work with JDK 24 ([#9114](DataDog/dd-trace-java#9114) - [@nikita-tkachenko-datadog](https://github.com/nikita-tkachenko-datadog)) - ✨ Add repo root as safe directory on git client creation ([#9033](DataDog/dd-trace-java#9033) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Add PR number tag and improve PR information building ([#8990](DataDog/dd-trace-java#8990) - [@daniel-mohedano](https://github.com/daniel-mohedano)) - ✨ Update impacted tests logic ([#8923](DataDog/dd-trace-java#8923) - [@daniel-mohedano](https://github.com/daniel-mohedano)) #### Data Streams Monitoring - 🧹 Clean up DSM context injection ([#8776](DataDog/dd-trace-java#8776) - [@PerfectSlayer](https://github.com/PerfectSlayer)) #### Database Monitoring - 🐛 Set trace\_injected in try block ([#9025](DataDog/dd-trace-java#9025) - [@natashadada](https://github.com/natashadada)) #### Dynamic Instrumentation - 🐛 Add source file tracking enable option ([#9115](DataDog/dd-trace-java#9115) - [@jpbempel](https://github.com/jpbempel)) - ✨ Add java.util.Date support ([#9111](DataDog/dd-trace-java#9111) - [@jpbempel](https://github.com/jpbempel)) - ✨ Update file probe format ([#9047](DataDog/dd-trace-java#9047) - [@jpbempel](https://github.com/jpbempel)) - ✨ add safe local var hoisting ([#9034](DataDog/dd-trace-java#9034) - [@jpbempel](https://github.com/jpbempel)) - 🧹 Add new config for debugger upload interval ([#8959](DataDog/dd-trace-java#8959) - [@jpbempel](https://github.com/jpbempel)) - ✨ Enable Code Origin with Dynamic instrumentation ([#8940](DataDog/dd-trace-java#8940) - [@jpbempel](https://github.com/jpbempel)) #### ML Observability (LLMObs) - 💡 LLM Observability SDK ([#8781](DataDog/dd-trace-java#8781) - [@gary-huang](https://github.com/gary-huang), [@nayeem-kamal](https://github.com/nayeem-kamal)) #### Metrics - 🐛 Ensure client stat reporter is started when the agent is not available at bootstrap ([#9082](DataDog/dd-trace-java#9082) - [@amarziali](https://github.com/amarziali)) - ✨ Create metric: appsec.waf.config\_errors ([#8394](DataDog/dd-trace-java#8394) - [@sezen-datadog](https://github.com/sezen-datadog)) #### Platform components - ✨ Introduce environment component ([#9071](DataDog/dd-trace-java#9071) - [@PerfectSlayer](https://github.com/PerfectSlayer)) #### Profiling - 🐛 Remove annoying warning for smap event parsing ([#9119](DataDog/dd-trace-java#9119) - [@jbachorik](https://github.com/jbachorik)) - 🐛 Fix ByteCountingInputStream when reading past EOF ([#8988](DataDog/dd-trace-java#8988) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Realtime User Monitoring - ✨ Add RUM SDK injection for servlet based web servers ([#9110](DataDog/dd-trace-java#9110) - [@PerfectSlayer](https://github.com/PerfectSlayer) [@amarziali](https://github.com/amarziali)) #### Telemetry - ✨ Update the config origin metric to match what it's mapping ([#9045](DataDog/dd-trace-java#9045) - [@sezen-datadog](https://github.com/sezen-datadog)) #### Testing - ✨ Add testing for latest stable version (JDK 24) ([#8875](DataDog/dd-trace-java#8875) - [@sarahchen6](https://github.com/sarahchen6)) #### Trace context propagation - 🐛 Fix bug with dropping baggage when `TracePropagationBehaviorExtract=IGNORE` ([#9037](DataDog/dd-trace-java#9037) - [@mhlidd](https://github.com/mhlidd)) - 🐛 Fix ArrayIndexOutOfBoundsException in PercentEscaper ([#9032](DataDog/dd-trace-java#9032) - [@mhlidd](https://github.com/mhlidd)) #### Tracer core - 🐛 Fix `Error` handling for trace interceptors ([#9097](DataDog/dd-trace-java#9097) - [@AlexeyKuznetsov-DD](https://github.com/AlexeyKuznetsov-DD)) - 💡 Add wildcard feature for `DD_TRACE_HEADER_TAGS` and enabling for Http Response headers ([#9067](DataDog/dd-trace-java#9067) - [@mhlidd](https://github.com/mhlidd)) #### Tracer public API - 💡 Add LLM Observability SDK ([#8781](DataDog/dd-trace-java#8781) - [@gary-huang](https://github.com/gary-huang)) ### Instrumentations #### Akka instrumentation - 🐛 Fix NPE in akka-http and pekko-http integrations ([#9019](DataDog/dd-trace-java#9019) - [@mcculls](https://github.com/mcculls)) #### Eclipse Vert.x instrumentation - ✨ Extract Vert.x json body response schemas ([#9001](DataDog/dd-trace-java#9001) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) - ✨ Write http.route tag as soon as possible in vert.x ([#8952](DataDog/dd-trace-java#8952) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### JAX-WS instrumentation - 💡⚠️ Enable jax-ws integration by default ([#9030](DataDog/dd-trace-java#9030) - [@bm1549](https://github.com/bm1549)) - ✨ Extract Jersey json body response schemas ([#9014](DataDog/dd-trace-java#9014) - [@jandro996](https://github.com/jandro996)) #### Mule instrumentation - 🐛 Propagate grizzly http span in filters if nothing is active ([#9016](DataDog/dd-trace-java#9016) - [@amarziali](https://github.com/amarziali)) #### Play Framework instrumentation - ✨ Extract Play json body response schemas ([#8995](DataDog/dd-trace-java#8995) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Ratpack instrumentation - ✨ Extract Ratpack json body response schemas ([#9013](DataDog/dd-trace-java#9013) - [@manuel-alvarez-alvarez](https://github.com/manuel-alvarez-alvarez)) #### Spring instrumentation - ✨ Extract Spring json body response schemas ([#8938](DataDog/dd-trace-java#8938) - [@sezen-datadog](https://github.com/sezen-datadog)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - "after 6pm every weekday,before 2am every weekday" in timezone Australia/Melbourne, Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Never, or you tick the rebase/retry checkbox. 👻 **Immortal**: This PR will be recreated if closed unmerged. Get [config help](https://github.com/renovatebot/renovate/discussions) if that's undesired. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). GitOrigin-RevId: 649b690d4c9d7dcb572c457f0802b42b8e3e682e

manuel-alvarez-alvarez added comp: asm waf Application Security Management (WAF) type: enhancement Enhancements and improvements inst: ratpack Ratpack instrumentation labels Jun 19, 2025

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from 686764c to 7e087e5 Compare June 19, 2025 16:03

manuel-alvarez-alvarez marked this pull request as ready for review June 19, 2025 16:04

manuel-alvarez-alvarez requested review from a team as code owners June 19, 2025 16:04

manuel-alvarez-alvarez requested a review from mcculls June 19, 2025 16:04

manuel-alvarez-alvarez force-pushed the malvarez/play-response-extraction branch from 135e0f0 to f5b9e7b Compare June 23, 2025 07:42

manuel-alvarez-alvarez requested review from a team, robertpi and sezen-datadog June 23, 2025 07:42

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from 7e087e5 to 244b4d6 Compare June 23, 2025 07:46

manuel-alvarez-alvarez force-pushed the malvarez/play-response-extraction branch from f5b9e7b to 3fabdcd Compare June 23, 2025 07:48

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from 244b4d6 to ffe6fd3 Compare June 23, 2025 08:20

manuel-alvarez-alvarez force-pushed the malvarez/play-response-extraction branch from fe3ba88 to 22b45ef Compare June 23, 2025 09:54

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from ffe6fd3 to dfccd9d Compare June 23, 2025 09:56

jandro996 approved these changes Jun 23, 2025

View reviewed changes

manuel-alvarez-alvarez force-pushed the malvarez/play-response-extraction branch from 22b45ef to ea1aa76 Compare June 23, 2025 10:37

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from dfccd9d to dd4fbc2 Compare June 23, 2025 10:38

manuel-alvarez-alvarez force-pushed the malvarez/play-response-extraction branch from ea1aa76 to 909e714 Compare June 23, 2025 16:05

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch 2 times, most recently from 0eb016c to 7e2e15d Compare June 23, 2025 18:48

manuel-alvarez-alvarez force-pushed the malvarez/play-response-extraction branch from 909e714 to 6bbdb08 Compare June 24, 2025 12:41

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from 7e2e15d to 0a6e658 Compare June 24, 2025 12:49

manuel-alvarez-alvarez force-pushed the malvarez/play-response-extraction branch 2 times, most recently from ed355c7 to ebaa338 Compare June 25, 2025 09:48

Base automatically changed from malvarez/play-response-extraction to master June 25, 2025 10:55

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from 0a6e658 to a327867 Compare June 25, 2025 10:58

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from a327867 to 8b84450 Compare June 25, 2025 14:31

Extract Ratpack json body response schemas

d9a0fb0

manuel-alvarez-alvarez force-pushed the malvarez/ratpack-response-extraction branch from 8b84450 to d9a0fb0 Compare June 26, 2025 07:03

manuel-alvarez-alvarez merged commit 2454633 into master Jun 26, 2025
508 checks passed

manuel-alvarez-alvarez deleted the malvarez/ratpack-response-extraction branch June 26, 2025 09:34

github-actions Bot added this to the 1.51.0 milestone Jun 26, 2025

Sunbelt Computer Software

PL/B Language Development and Support

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Extract Ratpack json body response schemas#9013

Extract Ratpack json body response schemas#9013
manuel-alvarez-alvarez merged 1 commit into
masterfrom
malvarez/ratpack-response-extraction

manuel-alvarez-alvarez commented Jun 19, 2025 •

edited

Loading

Uh oh!

pr-commenter Bot commented Jun 19, 2025 •

edited

Loading

Uh oh!

jandro996 left a comment

Uh oh!

manuel-alvarez-alvarez commented Jun 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Sunbelt Computer Software

PL/B Language Development and Support

Uh oh!

Conversation

manuel-alvarez-alvarez commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

pr-commenter Bot commented Jun 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

jandro996 left a comment

Choose a reason for hiding this comment

Uh oh!

manuel-alvarez-alvarez commented Jun 25, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

manuel-alvarez-alvarez commented Jun 19, 2025 •

edited

Loading

pr-commenter Bot commented Jun 19, 2025 •

edited

Loading