Optimize AppSecRequestContext numeric conversion to eliminate exceptions on hot path#10520
Merged
Optimize AppSecRequestContext numeric conversion to eliminate exceptions on hot path#10520
Conversation
jandro996
added
type: bug
jandro996
requested review from
daniel-romano-DD,
manuel-alvarez-alvarez and
smola
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 414bf71220
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/AppSecRequestContext.java
Outdated
Show resolved
Hide resolved
jandro996
force-pushed
the
alejandro.gonzalez/issue-10494
branch
from
414bf71 to
49d9f79
Compare
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 65 metrics, 6 unstable metrics. Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.60.0-SNAPSHOT~4004a3ad21, baseline=1.60.0-SNAPSHOT~b83178b28d
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.066 s) : 0, 1066374
Total [baseline] (8.768 s) : 0, 8768290
Agent [candidate] (1.065 s) : 0, 1065135
Total [candidate] (8.756 s) : 0, 8755744
section iast
Agent [baseline] (1.242 s) : 0, 1242482
Total [baseline] (9.393 s) : 0, 9393130
Agent [candidate] (1.233 s) : 0, 1233148
Total [candidate] (9.393 s) : 0, 9393484
gantt
title insecure-bank - break down per module: candidate=1.60.0-SNAPSHOT~4004a3ad21, baseline=1.60.0-SNAPSHOT~b83178b28d
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.197 ms) : 0, 1197
crashtracking [candidate] (1.19 ms) : 0, 1190
BytebuddyAgent [baseline] (630.543 ms) : 0, 630543
BytebuddyAgent [candidate] (629.126 ms) : 0, 629126
AgentMeter [baseline] (28.9 ms) : 0, 28900
AgentMeter [candidate] (28.899 ms) : 0, 28899
GlobalTracer [baseline] (258.253 ms) : 0, 258253
GlobalTracer [candidate] (258.024 ms) : 0, 258024
AppSec [baseline] (32.927 ms) : 0, 32927
AppSec [candidate] (32.74 ms) : 0, 32740
Debugger [baseline] (59.794 ms) : 0, 59794
Debugger [candidate] (62.085 ms) : 0, 62085
Remote Config [baseline] (630.314 µs) : 0, 630
Remote Config [candidate] (608.652 µs) : 0, 609
Telemetry [baseline] (10.849 ms) : 0, 10849
Telemetry [candidate] (10.592 ms) : 0, 10592
Flare Poller [baseline] (7.711 ms) : 0, 7711
Flare Poller [candidate] (6.45 ms) : 0, 6450
section iast
crashtracking [baseline] (1.217 ms) : 0, 1217
crashtracking [candidate] (1.198 ms) : 0, 1198
BytebuddyAgent [baseline] (803.707 ms) : 0, 803707
BytebuddyAgent [candidate] (796.635 ms) : 0, 796635
AgentMeter [baseline] (11.562 ms) : 0, 11562
AgentMeter [candidate] (11.322 ms) : 0, 11322
GlobalTracer [baseline] (249.972 ms) : 0, 249972
GlobalTracer [candidate] (248.766 ms) : 0, 248766
AppSec [baseline] (34.304 ms) : 0, 34304
AppSec [candidate] (34.999 ms) : 0, 34999
Debugger [baseline] (66.105 ms) : 0, 66105
Debugger [candidate] (65.157 ms) : 0, 65157
Remote Config [baseline] (555.707 µs) : 0, 556
Remote Config [candidate] (543.039 µs) : 0, 543
Telemetry [baseline] (8.775 ms) : 0, 8775
Telemetry [candidate] (8.685 ms) : 0, 8685
Flare Poller [baseline] (3.54 ms) : 0, 3540
Flare Poller [candidate] (3.473 ms) : 0, 3473
IAST [baseline] (27.087 ms) : 0, 27087
IAST [candidate] (27.025 ms) : 0, 27025
Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.60.0-SNAPSHOT~4004a3ad21, baseline=1.60.0-SNAPSHOT~b83178b28d
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.069 s) : 0, 1069047
Total [baseline] (10.932 s) : 0, 10932479
Agent [candidate] (1.07 s) : 0, 1069796
Total [candidate] (11.034 s) : 0, 11034386
section appsec
Agent [baseline] (1.241 s) : 0, 1240800
Total [baseline] (11.02 s) : 0, 11019982
Agent [candidate] (1.243 s) : 0, 1242907
Total [candidate] (10.966 s) : 0, 10965889
section iast
Agent [baseline] (1.236 s) : 0, 1236359
Total [baseline] (11.285 s) : 0, 11285034
Agent [candidate] (1.234 s) : 0, 1234201
Total [candidate] (11.212 s) : 0, 11212391
section profiling
Agent [baseline] (1.193 s) : 0, 1193218
Total [baseline] (11.047 s) : 0, 11047092
Agent [candidate] (1.189 s) : 0, 1189368
Total [candidate] (11.052 s) : 0, 11052444
gantt
title petclinic - break down per module: candidate=1.60.0-SNAPSHOT~4004a3ad21, baseline=1.60.0-SNAPSHOT~b83178b28d
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.194 ms) : 0, 1194
crashtracking [candidate] (1.18 ms) : 0, 1180
BytebuddyAgent [baseline] (630.896 ms) : 0, 630896
BytebuddyAgent [candidate] (629.647 ms) : 0, 629647
AgentMeter [baseline] (28.937 ms) : 0, 28937
AgentMeter [candidate] (29.093 ms) : 0, 29093
GlobalTracer [baseline] (258.352 ms) : 0, 258352
GlobalTracer [candidate] (259.442 ms) : 0, 259442
AppSec [baseline] (32.893 ms) : 0, 32893
AppSec [candidate] (33.224 ms) : 0, 33224
Debugger [baseline] (64.414 ms) : 0, 64414
Debugger [candidate] (61.791 ms) : 0, 61791
Remote Config [baseline] (620.357 µs) : 0, 620
Remote Config [candidate] (625.631 µs) : 0, 626
Telemetry [baseline] (10.836 ms) : 0, 10836
Telemetry [candidate] (14.858 ms) : 0, 14858
Flare Poller [baseline] (5.4 ms) : 0, 5400
Flare Poller [candidate] (4.556 ms) : 0, 4556
section appsec
crashtracking [baseline] (1.191 ms) : 0, 1191
crashtracking [candidate] (1.201 ms) : 0, 1201
BytebuddyAgent [baseline] (658.502 ms) : 0, 658502
BytebuddyAgent [candidate] (660.224 ms) : 0, 660224
AgentMeter [baseline] (11.965 ms) : 0, 11965
AgentMeter [candidate] (11.986 ms) : 0, 11986
GlobalTracer [baseline] (258.84 ms) : 0, 258840
GlobalTracer [candidate] (259.651 ms) : 0, 259651
IAST [baseline] (25.35 ms) : 0, 25350
IAST [candidate] (25.376 ms) : 0, 25376
AppSec [baseline] (168.533 ms) : 0, 168533
AppSec [candidate] (168.19 ms) : 0, 168190
Debugger [baseline] (67.684 ms) : 0, 67684
Debugger [candidate] (67.514 ms) : 0, 67514
Remote Config [baseline] (657.926 µs) : 0, 658
Remote Config [candidate] (670.581 µs) : 0, 671
Telemetry [baseline] (9.106 ms) : 0, 9106
Telemetry [candidate] (9.089 ms) : 0, 9089
Flare Poller [baseline] (3.661 ms) : 0, 3661
Flare Poller [candidate] (3.625 ms) : 0, 3625
section iast
crashtracking [baseline] (1.183 ms) : 0, 1183
crashtracking [candidate] (1.182 ms) : 0, 1182
BytebuddyAgent [baseline] (798.374 ms) : 0, 798374
BytebuddyAgent [candidate] (796.944 ms) : 0, 796944
AgentMeter [baseline] (11.311 ms) : 0, 11311
AgentMeter [candidate] (11.281 ms) : 0, 11281
GlobalTracer [baseline] (248.466 ms) : 0, 248466
GlobalTracer [candidate] (248.786 ms) : 0, 248786
IAST [baseline] (27.002 ms) : 0, 27002
IAST [candidate] (26.846 ms) : 0, 26846
AppSec [baseline] (34.929 ms) : 0, 34929
AppSec [candidate] (34.563 ms) : 0, 34563
Debugger [baseline] (66.875 ms) : 0, 66875
Debugger [candidate] (66.403 ms) : 0, 66403
Remote Config [baseline] (551.794 µs) : 0, 552
Remote Config [candidate] (550.182 µs) : 0, 550
Telemetry [baseline] (8.753 ms) : 0, 8753
Telemetry [candidate] (8.745 ms) : 0, 8745
Flare Poller [baseline] (3.482 ms) : 0, 3482
Flare Poller [candidate] (3.453 ms) : 0, 3453
section profiling
crashtracking [baseline] (1.241 ms) : 0, 1241
crashtracking [candidate] (1.213 ms) : 0, 1213
BytebuddyAgent [baseline] (683.774 ms) : 0, 683774
BytebuddyAgent [candidate] (680.86 ms) : 0, 680860
AgentMeter [baseline] (9.026 ms) : 0, 9026
AgentMeter [candidate] (8.994 ms) : 0, 8994
GlobalTracer [baseline] (216.314 ms) : 0, 216314
GlobalTracer [candidate] (215.705 ms) : 0, 215705
AppSec [baseline] (32.433 ms) : 0, 32433
AppSec [candidate] (32.368 ms) : 0, 32368
Debugger [baseline] (67.908 ms) : 0, 67908
Debugger [candidate] (67.66 ms) : 0, 67660
Remote Config [baseline] (606.346 µs) : 0, 606
Remote Config [candidate] (609.491 µs) : 0, 609
Telemetry [baseline] (8.849 ms) : 0, 8849
Telemetry [candidate] (8.962 ms) : 0, 8962
Flare Poller [baseline] (3.747 ms) : 0, 3747
Flare Poller [candidate] (3.752 ms) : 0, 3752
ProfilingAgent [baseline] (99.221 ms) : 0, 99221
ProfilingAgent [candidate] (99.418 ms) : 0, 99418
Profiling [baseline] (99.79 ms) : 0, 99790
Profiling [candidate] (99.986 ms) : 0, 99986
LoadParameters
See matching parameters
SummaryFound 2 performance improvements and 3 performance regressions! Performance is the same for 14 metrics, 17 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.60.0-SNAPSHOT~4004a3ad21, baseline=1.60.0-SNAPSHOT~b83178b28d
dateFormat X
axisFormat %s
section baseline
no_agent (18.559 ms) : 18371, 18746
. : milestone, 18559,
appsec (19.006 ms) : 18811, 19200
. : milestone, 19006,
code_origins (17.614 ms) : 17439, 17789
. : milestone, 17614,
iast (17.644 ms) : 17466, 17822
. : milestone, 17644,
profiling (18.91 ms) : 18722, 19098
. : milestone, 18910,
tracing (17.633 ms) : 17463, 17803
. : milestone, 17633,
section candidate
no_agent (19.55 ms) : 19346, 19754
. : milestone, 19550,
appsec (18.58 ms) : 18392, 18769
. : milestone, 18580,
code_origins (17.769 ms) : 17591, 17946
. : milestone, 17769,
iast (18.827 ms) : 18634, 19021
. : milestone, 18827,
profiling (18.847 ms) : 18658, 19036
. : milestone, 18847,
tracing (17.769 ms) : 17591, 17946
. : milestone, 17769,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.60.0-SNAPSHOT~4004a3ad21, baseline=1.60.0-SNAPSHOT~b83178b28d
dateFormat X
axisFormat %s
section baseline
no_agent (1.186 ms) : 1174, 1197
. : milestone, 1186,
iast (3.251 ms) : 3206, 3295
. : milestone, 3251,
iast_FULL (6.185 ms) : 6121, 6250
. : milestone, 6185,
iast_GLOBAL (3.46 ms) : 3401, 3519
. : milestone, 3460,
profiling (2.091 ms) : 2070, 2111
. : milestone, 2091,
tracing (1.813 ms) : 1798, 1829
. : milestone, 1813,
section candidate
no_agent (1.198 ms) : 1186, 1210
. : milestone, 1198,
iast (3.219 ms) : 3177, 3262
. : milestone, 3219,
iast_FULL (5.88 ms) : 5822, 5938
. : milestone, 5880,
iast_GLOBAL (3.706 ms) : 3636, 3775
. : milestone, 3706,
profiling (2.039 ms) : 2022, 2057
. : milestone, 2039,
tracing (1.88 ms) : 1863, 1897
. : milestone, 1880,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.60.0-SNAPSHOT~4004a3ad21, baseline=1.60.0-SNAPSHOT~b83178b28d
dateFormat X
axisFormat %s
section baseline
no_agent (14.961 s) : 14961000, 14961000
. : milestone, 14961000,
appsec (14.577 s) : 14577000, 14577000
. : milestone, 14577000,
iast (17.91 s) : 17910000, 17910000
. : milestone, 17910000,
iast_GLOBAL (17.667 s) : 17667000, 17667000
. : milestone, 17667000,
profiling (14.992 s) : 14992000, 14992000
. : milestone, 14992000,
tracing (15.195 s) : 15195000, 15195000
. : milestone, 15195000,
section candidate
no_agent (15.114 s) : 15114000, 15114000
. : milestone, 15114000,
appsec (14.89 s) : 14890000, 14890000
. : milestone, 14890000,
iast (18.127 s) : 18127000, 18127000
. : milestone, 18127000,
iast_GLOBAL (17.781 s) : 17781000, 17781000
. : milestone, 17781000,
profiling (14.965 s) : 14965000, 14965000
. : milestone, 14965000,
tracing (14.849 s) : 14849000, 14849000
. : milestone, 14849000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.60.0-SNAPSHOT~4004a3ad21, baseline=1.60.0-SNAPSHOT~b83178b28d
dateFormat X
axisFormat %s
section baseline
no_agent (1.472 ms) : 1461, 1484
. : milestone, 1472,
appsec (3.694 ms) : 3478, 3911
. : milestone, 3694,
iast (2.264 ms) : 2194, 2334
. : milestone, 2264,
iast_GLOBAL (2.305 ms) : 2235, 2374
. : milestone, 2305,
profiling (2.078 ms) : 2023, 2132
. : milestone, 2078,
tracing (2.069 ms) : 2015, 2123
. : milestone, 2069,
section candidate
no_agent (1.469 ms) : 1457, 1480
. : milestone, 1469,
appsec (3.786 ms) : 3566, 4006
. : milestone, 3786,
iast (2.257 ms) : 2188, 2326
. : milestone, 2257,
iast_GLOBAL (2.305 ms) : 2235, 2375
. : milestone, 2305,
profiling (2.079 ms) : 2024, 2134
. : milestone, 2079,
tracing (2.072 ms) : 2018, 2126
. : milestone, 2072,
|
Contributor
|
Nice. Thank you for doing that. |
dougqh
approved these changes
Feb 5, 2026
Member
Author
Thanks for the review @dougqh, I’ve moved the implementation into a static utility, as you suggested. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
Replaces exception-driven numeric parsing in AppSecRequestContext.convertToNumericAttribute() with fast-path validation to eliminate NumberFormatException overhead when processing non-numeric attribute values.
Key changes:
Motivation
Fixes #10494 - Memory growth/overhead in production services with
DD_APPSEC_ENABLED=true.Root cause: AppSec request processing frequently attempts to parse non-numeric attribute values (health check responses, request IDs, headers) as numbers. Each failed parse throws a NumberFormatException, causing ~1000ns overhead + allocation per call. Under profiling, this amplifies into observable memory pressure.
Additional Notes
Why numeric parsing matters: The tracer must distinguish numeric from string values for semantic correctness in Datadog backend. The
traceSegment.setTagTop(key, value)method has type-specific overloads (Number, String, Boolean) that encode metadata for backend processing.Performance impact (JMH benchmarks):
Contributor Checklist
type:and (comp:orinst:) labels in addition to any useful labelsclose,fixor any linking keywords when referencing an issue.Use
solvesinstead, and assign the PR milestone to the issueJira ticket: APPSEC-61110