diff --git a/dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/api/security/ApiSecurityDownstreamSamplerTest.groovy b/dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/api/security/ApiSecurityDownstreamSamplerTest.groovy index d89313b65a7..562925f01af 100644 --- a/dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/api/security/ApiSecurityDownstreamSamplerTest.groovy +++ b/dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/api/security/ApiSecurityDownstreamSamplerTest.groovy @@ -1,6 +1,11 @@ package com.datadog.appsec.api.security +import static datadog.trace.api.config.AppSecConfig.API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE +import static datadog.trace.api.config.AppSecConfig.API_SECURITY_DOWNSTREAM_REQUEST_ANALYSIS_SAMPLE_RATE +import static datadog.trace.api.config.AppSecConfig.API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE + import com.datadog.appsec.gateway.AppSecRequestContext +import datadog.trace.api.Config import datadog.trace.test.util.DDSpecification class ApiSecurityDownstreamSamplerTest extends DDSpecification { @@ -43,4 +48,22 @@ class ApiSecurityDownstreamSamplerTest extends DDSpecification { where: rate << [-1.0, 0.0, 0.1, 0.25, 0.5, 0.75, 0.9, 1.0, 2.0] } + + void 'test config aliases'() { + setup: + injectSysConfig(env, "0.25") + + when: + final value = Config.get().getApiSecurityDownstreamRequestBodyAnalysisSampleRate() + + then: + value == 0.25 + + where: + env << [ + API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE, + API_SECURITY_DOWNSTREAM_REQUEST_ANALYSIS_SAMPLE_RATE, + API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE, + ] + } } diff --git a/dd-trace-api/src/main/java/datadog/trace/api/config/AppSecConfig.java b/dd-trace-api/src/main/java/datadog/trace/api/config/AppSecConfig.java index ea1f6cb9e73..f495f21d2da 100644 --- a/dd-trace-api/src/main/java/datadog/trace/api/config/AppSecConfig.java +++ b/dd-trace-api/src/main/java/datadog/trace/api/config/AppSecConfig.java @@ -32,6 +32,8 @@ public final class AppSecConfig { "api-security.endpoint.collection.enabled"; public static final String API_SECURITY_ENDPOINT_COLLECTION_MESSAGE_LIMIT = "api-security.endpoint.collection.message.limit"; + public static final String API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE = + "api-security.downstream.body.analysis.sample_rate"; public static final String API_SECURITY_DOWNSTREAM_REQUEST_ANALYSIS_SAMPLE_RATE = "api-security.downstream.request.analysis.sample_rate"; public static final String API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE = diff --git a/internal-api/src/main/java/datadog/trace/api/Config.java b/internal-api/src/main/java/datadog/trace/api/Config.java index 3b7534eafb5..e4073041946 100644 --- a/internal-api/src/main/java/datadog/trace/api/Config.java +++ b/internal-api/src/main/java/datadog/trace/api/Config.java @@ -203,6 +203,7 @@ import static datadog.trace.api.config.AIGuardConfig.DEFAULT_AI_GUARD_MAX_CONTENT_SIZE; import static datadog.trace.api.config.AIGuardConfig.DEFAULT_AI_GUARD_MAX_MESSAGES_LENGTH; import static datadog.trace.api.config.AIGuardConfig.DEFAULT_AI_GUARD_TIMEOUT; +import static datadog.trace.api.config.AppSecConfig.API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE; import static datadog.trace.api.config.AppSecConfig.API_SECURITY_DOWNSTREAM_REQUEST_ANALYSIS_SAMPLE_RATE; import static datadog.trace.api.config.AppSecConfig.API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE; import static datadog.trace.api.config.AppSecConfig.API_SECURITY_ENABLED; @@ -2330,9 +2331,10 @@ PROFILING_DATADOG_PROFILER_ENABLED, isDatadogProfilerSafeInCurrentEnvironment()) DEFAULT_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS); apiSecurityDownstreamRequestBodyAnalysisSampleRate = configProvider.getDouble( - API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE, + API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE, DEFAULT_API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE, - API_SECURITY_DOWNSTREAM_REQUEST_ANALYSIS_SAMPLE_RATE); + API_SECURITY_DOWNSTREAM_REQUEST_ANALYSIS_SAMPLE_RATE, + API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE); // Trace Resource Renaming (Endpoint Inference) configuration // Default: enabled if AppSec is enabled, otherwise disabled diff --git a/metadata/supported-configurations.json b/metadata/supported-configurations.json index ac7935039e3..0c54f56fdef 100644 --- a/metadata/supported-configurations.json +++ b/metadata/supported-configurations.json @@ -129,6 +129,14 @@ "aliases": [] } ], + "DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE": [ + { + "version": "A", + "type": "decimal", + "default": "0.5", + "aliases": ["DD_API_SECURITY_DOWNSTREAM_REQUEST_ANALYSIS_SAMPLE_RATE", "DD_API_SECURITY_DOWNSTREAM_REQUEST_BODY_ANALYSIS_SAMPLE_RATE"] + } + ], "DD_API_SECURITY_DOWNSTREAM_REQUEST_ANALYSIS_SAMPLE_RATE": [ { "version": "A",