Add server.request.body.files_content AppSec address support for Jetty

[jandro996]

What Does This Do

• Adds extractContents() to MultipartHelper (jetty-appsec-9.2/9.3/9.4/11.0) and PartHelper (jetty-appsec-8.1.3) to extract file content from multipart Parts, reading up to dd.appsec.max-file-content-bytes (default 4096) bytes per part, capped at dd.appsec.max-file-content-count (default 25) parts per request
• Adds fireFilesContentEvent() to each helper, firing the server.request.body.files_content IG event via EVENTS.requestFilesContent()
• Updates both advice classes in all five AppSec modules to fire the content event sequentially after the filenames event: t = fireFilenamesEvent(...); if (t == null) t = fireFilesContentEvent(...)
• Form fields (parts with null submitted filename) are excluded; files with empty filename ("") are included for content inspection but excluded from filenames — matches the filter established in Add server.request.body.files_content AppSec address for Tomcat and Netty multipart #11198
• Content is decoded via MultipartContentDecoder.readInputStream() with charset detection from the part's Content-Type header
• For Jetty 8.1.3, filenameFromPart() (Content-Disposition header parsing) is used in place of getSubmittedFileName(), which was only added in Servlet 3.1
• Adds unit tests for extractContents() in all five modules (null/empty, form-field skip, empty-filename include, content read, byte truncation, IOException fallback, count cap)
• Enables testBodyFilesContent() in integration test classes for Jetty 8.x, 9.2, 9.3, 9.4, 10.0, and 11.0

Motivation

Extends the server.request.body.files_content WAF address to Jetty, following the Tomcat/Netty implementation in #11198 and building on the Jetty filenames support from #10988.

Additional Notes

The content event fires sequentially after the filenames event — only when filenames did not block. This matches the intent from #11137 (commons-fileupload). The MAX_CONTENT_BYTES and MAX_FILES_TO_INSPECT constants are static final fields on the helper classes (not on advice inner classes with @RequiresRequestContext) to avoid muzzle validation failures at CI.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Jira ticket: N/A

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

[jandro996]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 66fad6bbfd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.95 s	13.90 s	[-0.4%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	12.90 s	13.01 s	[-1.6%; -0.0%] (maybe better)
startup:petclinic:appsec:Agent	16.28 s	16.73 s	[-7.4%; +2.0%] (no difference)
startup:petclinic:iast:Agent	16.95 s	16.97 s	[-0.9%; +0.6%] (no difference)
startup:petclinic:profiling:Agent	16.87 s	16.96 s	[-1.4%; +0.3%] (no difference)
startup:petclinic:sca:Agent	16.99 s	16.69 s	[+0.9%; +2.7%] (maybe worse)
startup:petclinic:tracing:Agent	16.07 s	16.08 s	[-1.1%; +0.9%] (no difference)

Commit: d605e015 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[jandro996]

Addressed in d605e01:

• Jetty 8 body-block guard: added bodyBlock == null && before fireFilesContentEvent in both GetFilenamesAdvice and GetPartAdvice — consistent with the Tomcat, Netty, and Jersey pattern (PRs Add server.request.body.files_content AppSec address for Tomcat and Netty multipart #11198, Add server.request.body.files_content AppSec address for Jersey and RESTEasy #11229) where content only fires when no prior event blocked.
• Ordering-sensitive test fix: the max-files-limit assertion now counts occurrences of content_of_file_ instead of checking for a specific file number. Jetty returns parts in HashMap order rather than insertion order, so the file excluded by the limit isn't deterministically the last one sent.