Fix ObjectIntrospection exposing JDK internal toString() to the WAF by jandro996 · Pull Request #10820 · DataDog/dd-trace-java

jandro996 · 2026-03-12T14:26:56Z

What Does This Do

When setAccessible() failed for a field due to Java 9+ module encapsulation, ObjectIntrospection returned obj.toString() for the entire object.

This caused JDK internal string representations such as "class java.lang.Object" to reach the WAF engine, where they could match phrase_match rules (e.g., crs-944-130 java_code_injection) and generate false positive security events on every request, leading to a CPU spike.

This change replaces the early return with a continue, so that inaccessible fields are skipped while accessible fields on the same object are still reported to the WAF.

Motivation

Avoid false positive security events and unnecessary CPU spikes caused by internal JDK string representations being analyzed by the WAF.
https://datadoghq.atlassian.net/browse/SCRS-2006

Additional Notes

Affects behavior when setAccessible() fails under Java 9+ module encapsulation.
Ensures ObjectIntrospection continues processing remaining accessible fields instead of falling back to obj.toString().

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors

Jira ticket: APPSEC-61693

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

pr-commenter · 2026-03-12T15:58:23Z

Benchmarks

⚠️ Warning: Baseline build not found for merge-base commit. Comparing against the latest commit on master instead.

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	alejandro.gonzalez/APPSEC-61693
git_commit_date	1773436250	1773660080
git_commit_sha	`8185dcf`	`9ded002`
release_version	1.61.0-SNAPSHOT~8185dcf699	1.61.0-SNAPSHOT~9ded0025e1

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1773662045	1773662045
ci_job_id	1507946885	1507946885
ci_pipeline_id	102628732	102628732
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-mmi9yewo 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-mmi9yewo 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module	Agent	Agent
parent	None	None

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 63 metrics, 8 unstable metrics.

Startup time reports for insecure-bank

gantt
    title insecure-bank - global startup overhead: candidate=1.61.0-SNAPSHOT~9ded0025e1, baseline=1.61.0-SNAPSHOT~8185dcf699

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.063 s) : 0, 1062556
Total [baseline] (8.916 s) : 0, 8915736
Agent [candidate] (1.061 s) : 0, 1061178
Total [candidate] (8.868 s) : 0, 8868274
section iast
Agent [baseline] (1.232 s) : 0, 1232398
Total [baseline] (9.594 s) : 0, 9593508
Agent [candidate] (1.228 s) : 0, 1228242
Total [candidate] (9.601 s) : 0, 9600615

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.063 s	-
Agent	iast	1.232 s	169.842 ms (16.0%)
Total	tracing	8.916 s	-
Total	iast	9.594 s	677.772 ms (7.6%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.061 s	-
Agent	iast	1.228 s	167.064 ms (15.7%)
Total	tracing	8.868 s	-
Total	iast	9.601 s	732.342 ms (8.3%)

gantt
    title insecure-bank - break down per module: candidate=1.61.0-SNAPSHOT~9ded0025e1, baseline=1.61.0-SNAPSHOT~8185dcf699

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.2 ms) : 0, 1200
crashtracking [candidate] (1.198 ms) : 0, 1198
BytebuddyAgent [baseline] (631.44 ms) : 0, 631440
BytebuddyAgent [candidate] (629.169 ms) : 0, 629169
AgentMeter [baseline] (29.13 ms) : 0, 29130
AgentMeter [candidate] (29.133 ms) : 0, 29133
GlobalTracer [baseline] (258.399 ms) : 0, 258399
GlobalTracer [candidate] (257.759 ms) : 0, 257759
AppSec [baseline] (31.54 ms) : 0, 31540
AppSec [candidate] (31.539 ms) : 0, 31539
Debugger [baseline] (58.953 ms) : 0, 58953
Debugger [candidate] (58.839 ms) : 0, 58839
Remote Config [baseline] (615.671 µs) : 0, 616
Remote Config [candidate] (610.403 µs) : 0, 610
Telemetry [baseline] (8.747 ms) : 0, 8747
Telemetry [candidate] (8.702 ms) : 0, 8702
Flare Poller [baseline] (6.363 ms) : 0, 6363
Flare Poller [candidate] (8.108 ms) : 0, 8108
section iast
crashtracking [baseline] (1.197 ms) : 0, 1197
crashtracking [candidate] (1.19 ms) : 0, 1190
BytebuddyAgent [baseline] (799.47 ms) : 0, 799470
BytebuddyAgent [candidate] (796.927 ms) : 0, 796927
AgentMeter [baseline] (11.353 ms) : 0, 11353
AgentMeter [candidate] (11.357 ms) : 0, 11357
GlobalTracer [baseline] (248.609 ms) : 0, 248609
GlobalTracer [candidate] (248.157 ms) : 0, 248157
IAST [baseline] (25.223 ms) : 0, 25223
IAST [candidate] (25.159 ms) : 0, 25159
AppSec [baseline] (26.485 ms) : 0, 26485
AppSec [candidate] (26.35 ms) : 0, 26350
Debugger [baseline] (63.329 ms) : 0, 63329
Debugger [candidate] (62.719 ms) : 0, 62719
Remote Config [baseline] (507.579 µs) : 0, 508
Remote Config [candidate] (514.29 µs) : 0, 514
Telemetry [baseline] (14.82 ms) : 0, 14820
Telemetry [candidate] (14.904 ms) : 0, 14904
Flare Poller [baseline] (5.129 ms) : 0, 5129
Flare Poller [candidate] (4.865 ms) : 0, 4865

Startup time reports for petclinic

gantt
    title petclinic - global startup overhead: candidate=1.61.0-SNAPSHOT~9ded0025e1, baseline=1.61.0-SNAPSHOT~8185dcf699

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.066 s) : 0, 1065596
Total [baseline] (11.076 s) : 0, 11076140
Agent [candidate] (1.065 s) : 0, 1064825
Total [candidate] (11.155 s) : 0, 11154518
section appsec
Agent [baseline] (1.249 s) : 0, 1248702
Total [baseline] (11.275 s) : 0, 11275219
Agent [candidate] (1.251 s) : 0, 1250899
Total [candidate] (11.195 s) : 0, 11194625
section iast
Agent [baseline] (1.23 s) : 0, 1229501
Total [baseline] (11.4 s) : 0, 11399847
Agent [candidate] (1.233 s) : 0, 1232804
Total [candidate] (11.339 s) : 0, 11338731
section profiling
Agent [baseline] (1.187 s) : 0, 1186884
Total [baseline] (11.213 s) : 0, 11212906
Agent [candidate] (1.185 s) : 0, 1184954
Total [candidate] (11.138 s) : 0, 11138216

baseline results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.066 s	-
Agent	appsec	1.249 s	183.107 ms (17.2%)
Agent	iast	1.23 s	163.905 ms (15.4%)
Agent	profiling	1.187 s	121.288 ms (11.4%)
Total	tracing	11.076 s	-
Total	appsec	11.275 s	199.079 ms (1.8%)
Total	iast	11.4 s	323.706 ms (2.9%)
Total	profiling	11.213 s	136.765 ms (1.2%)

candidate results

Module	Variant	Duration	Δ tracing
Agent	tracing	1.065 s	-
Agent	appsec	1.251 s	186.074 ms (17.5%)
Agent	iast	1.233 s	167.978 ms (15.8%)
Agent	profiling	1.185 s	120.128 ms (11.3%)
Total	tracing	11.155 s	-
Total	appsec	11.195 s	40.107 ms (0.4%)
Total	iast	11.339 s	184.213 ms (1.7%)
Total	profiling	11.138 s	-16.303 ms (-0.1%)

gantt
    title petclinic - break down per module: candidate=1.61.0-SNAPSHOT~9ded0025e1, baseline=1.61.0-SNAPSHOT~8185dcf699

    dateFormat X
    axisFormat %s
section tracing
crashtracking [baseline] (1.197 ms) : 0, 1197
crashtracking [candidate] (1.209 ms) : 0, 1209
BytebuddyAgent [baseline] (631.48 ms) : 0, 631480
BytebuddyAgent [candidate] (631.202 ms) : 0, 631202
AgentMeter [baseline] (29.232 ms) : 0, 29232
AgentMeter [candidate] (29.271 ms) : 0, 29271
GlobalTracer [baseline] (258.584 ms) : 0, 258584
GlobalTracer [candidate] (259.29 ms) : 0, 259290
AppSec [baseline] (31.717 ms) : 0, 31717
AppSec [candidate] (31.778 ms) : 0, 31778
Debugger [baseline] (59.776 ms) : 0, 59776
Debugger [candidate] (59.918 ms) : 0, 59918
Remote Config [baseline] (620.054 µs) : 0, 620
Remote Config [candidate] (618.742 µs) : 0, 619
Telemetry [baseline] (8.747 ms) : 0, 8747
Telemetry [candidate] (8.823 ms) : 0, 8823
Flare Poller [baseline] (8.154 ms) : 0, 8154
Flare Poller [candidate] (6.458 ms) : 0, 6458
section appsec
crashtracking [baseline] (1.195 ms) : 0, 1195
crashtracking [candidate] (1.192 ms) : 0, 1192
BytebuddyAgent [baseline] (659.246 ms) : 0, 659246
BytebuddyAgent [candidate] (660.498 ms) : 0, 660498
AgentMeter [baseline] (12.139 ms) : 0, 12139
AgentMeter [candidate] (12.083 ms) : 0, 12083
GlobalTracer [baseline] (258.889 ms) : 0, 258889
GlobalTracer [candidate] (259.231 ms) : 0, 259231
IAST [baseline] (24.021 ms) : 0, 24021
IAST [candidate] (24.017 ms) : 0, 24017
AppSec [baseline] (177.664 ms) : 0, 177664
AppSec [candidate] (178.301 ms) : 0, 178301
Debugger [baseline] (66.008 ms) : 0, 66008
Debugger [candidate] (66.013 ms) : 0, 66013
Remote Config [baseline] (571.222 µs) : 0, 571
Remote Config [candidate] (566.673 µs) : 0, 567
Telemetry [baseline] (9.055 ms) : 0, 9055
Telemetry [candidate] (9.02 ms) : 0, 9020
Flare Poller [baseline] (3.649 ms) : 0, 3649
Flare Poller [candidate] (3.65 ms) : 0, 3650
section iast
crashtracking [baseline] (1.199 ms) : 0, 1199
crashtracking [candidate] (1.2 ms) : 0, 1200
BytebuddyAgent [baseline] (796.79 ms) : 0, 796790
BytebuddyAgent [candidate] (799.56 ms) : 0, 799560
AgentMeter [baseline] (11.374 ms) : 0, 11374
AgentMeter [candidate] (11.382 ms) : 0, 11382
GlobalTracer [baseline] (248.025 ms) : 0, 248025
GlobalTracer [candidate] (248.682 ms) : 0, 248682
IAST [baseline] (25.081 ms) : 0, 25081
IAST [candidate] (25.218 ms) : 0, 25218
AppSec [baseline] (27.193 ms) : 0, 27193
AppSec [candidate] (26.548 ms) : 0, 26548
Debugger [baseline] (65.452 ms) : 0, 65452
Debugger [candidate] (65.86 ms) : 0, 65860
Remote Config [baseline] (519.546 µs) : 0, 520
Remote Config [candidate] (520.19 µs) : 0, 520
Telemetry [baseline] (13.277 ms) : 0, 13277
Telemetry [candidate] (13.317 ms) : 0, 13317
Flare Poller [baseline] (4.459 ms) : 0, 4459
Flare Poller [candidate] (4.47 ms) : 0, 4470
section profiling
crashtracking [baseline] (1.183 ms) : 0, 1183
crashtracking [candidate] (1.172 ms) : 0, 1172
BytebuddyAgent [baseline] (684.764 ms) : 0, 684764
BytebuddyAgent [candidate] (684.407 ms) : 0, 684407
AgentMeter [baseline] (8.703 ms) : 0, 8703
AgentMeter [candidate] (8.633 ms) : 0, 8633
GlobalTracer [baseline] (216.631 ms) : 0, 216631
GlobalTracer [candidate] (215.935 ms) : 0, 215935
AppSec [baseline] (32.134 ms) : 0, 32134
AppSec [candidate] (32.017 ms) : 0, 32017
Debugger [baseline] (64.336 ms) : 0, 64336
Debugger [candidate] (65.568 ms) : 0, 65568
Remote Config [baseline] (583.834 µs) : 0, 584
Remote Config [candidate] (578.035 µs) : 0, 578
Telemetry [baseline] (9.794 ms) : 0, 9794
Telemetry [candidate] (8.167 ms) : 0, 8167
Flare Poller [baseline] (3.538 ms) : 0, 3538
Flare Poller [candidate] (3.476 ms) : 0, 3476
ProfilingAgent [baseline] (94.336 ms) : 0, 94336
ProfilingAgent [candidate] (94.187 ms) : 0, 94187
Profiling [baseline] (94.905 ms) : 0, 94905
Profiling [candidate] (94.748 ms) : 0, 94748

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	alejandro.gonzalez/APPSEC-61693
git_commit_date	1773436250	1773660080
git_commit_sha	`8185dcf`	`9ded002`
release_version	1.61.0-SNAPSHOT~8185dcf699	1.61.0-SNAPSHOT~9ded0025e1

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1773662518	1773662518
ci_job_id	1507946886	1507946886
ci_pipeline_id	102628732	102628732
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-0-4u4z20yw 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-0-4u4z20yw 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 4 performance regressions! Performance is the same for 16 metrics, 16 unstable metrics.

scenario	Δ mean agg_http_req_duration_p50	Δ mean agg_http_req_duration_p95	Δ mean throughput	candidate mean agg_http_req_duration_p50	candidate mean agg_http_req_duration_p95	candidate mean throughput	baseline mean agg_http_req_duration_p50	baseline mean agg_http_req_duration_p95	baseline mean throughput
scenario:load:petclinic:appsec:high_load	worse [+382.321µs; +912.022µs] or [+2.113%; +5.041%]	unsure [+306.524µs; +1385.319µs] or [+1.033%; +4.671%]	unstable [-32.266op/s; +14.829op/s] or [-12.750%; +5.860%]	18.740ms	30.506ms	244.344op/s	18.093ms	29.660ms	253.062op/s
scenario:load:petclinic:profiling:high_load	worse [+658.687µs; +1121.155µs] or [+3.575%; +6.085%]	unsure [+334.733µs; +1333.029µs] or [+1.125%; +4.480%]	unstable [-33.516op/s; +12.078op/s] or [-13.433%; +4.841%]	19.314ms	30.590ms	238.781op/s	18.424ms	29.756ms	249.500op/s
scenario:load:petclinic:tracing:high_load	worse [+0.770ms; +1.582ms] or [+4.410%; +9.061%]	worse [+0.596ms; +1.897ms] or [+2.075%; +6.605%]	unstable [-39.018op/s; +9.080op/s] or [-14.930%; +3.474%]	18.639ms	29.970ms	246.375op/s	17.463ms	28.723ms	261.344op/s

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~9ded0025e1, baseline=1.61.0-SNAPSHOT~8185dcf699
    dateFormat X
    axisFormat %s
section baseline
no_agent (19.609 ms) : 19403, 19815
.   : milestone, 19609,
appsec (18.441 ms) : 18253, 18629
.   : milestone, 18441,
code_origins (17.674 ms) : 17501, 17846
.   : milestone, 17674,
iast (17.881 ms) : 17704, 18058
.   : milestone, 17881,
profiling (18.706 ms) : 18520, 18892
.   : milestone, 18706,
tracing (17.852 ms) : 17673, 18031
.   : milestone, 17852,
section candidate
no_agent (19.448 ms) : 19251, 19645
.   : milestone, 19448,
appsec (19.1 ms) : 18906, 19294
.   : milestone, 19100,
code_origins (18.086 ms) : 17904, 18268
.   : milestone, 18086,
iast (18.29 ms) : 18110, 18471
.   : milestone, 18290,
profiling (19.548 ms) : 19353, 19743
.   : milestone, 19548,
tracing (18.949 ms) : 18758, 19140
.   : milestone, 18949,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	19.609 ms [19.403 ms, 19.815 ms]	-
appsec	18.441 ms [18.253 ms, 18.629 ms]	-1.167 ms (-6.0%)
code_origins	17.674 ms [17.501 ms, 17.846 ms]	-1.935 ms (-9.9%)
iast	17.881 ms [17.704 ms, 18.058 ms]	-1.727 ms (-8.8%)
profiling	18.706 ms [18.52 ms, 18.892 ms]	-902.352 µs (-4.6%)
tracing	17.852 ms [17.673 ms, 18.031 ms]	-1.756 ms (-9.0%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	19.448 ms [19.251 ms, 19.645 ms]	-
appsec	19.1 ms [18.906 ms, 19.294 ms]	-348.22 µs (-1.8%)
code_origins	18.086 ms [17.904 ms, 18.268 ms]	-1.362 ms (-7.0%)
iast	18.29 ms [18.11 ms, 18.471 ms]	-1.158 ms (-6.0%)
profiling	19.548 ms [19.353 ms, 19.743 ms]	99.706 µs (0.5%)
tracing	18.949 ms [18.758 ms, 19.14 ms]	-498.965 µs (-2.6%)

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~9ded0025e1, baseline=1.61.0-SNAPSHOT~8185dcf699
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.171 ms) : 1159, 1183
.   : milestone, 1171,
iast (3.225 ms) : 3182, 3268
.   : milestone, 3225,
iast_FULL (5.876 ms) : 5818, 5934
.   : milestone, 5876,
iast_GLOBAL (3.46 ms) : 3403, 3517
.   : milestone, 3460,
profiling (2.423 ms) : 2396, 2450
.   : milestone, 2423,
tracing (1.745 ms) : 1732, 1759
.   : milestone, 1745,
section candidate
no_agent (1.251 ms) : 1239, 1264
.   : milestone, 1251,
iast (3.124 ms) : 3084, 3164
.   : milestone, 3124,
iast_FULL (6.031 ms) : 5970, 6093
.   : milestone, 6031,
iast_GLOBAL (3.489 ms) : 3425, 3552
.   : milestone, 3489,
profiling (2.188 ms) : 2168, 2207
.   : milestone, 2188,
tracing (1.831 ms) : 1815, 1847
.   : milestone, 1831,

baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.171 ms [1.159 ms, 1.183 ms]	-
iast	3.225 ms [3.182 ms, 3.268 ms]	2.054 ms (175.4%)
iast_FULL	5.876 ms [5.818 ms, 5.934 ms]	4.705 ms (401.8%)
iast_GLOBAL	3.46 ms [3.403 ms, 3.517 ms]	2.289 ms (195.5%)
profiling	2.423 ms [2.396 ms, 2.45 ms]	1.252 ms (106.9%)
tracing	1.745 ms [1.732 ms, 1.759 ms]	574.473 µs (49.1%)

candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.251 ms [1.239 ms, 1.264 ms]	-
iast	3.124 ms [3.084 ms, 3.164 ms]	1.873 ms (149.6%)
iast_FULL	6.031 ms [5.97 ms, 6.093 ms]	4.78 ms (382.0%)
iast_GLOBAL	3.489 ms [3.425 ms, 3.552 ms]	2.237 ms (178.8%)
profiling	2.188 ms [2.168 ms, 2.207 ms]	936.164 µs (74.8%)
tracing	1.831 ms [1.815 ms, 1.847 ms]	579.994 µs (46.3%)

Dacapo

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	alejandro.gonzalez/APPSEC-61693
git_commit_date	1773436250	1773660080
git_commit_sha	`8185dcf`	`9ded002`
release_version	1.61.0-SNAPSHOT~8185dcf699	1.61.0-SNAPSHOT~9ded0025e1

See matching parameters

	Baseline	Candidate
application	biojava	biojava
ci_job_date	1773662398	1773662398
ci_job_id	1507946887	1507946887
ci_pipeline_id	102628732	102628732
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version	Linux runner-zfyrx7zua-project-304-concurrent-2-l7u2g531 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux	Linux runner-zfyrx7zua-project-304-concurrent-2-l7u2g531 6.8.0-1031-aws #33~22.04.1-Ubuntu SMP Thu Jun 26 14:22:30 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 10 metrics, 2 unstable metrics.

Execution time for tomcat

gantt
    title tomcat - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~9ded0025e1, baseline=1.61.0-SNAPSHOT~8185dcf699
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.474 ms) : 1463, 1486
.   : milestone, 1474,
appsec (2.52 ms) : 2465, 2575
.   : milestone, 2520,
iast (2.261 ms) : 2192, 2330
.   : milestone, 2261,
iast_GLOBAL (2.301 ms) : 2231, 2370
.   : milestone, 2301,
profiling (2.528 ms) : 2363, 2692
.   : milestone, 2528,
tracing (2.07 ms) : 2016, 2124
.   : milestone, 2070,
section candidate
no_agent (1.471 ms) : 1459, 1482
.   : milestone, 1471,
appsec (3.814 ms) : 3595, 4034
.   : milestone, 3814,
iast (2.262 ms) : 2193, 2331
.   : milestone, 2262,
iast_GLOBAL (2.298 ms) : 2228, 2368
.   : milestone, 2298,
profiling (2.107 ms) : 2050, 2164
.   : milestone, 2107,
tracing (2.073 ms) : 2020, 2127
.   : milestone, 2073,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.474 ms [1.463 ms, 1.486 ms]	-
appsec	2.52 ms [2.465 ms, 2.575 ms]	1.045 ms (70.9%)
iast	2.261 ms [2.192 ms, 2.33 ms]	786.851 µs (53.4%)
iast_GLOBAL	2.301 ms [2.231 ms, 2.37 ms]	826.255 µs (56.0%)
profiling	2.528 ms [2.363 ms, 2.692 ms]	1.053 ms (71.4%)
tracing	2.07 ms [2.016 ms, 2.124 ms]	595.495 µs (40.4%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	1.471 ms [1.459 ms, 1.482 ms]	-
appsec	3.814 ms [3.595 ms, 4.034 ms]	2.343 ms (159.3%)
iast	2.262 ms [2.193 ms, 2.331 ms]	791.331 µs (53.8%)
iast_GLOBAL	2.298 ms [2.228 ms, 2.368 ms]	827.658 µs (56.3%)
profiling	2.107 ms [2.05 ms, 2.164 ms]	636.137 µs (43.3%)
tracing	2.073 ms [2.02 ms, 2.127 ms]	602.644 µs (41.0%)

Execution time for biojava

gantt
    title biojava - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~9ded0025e1, baseline=1.61.0-SNAPSHOT~8185dcf699
    dateFormat X
    axisFormat %s
section baseline
no_agent (14.929 s) : 14929000, 14929000
.   : milestone, 14929000,
appsec (14.829 s) : 14829000, 14829000
.   : milestone, 14829000,
iast (18.069 s) : 18069000, 18069000
.   : milestone, 18069000,
iast_GLOBAL (17.759 s) : 17759000, 17759000
.   : milestone, 17759000,
profiling (15.072 s) : 15072000, 15072000
.   : milestone, 15072000,
tracing (15.164 s) : 15164000, 15164000
.   : milestone, 15164000,
section candidate
no_agent (15.234 s) : 15234000, 15234000
.   : milestone, 15234000,
appsec (14.816 s) : 14816000, 14816000
.   : milestone, 14816000,
iast (18.314 s) : 18314000, 18314000
.   : milestone, 18314000,
iast_GLOBAL (18.459 s) : 18459000, 18459000
.   : milestone, 18459000,
profiling (15.496 s) : 15496000, 15496000
.   : milestone, 15496000,
tracing (15.101 s) : 15101000, 15101000
.   : milestone, 15101000,

baseline results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	14.929 s [14.929 s, 14.929 s]	-
appsec	14.829 s [14.829 s, 14.829 s]	-100.0 ms (-0.7%)
iast	18.069 s [18.069 s, 18.069 s]	3.14 s (21.0%)
iast_GLOBAL	17.759 s [17.759 s, 17.759 s]	2.83 s (19.0%)
profiling	15.072 s [15.072 s, 15.072 s]	143.0 ms (1.0%)
tracing	15.164 s [15.164 s, 15.164 s]	235.0 ms (1.6%)

candidate results

Variant	Execution Time [CI 0.99]	Δ no_agent
no_agent	15.234 s [15.234 s, 15.234 s]	-
appsec	14.816 s [14.816 s, 14.816 s]	-418.0 ms (-2.7%)
iast	18.314 s [18.314 s, 18.314 s]	3.08 s (20.2%)
iast_GLOBAL	18.459 s [18.459 s, 18.459 s]	3.225 s (21.2%)
profiling	15.496 s [15.496 s, 15.496 s]	262.0 ms (1.7%)
tracing	15.101 s [15.101 s, 15.101 s]	-133.0 ms (-0.9%)

Fix ObjectIntrospection exposing JDK internal toString() to the WAF

0305b40

jandro996 added type: bug Bug report and fix comp: asm waf Application Security Management (WAF) labels Mar 12, 2026

jandro996 added 2 commits March 12, 2026 15:42

wip

b2b247b

fix test for all jdks

c818028

jandro996 added 2 commits March 13, 2026 15:26

Avoid log classes

208c7bf

Merge branch 'master' into alejandro.gonzalez/APPSEC-61693

9ded002

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix ObjectIntrospection exposing JDK internal toString() to the WAF#10820

Fix ObjectIntrospection exposing JDK internal toString() to the WAF#10820
jandro996 wants to merge 5 commits intomasterfrom
alejandro.gonzalez/APPSEC-61693

jandro996 commented Mar 12, 2026 •

edited by atlassian bot

Loading

Uh oh!

pr-commenter bot commented Mar 12, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jandro996 commented Mar 12, 2026 • edited by atlassian bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

pr-commenter bot commented Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Startup

Parameters

Summary

Load

Parameters

Summary

Dacapo

Parameters

Summary

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jandro996 commented Mar 12, 2026 •

edited by atlassian bot

Loading

pr-commenter bot commented Mar 12, 2026 •

edited

Loading