Add file upload WAF rules from appsec-event-rules#277#11093
Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 1 commit intomasterfrom Apr 14, 2026
Conversation
jandro996
added
type: enhancement
jandro996
force-pushed
the
alejandro.gonzalez/appsec-event-rules-277-file-upload-rules
branch
from
7ceb952 to
1055574
Compare
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 10555742f5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 61 metrics, 10 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.62.0-SNAPSHOT~85593a1b73, baseline=1.62.0-SNAPSHOT~da8bdd22c1
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.059 s) : 0, 1059433
Total [baseline] (11.145 s) : 0, 11144751
Agent [candidate] (1.059 s) : 0, 1059159
Total [candidate] (11.102 s) : 0, 11102442
section appsec
Agent [baseline] (1.249 s) : 0, 1249219
Total [baseline] (11.177 s) : 0, 11177288
Agent [candidate] (1.255 s) : 0, 1255415
Total [candidate] (11.246 s) : 0, 11246261
section iast
Agent [baseline] (1.224 s) : 0, 1224019
Total [baseline] (11.291 s) : 0, 11290840
Agent [candidate] (1.228 s) : 0, 1228118
Total [candidate] (11.401 s) : 0, 11400889
section profiling
Agent [baseline] (1.184 s) : 0, 1184242
Total [baseline] (11.155 s) : 0, 11155444
Agent [candidate] (1.198 s) : 0, 1198465
Total [candidate] (11.204 s) : 0, 11203801
gantt
title petclinic - break down per module: candidate=1.62.0-SNAPSHOT~85593a1b73, baseline=1.62.0-SNAPSHOT~da8bdd22c1
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.238 ms) : 0, 1238
crashtracking [candidate] (1.232 ms) : 0, 1232
BytebuddyAgent [baseline] (632.864 ms) : 0, 632864
BytebuddyAgent [candidate] (633.132 ms) : 0, 633132
AgentMeter [baseline] (29.384 ms) : 0, 29384
AgentMeter [candidate] (29.449 ms) : 0, 29449
GlobalTracer [baseline] (249.177 ms) : 0, 249177
GlobalTracer [candidate] (249.059 ms) : 0, 249059
AppSec [baseline] (32.292 ms) : 0, 32292
AppSec [candidate] (32.36 ms) : 0, 32360
Debugger [baseline] (59.878 ms) : 0, 59878
Debugger [candidate] (59.987 ms) : 0, 59987
Remote Config [baseline] (596.456 µs) : 0, 596
Remote Config [candidate] (586.389 µs) : 0, 586
Telemetry [baseline] (8.088 ms) : 0, 8088
Telemetry [candidate] (8.072 ms) : 0, 8072
Flare Poller [baseline] (9.659 ms) : 0, 9659
Flare Poller [candidate] (8.996 ms) : 0, 8996
section appsec
crashtracking [baseline] (1.233 ms) : 0, 1233
crashtracking [candidate] (1.233 ms) : 0, 1233
BytebuddyAgent [baseline] (661.853 ms) : 0, 661853
BytebuddyAgent [candidate] (667.092 ms) : 0, 667092
AgentMeter [baseline] (12.087 ms) : 0, 12087
AgentMeter [candidate] (12.125 ms) : 0, 12125
GlobalTracer [baseline] (249.176 ms) : 0, 249176
GlobalTracer [candidate] (249.791 ms) : 0, 249791
IAST [baseline] (24.552 ms) : 0, 24552
IAST [candidate] (24.598 ms) : 0, 24598
AppSec [baseline] (184.986 ms) : 0, 184986
AppSec [candidate] (185.294 ms) : 0, 185294
Debugger [baseline] (66.243 ms) : 0, 66243
Debugger [candidate] (66.083 ms) : 0, 66083
Remote Config [baseline] (610.799 µs) : 0, 611
Remote Config [candidate] (620.596 µs) : 0, 621
Telemetry [baseline] (8.469 ms) : 0, 8469
Telemetry [candidate] (8.472 ms) : 0, 8472
Flare Poller [baseline] (3.54 ms) : 0, 3540
Flare Poller [candidate] (3.523 ms) : 0, 3523
section iast
crashtracking [baseline] (1.225 ms) : 0, 1225
crashtracking [candidate] (1.222 ms) : 0, 1222
BytebuddyAgent [baseline] (800.6 ms) : 0, 800600
BytebuddyAgent [candidate] (801.949 ms) : 0, 801949
AgentMeter [baseline] (11.388 ms) : 0, 11388
AgentMeter [candidate] (11.386 ms) : 0, 11386
GlobalTracer [baseline] (239.083 ms) : 0, 239083
GlobalTracer [candidate] (240.154 ms) : 0, 240154
IAST [baseline] (25.784 ms) : 0, 25784
IAST [candidate] (25.818 ms) : 0, 25818
AppSec [baseline] (32.762 ms) : 0, 32762
AppSec [candidate] (31.52 ms) : 0, 31520
Debugger [baseline] (57.97 ms) : 0, 57970
Debugger [candidate] (64.257 ms) : 0, 64257
Remote Config [baseline] (2.901 ms) : 0, 2901
Remote Config [candidate] (1.771 ms) : 0, 1771
Telemetry [baseline] (12.552 ms) : 0, 12552
Telemetry [candidate] (10.247 ms) : 0, 10247
Flare Poller [baseline] (3.538 ms) : 0, 3538
Flare Poller [candidate] (3.526 ms) : 0, 3526
section profiling
crashtracking [baseline] (1.187 ms) : 0, 1187
crashtracking [candidate] (1.203 ms) : 0, 1203
BytebuddyAgent [baseline] (690.563 ms) : 0, 690563
BytebuddyAgent [candidate] (699.014 ms) : 0, 699014
AgentMeter [baseline] (9.134 ms) : 0, 9134
AgentMeter [candidate] (9.238 ms) : 0, 9238
GlobalTracer [baseline] (206.804 ms) : 0, 206804
GlobalTracer [candidate] (209.805 ms) : 0, 209805
AppSec [baseline] (32.806 ms) : 0, 32806
AppSec [candidate] (33.482 ms) : 0, 33482
Debugger [baseline] (65.869 ms) : 0, 65869
Debugger [candidate] (66.591 ms) : 0, 66591
Remote Config [baseline] (577.641 µs) : 0, 578
Remote Config [candidate] (576.154 µs) : 0, 576
Telemetry [baseline] (7.772 ms) : 0, 7772
Telemetry [candidate] (7.924 ms) : 0, 7924
Flare Poller [baseline] (3.488 ms) : 0, 3488
Flare Poller [candidate] (3.633 ms) : 0, 3633
ProfilingAgent [baseline] (94.712 ms) : 0, 94712
ProfilingAgent [candidate] (95.17 ms) : 0, 95170
Profiling [baseline] (95.293 ms) : 0, 95293
Profiling [candidate] (95.75 ms) : 0, 95750
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.62.0-SNAPSHOT~85593a1b73, baseline=1.62.0-SNAPSHOT~da8bdd22c1
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.08 s) : 0, 1079788
Total [baseline] (8.939 s) : 0, 8939429
Agent [candidate] (1.061 s) : 0, 1060579
Total [candidate] (8.859 s) : 0, 8858686
section iast
Agent [baseline] (1.23 s) : 0, 1230169
Total [baseline] (9.589 s) : 0, 9588812
Agent [candidate] (1.224 s) : 0, 1223814
Total [candidate] (9.552 s) : 0, 9552384
gantt
title insecure-bank - break down per module: candidate=1.62.0-SNAPSHOT~85593a1b73, baseline=1.62.0-SNAPSHOT~da8bdd22c1
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.266 ms) : 0, 1266
crashtracking [candidate] (1.231 ms) : 0, 1231
BytebuddyAgent [baseline] (645.5 ms) : 0, 645500
BytebuddyAgent [candidate] (637.163 ms) : 0, 637163
AgentMeter [baseline] (30.157 ms) : 0, 30157
AgentMeter [candidate] (29.688 ms) : 0, 29688
GlobalTracer [baseline] (253.189 ms) : 0, 253189
GlobalTracer [candidate] (249.375 ms) : 0, 249375
AppSec [baseline] (33.081 ms) : 0, 33081
AppSec [candidate] (32.324 ms) : 0, 32324
Debugger [baseline] (60.501 ms) : 0, 60501
Debugger [candidate] (59.19 ms) : 0, 59190
Remote Config [baseline] (619.455 µs) : 0, 619
Remote Config [candidate] (590.273 µs) : 0, 590
Telemetry [baseline] (8.271 ms) : 0, 8271
Telemetry [candidate] (8.008 ms) : 0, 8008
Flare Poller [baseline] (10.603 ms) : 0, 10603
Flare Poller [candidate] (6.676 ms) : 0, 6676
section iast
crashtracking [baseline] (1.239 ms) : 0, 1239
crashtracking [candidate] (1.23 ms) : 0, 1230
BytebuddyAgent [baseline] (804.937 ms) : 0, 804937
BytebuddyAgent [candidate] (801.927 ms) : 0, 801927
AgentMeter [baseline] (11.483 ms) : 0, 11483
AgentMeter [candidate] (11.408 ms) : 0, 11408
GlobalTracer [baseline] (240.805 ms) : 0, 240805
GlobalTracer [candidate] (239.188 ms) : 0, 239188
IAST [baseline] (26.017 ms) : 0, 26017
IAST [candidate] (25.734 ms) : 0, 25734
AppSec [baseline] (29.794 ms) : 0, 29794
AppSec [candidate] (31.03 ms) : 0, 31030
Debugger [baseline] (64.335 ms) : 0, 64335
Debugger [candidate] (59.599 ms) : 0, 59599
Remote Config [baseline] (533.862 µs) : 0, 534
Remote Config [candidate] (2.961 ms) : 0, 2961
Telemetry [baseline] (11.222 ms) : 0, 11222
Telemetry [candidate] (11.161 ms) : 0, 11161
Flare Poller [baseline] (3.454 ms) : 0, 3454
Flare Poller [candidate] (3.426 ms) : 0, 3426
LoadParameters
See matching parameters
SummaryFound 2 performance improvements and 1 performance regressions! Performance is the same for 18 metrics, 15 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~85593a1b73, baseline=1.62.0-SNAPSHOT~da8bdd22c1
dateFormat X
axisFormat %s
section baseline
no_agent (18.632 ms) : 18447, 18817
. : milestone, 18632,
appsec (19.007 ms) : 18815, 19199
. : milestone, 19007,
code_origins (17.569 ms) : 17398, 17740
. : milestone, 17569,
iast (17.881 ms) : 17705, 18057
. : milestone, 17881,
profiling (18.162 ms) : 17983, 18342
. : milestone, 18162,
tracing (17.858 ms) : 17681, 18035
. : milestone, 17858,
section candidate
no_agent (17.919 ms) : 17736, 18103
. : milestone, 17919,
appsec (18.331 ms) : 18149, 18514
. : milestone, 18331,
code_origins (17.994 ms) : 17813, 18175
. : milestone, 17994,
iast (17.852 ms) : 17677, 18028
. : milestone, 17852,
profiling (18.222 ms) : 18044, 18400
. : milestone, 18222,
tracing (17.588 ms) : 17416, 17760
. : milestone, 17588,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.62.0-SNAPSHOT~85593a1b73, baseline=1.62.0-SNAPSHOT~da8bdd22c1
dateFormat X
axisFormat %s
section baseline
no_agent (1.257 ms) : 1246, 1269
. : milestone, 1257,
iast (3.343 ms) : 3304, 3383
. : milestone, 3343,
iast_FULL (6.012 ms) : 5951, 6073
. : milestone, 6012,
iast_GLOBAL (3.629 ms) : 3569, 3689
. : milestone, 3629,
profiling (2.215 ms) : 2195, 2235
. : milestone, 2215,
tracing (1.89 ms) : 1875, 1905
. : milestone, 1890,
section candidate
no_agent (1.257 ms) : 1244, 1269
. : milestone, 1257,
iast (3.23 ms) : 3184, 3275
. : milestone, 3230,
iast_FULL (5.952 ms) : 5893, 6011
. : milestone, 5952,
iast_GLOBAL (3.57 ms) : 3513, 3628
. : milestone, 3570,
profiling (2.096 ms) : 2078, 2114
. : milestone, 2096,
tracing (1.897 ms) : 1879, 1916
. : milestone, 1897,
DacapoParameters
See matching parameters
SummaryFound 1 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 0 unstable metrics.
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~85593a1b73, baseline=1.62.0-SNAPSHOT~da8bdd22c1
dateFormat X
axisFormat %s
section baseline
no_agent (1.489 ms) : 1477, 1500
. : milestone, 1489,
appsec (3.812 ms) : 3592, 4033
. : milestone, 3812,
iast (2.274 ms) : 2205, 2344
. : milestone, 2274,
iast_GLOBAL (2.32 ms) : 2250, 2390
. : milestone, 2320,
profiling (2.116 ms) : 2060, 2171
. : milestone, 2116,
tracing (2.077 ms) : 2023, 2130
. : milestone, 2077,
section candidate
no_agent (1.486 ms) : 1475, 1498
. : milestone, 1486,
appsec (2.549 ms) : 2493, 2604
. : milestone, 2549,
iast (2.273 ms) : 2203, 2342
. : milestone, 2273,
iast_GLOBAL (2.318 ms) : 2249, 2388
. : milestone, 2318,
profiling (2.107 ms) : 2052, 2163
. : milestone, 2107,
tracing (2.084 ms) : 2030, 2138
. : milestone, 2084,
Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.62.0-SNAPSHOT~85593a1b73, baseline=1.62.0-SNAPSHOT~da8bdd22c1
dateFormat X
axisFormat %s
section baseline
no_agent (15.05 s) : 15050000, 15050000
. : milestone, 15050000,
appsec (14.631 s) : 14631000, 14631000
. : milestone, 14631000,
iast (18.674 s) : 18674000, 18674000
. : milestone, 18674000,
iast_GLOBAL (18.367 s) : 18367000, 18367000
. : milestone, 18367000,
profiling (15.575 s) : 15575000, 15575000
. : milestone, 15575000,
tracing (14.978 s) : 14978000, 14978000
. : milestone, 14978000,
section candidate
no_agent (15.436 s) : 15436000, 15436000
. : milestone, 15436000,
appsec (15.245 s) : 15245000, 15245000
. : milestone, 15245000,
iast (18.536 s) : 18536000, 18536000
. : milestone, 18536000,
iast_GLOBAL (18.161 s) : 18161000, 18161000
. : milestone, 18161000,
profiling (14.755 s) : 14755000, 14755000
. : milestone, 14755000,
tracing (15.13 s) : 15130000, 15130000
. : milestone, 15130000,
|
manuel-alvarez-alvarez
approved these changes
Apr 14, 2026
jandro996
force-pushed
the
alejandro.gonzalez/appsec-event-rules-277-file-upload-rules
branch
from
1055574 to
6b66dc2
Compare
Ports two new rules from DataDog/appsec-event-rules#277: - crs-944-140: detects JSP/JSPX script file uploads via server.request.body.filenames and x-filename headers - dog-920-100: detects double-extension file uploads (e.g. file.php.jpg)
jandro996
force-pushed
the
alejandro.gonzalez/appsec-event-rules-277-file-upload-rules
branch
from
abbfb13 to
85593a1
Compare
Contributor
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
gh-worker-dd-mergequeue-cf854d
bot
deleted the
alejandro.gonzalez/appsec-event-rules-277-file-upload-rules
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
Ports two new WAF rules introduced in DataDog/appsec-event-rules#277 into the default AppSec config (
default_config.json).Motivation
Both rules were added to tackle issues in APPSEC-61873
Additional Notes
crs-944-140— Java Injection Attack: Java Script File Upload Foundunrestricted_file_upload| CWE-434 | confidence: 1.jsp/.jspxfilenames inserver.request.body.filenamesandx-filename-style headersdog-920-100— File upload with double extensionhttp_protocol_violation| CWE-176 | confidence: 0shell.php.jpg) via regex\w\.[a-zA-Z0-9]{2,5}\.[a-zA-Z0-9]{2,5}$Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issue