Merge branch 'master' into smola/kafka-streams-test-fix

Author: smola

.circleci/config.continue.yml.j2

@@ -36,7 +36,7 @@ instrumentation_modules: &instrumentation_modules "dd-java-agent/instrumentation
 debugger_modules: &debugger_modules "dd-java-agent/agent-debugger|dd-java-agent/agent-bootstrap|dd-java-agent/agent-builder|internal-api|communication|dd-trace-core"
 profiling_modules: &profiling_modules "dd-java-agent/agent-profiling"
 
-default_system_tests_commit: &default_system_tests_commit 1ef00a34ad1f83ae999887e510ef1ea1c27b151b
+default_system_tests_commit: &default_system_tests_commit 1de04c42cbd9783432258004e46eb5982bbc9fe5
 
 parameters:
   nightly:
@@ -1333,6 +1333,7 @@ build_test_jobs: &build_test_jobs
       matrix:
         <<: *test_matrix
 
+{% if ssi_smoke %}
   - tests:
       requires:
         - ok_to_test
@@ -1346,6 +1347,7 @@ build_test_jobs: &build_test_jobs
       maxWorkers: 3
       matrix:
         <<: *test_matrix
+{% endif %}
 
   - tests:
       requires:
@@ -1389,6 +1391,7 @@ build_test_jobs: &build_test_jobs
       maxWorkers: 3
       testJvm: "8"
 
+{% if ssi_smoke %}
   - tests:
       requires:
         - ok_to_test
@@ -1401,13 +1404,16 @@ build_test_jobs: &build_test_jobs
       parallelism: 4
       maxWorkers: 3
       testJvm: "8"
+{% endif %}
 
   - fan_in:
       requires:
         - z_test_<< matrix.testJvm >>_base
         - z_test_<< matrix.testJvm >>_inst
         - z_test_<< matrix.testJvm >>_smoke
+{% if ssi_smoke %}
         - z_test_<< matrix.testJvm >>_ssi_smoke
+{% endif %}
       name: test_<< matrix.testJvm >>
       stage: tracing
       matrix:
@@ -1418,7 +1424,9 @@ build_test_jobs: &build_test_jobs
         - z_test_8_base
         - z_test_8_inst
         - z_test_8_smoke
+{% if ssi_smoke %}
         - z_test_8_ssi_smoke
+{% endif %}
       name: test_8
       stage: tracing
       testJvm: "8"
@@ -1512,6 +1520,14 @@ build_test_jobs: &build_test_jobs
       stage: required
 
 workflows:
+{% if skip_circleci %}
+  build_test:
+    jobs:
+      # Just a "required" job to make GitHub PR checks happy, and run nothing else.
+      - fan_in:
+          name: required
+          stage: required
+{% else %}
 {% if is_regular %}
   build_test:
     jobs:
@@ -1552,3 +1568,4 @@ workflows:
           gradleTarget: :profilingTest
           cacheType: profiling
 {% endif %}
+{% endif %}

.circleci/no_circleci_changes.sh

@@ -0,0 +1,3 @@
+#!/usr/bin/env bash
+set -eu
+git diff --name-only "$1" | grep --invert-match --quiet -E '^(.gitlab-ci.yml|.gitlab)'

.circleci/render_config.py

@@ -2,6 +2,7 @@
 
 import os
 import os.path
+import subprocess
 import time
 
 import jinja2
@@ -14,9 +15,10 @@
 GENERATED_CONFIG_PATH = os.path.join(SCRIPT_DIR, OUT_FILENAME)
 
 # JDKs that will run on every pipeline.
-ALWAYS_ON_JDKS = {"8", "11", "17", "21"}
+ALWAYS_ON_JDKS = {"8", "17", "21"}
 # And these will run only in master and release/ branches.
 MASTER_ONLY_JDKS = {
+    "11",
     "ibm8",
     "oracle8",
     "semeru8",
@@ -74,6 +76,13 @@
 run_all = "all" in labels
 is_master_or_release = branch == "master" or branch.startswith("release/v")
 
+skip_circleci = False
+if pr_base_ref:
+   ret = subprocess.call([".circleci/no_circleci_changes.sh", f"{pr_base_ref}..HEAD"], shell=False)
+   if ret == 1:
+       # Only GitLab-related files have changed, just skip Circle CI jobs.
+       skip_circleci = True
+
 if is_master_or_release or run_all:
     all_jdks = ALWAYS_ON_JDKS | MASTER_ONLY_JDKS
 else:
@@ -99,10 +108,12 @@
     "all_jdks": all_jdks,
     "all_debugger_jdks": all_debugger_jdks,
     "nocov_jdks": nocov_jdks,
-    "flaky": branch == "master" or "flaky" in labels or "all" in labels,
+    "flaky": "flaky" in labels or "all" in labels,
     "docker_image_prefix": "" if is_nightly else f"{DOCKER_IMAGE_VERSION}-",
     "use_git_changes": use_git_changes,
     "pr_base_ref": pr_base_ref,
+    "skip_circleci": skip_circleci,
+    "ssi_smoke": is_regular and is_master_or_release
 }
 
 print(f"Variables for this build: {vars}")

dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java

@@ -68,9 +68,13 @@ public class GatewayBridge {
 
   /** User tracking tags that will force the collection of request headers */
   private static final String[] USER_TRACKING_TAGS = {
-    "appsec.events.users.login.success.track", "appsec.events.users.login.failure.track"
+    "appsec.events.users.login.success.track",
+    "appsec.events.users.login.failure.track",
+    "appsec.events.users.signup.track"
   };
 
+  private static final String USER_COLLECTION_MODE_TAG = "_dd.appsec.user.collection_mode";
+
   private static final Map<LoginEvent, Address<?>> EVENT_MAPPINGS = new EnumMap<>(LoginEvent.class);
 
   static {
@@ -708,7 +712,7 @@ private NoopFlow onRequestEnded(RequestContext ctx_, IGSpanInfo spanInfo) {
           StackUtils.addStacktraceEventsToMetaStruct(ctx_, METASTRUCT_EXPLOIT, stackTraces);
         }
 
-      } else if (hasUserTrackingEvent(traceSeg)) {
+      } else if (hasUserInfo(traceSeg)) {
         // Report all collected request headers on user tracking event
         writeRequestHeaders(traceSeg, REQUEST_HEADERS_ALLOW_LIST, ctx.getRequestHeaders());
       } else {
@@ -803,6 +807,10 @@ public void stop() {
     subscriptionService.reset();
   }
 
+  private static boolean hasUserInfo(final TraceSegment traceSegment) {
+    return hasUserTrackingEvent(traceSegment) || hasUserCollectionEvent(traceSegment);
+  }
+
   private static boolean hasUserTrackingEvent(final TraceSegment traceSeg) {
     for (String tagName : USER_TRACKING_TAGS) {
       final Object value = traceSeg.getTagTop(tagName);
@@ -813,6 +821,10 @@ private static boolean hasUserTrackingEvent(final TraceSegment traceSeg) {
     return false;
   }
 
+  private static boolean hasUserCollectionEvent(final TraceSegment traceSeg) {
+    return traceSeg.getTagTop(USER_COLLECTION_MODE_TAG) != null;
+  }
+
   private static void writeRequestHeaders(
       final TraceSegment traceSeg,
       final Set<String> allowed,