Fix RUM injection for offset response writes by pawelchcki · Pull Request #11949 · DataDog/dd-trace-java

pawelchcki · 2026-07-14T17:56:41Z

What changed

Fix non-zero-offset bulk writes in InjectingPipeWriter and InjectingPipeOutputStream.
Search the entire requested slice, including a marker at its final valid position.
Treat marker indexes as absolute and use the requested offset for pre-marker, post-marker, and trailing look-behind writes.
Add focused writer and output-stream regressions for marker-free slices, an internal marker, and a marker at the end of a slice.
Add a sanitized Spring Boot 3.3/Thymeleaf smoke reproducer that renders inline JavaScript and an auto-submitting form, then writes the response from a six-character buffer offset.

Why

The bulk-write paths mixed absolute array indexes with indexes relative to len. When a servlet or template stack wrote a response from a non-zero array offset, six characters around the </head> marker could be moved across the injected RUM snippet. This corrupted otherwise valid response markup and could also corrupt dynamic inline JavaScript or rendered URLs.

The fix preserves the original response exactly, injects the RUM snippet once, and keeps original response-size accounting unchanged.

Validation

Confirmed all six focused unit cases fail before the production fix and pass afterward.
Confirmed the Thymeleaf smoke regression fails before the production fix at the </head> integrity assertion and passes afterward.
./gradlew :dd-java-agent:agent-bootstrap:test
./gradlew :dd-smoke-tests:spring-boot-3.3-webmvc:test
./gradlew :dd-java-agent:agent-bootstrap:spotlessCheck :dd-smoke-tests:spring-boot-3.3-webmvc:spotlessCheck

The local smoke build excluded the unrelated CICS 9.1 instrumentation aggregate because public.dhe.ibm.com was not resolvable; the Spring Boot 3.3 WebMVC module and its smoke tests completed successfully.

pawelchcki · 2026-07-14T18:13:23Z

Commit d95beb4

Reproduces the regression standalone. The following commits fix the regression

pawelchcki · 2026-07-14T18:13:31Z

@codex review

datadog-datadog-prod-us1-2

More details

The PR correctly fixes a critical offset-handling bug in RUM injection that corrupted HTML responses when servlets wrote from non-zero array offsets. The code had mixed absolute array indices with slice-relative indices; fixes convert all calculations to handle offsets properly. Three focused test cases and a Thymeleaf smoke test validate the fix and lock in real-world scenarios.

Was this helpful? React 👍 or 👎

_{📊 Validated against 3 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit ea2c639 · What is Autotest? · Any feedback? Reach out in #autotest}

dd-octo-sts · 2026-07-14T18:19:41Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.99 s	13.86 s	[+0.2%; +1.7%] (maybe worse)
startup:insecure-bank:tracing:Agent	12.93 s	13.01 s	[-1.3%; +0.1%] (no difference)
startup:petclinic:appsec:Agent	16.85 s	16.68 s	[+0.0%; +2.0%] (maybe worse)
startup:petclinic:iast:Agent	16.89 s	16.93 s	[-1.0%; +0.5%] (no difference)
startup:petclinic:profiling:Agent	16.54 s	16.94 s	[-3.4%; -1.3%] (significantly better)
startup:petclinic:sca:Agent	17.03 s	16.79 s	[+0.5%; +2.4%] (maybe worse)
startup:petclinic:tracing:Agent	15.59 s	16.09 s	[-7.2%; +1.0%] (no difference)

Commit: e050c08c · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ea2c639e49

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

amarziali

Thanks for the fix and the tests. The changes sounds good. One optional suggestion to make it harder to reintroduce this bug: every site in the bulk-write branch now recomputes off + … by hand, and the original bug was exactly a "did I mean len or off+len" slip at one of these. Could we introduce a single final int end = off + len; at the top of the branch and express all bounds as the half-open range [off, end)? Happy to merge as-is if you'd rather not churn it. Same applies to the char version in InjectingPipeWriter.

amarziali · 2026-07-15T05:49:33Z

    command.add(javaPath())
    command.addAll(defaultJavaProperties)
    command.addAll((String[]) [
+      "-Ddd.rum.enabled=true",


Can we have a specific smoke test for RUM and keep the existing without?

amarziali · 2026-07-15T06:03:14Z


    if (len > bulkWriteThreshold) {
+      // A match that started in the previous write precedes every match wholly in this array.
+      if (matchingPos > 0 && arrayCompletesPendingMatch(array, off, len)) {


what about havingfinal int end = off + len; since off + len is quite a lot calculated in all the class (same for InjectingPipeWriter

amarziali · 2026-07-15T06:04:16Z

        }
-        bytesToWrite = len - idx;
-        downstream.write(array, off + idx, bytesToWrite);
+        bytesToWrite = off + len - idx;


that would translate to end - idx

amarziali · 2026-07-15T15:21:00Z

❌ New Groovy Files Detected

Please avoid introducing new .groovy files to this repository.

dd-smoke-tests/spring-boot-3.3-webmvc/src/test/groovy/AbstractSpringBootWebmvcIntegrationTest.groovy

dd-smoke-tests/spring-boot-3.3-webmvc/src/test/groovy/SpringBootWebmvcRumInjectionTest.groovy

Instead, rewrite the new file(s) in Java / JUnit. See the How to Test With JUnit Guide for more details.

If this PR needs an exception, add the tag: override groovy enforcement label to bypass this workflow.

Can be overridden no worries

pawelchcki · 2026-07-15T17:21:17Z

@codex review

chatgpt-codex-connector · 2026-07-15T17:27:12Z

Codex Review: Didn't find any major issues. 🎉

Reviewed commit: e050c08c4d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

dd-octo-sts · 2026-07-15T18:04:25Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-07-15T18:04:38Z

View all feedbacks in Devflow UI.

2026-07-15 18:04:37 UTC ℹ️ Start processing command /merge

2026-07-15 18:04:43 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 2h (p90).

2026-07-15 19:02:35 UTC ℹ️ MergeQueue: This merge request was merged

pawelchcki added 2 commits July 14, 2026 19:53

Add RUM offset write regression coverage

d95beb4

Fix RUM injection for offset writes

ea2c639

pawelchcki added comp: rum Realtime User Monitoring type: bug fix Bug fix tag: ai generated Largely based on code generated by an AI or LLM labels Jul 14, 2026

This comment has been minimized.

Sign in to view

pawelchcki marked this pull request as ready for review July 14, 2026 18:12

pawelchcki requested review from a team as code owners July 14, 2026 18:12

pawelchcki requested review from ygree and removed request for a team July 14, 2026 18:12

datadog-datadog-prod-us1-2 Bot reviewed Jul 14, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread .../src/main/java/datadog/trace/bootstrap/instrumentation/buffer/InjectingPipeOutputStream.java Outdated

Comment thread ...tstrap/src/main/java/datadog/trace/bootstrap/instrumentation/buffer/InjectingPipeWriter.java Outdated

pawelchcki added 2 commits July 14, 2026 21:46

Merge branch 'master' into codex/fix-rum-injection-offset-writes

a541bc1

Preserve boundary-spanning RUM injection matches

ac95148

pawelchcki requested a review from amarziali July 14, 2026 19:47

amarziali approved these changes Jul 15, 2026

View reviewed changes

Refine RUM injection offset writes

78485a0

amarziali added the tag: override groovy enforcement Override the "Enforce Groovy Migration" check label Jul 15, 2026

Consolidate Spring Boot WebMVC smoke tests

e050c08

pawelchcki enabled auto-merge July 15, 2026 17:22

pawelchcki added this pull request to the merge queue Jul 15, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jul 15, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit 8f323b5 into master Jul 15, 2026
586 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the codex/fix-rum-injection-offset-writes branch July 15, 2026 19:02

github-actions Bot added this to the 1.65.0 milestone Jul 15, 2026

Uh oh!

Conversation

pawelchcki commented Jul 14, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Why

Validation

Uh oh!

This comment has been minimized.

pawelchcki commented Jul 14, 2026

Uh oh!

pawelchcki commented Jul 14, 2026

Uh oh!

datadog-datadog-prod-us1-2 Bot left a comment

Choose a reason for hiding this comment

Uh oh!

dd-octo-sts Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

amarziali left a comment

Choose a reason for hiding this comment

Uh oh!

amarziali Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

amarziali Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

amarziali Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

amarziali commented Jul 15, 2026

Uh oh!

pawelchcki commented Jul 15, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 15, 2026

Uh oh!

dd-octo-sts Bot commented Jul 15, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

pawelchcki commented Jul 14, 2026 •

edited by atlassian Bot

Loading

dd-octo-sts Bot commented Jul 14, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Jul 15, 2026 •

edited

Loading