From c887847073ed5957fb31bf28cd2385d81a5ab747 Mon Sep 17 00:00:00 2001 From: Brice Dutheil Date: Wed, 10 Jun 2026 20:13:00 +0200 Subject: [PATCH 1/2] fix: apply main forbidden APIs to instrumentation --- dd-java-agent/instrumentation/build.gradle | 4 +++- .../instrumentation/codeorigin/CodeOriginInstrumentation.java | 2 ++ .../datadog/trace/instrumentation/liberty20/PartHelper.java | 2 ++ .../springcore/StreamUtilsInstrumentation.java | 3 ++- 4 files changed, 9 insertions(+), 2 deletions(-) diff --git a/dd-java-agent/instrumentation/build.gradle b/dd-java-agent/instrumentation/build.gradle index 2f5807ba4f5..5e36217ad42 100644 --- a/dd-java-agent/instrumentation/build.gradle +++ b/dd-java-agent/instrumentation/build.gradle @@ -44,7 +44,9 @@ subprojects { Project subProj -> // Add instrumentation-specific forbiddenApi rules subProj.tasks.withType(CheckForbiddenApis).configureEach { - signaturesFiles += subProj.files("$rootDir/gradle/forbiddenApiFilters/instrumentation.txt") + signaturesFiles = subProj.files( + "$rootDir/gradle/forbiddenApiFilters/main.txt", + "$rootDir/gradle/forbiddenApiFilters/instrumentation.txt") } diff --git a/dd-java-agent/instrumentation/datadog/dynamic-instrumentation/span-origin/src/main/java/datadog/trace/instrumentation/codeorigin/CodeOriginInstrumentation.java b/dd-java-agent/instrumentation/datadog/dynamic-instrumentation/span-origin/src/main/java/datadog/trace/instrumentation/codeorigin/CodeOriginInstrumentation.java index 239c1f0e962..3af5b3fa74a 100644 --- a/dd-java-agent/instrumentation/datadog/dynamic-instrumentation/span-origin/src/main/java/datadog/trace/instrumentation/codeorigin/CodeOriginInstrumentation.java +++ b/dd-java-agent/instrumentation/datadog/dynamic-instrumentation/span-origin/src/main/java/datadog/trace/instrumentation/codeorigin/CodeOriginInstrumentation.java @@ -56,6 +56,8 @@ public ElementMatcher hierarchyMatcher() { } @Override + @SuppressForbidden // Existing direct ElementMatchers usage differs from HierarchyMatchers + // behavior public void methodAdvice(MethodTransformer transformer) { transformer.applyAdvice( HierarchyMatchers.isAnnotatedWith(matcher), diff --git a/dd-java-agent/instrumentation/liberty/liberty-20.0/src/main/java/datadog/trace/instrumentation/liberty20/PartHelper.java b/dd-java-agent/instrumentation/liberty/liberty-20.0/src/main/java/datadog/trace/instrumentation/liberty20/PartHelper.java index ed6ecb8ad3d..5fb6e4403dc 100644 --- a/dd-java-agent/instrumentation/liberty/liberty-20.0/src/main/java/datadog/trace/instrumentation/liberty20/PartHelper.java +++ b/dd-java-agent/instrumentation/liberty/liberty-20.0/src/main/java/datadog/trace/instrumentation/liberty20/PartHelper.java @@ -1,5 +1,6 @@ package datadog.trace.instrumentation.liberty20; +import de.thetaphi.forbiddenapis.SuppressForbidden; import java.lang.reflect.Method; import java.util.ArrayList; import java.util.Collection; @@ -48,6 +49,7 @@ private static String getSubmittedFilename(Method method, Object part) { } } + @SuppressForbidden // split on single-character uses a fast path private static String getFilenameFromContentDisposition(Method getHeader, Object part) { if (getHeader == null) { return null; diff --git a/dd-java-agent/instrumentation/spring/spring-core-3.2.2/src/main/java/datadog/trace/instrumentation/springcore/StreamUtilsInstrumentation.java b/dd-java-agent/instrumentation/spring/spring-core-3.2.2/src/main/java/datadog/trace/instrumentation/springcore/StreamUtilsInstrumentation.java index 68a081bf54d..1b9f15b2d35 100644 --- a/dd-java-agent/instrumentation/spring/spring-core-3.2.2/src/main/java/datadog/trace/instrumentation/springcore/StreamUtilsInstrumentation.java +++ b/dd-java-agent/instrumentation/spring/spring-core-3.2.2/src/main/java/datadog/trace/instrumentation/springcore/StreamUtilsInstrumentation.java @@ -1,6 +1,7 @@ package datadog.trace.instrumentation.springcore; import static datadog.trace.agent.tooling.bytebuddy.matcher.NameMatchers.named; +import static java.nio.charset.StandardCharsets.UTF_8; import static net.bytebuddy.matcher.ElementMatchers.isMethod; import static net.bytebuddy.matcher.ElementMatchers.takesArgument; import static net.bytebuddy.matcher.ElementMatchers.takesArguments; @@ -56,7 +57,7 @@ public static void checkReturnedObject( private static void muzzleCheck() throws IOException { StreamUtils.copyToString( - new ByteArrayInputStream("test".getBytes()), Charset.defaultCharset()); + new ByteArrayInputStream("test".getBytes(UTF_8)), Charset.defaultCharset()); } } } From a6e4188304ba9b8262a4abbac8af76256cc87462 Mon Sep 17 00:00:00 2001 From: Brice Dutheil Date: Fri, 12 Jun 2026 11:33:23 +0200 Subject: [PATCH 2/2] refactor: Replace for bidden ElementMatchers API by HierarchyMatchers --- .../codeorigin/CodeOriginInstrumentation.java | 26 ++++++------------- 1 file changed, 8 insertions(+), 18 deletions(-) diff --git a/dd-java-agent/instrumentation/datadog/dynamic-instrumentation/span-origin/src/main/java/datadog/trace/instrumentation/codeorigin/CodeOriginInstrumentation.java b/dd-java-agent/instrumentation/datadog/dynamic-instrumentation/span-origin/src/main/java/datadog/trace/instrumentation/codeorigin/CodeOriginInstrumentation.java index 3af5b3fa74a..db77d1b8bc5 100644 --- a/dd-java-agent/instrumentation/datadog/dynamic-instrumentation/span-origin/src/main/java/datadog/trace/instrumentation/codeorigin/CodeOriginInstrumentation.java +++ b/dd-java-agent/instrumentation/datadog/dynamic-instrumentation/span-origin/src/main/java/datadog/trace/instrumentation/codeorigin/CodeOriginInstrumentation.java @@ -1,13 +1,12 @@ package datadog.trace.instrumentation.codeorigin; -import static net.bytebuddy.matcher.ElementMatchers.declaresMethod; -import static net.bytebuddy.matcher.ElementMatchers.hasSuperType; -import static net.bytebuddy.matcher.ElementMatchers.isAnnotatedWith; -import static net.bytebuddy.matcher.ElementMatchers.isInterface; +import static datadog.trace.agent.tooling.bytebuddy.matcher.HierarchyMatchers.declaresMethod; +import static datadog.trace.agent.tooling.bytebuddy.matcher.HierarchyMatchers.implementsInterface; +import static datadog.trace.agent.tooling.bytebuddy.matcher.HierarchyMatchers.isAnnotatedWith; +import static net.bytebuddy.matcher.ElementMatchers.isDeclaredBy; import datadog.trace.agent.tooling.Instrumenter; import datadog.trace.agent.tooling.InstrumenterModule.Tracing; -import datadog.trace.agent.tooling.bytebuddy.matcher.HierarchyMatchers; import datadog.trace.agent.tooling.bytebuddy.matcher.NameMatchers; import datadog.trace.agent.tooling.bytebuddy.matcher.NameMatchers.OneOf; import datadog.trace.api.InstrumenterConfig; @@ -16,7 +15,6 @@ import net.bytebuddy.description.NamedElement; import net.bytebuddy.description.type.TypeDescription; import net.bytebuddy.matcher.ElementMatcher; -import net.bytebuddy.matcher.ElementMatchers; public abstract class CodeOriginInstrumentation extends Tracing implements Instrumenter.ForTypeHierarchy, Instrumenter.HasMethodAdvice { @@ -44,28 +42,20 @@ public String hierarchyMarkerType() { @Override public ElementMatcher hierarchyMatcher() { ElementMatcher.Junction matcher = - HierarchyMatchers.declaresMethod(HierarchyMatchers.isAnnotatedWith(this.matcher)); + declaresMethod(isAnnotatedWith(this.matcher)); if (InstrumenterConfig.get().isCodeOriginInterfaceSupport()) { - matcher = - matcher.or( - HierarchyMatchers.implementsInterface( - HierarchyMatchers.declaresMethod( - HierarchyMatchers.isAnnotatedWith(this.matcher)))); + matcher = matcher.or(implementsInterface(declaresMethod(isAnnotatedWith(this.matcher)))); } return matcher; } @Override - @SuppressForbidden // Existing direct ElementMatchers usage differs from HierarchyMatchers - // behavior public void methodAdvice(MethodTransformer transformer) { transformer.applyAdvice( - HierarchyMatchers.isAnnotatedWith(matcher), - "datadog.trace.instrumentation.codeorigin.EntrySpanOriginAdvice"); + isAnnotatedWith(matcher), "datadog.trace.instrumentation.codeorigin.EntrySpanOriginAdvice"); if (InstrumenterConfig.get().isCodeOriginInterfaceSupport()) { transformer.applyAdvice( - ElementMatchers.isDeclaredBy( - hasSuperType(isInterface().and(declaresMethod(isAnnotatedWith(matcher))))), + isDeclaredBy(implementsInterface(declaresMethod(isAnnotatedWith(matcher)))), "datadog.trace.instrumentation.codeorigin.EntrySpanOriginAdvice"); } }