Add server.request.body.files_content AppSec address for Tomcat and Netty multipart#11198

Merged

gh-worker-dd-mergequeue-cf854d[bot] merged 45 commits intomasterfrom

alejandro.gonzalez/APPSEC-61875-files-content-tomcat-netty

Apr 30, 2026

Commits on Apr 28, 2026

refactor(appsec): extract MultipartContentDecoder to internal-api for reuse across integrations
jandro996
committed
test(appsec): add missing corner cases to MultipartContentDecoderTest
jandro996
committed
fix(appsec): use machine default charset as fallback in MultipartContentDecoder
jandro996
committed
test(appsec): migrate MultipartContentDecoderTest from Groovy/Spock to Java/JUnit 5
jandro996
committed
feat(appsec): extend files_content WAF address to Tomcat and Netty multipart
jandro996
committed
fix(appsec): address techdebt in Tomcat/Netty files_content instrumentation
jandro996
committed
fix(appsec): further cleanup of Tomcat/Netty files_content instrumentation
jandro996
committed
fix(appsec): align blocking paths with canonical pattern in Tomcat/Netty files_content
jandro996
committed
fix(appsec): skip file content I/O in Netty when requestFilesContent callback is unregistered
jandro996
committed
fix(appsec): align Netty filenames blocking and merge CommonsFileUpload loop
jandro996
committed
refactor(appsec): remove dead readContents() from FileItemContentReader
jandro996
committed
fix(appsec): lazy-init filesContent in Netty and align CommonsFileUpload guard style
jandro996
committed
fix(appsec): skip file content I/O in Tomcat when requestFilesContent callback is unregistered
jandro996
committed
fix(appsec): move BlockingException inside brf guard in all remaining paths
jandro996
committed
refactor(appsec): cache reflection and use try-with-resources in ParameterCollector
jandro996
committed
test(appsec): add Netty integration tests for multipart filenames and file content
jandro996
committed
refactor(appsec): extract Netty file content reading to NettyFileUploadContentReader helper
jandro996
committed
test(appsec): add integration tests for file content size and count limits
jandro996
committed
test(appsec): increase Netty test server aggregator limit to support large multipart payloads
jandro996
committed
fix(appsec): do not gate Netty file content callback on requestBodyProcessed subscriber
jandro996
committed
style: apply spotless formatting to HttpServerTest
jandro996
committed
fix(appsec): remove effectivelyBlocked() calls in Netty filenames and content blocking paths
jandro996
committed
fix(appsec): set t before effectivelyBlocked() in Tomcat filenames and content blocking paths
jandro996
committed
perf(appsec): skip attribute I/O in Netty multipart when body callback is absent
jandro996
committed
refactor(appsec): unify file content limits via Config for DD_APPSEC_MAX_FILE_CONTENT_BYTES/COUNT
jandro996
committed
chore: register DD_APPSEC_MAX_FILE_CONTENT_BYTES/COUNT in supported-configurations.json
jandro996
committed
test(appsec): use Config values instead of hardcoded literals in ParameterCollectorImplTest
jandro996
committed
fix(appsec): move MAX_FILES_TO_INSPECT out of advice inner class to fix muzzle validation
jandro996
committed
style: apply spotless formatting to HttpPostRequestDecoderInstrumentation
jandro996
committed
fix(appsec): include filenames callback in Netty multipart early-return gate
jandro996
committed
fix(appsec): use per-part charset for files_content in Tomcat and Netty
jandro996
committed
refactor(appsec): extract shared InputStream read loop into MultipartContentDecoder
jandro996
committed
test(appsec): add charset-aware decoding tests for readInputStream, Netty and Tomcat helpers
jandro996
committed
test(appsec): add getContentType() to Tomcat test part doubles to fix reflective method resolution
jandro996
committed
perf(appsec): skip filenames list allocation in CommonsFileUpload when filenames callback is absent
jandro996
committed
refactor(appsec): extract Netty multipart data collection to NettyMultipartHelper and add unit tests
jandro996
committed
test(appsec): declare ISO-8859-1 content type on RawBytesPart to match decoder charset expectation
jandro996
committed
refactor(appsec): extract tryBlock helper to NettyMultipartHelper
jandro996
committed
test(appsec): add unit tests for NettyMultipartHelper.tryBlock
jandro996
committed

Commits on Apr 29, 2026