Update default AppSec ruleset to release 1.18.2

[jandro996]

What Does This Do

Syncs dd-java-agent/appsec/src/main/resources/default_config.json (the bundled AppSec/WAF ruleset) with the upstream ASM_DD 1.18.2 release, merged by rule id rather than a wholesale file replace to avoid dropping tracer-only rules.

• Bumps metadata.rules_version from 1.13.3 to 1.18.2.
• Adds 45 new rules and updates the content (regex/confidence/inputs) of 17 existing rules from the upstream recommended.json.
• Adds the new top-level rules_compat key (17 entries, gated by min_version: "1.25.0") — covers new JWT/API-security business-logic rules with output.attributes derivative tags such as _dd.appsec.api.jwt.no_expiry.
• Replaces processors[] (8 entries, adds decode-auth-jwt and extract-auth) and scanners[] (37 entries, adds a Password credentials scanner) wholesale — no tracer-only entries in either array.
• Four fingerprint processors (http-network-fingerprint, http-endpoint-fingerprint, http-header-fingerprint, session-fingerprint) switch from evaluate: false + login-gated conditions to evaluate: true + conditions: [], matching upstream — they now run on every request instead of only on login events.
• Preserves the two tracer-only rules not present upstream: dog-920-100 ("File upload with double extension") and dog-942-001 ("Blind XSS callback domains"). crs-944-140, previously tracer-added, is now upstream with new content and is treated as a normal synced rule.

AppSecConfigServiceImpl deserializes this file generically via Moshi into a Map<String, Object> with no typed schema, so the new top-level key and per-rule min_version/max_version fields require no Java-side changes.

Follow-up fix: noisy debug log

Because the fingerprint processors above now evaluate on every request, WAFModule.buildEvents() started hitting its actionWithData.data == null branch on ordinary traffic instead of only in rare edge cases, logging "WAF result data is null" at DEBUG on every request and breaking system-tests' Test_NoExceptions::test_java_telemetry_logs (unexpected-log assertion) on several end-to-end CI jobs.

• Removed that log.debug(...) call (and the now-unused SEND_TELEMETRY import), replacing it with a comment explaining why a MATCH-with-no-data result is expected now.
• Verified dd-trace-py and dd-trace-go don't log in this case either — both separate real rule "events"/"data" from fingerprint "attributes"/"derivatives" and gate their equivalent debug log on non-empty events, never on the raw WAF return code (MATCH/OK). This change brings dd-trace-java's behavior in line with the other two tracers.

Motivation

Keeps the bundled default ruleset current with the latest published ASM event rules release, closing the gap between the tracer's 1.13.3 and the current 1.18.2.

Additional Notes

The always-on fingerprint processors are a real behavior change inherited from upstream (not introduced by this PR) — flagged for /perf-review since they now evaluate on every request rather than only login events. That same behavior change is what surfaced the pre-existing noisy debug log fixed in the second commit.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Jira ticket: APPSEC-69446

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

[jandro996]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: 490efe10ed

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-official]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 55.88% (-1.96%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 56c4831 | Docs | Datadog PR Page | Give us feedback!}

[dd-octo-sts]

🟡 Java Benchmark SLOs — Performance SLO warning (near threshold)

Suite	Status
Startup	🟡 warning

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.95 s	14.00 s	[-1.1%; +0.4%] (no difference)
startup:insecure-bank:tracing:Agent	12.96 s	13.00 s	[-1.1%; +0.4%] (no difference)
startup:petclinic:appsec:Agent	16.74 s	17.22 s	[-7.0%; +1.5%] (no difference)
startup:petclinic:iast:Agent	17.40 s	17.47 s	[-1.1%; +0.4%] (no difference)
startup:petclinic:profiling:Agent	17.55 s	17.58 s	[-1.5%; +1.1%] (no difference)
startup:petclinic:sca:Agent	17.62 s	17.58 s	[-0.9%; +1.3%] (no difference)
startup:petclinic:tracing:Agent	16.51 s	16.64 s	[-1.7%; +0.2%] (no difference)

Commit: 2f51745a · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.