Restore the no-arg constructors the Moshi reflective adapters require by claponcet · Pull Request #12566 · DataDog/dd-trace-java

claponcet · 2026-09-18T14:33:12Z

What Does This Do

Restores the no-arg constructors that Moshi's reflective adapters need:

WAFResultData and its four nested DTOs (Rule, RuleMatch, Parameter, MatchInfo)
AppSecEventWrapper

Adds a unit test asserting the contract for every class reached by those adapters, and documents on both classes why the constructors must stay.

Motivation

On a JVM that does not resolve the jdk.unsupported module, AppSec fails to start:

java.lang.IllegalArgumentException: cannot construct instances of com.datadog.appsec.ddwaf.WAFResultData$Rule
	at com.squareup.moshi.ClassFactory.get(ClassFactory.java:145)
	at com.squareup.moshi.ClassJsonAdapter$1.create(ClassJsonAdapter.java:103)

Moshi's reflective adapter instantiates bound classes through a declared no-arg constructor and falls back to sun.misc.Unsafe.allocateInstance when there isn't one. sun.misc.Unsafe lives in jdk.unsupported, so on a runtime without that module the fallback is gone and building the adapter throws — taking down AppSec startup from WAFModule's static initializer.

#12118 removed those constructors on the stated basis that the Unsafe fallback made them unnecessary. That holds on a standard JVM but not on a trimmed one, so the failure shipped in 1.66.0.

AppSecEventWrapper has had the same flaw since dcc4363dc (2021): declaring AppSecEventWrapper(Collection) removed its implicit no-arg constructor. Its adapter is only built on the first WAF match, at GatewayBridge.java:1042, so fixing only the WAF DTOs would have moved the crash from startup to the first attack report rather than removing it.

Additional Notes

Alternatives checked against a JVM run with --limit-modules java.base, all rejected:

Making the DTOs Serializable does not help — Moshi's other fallback needs ObjectStreamClass.getConstructorId, which exists only on Android; OpenJDK has no such method, so the branch can never fire.
Upgrading Moshi does not help — 1.15.2 has a byte-identical fallback chain.
A hand-written JsonAdapter, a custom JsonAdapter.Factory invoking the canonical constructor, and our in-house reflection-free datadog.json all work, but each replaces Moshi's automatic binding with parsing code we maintain by hand. Five empty constructors on the path Moshi checks first are cheaper. The datadog.json migration has value on its own and is worth a separate ticket.

AppSecEventWrapper's adapter is only ever used to serialize, but Moshi resolves the instantiation strategy when the adapter is built, not when it is used, so serialize-only does not exempt it.

Roughly 115 other Moshi reflective-adapter sites outside AppSec (ci-visibility, debugger, crashtracking, remote-config, telemetry, llmobs, feature-flagging) are unaudited and may carry the same latent issue. Out of scope here.

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors
Once approved, use merge queue to merge the PR

Jira ticket: APPSEC-70182

🤖 Generated with Claude Code

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

claponcet · 2026-09-18T14:33:21Z

@codex review

claponcet · 2026-09-18T14:33:23Z

@DataDog review

chatgpt-codex-connector · 2026-09-18T14:33:49Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T11:53:22.708149Z	`e339030`	Draft marked ready
🔒 Security Review	✅ Completed 2026-09-21T11:54:17.233197Z	`e339030`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector · 2026-09-18T14:35:33Z

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: e339030574

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-18T14:36:30Z

🛡️ Codex Security Review · Automatically triggered

Security review completed. No security issues were found in this pull request.

Reviewed commit: e339030574

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

datadog-official

More details

Each Moshi-reflective AppSec DTO has a declared no-argument constructor. Adapter creation no longer needs sun.misc.Unsafe.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit e339030 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

datadog-official · 2026-09-18T14:49:27Z

🎯 Code Coverage (details)
• Patch Coverage: 57.14%
• Overall Coverage: 57.30% (-1.79%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: e339030 | Docs | Give us feedback!}

dd-octo-sts · 2026-09-18T15:01:39Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.87 s	14.62 s	[+0.8%; +2.5%] (maybe worse)
startup:insecure-bank:tracing:Agent	13.73 s	13.70 s	[-0.6%; +1.1%] (no difference)
startup:petclinic:appsec:Agent	16.59 s	16.86 s	[-6.3%; +3.1%] (no difference)
startup:petclinic:iast:Agent	16.91 s	16.94 s	[-1.0%; +0.7%] (no difference)
startup:petclinic:profiling:Agent	16.63 s	16.94 s	[-3.1%; -0.6%] (maybe better)
startup:petclinic:sca:Agent	16.99 s	16.81 s	[-0.0%; +2.2%] (no difference)
startup:petclinic:tracing:Agent	16.01 s	16.24 s	[-2.4%; -0.5%] (maybe better)

Commit: e3390305 · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

datadog-official

More details

All classes that Moshi creates now have a no-argument constructor. The contract test includes each class that the two reflective adapters use.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit e339030 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

jandro996

LGTM!

dd-octo-sts · 2026-09-21T14:00:30Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-09-21T14:00:34Z

View all feedbacks in Devflow UI.

2026-09-21 14:00:34 UTC ℹ️ Start processing command /merge

2026-09-21 14:00:39 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

2026-09-21 15:07:35 UTC ❌ MergeQueue: The build pipeline contains failing jobs for this merge request

Build pipeline has failing jobs for 18d28a1:

test_smoke: [semeru17, 8/8]

⚠️ Do NOT retry failed jobs directly (why?).

What to do next?

Investigate the failures and when ready, re-add your pull request to the queue!
If your PR checks are green, try to rebase/merge. It might be because the CI run is a bit old.
Any question, go check the FAQ.

Details

Since those jobs are not marked as being allowed to fail, the pipeline will most likely fail.
Therefore, and to allow other builds to be processed, this merge request has been rejected and the pipeline got canceled.

dd-octo-sts · 2026-09-21T15:09:24Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-09-21T15:09:29Z

View all feedbacks in Devflow UI.

2026-09-21 15:09:29 UTC ℹ️ Start processing command /merge

2026-09-21 15:09:34 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

2026-09-21 16:30:12 UTC ℹ️ MergeQueue: This merge request was merged

Restore the no-arg constructors the Moshi reflective adapters require

e339030

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

claponcet added type: bug fix Bug fix comp: asm waf Application Security Management (WAF) tag: ai generated Largely based on code generated by an AI or LLM labels Sep 18, 2026

datadog-official Bot reviewed Sep 18, 2026

View reviewed changes

claponcet marked this pull request as ready for review September 21, 2026 11:51

claponcet requested a review from a team as a code owner September 21, 2026 11:51

claponcet requested review from jandro996 and manuel-alvarez-alvarez September 21, 2026 11:51

datadog-official Bot reviewed Sep 21, 2026

View reviewed changes

jandro996 approved these changes Sep 21, 2026

View reviewed changes

claponcet added this pull request to the merge queue Sep 21, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 21, 2026

claponcet added this pull request to the merge queue Sep 21, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 21, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit c57b5a5 into master Sep 21, 2026
613 of 619 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the clara.poncet/waf-result-data-no-arg-constructors branch September 21, 2026 16:30

github-actions Bot added this to the 1.67.0 milestone Sep 21, 2026

Conversation

claponcet commented Sep 18, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

claponcet commented Sep 18, 2026

Uh oh!

claponcet commented Sep 18, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot commented Sep 18, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 18, 2026

🛡️ Codex Security Review · Automatically triggered

Uh oh!

datadog-official Bot left a comment

Choose a reason for hiding this comment

Uh oh!

datadog-official Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dd-octo-sts Bot commented Sep 18, 2026

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

datadog-official Bot left a comment

Choose a reason for hiding this comment

Uh oh!

jandro996 left a comment

Choose a reason for hiding this comment

Uh oh!

dd-octo-sts Bot commented Sep 21, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What to do next?

Uh oh!

Uh oh!

dd-octo-sts Bot commented Sep 21, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Sep 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

claponcet commented Sep 18, 2026 •

edited by atlassian Bot

Loading

chatgpt-codex-connector Bot commented Sep 18, 2026 •

edited

Loading

datadog-official Bot commented Sep 18, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Sep 21, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Sep 21, 2026 •

edited

Loading