Add IAST code injection detection for BeanShell

[claponcet]

What Does This Do

Adds IAST code injection detection for BeanShell:

• New CODE_INJECTION vulnerability type.
• New beanshell-2.0 instrumentation flagging untrusted input reaching Interpreter.eval(String) / eval(Reader) and Remote.eval, plus SSRF on Remote.eval's outbound URL.

Motivation

BeanShell evaluates arbitrary Java-like scripts, so untrusted input reaching eval is a code-injection (RCE) risk. There was no IAST coverage for it.

Additional Notes

A few non-obvious decisions:

• We inspect the String argument of eval, not the Reader BeanShell builds internally. bsh.* is in the IAST call-site exclusion trie, so new StringReader(...) built inside bsh.Interpreter is never tainted. Method advice (unlike call-site) still applies to bsh.*, so inspecting the argument directly works. We deliberately did not remove bsh.* from the exclusion trie (global change, re-enables call-site rewriting across all BeanShell internals for the benefit of one sink).
• Reader path (eval(Reader)) covers caller-supplied tainted StringReader/InputStreamReader. A coverage boundary that depends on the caller building the Reader through an instrumented propagation path — not a bug.
• Remote.eval reports SSRF for both connecting schemes (http: and bsh:). The http: branch is not covered by the existing URL/URLConnection sink: that sink is call-site based and bsh.Remote is excluded, so it never fires inside BeanShell.
• Supported floor is 2.0b4 (first stable Remote.eval(String, String) signature). Muzzle covers both Maven coordinates (org.beanshell:bsh, org.apache-extras.beanshell:bsh); latestDepTest runs against 2.0b6 (newest on Central).

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue; use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Once approved, use merge queue to merge the PR

Jira ticket: APPSEC-68816

[dd-octo-sts]

❌ New Groovy Files Detected

Please avoid introducing new .groovy files to this repository.

• dd-java-agent/agent-iast/src/test/groovy/com/datadog/iast/sink/CodeInjectionModuleTest.groovy
• dd-java-agent/instrumentation/beanshell-2.0/src/test/groovy/datadog/trace/instrumentation/beanshell/BeanShellInstrumentationTest.groovy

Instead, rewrite the new file(s) in Java / JUnit. See the How to Test With JUnit Guide for more details.

If this PR needs an exception, add the tag: override groovy enforcement label to bypass this workflow.

[datadog-prod-us1-4]

🎯 Code Coverage (details)
• Patch Coverage: 85.71%
• Overall Coverage: 57.78% (-0.01%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 53d77e6 | Docs | Datadog PR Page | Give us feedback!}

[datadog-prod-us1-4]

The new BeanShell SSRF advice only recognizes lowercase http: and bsh: prefixes. A valid mixed-case URL such as HTTP://localhost:1/ is accepted by Java URL handling but bypasses this guard, so tainted Remote.eval requests can execute without an SSRF report; the fix is to compare schemes case-insensitively.

_{📊 Validated against 1 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit e6bd5f6 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

🟡 Java Benchmark SLOs — Performance SLO warning (near threshold)

Suite	Status
Startup	🟡 warning

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.05 s	14.03 s	[-0.6%; +0.9%] (no difference)
startup:insecure-bank:tracing:Agent	12.87 s	12.98 s	[-1.6%; -0.1%] (maybe better)
startup:petclinic:appsec:Agent	16.83 s	16.85 s	[-1.1%; +0.9%] (no difference)
startup:petclinic:iast:Agent	16.96 s	16.96 s	[-0.9%; +0.9%] (no difference)
startup:petclinic:profiling:Agent	16.39 s	16.86 s	[-7.0%; +1.5%] (no difference)
startup:petclinic:sca:Agent	16.72 s	16.69 s	[-0.8%; +1.2%] (no difference)
startup:petclinic:tracing:Agent	15.64 s	15.79 s	[-7.0%; +5.1%] (unstable)

Commit: 53d77e60 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e6bd5f6a0a

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[claponcet]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a748317efe

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[jandro996]

This is a new .groovy test file, we should try to write them in Java/JUnit 5 (see docs/how_to_test_with_junit.md), or add the tag: override groovy enforcement label if an exception is needed

[jandro996]

This is a new .groovy test file, we should try to write them in Java/JUnit 5 (see docs/how_to_test_with_junit.md), or add the tag: override groovy enforcement label if an exception is needed

[jandro996]

#12113 (comment) and #12113 (comment) comments related with groovy test migration are optional as both extend Groovy-only Spock base classes so they aren't trivially usable from JUnit5/Java tests. Given that, staying in Groovy here seems reasonable rather than a violation to fix, but the tag: override groovy enforcement label should probably be added so the check reflects that explicitly, instead of just failing silently

[jandro996]

We need to add CODEOWNERS entry for dd-java-agent/instrumentation/beanshell-2.0/ under the ASM/IAST ownership section