Skip to content

Restrict freemarker ObjectWrapper instrumentation to 2.3.24+ #12117

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
AlexeyKuznetsov-DD wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Restrict freemarker ObjectWrapper instrumentation to 2.3.24+ #12117

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions ...rc/main/java/datadog/trace/instrumentation/freemarker24/ObjectWrapperInstrumentation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
package datadog.trace.instrumentation.freemarker24;

import static datadog.trace.agent.tooling.bytebuddy.matcher.ClassLoaderMatchers.hasClassNamed;
import static datadog.trace.agent.tooling.bytebuddy.matcher.HierarchyMatchers.implementsInterface;
import static datadog.trace.agent.tooling.bytebuddy.matcher.NameMatchers.named;
import static net.bytebuddy.matcher.ElementMatchers.returns;
Expand Down Expand Up @@ -29,6 +30,14 @@ public ObjectWrapperInstrumentation() {
super("freemarker");
}

static final ElementMatcher.Junction<ClassLoader> VERSION_POST_2_3_24 =
hasClassNamed("freemarker.cache.ByteArrayTemplateLoader");
Comment on lines +33 to +34

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Return the class-loader matcher directly

When this instrumentation is registered, classLoaderMatcher() is invoked only once, so caching its result in VERSION_POST_2_3_24 adds static state and constant-pool bloat without reuse. docs/instrumentation_design_guidelines.md explicitly requires one-shot matcher values to be constructed and returned directly; inline hasClassNamed(...) in classLoaderMatcher() instead.

AGENTS.md reference: AGENTS.md:L40-L44

Useful? React with 👍 / 👎.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Gate hierarchy implementations on a visible package

When a custom ObjectWrapper implementation is loaded by an OSGi bundle that imports freemarker.template but not freemarker.cache, this matcher is evaluated against the implementation's bundle class loader and cannot see ByteArrayTemplateLoader. BundleWiringHelper.probeResource() only reports resources from directly imported packages, so the new module-wide guard rejects the transformation even with FreeMarker 2.3.24+, silently disabling the IAST taint propagation for that wrapper; use a version marker visible through the same imported package or a gate that does not require the unrelated cache package.

Useful? React with 👍 / 👎.


@Override
public ElementMatcher.Junction<ClassLoader> classLoaderMatcher() {
return VERSION_POST_2_3_24;
}

@Override
public String hierarchyMarkerType() {
return "freemarker.template.ObjectWrapper";
Expand Down
Loading