fix(feature-flags): constrain direct EVP intake origin - #12299
fix(feature-flags): constrain direct EVP intake origin#12299leoromanovsky wants to merge 14 commits into
Conversation
Route direct feature flag intake through standard HTTPS proxy settings and attach the canonical fixed-width API key fingerprint. Environment: Datadog workspace
This comment has been minimized.
This comment has been minimized.
🟢 Java Benchmark SLOs — All performance SLOs passed
PR vs. master results
Commit: Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion. |
Keep this PR focused on proxy-aware direct Event Platform intake and leave fingerprinting to an independent change. Environment: Datadog workspace
Keep the direct-intake diff free of fingerprint-only formatting artifacts. Environment: Datadog workspace
leoromanovsky
changed the title
Use the original two-argument direct intake factory now that the unrelated fingerprint header plumbing has moved out of this PR. Environment: Datadog workspace
leoromanovsky
changed the title
Reject URL authority confusion before adding DD-API-KEY. Environment: Datadog workspace
Read standard proxy environment variables without registering them as Datadog configuration aliases, and use the existing non-regex parser for no-proxy hosts. Environment: Datadog workspace
leoromanovsky
added
tag: ai generated
Disable HTTP and HTTPS redirects for Feature Flags direct EVP intake so DD-API-KEY remains bound to the configured origin. Environment: Datadog workspace
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 489706ce96
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
![datadog-datadog-us1-prod[bot]](https://avatars.githubusercontent.com/u/365230?s=60&v=4){kind=small}
There was a problem hiding this comment.
NO_PROXY=* does not bypass the new intake proxy. The parser removes the wildcard before the proxy selector reads it.
🤖 Datadog Autotest · Commit 489706c · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
dougqh
left a comment
dougqh
left a comment
There was a problem hiding this comment.
Looks good to me, and I very much appreciate the thoroughness of the testing.
danyal002
left a comment
danyal002
left a comment
There was a problem hiding this comment.
LGTM. Some of the bot comments might be worth looking further into.
Preserve one-character NO_PROXY entries and prevent HTTPS proxy URLs from exposing credentials through configuration telemetry. Environment: Datadog workspace
…agentless-evp-java-hardening # Conflicts: # utils/config-utils/src/main/java/datadog/trace/api/ConfigSetting.java # utils/config-utils/src/test/java/datadog/trace/api/ConfigSettingTest.java
There was a problem hiding this comment.
A plain NO_PROXY domain does not cover its subdomains. This can send direct intake traffic through a proxy that blocks Datadog.
🤖 Datadog Autotest · Commit 75471e9 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest
Keep direct intake origin and redirect protections while removing proxy and runtime failover changes. Environment: Datadog workspace
leoromanovsky
changed the title
…ening\n\nEnvironment: Datadog workspace
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
Build pipeline has failing jobs for 87bf55f: What to do next?
DetailsSince those jobs are not marked as being allowed to fail, the pipeline will most likely fail. |
4 participants
Motivation
Agentless Feature Flags sends exposures and flag evaluations directly to Event Platform intake when no compatible local EVP route is available. These requests carry
DD-API-KEY.The direct client currently follows redirects, and a crafted
DD_SITEvalue can make the parsed request host differ fromevent-platform-intake.<DD_SITE>. Either case can send the API key to an unintended origin.Changes
HttpUrl.Builder.event-platform-intake.<DD_SITE>.Decisions
/inforoute selection or local-to-direct fallback classification.Validation
./gradlew :communication:test --tests datadog.communication.BackendApiFactoryTest./gradlew :products:feature-flagging:feature-flagging-lib:test --tests com.datadog.featureflag.FeatureFlagBackendApiFactoryTest --tests com.datadog.featureflag.ExposureWriterTests --tests com.datadog.featureflag.FlagEvaluationWriterImplTest./gradlew :communication:spotlessCheck :communication:forbiddenApisMain :products:feature-flagging:feature-flagging-lib:spotlessCheck :products:feature-flagging:feature-flagging-lib:forbiddenApisMain