feat(appsec): support for inserting blocking IDs to blocking templates by simon-id · Pull Request #7923 · DataDog/dd-trace-js

simon-id · 2026-04-03T14:54:34Z

What does this PR do?

This updates the appsec blocking templates to include [security_response_id]. And update blocking code to replace this string by a random UUID provided by the WAF.

Motivation

Easier to track stuff.

github-actions · 2026-04-03T15:04:20Z

Overall package size

Self size: 5.48 MB
Deduped: 6.32 MB
No deduping: 6.32 MB

Dependency sizes

| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.0.1 | 82.56 kB | 817.39 kB | | dc-polyfill | 0.1.10 | 26.73 kB | 26.73 kB |

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

datadog-datadog-prod-us1-2 · 2026-04-03T15:05:18Z

⚠️ Tests

✨ Fix all issues with BitsAI or with Cursor

⚠️ Other Violations

🧪 60 Tests failed

with @apollo/server 4 (4.0.0) Block with content Should block an attack on directive from Block with content (Fix with Cursor)
Request should not return 200

Error: Request should not return 200
    at Context.<anonymous> (packages/dd-trace/test/appsec/graphql.test-utils.js:100:31)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
with @apollo/server 4 (4.0.0) Block with content Should block an attack on variable from Block with content (Fix with Cursor)
Request should not return 200

Error: Request should not return 200
    at Context.<anonymous> (packages/dd-trace/test/appsec/graphql.test-utils.js:89:31)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
with @apollo/server 4 (4.0.0) Block with content Should block an http attack with graphql response from Block with content (Fix with Cursor)
Request should not return 200

Error: Request should not return 200
    at Context.<anonymous> (packages/dd-trace/test/appsec/graphql.test-utils.js:130:31)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
View all

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 48.28%
• Overall Coverage: 48.52% (-19.74%)

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 00faf2e | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

pr-commenter · 2026-04-03T15:13:43Z

Benchmarks

Benchmark execution time: 2026-04-09 18:19:19

Comparing candidate commit 00faf2e in PR branch blocking_id with baseline commit 70baebd in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 224 metrics, 36 unstable metrics.

codecov · 2026-04-03T16:01:18Z

Codecov Report

❌ Patch coverage is 65.51724% with 10 lines in your changes missing coverage. Please review.
✅ Project coverage is 70.67%. Comparing base (70baebd) to head (00faf2e).
⚠️ Report is 6 commits behind head on master.

Files with missing lines	Patch %	Lines
packages/dd-trace/src/appsec/blocking.js	61.53%	10 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #7923      +/-   ##
==========================================
- Coverage   73.87%   70.67%   -3.21%     
==========================================
  Files         773      773              
  Lines       35985    35991       +6     
==========================================
- Hits        26584    25436    -1148     
- Misses       9401    10555    +1154

Flag	Coverage Δ
aiguard-macos	`36.42% <51.72%> (-0.06%)`	⬇️
aiguard-ubuntu	`36.53% <51.72%> (-0.06%)`	⬇️
aiguard-windows	`36.33% <51.72%> (-0.06%)`	⬇️
apm-capabilities-tracing-macos	`48.81% <51.72%> (+0.01%)`	⬆️
apm-capabilities-tracing-ubuntu	`48.85% <51.72%> (+0.01%)`	⬆️
apm-capabilities-tracing-windows	`48.63% <51.72%> (+0.01%)`	⬆️
apm-integrations-child-process	`36.06% <51.72%> (-0.06%)`	⬇️
apm-integrations-couchbase-18	`35.04% <51.72%> (-0.03%)`	⬇️
apm-integrations-couchbase-eol	`?`
apm-integrations-oracledb	`35.06% <51.72%> (-0.06%)`	⬇️
appsec-express	`?`
appsec-fastify	`49.36% <65.51%> (-0.04%)`	⬇️
appsec-graphql	`?`
appsec-kafka	`42.12% <51.72%> (-0.06%)`	⬇️
appsec-ldapjs	`41.43% <51.72%> (-0.05%)`	⬇️
appsec-lodash	`41.46% <51.72%> (-0.05%)`	⬇️
appsec-macos	`?`
appsec-mongodb-core	`46.07% <51.72%> (-0.05%)`	⬇️
appsec-mongoose	`46.68% <51.72%> (-0.05%)`	⬇️
appsec-mysql	`48.81% <51.72%> (-0.05%)`	⬇️
appsec-node-serialize	`40.63% <51.72%> (-0.05%)`	⬇️
appsec-passport	`44.65% <51.72%> (-0.06%)`	⬇️
appsec-postgres	`48.39% <51.72%> (-0.05%)`	⬇️
appsec-sourcing	`40.09% <51.72%> (-0.05%)`	⬇️
appsec-stripe	`42.46% <51.72%> (+0.06%)`	⬆️
appsec-template	`40.79% <51.72%> (-0.05%)`	⬇️
appsec-ubuntu	`?`
appsec-windows	`?`
instrumentations-instrumentation-bluebird	`29.94% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-body-parser	`37.68% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-child_process	`35.45% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-cookie-parser	`31.88% <51.72%> (-0.05%)`	⬇️
instrumentations-instrumentation-express	`32.17% <51.72%> (-0.05%)`	⬇️
instrumentations-instrumentation-express-mongo-sanitize	`32.00% <51.72%> (-0.05%)`	⬇️
instrumentations-instrumentation-express-session	`37.34% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-fs	`29.58% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-generic-pool	`31.44% <ø> (ø)`
instrumentations-instrumentation-http	`36.89% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-knex	`29.95% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-mongoose	`31.06% <51.72%> (-0.05%)`	⬇️
instrumentations-instrumentation-multer	`37.45% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-mysql2	`35.42% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-passport	`41.27% <51.72%> (-0.05%)`	⬇️
instrumentations-instrumentation-passport-http	`40.96% <51.72%> (-0.05%)`	⬇️
instrumentations-instrumentation-passport-local	`41.46% <51.72%> (-0.05%)`	⬇️
instrumentations-instrumentation-pg	`34.93% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-promise	`29.87% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-promise-js	`29.88% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-q	`29.92% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-url	`29.84% <51.72%> (-0.06%)`	⬇️
instrumentations-instrumentation-when	`29.89% <51.72%> (-0.06%)`	⬇️
llmobs-ai	`38.44% <51.72%> (-0.06%)`	⬇️
llmobs-anthropic	`37.90% <51.72%> (-0.06%)`	⬇️
llmobs-bedrock	`37.19% <51.72%> (-0.05%)`	⬇️
llmobs-google-genai	`37.58% <51.72%> (-0.05%)`	⬇️
llmobs-langchain	`37.09% <51.72%> (-0.05%)`	⬇️
llmobs-openai	`41.26% <51.72%> (-0.06%)`	⬇️
llmobs-vertex-ai	`37.75% <51.72%> (-0.06%)`	⬇️
platform-core	`30.82% <ø> (ø)`
platform-esbuild	`33.74% <ø> (ø)`
platform-instrumentations-misc	`40.89% <ø> (ø)`
platform-shimmer	`36.80% <ø> (ø)`
platform-unit-guardrails	`32.24% <ø> (ø)`
platform-webpack	`20.96% <ø> (ø)`
plugins-azure-durable-functions	`25.38% <ø> (ø)`
plugins-azure-event-hubs	`25.53% <ø> (ø)`
plugins-azure-service-bus	`24.92% <ø> (ø)`
plugins-bullmq	`40.74% <51.72%> (-0.06%)`	⬇️
plugins-cassandra	`35.21% <51.72%> (+0.07%)`	⬆️
plugins-cookie	`26.56% <ø> (ø)`
plugins-cookie-parser	`26.35% <ø> (ø)`
plugins-crypto	`26.21% <ø> (ø)`
plugins-dd-trace-api	`35.42% <51.72%> (-0.06%)`	⬇️
plugins-express-mongo-sanitize	`26.50% <ø> (ø)`
plugins-express-session	`26.31% <ø> (ø)`
plugins-fastify	`39.46% <51.72%> (-0.06%)`	⬇️
plugins-fetch	`35.72% <51.72%> (-0.06%)`	⬇️
plugins-fs	`35.67% <51.72%> (-0.06%)`	⬇️
plugins-generic-pool	`25.57% <ø> (ø)`
plugins-google-cloud-pubsub	`43.05% <51.72%> (-0.06%)`	⬇️
plugins-grpc	`38.07% <51.72%> (-0.06%)`	⬇️
plugins-handlebars	`26.54% <ø> (ø)`
plugins-hapi	`37.27% <51.72%> (-0.06%)`	⬇️
plugins-hono	`37.55% <51.72%> (-0.06%)`	⬇️
plugins-ioredis	`35.63% <51.72%> (-0.06%)`	⬇️
plugins-knex	`26.20% <ø> (ø)`
plugins-langgraph	`35.11% <51.72%> (-0.06%)`	⬇️
plugins-ldapjs	`24.12% <ø> (ø)`
plugins-light-my-request	`25.93% <ø> (ø)`
plugins-limitd-client	`30.20% <51.72%> (-0.06%)`	⬇️
plugins-lodash	`25.66% <ø> (ø)`
plugins-mariadb	`36.53% <51.72%> (-0.06%)`	⬇️
plugins-memcached	`35.29% <51.72%> (-0.06%)`	⬇️
plugins-microgateway-core	`36.39% <51.72%> (-0.06%)`	⬇️
plugins-moleculer	`38.06% <51.72%> (-0.06%)`	⬇️
plugins-mongodb	`36.51% <51.72%> (+0.05%)`	⬆️
plugins-mongodb-core	`36.10% <51.72%> (-0.06%)`	⬇️
plugins-mongoose	`36.19% <51.72%> (+0.05%)`	⬆️
plugins-multer	`26.31% <ø> (ø)`
plugins-mysql	`36.37% <51.72%> (-0.06%)`	⬇️
plugins-mysql2	`36.37% <51.72%> (-0.06%)`	⬇️
plugins-node-serialize	`26.60% <ø> (ø)`
plugins-opensearch	`34.96% <51.72%> (-0.06%)`	⬇️
plugins-passport-http	`26.37% <ø> (ø)`
plugins-postgres	`34.37% <51.72%> (-0.03%)`	⬇️
plugins-process	`26.21% <ø> (ø)`
plugins-pug	`26.56% <ø> (ø)`
plugins-redis	`35.94% <51.72%> (-0.06%)`	⬇️
plugins-router	`40.03% <51.72%> (-0.06%)`	⬇️
plugins-sequelize	`25.19% <ø> (ø)`
plugins-test-and-upstream-amqp10	`35.66% <51.72%> (-0.06%)`	⬇️
plugins-test-and-upstream-amqplib	`40.85% <51.72%> (-0.06%)`	⬇️
plugins-test-and-upstream-apollo	`36.56% <51.72%> (-0.05%)`	⬇️
plugins-test-and-upstream-avsc	`35.66% <51.72%> (-0.06%)`	⬇️
plugins-test-and-upstream-bunyan	`31.31% <51.72%> (-0.06%)`	⬇️
plugins-test-and-upstream-connect	`37.87% <51.72%> (-0.06%)`	⬇️
plugins-test-and-upstream-graphql	`37.21% <51.72%> (-0.06%)`	⬇️
plugins-test-and-upstream-koa	`37.52% <51.72%> (-0.06%)`	⬇️
plugins-test-and-upstream-protobufjs	`35.88% <51.72%> (-0.06%)`	⬇️
plugins-test-and-upstream-rhea	`41.07% <51.72%> (+0.07%)`	⬆️
plugins-undici	`36.62% <51.72%> (-0.06%)`	⬇️
plugins-url	`26.21% <ø> (ø)`
plugins-valkey	`35.32% <51.72%> (-0.06%)`	⬇️
plugins-vm	`26.21% <ø> (ø)`
plugins-winston	`31.75% <51.72%> (+0.07%)`	⬆️
plugins-ws	`38.96% <51.72%> (-0.06%)`	⬇️
profiling-macos	`38.09% <51.72%> (-0.06%)`	⬇️
profiling-ubuntu	`38.25% <51.72%> (-0.06%)`	⬇️
profiling-windows	`39.56% <51.72%> (-0.06%)`	⬇️
serverless-azure-functions-client	`25.26% <ø> (ø)`
serverless-azure-functions-eventhubs	`25.26% <ø> (ø)`
serverless-azure-functions-servicebus	`25.26% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

simon-id added 5 commits October 31, 2025 11:31

add RC capability 16 and 17

fbb5a3a

update tests

0effd5e

update waf to 11.0.0

b971205

push stuff

4a15d26

Merge branch 'master' into blocking_id

3a6b2c1

simon-id added the semver-minor label Apr 3, 2026

simon-id added 13 commits April 9, 2026 16:01

fix

1b4d683

Merge branch 'master' into blocking_id

37570f5

cleanup

82d8868

cleanup

4e289b4

fix test

c74fb82

cleanup

e43dc9e

fix

30e04b2

fix express test

816341c

fix test

a465007

fix more tests

d223747

fix more stuff

2cee32f

fix more stuff

511e7c3

little fix

3896805

simon-id changed the title ~~Blocking~~ feat(appsec): add support for inserting blocking IDs to blocking templates Apr 9, 2026

simon-id changed the title ~~feat(appsec): add support for inserting blocking IDs to blocking templates~~ feat(appsec): support for inserting blocking IDs to blocking templates Apr 9, 2026

simon-id added 5 commits April 9, 2026 19:05

Merge branch 'master' into blocking_id

b994c47

test something

ba867b0

Merge branch 'master' into blocking_id

bec2194

fix

d869dc4

fix

fbe825a

fix

00faf2e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(appsec): support for inserting blocking IDs to blocking templates#7923

feat(appsec): support for inserting blocking IDs to blocking templates#7923
simon-id wants to merge 24 commits intomasterfrom
blocking_id

simon-id commented Apr 3, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Apr 3, 2026 •

edited

Loading

Uh oh!

datadog-datadog-prod-us1-2 bot commented Apr 3, 2026 •

edited by datadog-prod-us1-5 bot

Loading

Uh oh!

pr-commenter bot commented Apr 3, 2026 •

edited

Loading

Uh oh!

codecov bot commented Apr 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

simon-id commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Uh oh!

github-actions bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Overall package size

Uh oh!

datadog-datadog-prod-us1-2 bot commented Apr 3, 2026 • edited by datadog-prod-us1-5 bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Other Violations

ℹ️ Info

Uh oh!

pr-commenter bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks

Uh oh!

codecov bot commented Apr 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

simon-id commented Apr 3, 2026 •

edited

Loading

github-actions bot commented Apr 3, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 bot commented Apr 3, 2026 •

edited by datadog-prod-us1-5 bot

Loading

pr-commenter bot commented Apr 3, 2026 •

edited

Loading

codecov bot commented Apr 3, 2026 •

edited

Loading