test(appsec): deflake RASP SSRF "should not detect threat" express tests - #9417
Conversation
Overall package sizeSelf size: 6.77 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.1 | 122.62 kB | 438.86 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6f8ec5796d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
🎉 All green!🧪 All tests passed 🎯 Code Coverage (details) 🔗 Commit SHA: c768114 | Docs | Datadog PR Page | Give us feedback! |
BenchmarksBenchmark execution time: 2026-07-17 10:54:59 Comparing candidate commit c768114 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 2315 metrics, 43 unstable metrics.
|
There was a problem hiding this comment.
💡 Codex Review
Disable proxies for the unresolvable-host request
When the test process has HTTPS_PROXY configured, Axios 1.16.1 uses its proxy-from-env dependency and sends this request to the proxy rather than resolving .invalid locally. A proxy that retries or waits while resolving the target leaves res.end() pending and can still exceed checkRaspExecutedAndNotThreat's 1000 ms window, so the intended deflake does not hold in proxied CI environments. Set proxy: false (and a local timeout) for this outbound test request.
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
…sts (#9417) * test(appsec): deflake RASP SSRF "should not detect threat" express tests * test(appsec): disable proxy on RASP SSRF outbound "not detect threat" requests
…sts (#9417) * test(appsec): deflake RASP SSRF "should not detect threat" express tests * test(appsec): disable proxy on RASP SSRF outbound "not detect threat" requests
…sts (#9417) * test(appsec): deflake RASP SSRF "should not detect threat" express tests * test(appsec): disable proxy on RASP SSRF outbound "not detect threat" requests
…sts (#9417) * test(appsec): deflake RASP SSRF "should not detect threat" express tests * test(appsec): disable proxy on RASP SSRF outbound "not detect threat" requests
2 participants
What does this PR do?
Points the SSRF RASP "should not detect threat" express tests at an unresolvable host (
not-a-threat.invalid) instead ofwww.datadoghq.com, and ends the response on the outbound request'serrorevent. The request now fails fast locally instead of depending on a live external connection.Motivation
Flaky test.
Ending the response waited on a live request to
www.datadoghq.com, so slow CI networking pushed the web span past the 1000 ms assertion window (No matching trace received). The SSRF check runs at request start, before DNS, so it never needed the network.Additional Notes
Behaviour under assertion is unchanged: both hosts yield
_dd.appsec.rasp.rule.eval = 1with no threat; the fix is more deterministic.