Ensure instrumenter is only active if appsec is not explicitly disabled

DataDog · Aug 16, 2024 · 9dc7948 · 9dc7948
1 parent fd2148d
commit 9dc7948
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 6 deletions.
diff --git a/...ter/src/main/java/datadog/trace/instrumentation/iastinstrumenter/IastInstrumentation.java b/...ter/src/main/java/datadog/trace/instrumentation/iastinstrumenter/IastInstrumentation.java
@@ -37,7 +37,8 @@ public ElementMatcher<TypeDescription> callerType() {
 
   @Override
   public boolean isApplicable(final Set<TargetSystem> enabledSystems) {
-    return enabledSystems.contains(TargetSystem.IAST) || Config.get().isAppSecRaspEnabled();
+    return enabledSystems.contains(TargetSystem.IAST)
+        || (enabledSystems.contains(TargetSystem.APPSEC) && Config.get().isAppSecRaspEnabled());
   }
 
   @Override

diff --git a/...va-agent/instrumentation/iast-instrumenter/src/test/groovy/IastInstrumentationTest.groovy b/...va-agent/instrumentation/iast-instrumenter/src/test/groovy/IastInstrumentationTest.groovy
@@ -1,5 +1,6 @@
 import datadog.trace.agent.test.AgentTestRunner
 import datadog.trace.agent.tooling.InstrumenterModule
+import datadog.trace.api.config.AppSecConfig
 import datadog.trace.api.config.IastConfig
 import datadog.trace.instrumentation.iastinstrumenter.IastHardcodedSecretListener
 import datadog.trace.instrumentation.iastinstrumenter.IastInstrumentation
@@ -9,6 +10,7 @@ class IastInstrumentationTest extends AgentTestRunner {
 
   void 'test Iast Instrumentation enablement'() {
     given:
+    injectSysConfig(AppSecConfig.APPSEC_RASP_ENABLED, Boolean.toString(rasp))
     final instrumentation = new IastInstrumentation()
 
     when:
@@ -20,11 +22,13 @@ class IastInstrumentationTest extends AgentTestRunner {
     applicable == expected
 
     where:
-    enabledSystems                                                                 | expected
-    []                                                                             | false
-    [InstrumenterModule.TargetSystem.APPSEC]                                       | false
-    [InstrumenterModule.TargetSystem.IAST]                                         | true
-    [InstrumenterModule.TargetSystem.IAST, InstrumenterModule.TargetSystem.APPSEC] | true
+    enabledSystems                                                                 | rasp  | expected
+    []                                                                             | false | false
+    [InstrumenterModule.TargetSystem.APPSEC]                                       | false | false
+    [InstrumenterModule.TargetSystem.IAST]                                         | false | true
+    [InstrumenterModule.TargetSystem.APPSEC]                                       | true  | true
+    [InstrumenterModule.TargetSystem.IAST, InstrumenterModule.TargetSystem.APPSEC] | false | true
+    [InstrumenterModule.TargetSystem.IAST, InstrumenterModule.TargetSystem.APPSEC] | true  | true
   }
 
   void 'test Iast Instrumentation type matching'() {