[Java} Enable SCA reachability system tests

[jandro996]

Summary

• Add ScaReachability.java controller to the spring-boot weblog exposing /sca/vulnerable-call and /sca/vulnerable-call-alt endpoints that invoke org.yaml.snakeyaml.Yaml.load() (vulnerable via GHSA-mjmj-j48q-9wg2 — snakeyaml <= 1.33; Spring Boot 2.6.0 ships 1.29)
• Add java entry to _LANG_CONFIG in test_sca_reachability.py with expected CVE, dependency name, and callsite class/method
• Enable the five SCA reachability test classes in manifests/java.yml for spring-boot: v1.63.0-SNAPSHOT; all other weblogs marked irrelevant

Companion tracer PR

DataDog/dd-trace-java#11352 — SCA Reachability runtime detection (APPSEC-62260)

Test plan

• Verify CI runs RUNTIME_SCA_REACHABILITY scenario against spring-boot weblog with DD_APPSEC_SCA_ENABLED=true
• Confirm org.yaml:snakeyaml appears in app-dependencies-loaded telemetry with metadata[type=reachability]
• Confirm reached:[] at startup and reached:[{path, symbol, line}] after /sca/vulnerable-call is hit
• Confirm first-hit-wins: /sca/vulnerable-call-alt does not overwrite the first callsite

[github-actions]

CODEOWNERS have been resolved as:

utils/build/docker/java/spring-boot/src/main/java/com/datadoghq/system_tests/springboot/ScaReachability.java  @DataDog/apm-java @DataDog/asm-java @DataDog/system-tests-core
manifests/java.yml                                                      @DataDog/asm-java @DataDog/apm-java
tests/appsec/test_sca_reachability.py                                   @DataDog/asm-libraries @DataDog/system-tests-core

[datadog-prod-us1-5]

✨ Fix all issues with BitsAI or with Cursor

⚠️ Warnings

🧪 6 Tests failed

tests.appsec.test_sca_reachability.Test_SCA_Reachability_CVE_After_Vulnerable_Call.test_cve_metadata_after_vulnerable_call[spring-boot] from system_tests_suite     (Fix with Cursor)

AssertionError: GHSA-mjmj-j48q-9wg2 not found in org.yaml:snakeyaml metadata
assert 0 >= 1
 +  where 0 = len([])

self = <tests.appsec.test_sca_reachability.Test_SCA_Reachability_CVE_After_Vulnerable_Call object at 0x7f9e44602cf0>

    def test_cve_metadata_after_vulnerable_call(self) -> None:
        cve_entries = _get_dependency_cve_metadata(_vulnerable_dep(), _cve_id())
>       assert len(cve_entries) >= 1, f"{_cve_id()} not found in {_vulnerable_dep()} metadata"
E       AssertionError: GHSA-mjmj-j48q-9wg2 not found in org.yaml:snakeyaml metadata
...

tests.appsec.test_sca_reachability.Test_SCA_Reachability_CVE_Registered_At_Load_Time.test_cve_registered_at_load_time[spring-boot] from system_tests_suite     (Fix with Cursor)

AssertionError: GHSA-mjmj-j48q-9wg2 not found in org.yaml:snakeyaml dependency metadata at load time
assert 0 >= 1
 +  where 0 = len([])

self = <tests.appsec.test_sca_reachability.Test_SCA_Reachability_CVE_Registered_At_Load_Time object at 0x7f9e44602f00>

    def test_cve_registered_at_load_time(self) -> None:
        cve_entries = _get_dependency_cve_metadata(_vulnerable_dep(), _cve_id())
>       assert len(cve_entries) >= 1, f"{_cve_id()} not found in {_vulnerable_dep()} dependency metadata at load time"
E       AssertionError: GHSA-mjmj-j48q-9wg2 not found in org.yaml:snakeyaml dependency metadata at load time
...

tests.appsec.test_sca_reachability.Test_SCA_Reachability_Deduplication.test_deduplication_repeated_calls[spring-boot] from system_tests_suite     (Fix with Cursor)

AssertionError: GHSA-mjmj-j48q-9wg2 not found in org.yaml:snakeyaml metadata
assert 0 >= 1
 +  where 0 = len([])

self = <tests.appsec.test_sca_reachability.Test_SCA_Reachability_Deduplication object at 0x7f9e44602b10>

    def test_deduplication_repeated_calls(self) -> None:
        cve_entries = _get_dependency_cve_metadata(_vulnerable_dep(), _cve_id())
>       assert len(cve_entries) >= 1, f"{_cve_id()} not found in {_vulnerable_dep()} metadata"
E       AssertionError: GHSA-mjmj-j48q-9wg2 not found in org.yaml:snakeyaml metadata
...

View all

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ead7339 | Docs | Datadog PR Page | Give us feedback!}