Fix password leak from JDBC URL by ValentinZakharov · Pull Request #11568 · DataDog/dd-trace-java

ValentinZakharov · 2026-06-04T17:35:08Z

What Does This Do

Strips the password from JDBC URL credentials before storing the username in the db.user span tag.

jdbc:postgresql://myuser:secret123@pg.host/mydb

Before:
db.user = "myuser:secret123" ← password leaks into the tag

After:
db.user = "myuser"

Motivation

JDBC URLs can embed credentials directly in the URL (user:password@host). Java's URI.getUserInfo() returns the full string including the password.
Without sanitization, this password ends up in the db.user span tag sent to Datadog.

Additional Notes

Only affects the GENERIC_URL_LIKE parser (PostgreSQL, SAP, Redshift, Snowflake, IRIS, Sybase TDS)
Other parsers (Oracle, DB2, MSSQL) use different URL formats and were already correct

Contributor Checklist

Format the title according to the contribution guidelines
Assign the type: and (comp: or inst:) labels in addition to any other useful labels
Avoid using close, fix, or any linking keywords when referencing an issue
Use solves instead, and assign the PR milestone to the issue
Update the CODEOWNERS file on source file addition, migration, or deletion
Update public documentation with any new configuration flags or behaviors
Add your completed PR to the merge queue by commenting /merge. You can also:
- Customize the commit message associated with the merge with /merge --commit-message "..."
- Remove your PR from the merge queue with /merge -c
- Skip all merge queue checks with /merge -f --reason "reason"; please use this judiciously, as some checks do not run at the PR-level (note: the PR still needs to be mergeable, this will only skip the pre-merge build)
- Get more information in this doc

Jira ticket: [PROJ-IDENT]

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5be0f0b137

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-06-04T17:36:39Z

+          final int colonLoc = userInfo.indexOf(':');
+          builder.user(colonLoc >= 0 ? userInfo.substring(0, colonLoc) : userInfo);


Preserve escaped colons in JDBC usernames

When the JDBC URL contains an escaped colon in the username (for example jdbc:postgresql://tenant%3Aalice@pg.host/db with no password), URI.getUserInfo() has already decoded %3A to :, so this split stores only tenant in db.user instead of the actual username tenant:alice. That is a regression from the previous behavior for valid URL-encoded userinfo; use the raw userinfo to detect only an unescaped password separator, then decode the retained username.

Useful? React with 👍 / 👎.

dougqh

Review from Claude (via claude.ai/code)

The fix itself is correct and security-sound — indexOf(':') on URI.getUserInfo() is the right approach since the spec guarantees userinfo is user:password and getUserInfo() already percent-decodes the string, so URL-encoded colons in passwords won't slip through. A few issues are worth addressing before merge (see inline comments).

dougqh · 2026-06-04T17:42:28Z

+    "scenario                             | url                                             | type       | host    | user  ",
+    "PostgreSQL userinfo with password    | jdbc:postgresql://myuser:secret123@pg.host/mydb | postgresql | pg.host | myuser",
+    "PostgreSQL userinfo without password | jdbc:postgresql://myuser@pg.host/mydb           | postgresql | pg.host | myuser"
+  })


Claude: The scenario column appears in the table header but has no matching method parameter. Depending on how @TableTest maps columns to parameters this will either fail at runtime or silently drop the column. Either add String scenario as the first parameter (many table-test frameworks use it as the display label), or drop the scenario column from the header.

The Scenario special column is used to display label, so it doesn't map to method param

dougqh · 2026-06-04T17:42:28Z

+import static datadog.trace.bootstrap.instrumentation.jdbc.JDBCConnectionUrlParser.extractDBInfo;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+import org.tabletest.junit.TableTest;


Claude: Project conventions say no multi-line comment blocks (one short line max). This 8-line class Javadoc can be removed entirely — the test name and table rows are already self-documenting.

Fixed thanks

dougqh · 2026-06-04T17:42:28Z

+    assertEquals(host, info.getHost());
+    assertEquals(user, info.getUser());
+  }
+}


Claude: The comprehensive parser tests live in dd-java-agent/instrumentation/jdbc/src/test/groovy/JDBCConnectionUrlParserTest.groovy and cover dozens of URL variants across every GENERIC_URL_LIKE scheme. These two new rows fit better there (after migrating that file from Groovy to Java per project conventions) rather than in a standalone class. Additionally, only PostgreSQL is tested here — GENERIC_URL_LIKE also handles SAP, Snowflake, Redshift, IRIS, and Sybase TDS, so at least one non-PostgreSQL user:password@host case (e.g. jdbc:sap://myuser:secret@sap.host:88/sapdb) would confirm the fix covers those schemes too.

Added SAP test-case, thanks

dougqh · 2026-06-04T17:42:29Z

-          builder.user(user);
+        final String userInfo = uri.getUserInfo();
+        if (userInfo != null) {
+          // getUserInfo() returns "user:password" — strip the password


Claude: The comment is justified (non-obvious platform behaviour worth explaining), but it could be shorter per project conventions — e.g. // userInfo is "user:password"; keep only the username.

dougqh

Looks good to me.
Claude had some feedback based on conventions - that I had it add.

dd-octo-sts · 2026-06-04T17:44:19Z

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.98 s	13.91 s	[-0.2%; +1.2%] (no difference)
startup:insecure-bank:tracing:Agent	12.91 s	13.01 s	[-1.8%; +0.2%] (no difference)
startup:petclinic:appsec:Agent	16.45 s	15.35 s	[-1.5%; +15.9%] (unstable)
startup:petclinic:iast:Agent	16.43 s	16.62 s	[-2.4%; +0.2%] (no difference)
startup:petclinic:profiling:Agent	16.38 s	16.45 s	[-1.7%; +0.8%] (no difference)
startup:petclinic:tracing:Agent	15.59 s	15.95 s	[-3.3%; -1.2%] (significantly better)

Commit: 00fda7ba · CI Pipeline · Benchmarking Platform UI

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

…sername

…avadoc

dd-octo-sts · 2026-06-04T21:09:19Z

/merge

gh-worker-devflow-routing-ef8351 · 2026-06-04T21:09:22Z

View all feedbacks in Devflow UI.

2026-06-04 21:09:22 UTC ℹ️ Start processing command /merge
Use /merge -c to cancel this operation!

2026-06-04 21:09:26 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

Use /merge -c to cancel this operation!

⏳ Processing

Fix password leak from JDBC URL userinfo into db.user span tag

5be0f0b

ValentinZakharov self-assigned this Jun 4, 2026

ValentinZakharov requested a review from a team as a code owner June 4, 2026 17:35

ValentinZakharov added type: bug Bug report and fix inst: jdbc JDBC instrumentation labels Jun 4, 2026

ValentinZakharov requested a review from dougqh June 4, 2026 17:35

ValentinZakharov added the tag: security Security related changes label Jun 4, 2026

chatgpt-codex-connector Bot reviewed Jun 4, 2026

View reviewed changes

dougqh reviewed Jun 4, 2026

View reviewed changes

dougqh approved these changes Jun 4, 2026

View reviewed changes

Use getRawUserInfo() to avoid splitting on percent-encoded colon in u…

13f882e

…sername

This comment has been minimized.

Sign in to view

Address review comments: shorten comment, add SAP test case, remove J…

00fda7b

…avadoc

ValentinZakharov added this pull request to the merge queue Jun 4, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Jun 4, 2026

		final int colonLoc = userInfo.indexOf(':');
		builder.user(colonLoc >= 0 ? userInfo.substring(0, colonLoc) : userInfo);

Conversation

ValentinZakharov commented Jun 4, 2026

What Does This Do

Motivation

Additional Notes

Contributor Checklist

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jun 4, 2026

Choose a reason for hiding this comment

Uh oh!

dougqh left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dougqh left a comment

Choose a reason for hiding this comment

Uh oh!

dd-octo-sts Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🟢 Java Benchmark SLOs — All performance SLOs passed

Uh oh!

This comment has been minimized.

dd-octo-sts Bot commented Jun 4, 2026

Uh oh!

gh-worker-devflow-routing-ef8351 Bot commented Jun 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dd-octo-sts Bot commented Jun 4, 2026 •

edited

Loading

gh-worker-devflow-routing-ef8351 Bot commented Jun 4, 2026 •

edited

Loading