Test IastOverheadControlSpringBootSmokeTest.'Test that all the vulnerabilities are detected' is flaky

Open

#9,417 opened on Aug 25, 2025 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: java
Domain: security, testing

Research direction

Locate IastOverheadControlSpringBootSmokeTest and the test named "Test that all the vulnerabilities are detected"; start by examining its vulnerability matching and the reported multipleVulns and multipleVulns2 methods. The test is done when it passes consistently and detects the WEAK_HASH vulnerability with evidence SHA1 at the expected method.

Written by the indexing model from the issue text.

Description

type: bug report

Tracer Version(s)

1.52.1

Java Version(s)

JVM Vendor

Oracle JDK

Bug Report

Condition failed with Exception:

hasVulnerability { vul -> vul.type == 'WEAK_HASH' && vul.location.method == 'multipleVulns' && vul.evidence.value == 'SHA1' }
|
java.lang.AssertionError: No matching vulnerability found. Vulnerabilities found: [
    {
        "evidence": {
            "value": "SHA1"
        },
        "hash": 1972954159,
        "location": {
            "line": 54,
            "method": "multipleVulns2",
            "path": "datadog.smoketest.springboot.controller.IastSamplingController",
            "spanId": 4999927944762673122,
            "stackId": "1"
        },
        "type": "WEAK_HASH"
    },

Expected Behavior

Test should pass always

Reproduction Code

No response

Dominant language: Java
Stars: 737
Forks: 361
Avg merge: 3d 20h
Merged PRs (30d): 173

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Compatibility certification request for FJ-EAP 2.1.0 for Jakarta EE Platform 11 Open

certification

Difficulty 1/5 Under an hour Newbie friendliness 80/100

jakartaee/platform#1359 · Opened Sep 24, 2026
Python guide test runner copies stale Micronaut Test Resources state Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

micronaut-projects/micronaut-guides#1856 · Opened Sep 23, 2026
[BUG] ECR GetAuthorizationToken returns a proxyEndpoint for the default region, not the request's Open

bug ecr

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

floci-io/floci#4264 · Opened Sep 23, 2026
Drop point numbers from GitHub milestones Open

Needs: Triage Type: Feature request

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

AntennaPod/AntennaPod#8794 · Opened Sep 23, 2026
[aw] Issue Classification Agent timed out Open

agentic-workflows

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

github/copilot-sdk#2760 · Opened Sep 23, 2026

More Java issues