Fix GatewayBridge to re-register additional IG callbacks on Remote Config reload

[jandro996]

What Does This Do

• Extracts the conditional registration of the four additional instrumentation gateway (IG) callbacks (requestPathParams, requestBodyProcessed, requestFilesFilenames, requestFilesContent) from GatewayBridge.init() into a new method, registerAdditionalIGCallbacksIfNeeded(Collection<EventType<?>>).
• Adds four volatile Subscription fields to GatewayBridge that mark each callback as already registered, making the new method idempotent across repeated calls.
• Calls registerAdditionalIGCallbacksIfNeeded from AppSecSystem.reloadSubscriptions() on every Remote Config reload, in addition to GatewayBridge.init() at startup, recomputing the required event types from the current subscribed data addresses.
• Wraps the new reload-time registration in its own try/catch (RuntimeException), separate from the existing cache-clearing logic in reset(), so a failure there cannot prevent the rest of the reload from completing.
• Clears the four new Subscription fields in GatewayBridge.stop().

Motivation

GatewayBridge.init() computed the set of additional IG event types required by the initially subscribed WAF addresses once, at agent startup, and registered the matching callbacks. This computation was never repeated. If a ruleset delivered later via Remote Config newly required one of those addresses (e.g. server.request.path_params), the corresponding callback was never registered, so the addresses stayed subscribed but with no data ever reaching them.

Additional Notes

• No Subscription.cancel() is called when an address stops being required after a reload — callbacks are only added, never removed. This is a conscious choice to avoid unregister/re-register churn across reloads; the addresses it can affect are: server.request.path_params, server.request.body, server.request.files.filenames and server.request.files.content.
• The idempotency guard relies on SubscriptionService.registerCallback never returning null for an unregistered event and throwing IllegalStateException for an already-registered one, both true in every current implementation (InstrumentationGateway, SubscriptionServiceNoop).

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Jira ticket: APPSEC-69447

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

[jandro996]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 10974a60dd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-prod-us1-6]

🎯 Code Coverage (details)
• Patch Coverage: 91.67%
• Overall Coverage: 57.09% (-1.72%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 067c0a2 | Docs | View more details | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.02 s	13.98 s	[-0.7%; +1.3%] (no difference)
startup:insecure-bank:tracing:Agent	12.90 s	13.04 s	[-1.7%; -0.4%] (maybe better)
startup:petclinic:appsec:Agent	17.39 s	16.57 s	[+0.6%; +9.3%] (maybe worse)
startup:petclinic:iast:Agent	17.23 s	17.50 s	[-2.5%; -0.6%] (maybe better)
startup:petclinic:profiling:Agent	17.21 s	17.27 s	[-1.6%; +0.8%] (no difference)
startup:petclinic:sca:Agent	17.32 s	16.50 s	[+0.7%; +9.3%] (maybe worse)
startup:petclinic:tracing:Agent	16.51 s	16.74 s	[-2.5%; -0.2%] (maybe better)

Commit: 067c0a22 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-prod-us1-6]

More details

The reload path computes the required callback types again and registers each callback only one time. The static review finds no defect.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 10974a6 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}