DataDog · robertomonteromiguel · Nov 7, 2025 · Nov 7, 2025 · Nov 10, 2025 · Nov 10, 2025
@@ -46,6 +46,7 @@ public static void main(String[] args) throws Exception {
     webAppContext.addServlet(new ServletHolder(new CrashServlet()), "/fork_and_crash");
     webAppContext.addServlet(new ServletHolder(new CrashServlet()), "/child_pids");
     webAppContext.addServlet(new ServletHolder(new CrashServlet()), "/zombies");
+    webAppContext.addServlet(new ServletHolder(new MyServlet()), "/myservlet");
 
     // Start the server!
     server.start();

@@ -0,0 +1,81 @@
+import java.io.IOException;
+import java.io.PrintWriter;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.ServletException;
+
+public class MyServlet extends HttpServlet {
+    @Override
+    protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+            throws ServletException, IOException {
+
+        resp.setContentType("text/html");
+        resp.setCharacterEncoding("UTF-8");
+        resp.setStatus(HttpServletResponse.SC_OK);
+
+        PrintWriter out = resp.getWriter();
+
+        out.println("<!DOCTYPE html>");
+        out.println("<html lang=\"en\">");
+        out.println("<head>");
+        out.println("    <meta charset=\"UTF-8\">");
+        out.println("    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">");
+        out.println("    <title>My Servlet</title>");
+        out.println("    <style>");
+        out.println("        * { margin: 0; padding: 0; box-sizing: border-box; }");
+        out.println("        body {");
+        out.println("            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;");
+        out.println("            background: linear-gradient(135deg, #1a1a2e 0%, #16213e 50%, #0f3460 100%);");
+        out.println("            min-height: 100vh;");
+        out.println("            display: flex;");
+        out.println("            justify-content: center;");
+        out.println("            align-items: center;");
+        out.println("            color: #e4e4e7;");
+        out.println("        }");
+        out.println("        .container {");
+        out.println("            background: rgba(255, 255, 255, 0.05);");
+        out.println("            backdrop-filter: blur(10px);");
+        out.println("            border-radius: 20px;");
+        out.println("            padding: 3rem;");
+        out.println("            border: 1px solid rgba(255, 255, 255, 0.1);");
+        out.println("            box-shadow: 0 25px 45px rgba(0, 0, 0, 0.3);");
+        out.println("            text-align: center;");
+        out.println("            max-width: 500px;");
+        out.println("        }");
+        out.println("        h1 {");
+        out.println("            font-size: 2.5rem;");
+        out.println("            background: linear-gradient(90deg, #00d4ff, #7c3aed);");
+        out.println("            -webkit-background-clip: text;");
+        out.println("            -webkit-text-fill-color: transparent;");
+        out.println("            background-clip: text;");
+        out.println("            margin-bottom: 1rem;");
+        out.println("        }");
+        out.println("        p {");
+        out.println("            font-size: 1.1rem;");
+        out.println("            line-height: 1.8;");
+        out.println("            color: #a1a1aa;");
+        out.println("        }");
+        out.println("        .badge {");
+        out.println("            display: inline-block;");
+        out.println("            margin-top: 1.5rem;");
+        out.println("            padding: 0.5rem 1.5rem;");
+        out.println("            background: linear-gradient(90deg, #7c3aed, #2563eb);");
+        out.println("            border-radius: 50px;");
+        out.println("            font-weight: 600;");
+        out.println("            font-size: 0.9rem;");
+        out.println("            letter-spacing: 0.5px;");
+        out.println("        }");
+        out.println("    </style>");
+        out.println("</head>");
+        out.println("<body>");
+        out.println("    <div class=\"container\">");
+        out.println("        <h1>Welcome to MyServlet!</h1>");
+        out.println("        <p>This is a simple HTML view served by a Jetty servlet. The server is running and ready to handle your requests.</p>");
+        out.println("        <span class=\"badge\">Jetty Server</span>");
+        out.println("    </div>");
+        out.println("</body>");
+        out.println("</html>");
+    }
+}
+
@@ -13,5 +13,5 @@ class TestURI(BaseSourceTest):
     endpoint = "/iast/source/uri/test"
     requests_kwargs = [{"method": "GET"}]
     source_type = "http.request.uri"
-    source_value = "http://localhost:7777/iast/source/uri/test"
+    source_value = "http://weblog:7777/iast/source/uri/test"
     source_names = None
@@ -18,6 +18,7 @@
 @scenarios.external_processing
 @scenarios.stream_processing_offload
 @scenarios.default
+@scenarios.default_antithesis
 @scenarios.appsec_lambda_default
 class Test_RetainTraces:
     """Retain trace (manual keep & appsec.event = true)"""
@@ -64,6 +65,8 @@ def validate_appsec_event_span_tags(span: dict):
 @scenarios.external_processing
 @scenarios.stream_processing_offload
 @scenarios.default
+@scenarios.default_antithesis
+@scenarios.default_antithesis_debug
 @scenarios.appsec_lambda_default
 class Test_AppSecEventSpanTags:
     """AppSec correctly fill span tags."""
@@ -152,6 +155,7 @@ def test_root_span_coherence(self):
 @scenarios.external_processing
 @scenarios.stream_processing_offload
 @scenarios.default
+@scenarios.default_antithesis
 @scenarios.appsec_lambda_default
 class Test_AppSecObfuscator:
     """AppSec obfuscates sensitive data."""
@@ -308,6 +312,7 @@ def validate_appsec_span_tags(span: dict, appsec_data: dict):  # noqa: ARG001
 @scenarios.external_processing
 @scenarios.stream_processing_offload
 @scenarios.default
+@scenarios.default_antithesis
 @scenarios.appsec_lambda_default
 class Test_CollectRespondHeaders:
     """AppSec should collect some headers for http.response and store them in span tags."""
@@ -340,6 +345,7 @@ def validate_response_headers(span: dict):
 @scenarios.external_processing
 @scenarios.stream_processing_offload
 @scenarios.default
+@scenarios.default_antithesis
 @scenarios.appsec_lambda_default
 class Test_CollectDefaultRequestHeader:
     HEADERS = {
@@ -376,6 +382,7 @@ def test_collect_default_request_headers(self):
 @scenarios.external_processing
 @scenarios.stream_processing_offload
 @scenarios.default
+@scenarios.default_antithesis
 @scenarios.appsec_lambda_default
 class Test_ExternalWafRequestsIdentification:
     def setup_external_wafs_header_collection(self):

@@ -0,0 +1,37 @@
+from urllib.parse import urlparse
+import requests
+import time
+from utils import scenarios, weblog, features
+from utils import logger
+
+
+@features.profiling
+@scenarios.docker_ssi_profiling
+class TestDockerSSIAppsecFeatures:
+    """Test the ssi in a simulated host injection environment (docker container + test agent)
+    We test that the injection is performed and profiling is enabled and telemetry is generated.
+    """
+
+    def setup_profiling(self):
+        parsed_url = urlparse(scenarios.docker_ssi_profiling.weblog_url)
+        self.r = weblog.request("GET", parsed_url.path, domain=parsed_url.hostname, port=parsed_url.port)
+        logger.info(f"Setup Docker SSI profiling installation {self.r}")
+
+    def test_profiling(self):
+        agent_port = scenarios.docker_ssi_profiling.agent_port
+        agent_host = scenarios.docker_ssi_profiling.agent_host
+        profiling_request_found = False
+        timeout = 90
+        mustend = time.time() + timeout
+        while time.time() < mustend:
+            response = requests.get(
+                f"http://{agent_host}:{agent_port}/test/session/requests",
+                timeout=60,
+            )
+            logger.info(f"Profiling request response: {response.json()}")
+            for request in response.json():
+                logger.info(f"Profiling request: {request}")
+                if request["url"].endswith("/profiling/v1/input"):
+                    profiling_request_found = True
+            time.sleep(1)
+        assert profiling_request_found, "No profiling request found"
@@ -39,6 +39,7 @@ def test_tracer_release():
         scenarios.docker_ssi_appsec,
         scenarios.docker_ssi_crashtracking,
         scenarios.docker_ssi_servicenaming,
+        scenarios.docker_ssi_profiling,
         scenarios.external_processing_blocking,  # need to declare a white list of library in get-workflow-parameters
         scenarios.external_processing,  # need to declare a white list of library in get-workflow-parameters
         scenarios.stream_processing_offload_blocking,  # need to declare a white list of library in get-workflow-parameters
@@ -67,6 +68,7 @@ def test_tracer_release():
         scenarios.multi_installer_auto_injection,
         scenarios.demo_aws,
         scenarios.otel_collector_e2e,
+        scenarios.default_antithesis,
     ]
 
     for scenario in get_all_scenarios():

@@ -7,6 +7,7 @@
 from .aws_lambda import LambdaScenario
 from .core import Scenario, scenario_groups
 from .default import DefaultScenario
+from .default_antithesis import DefaultAntithesisScenario
 from .endtoend import DockerScenario, EndToEndScenario
 from .integrations import CrossedTracingLibraryScenario, IntegrationsScenario, AWSIntegrationsScenario
 from .open_telemetry import OpenTelemetryScenario
@@ -37,6 +38,8 @@ class _Scenarios:
     mock_the_test_2 = TestTheTestScenario("MOCK_THE_TEST_2", doc="Mock scenario that check system-tests internals")
 
     default = DefaultScenario("DEFAULT")
+    default_antithesis = DefaultAntithesisScenario("DEFAULT_ANTITHESIS")
+    default_antithesis_debug = DefaultScenario("DEFAULT_ANTITHESIS_DEBUG")
 
     # performance scenario just spawn an agent and a weblog, and spies the CPU and mem usage
     performances = PerformanceScenario(
@@ -999,6 +1002,17 @@ class _Scenarios:
         appsec_enabled="true",
         scenario_groups=[scenario_groups.all, scenario_groups.docker_ssi],
     )
+    docker_ssi_profiling = DockerSSIScenario(
+        "DOCKER_SSI_PROFILING",
+        doc="Validates the crashtracking for ssi on a docker environment",
+        extra_env_vars={
+            "DD_PROFILING_UPLOAD_PERIOD": "2",
+            "DD_INTERNAL_PROFILING_LONG_LIVED_THRESHOLD": "1000",
+            "DD_PROFILING_START_FORCE_FIRST": "true",
+        },
+        profiling_enabled="auto",
+        scenario_groups=[scenario_groups.all, scenario_groups.docker_ssi],
+    )
     docker_ssi_crashtracking = DockerSSIScenario(
         "DOCKER_SSI_CRASHTRACKING",
         doc="Validates the crashtracking for ssi on a docker environment",

@@ -62,6 +62,7 @@ class _ScenarioGroups:
     parametric = ScenarioGroup()
     appsec_low_waf_timeout = ScenarioGroup()
     default = ScenarioGroup()
+    default_antithesis = ScenarioGroup()
     feature_flag_exposure = ScenarioGroup()
 
     def __getitem__(self, key: str) -> ScenarioGroup: