[mcculls]

What Does This Do

Preserve %26 and %23 in otherwise decoded query strings so encoded value characters retain their parameter and fragment boundaries. Apply this to HTTP client spans and to server spans when http.server.raw.query-string=false and raw queries are available.

Motivation

Decoding token=first%26SECOND_HALF&view=full before redaction turned %26 into a literal &, causing sensitive parameter redaction to stop early and expose SECOND_HALF in http.query and http.url. The query now becomes <redacted>&view=full, while encoded parameter names remain decoded for sensitive-name matching.

Additional Notes

Java has used decoded client queries (URI.getQuery()) since query tagging was introduced in 2019, before query obfuscation was added in 2022. The obfuscator can process raw queries, as other tracers do, but switching to getRawQuery() would change reported tag values and the input seen by custom obfuscation regexes. This fix preserves the existing decoded representation while retaining encoded delimiters, and continues to decode parameter names such as t%6fken for sensitive-name matching. Server spans already support raw queries; this change covers the explicitly decoded mode when raw queries are available.

Formatting checks passed for internal-api, dd-trace-core, and agent-bootstrap. Targeted tests passed:

• URIUtilsTest
• QueryObfuscatorTest
• HttpClientDecoratorTest and HttpServerDecoratorTest
• HttpClientQueryRedactionForkedTest, including assertions on the written span's http.query and http.url

Contributor Checklist

• Use an imperative title and component/type labels.
• Run formatting checks and targeted regression tests.
• Confirm the new test is covered by existing CODEOWNERS rules.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T16:19:36.635285Z	476c2f9	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-prod-us1-2]

🎯 Code Coverage (details)
• Patch Coverage: 91.49%
• Overall Coverage: 59.47% (-0.35%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 627effe | Docs | Give us feedback!}

[mcculls]

@DataDog review

[sarahchen6]

Nice

[mcculls]

@DataDog review

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.05 s	13.99 s	[-0.3%; +1.1%] (no difference)
startup:insecure-bank:tracing:Agent	13.02 s	12.96 s	[-0.4%; +1.2%] (no difference)
startup:petclinic:appsec:Agent	17.08 s	17.00 s	[-0.5%; +1.5%] (no difference)
startup:petclinic:iast:Agent	16.96 s	16.97 s	[-0.9%; +0.7%] (no difference)
startup:petclinic:profiling:Agent	16.56 s	16.82 s	[-2.5%; -0.6%] (maybe better)
startup:petclinic:sca:Agent	17.04 s	16.94 s	[-0.4%; +1.5%] (no difference)
startup:petclinic:tracing:Agent	16.08 s	16.09 s	[-1.0%; +0.9%] (no difference)

Commit: 627effe3 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[datadog-datadog-prod-us1-2]

More details

Focused generated-query checks supported correct delimiter preservation across Java 21 and Java 8 decoder behavior, including bracketed queries. The completed static review returned no actionable findings.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Bits Code Review · Commit 627effe}