Implement normalised http routes by estringana · Pull Request #4101 · DataDog/dd-trace-php

estringana · 2026-08-10T15:15:19Z

Description

Add _dd.appsec.normalized_route tag to HTTP framework integrations (Laravel, Slim, Symfony, Laminas, CakePHP, Yii, CodeIgniter, WordPress) per RFC-1103. The tag exposes a normalized form of the matched route, stripping concrete parameter values and framework-specific syntax (regexconstraints, optional markers) into a canonical {param} notation suitable for security analysis.

Reviewer checklist

Test coverage seems ok.
Appropriate labels assigned.

github-actions · 2026-08-10T15:16:18Z

Snapshots difference summary

The following differences have been observed in committed snapshots. It is meant to help the reviewer.
The diff is simplistic, so please check some files anyway while we improve it.

If you need to update snapshots, please refer to CONTRIBUTING.md

datadog-datadog-prod-us1-2 · 2026-08-10T15:18:47Z

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 2 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | ASAN test_c with multiple observers: [8.4] — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-php | publish docker image for system tests

View more details · View in GitLab

❄️ 2 New flaky tests detected

tmp/build_extension/tests/ext/routing_cache/cache_capacity_eviction.phpt (DDTrace\routing_cache evicts the oldest inserted entry when capacity (500) is excee... from PHP.tmp.build_extension.tests.ext.routing_cache
005&#43; ==5978==LeakSanitizer has encountered a fatal error.
006&#43; ==5978==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
007&#43; ==5978==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)
008&#43; Aborted
009&#43; 
010&#43; Termsig=6
tmp/build_extension/tests/ext/routing_cache/cache_capacity_eviction.phpt (DDTrace\routing_cache evicts the oldest inserted entry when capacity (500) is excee... from php.tmp.build_extension.tests.ext.routing_cache
--
     bool(false)
     string(6) &#34;value1&#34;
     string(8) &#34;value500&#34;
005&#43; ==3778==LeakSanitizer has encountered a fatal error.
006&#43; ==3778==HINT: For debugging, try setting environment variable LSAN_OPTIONS=verbosity=1:log_threads=1
007&#43; ==3778==HINT: LeakSanitizer does not work under ptrace (strace, gdb, etc)
008&#43; Aborted
009&#43; 
010&#43; Termsig=6
View in Flaky Test Management

ℹ️ Info

No other issues found (see more)

🧪 All tests passed

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 60.63% (+0.01%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 82db9a3 | Docs | View more details | Give us feedback!}

pr-commenter · 2026-08-14T12:26:32Z

Benchmarks [ tracer ]

Benchmark execution time: 2026-09-02 12:43:28

Comparing candidate commit 82db9a3 in PR branch estringana/normalise-http-route with baseline commit 9c2caf0 in branch master.

Found 5 performance improvements and 43 performance regressions! Performance is the same for 145 metrics, 1 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:ComposerTelemetryBench/benchTelemetryParsing

🟥 mem_peak [+151.904KB; +151.904KB] or [+3.741%; +3.741%]

scenario:ContextPropagationBench/benchExtractHeaders128Bit

🟥 mem_peak [+163.616KB; +163.616KB] or [+4.029%; +4.029%]

scenario:ContextPropagationBench/benchExtractHeaders128Bit-opcache

🟩 execution_time [-910.590ns; -830.743ns] or [-52.696%; -48.075%]

scenario:ContextPropagationBench/benchExtractHeaders64Bit

🟥 mem_peak [+163.616KB; +163.616KB] or [+4.029%; +4.029%]

scenario:ContextPropagationBench/benchExtractTraceContext128Bit

🟥 mem_peak [+163.616KB; +163.616KB] or [+4.029%; +4.029%]

scenario:ContextPropagationBench/benchExtractTraceContext64Bit

🟥 mem_peak [+163.616KB; +163.616KB] or [+4.029%; +4.029%]

scenario:ContextPropagationBench/benchInject128Bit

🟥 mem_peak [+163.624KB; +163.624KB] or [+4.029%; +4.029%]

scenario:ContextPropagationBench/benchInject128Bit-opcache

🟩 execution_time [-855.123ns; -750.877ns] or [-34.109%; -29.951%]

scenario:ContextPropagationBench/benchInject64Bit

🟥 mem_peak [+163.624KB; +163.624KB] or [+4.029%; +4.029%]

scenario:EmptyFileBench/benchEmptyFileBaseline

🟥 mem_peak [+171.232KB; +171.232KB] or [+3.262%; +3.262%]

scenario:EmptyFileBench/benchEmptyFileDdprof

🟥 mem_peak [+170.589KB; +172.531KB] or [+3.245%; +3.282%]

scenario:EmptyFileBench/benchEmptyFileOverhead

🟥 mem_peak [+171.232KB; +171.232KB] or [+3.262%; +3.262%]

scenario:HookBench/benchHookOverheadInstallHookOnFunction

🟥 mem_peak [+163.488KB; +163.488KB] or [+4.026%; +4.026%]

scenario:HookBench/benchHookOverheadInstallHookOnMethod

🟥 mem_peak [+163.488KB; +163.488KB] or [+4.026%; +4.026%]

scenario:HookBench/benchHookOverheadTraceFunction

🟥 mem_peak [+172.240KB; +172.240KB] or [+3.821%; +3.821%]

scenario:HookBench/benchHookOverheadTraceMethod

🟥 mem_peak [+172.239KB; +172.242KB] or [+3.768%; +3.768%]

scenario:HookBench/benchHookOverheadTraceMethod-opcache

🟩 execution_time [-17.533µs; -9.506µs] or [-9.657%; -5.236%]

scenario:HookBench/benchWithoutHook

🟥 mem_peak [+163.504KB; +163.504KB] or [+4.027%; +4.027%]

scenario:LaravelBench/benchLaravelBaseline

🟥 mem_peak [+171.264KB; +171.264KB] or [+3.262%; +3.262%]

scenario:LaravelBench/benchLaravelDdprof

🟥 mem_peak [+171.389KB; +173.105KB] or [+3.259%; +3.292%]

scenario:LaravelBench/benchLaravelOverhead

🟥 mem_peak [+171.264KB; +171.264KB] or [+3.262%; +3.262%]

scenario:LogsInjectionBench/benchLogsInfoBaseline

🟥 mem_peak [+90.320KB; +90.320KB] or [+2.120%; +2.120%]

scenario:LogsInjectionBench/benchLogsInfoBaseline-opcache

🟥 execution_time [+139.269ns; +194.931ns] or [+8.835%; +12.366%]

scenario:LogsInjectionBench/benchLogsInfoInjection

🟥 mem_peak [+90.336KB; +90.336KB] or [+2.115%; +2.115%]

scenario:LogsInjectionBench/benchLogsNullBaseline

🟥 mem_peak [+90.320KB; +90.320KB] or [+2.120%; +2.120%]

scenario:LogsInjectionBench/benchLogsNullInjection

🟥 mem_peak [+90.336KB; +90.336KB] or [+2.110%; +2.110%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization

🟥 mem_peak [+172.240KB; +172.240KB] or [+3.989%; +3.989%]
🟩 execution_time [-4.791µs; -2.949µs] or [-4.149%; -2.553%]

scenario:PDOBench/benchPDOBaseline

🟥 mem_peak [+172.240KB; +172.240KB] or [+4.204%; +4.204%]

scenario:PDOBench/benchPDOOverhead

🟥 mem_peak [+90.320KB; +90.320KB] or [+2.105%; +2.105%]

scenario:PDOBench/benchPDOOverheadWithDBM

🟥 mem_peak [+90.320KB; +90.320KB] or [+2.105%; +2.105%]

scenario:PHPRedisBench/benchRedisBaseline

🟥 mem_peak [+162.744KB; +162.744KB] or [+4.007%; +4.007%]

scenario:SamplingRuleMatchingBench/benchGlobMatching1

🟥 mem_peak [+166.744KB; +166.744KB] or [+4.107%; +4.107%]

scenario:SamplingRuleMatchingBench/benchGlobMatching2

🟥 mem_peak [+166.744KB; +166.744KB] or [+4.107%; +4.107%]

scenario:SamplingRuleMatchingBench/benchGlobMatching3

🟥 mem_peak [+166.744KB; +166.744KB] or [+4.107%; +4.107%]

scenario:SamplingRuleMatchingBench/benchGlobMatching4

🟥 mem_peak [+166.744KB; +166.744KB] or [+4.107%; +4.107%]

scenario:SamplingRuleMatchingBench/benchRegexMatching1

🟥 mem_peak [+166.744KB; +166.744KB] or [+4.106%; +4.106%]

scenario:SamplingRuleMatchingBench/benchRegexMatching2

🟥 mem_peak [+166.744KB; +166.744KB] or [+4.106%; +4.106%]

scenario:SamplingRuleMatchingBench/benchRegexMatching3

🟥 mem_peak [+166.744KB; +166.744KB] or [+4.106%; +4.106%]

scenario:SamplingRuleMatchingBench/benchRegexMatching4

🟥 mem_peak [+166.744KB; +166.744KB] or [+4.106%; +4.106%]

scenario:SpanBench/benchDatadogAPI

🟥 mem_peak [+164.976KB; +164.976KB] or [+4.063%; +4.063%]

scenario:SymfonyBench/benchSymfonyBaseline

🟥 mem_peak [+171.264KB; +171.264KB] or [+3.262%; +3.262%]

scenario:SymfonyBench/benchSymfonyDdprof

🟥 mem_peak [+167.924KB; +175.915KB] or [+3.192%; +3.344%]

scenario:SymfonyBench/benchSymfonyOverhead

🟥 mem_peak [+171.264KB; +171.264KB] or [+3.262%; +3.262%]

scenario:TraceAnnotationsBench/benchTraceAnnotationOverhead

🟥 mem_peak [+172.240KB; +172.240KB] or [+3.762%; +3.762%]

scenario:TraceAnnotationsBench/benchTraceAnnotationOverhead-opcache

🟩 execution_time [-9.082µs; -3.644µs] or [-5.017%; -2.013%]

scenario:TraceFlushBench/benchFlushTrace

🟥 mem_peak [+172.239KB; +172.240KB] or [+4.158%; +4.158%]

scenario:TraceSerializationBench/benchSerializeTrace

🟥 mem_peak [+172.240KB; +172.240KB] or [+4.064%; +4.064%]

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b7f9710a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

bwoebi · 2026-08-14T18:26:59Z

Do you have a rough estimate on the overhead of the route normalization? It seems expensive.

Laminas is obviously just slow because it does runtime route matching, but other stacks like Slim or Symfony rely on precompiled routes.
E.g. for Symfony we could make it part of the logic used in #3676. Please check if other frameworks have similar, acceptable solutions. Or consider some caching in the C code. (a LRU cache of route to normalized route with e.g. 500 routes max)

tabgok · 2026-08-18T11:03:46Z

Approving from the stance of IDM, due to the new field being introduced

cataphract

It seems there are many gaps in framework support. I asked AI for failing counterexamples against the spec and got many:

https://github.com/DataDog/dd-trace-php/compare/estringana/normalise-http-route...glopes/normalise-http-route-failing?expand=1

I already removed a few that were obviously invalid (like, changing the routing type at runtime and complained about cache staleness), but the rest seem mostly valid

estringana · 2026-08-28T10:01:19Z

@cataphract pr is ready back to you with all your comments addressed

Add missing Tag::APPSEC_NORMALIZED_ROUTE assertions to: - Symfony TraceSearchConfigTest (V4_4, V5_0, V5_1, V5_2, V6_2) - Laravel TraceSearchConfigTest (V4, V5_7, V5_8, V8_x) - Laravel V8_x RouteCachingTest and InternalExceptionsTest - Laravel Octane CommonScenariosTest - Yii ParameterizedRouteTest, ModuleTest, LazyLoadingIntegrationsFromYiiTest - CodeIgniter ExitTest and NoCI_ControllertTest - Fix UserAvailableConstantsTest tag ordering (APPSEC_NORMALIZED_ROUTE must appear after HTTP_ROUTE to match Tag.php declaration order) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…coding, regex constraints - expandBracketOptionals: use strpos > 0 (not != false) so optional sections whose text coincidentally appears in the mandatory route prefix are not falsely detected as present; add case-insensitive fallback for percent-encoded param values so %c3%a9 (lowercase hex from browsers) matches %C3%A9 (rawurlencode output) - normalizeFromLaminas: accept pre-computed $urlMatchedParams to skip inferSymfonyRouteParams when the caller has better information - LaminasIntegration cache key: use '/'+value prefix check at position > 0 so params whose default value equals the mandatory route text are not treated as present; include static-only optional sections ([/draft]) in the key so absent and present shapes get distinct entries; for Regex routes, extract the actual route regex via reflection and run it against the URL to get accurate named captures, avoiding inferSymfonyRouteParams which ignores Laminas constraints - SymfonyIntegration: use $route->compile()->getRegex() when available to determine URL-matched params instead of generic URL inference, so routes with requirements (e.g. format=html|json with a default) correctly exclude defaulted params from the normalized route Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

estringana force-pushed the estringana/normalise-http-route branch 3 times, most recently from 0cc69dd to 1fa5485 Compare August 14, 2026 10:19

estringana force-pushed the estringana/normalise-http-route branch from a2be41b to 7b7f971 Compare August 14, 2026 12:53

estringana marked this pull request as ready for review August 14, 2026 14:55

estringana requested review from a team as code owners August 14, 2026 14:55

estringana requested review from tabgok and removed request for a team August 14, 2026 14:55

chatgpt-codex-connector Bot reviewed Aug 14, 2026

View reviewed changes

bwoebi reviewed Aug 14, 2026

View reviewed changes

Comment thread src/DDTrace/Util/RouteNormalizer.php

estringana force-pushed the estringana/normalise-http-route branch from ff7f8fe to 8632abe Compare August 18, 2026 10:21

tabgok approved these changes Aug 18, 2026

View reviewed changes

estringana force-pushed the estringana/normalise-http-route branch from b57a9e9 to 2ab71bd Compare August 18, 2026 15:55

bwoebi reviewed Aug 18, 2026

View reviewed changes

Comment thread tracer/routing_cache.c Outdated

estringana force-pushed the estringana/normalise-http-route branch from 34e4e8b to f42c408 Compare August 26, 2026 10:13

estringana requested review from a team as code owners August 26, 2026 10:13

cataphract requested changes Aug 26, 2026

View reviewed changes

Comment thread tests/ext/routing_cache/cache_capacity_eviction.phpt

Comment thread src/DDTrace/Integrations/CakePHP/CakePHPIntegration.php Outdated

Comment thread src/DDTrace/Integrations/Symfony/SymfonyIntegration.php Outdated

estringana force-pushed the estringana/normalise-http-route branch from 5d1199f to d5e909b Compare August 27, 2026 16:12

estringana force-pushed the estringana/normalise-http-route branch from bdadbff to eddfd4f Compare September 1, 2026 16:12

estringana and others added 3 commits September 2, 2026 13:19

Implement normalised http routes

a181c3a

Fix pipeline errors

4c73d49

estringana and others added 29 commits September 2, 2026 13:19

Implement a route caching system

778b876

Fix pipeline

b52bb00

Fix pipeline

a3b0e59

Fix pipeline

7ce230c

Add cache to wordpress and Slim

0d3dc46

Make hashtable thread safety

dec4346

Fix pipeline

793b0c0

Fix pipeline

00db486

Fix pipeline

39e0cc1

Fix codeigniter

923587b

Add appsec integration tests

d049db3

Fix integration tests

6035819

Amend test file name

fdb455d

Generate normalise routes only when appsec is enabled

ecc336e

Improve route generation

b02a141

Improve laminas integration

6275ac8

Improve Symfony

3f95e7b

Fix pipeline

c0818ec

Add more tests

e0107a0

Add more tests

cc539d3

Fix pipeline

3d00863

Fix pipeline

30f8ef4

Address report comments

cd9d6c4

Add new tests

066da29

Fix tests

761fec3

Fix tests

182a201

Fix laminas

2aa0cbf

Amend Wordpress

82db9a3

estringana force-pushed the estringana/normalise-http-route branch from 4cbeed5 to 82db9a3 Compare September 2, 2026 11:26

Uh oh!

Conversation

estringana commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Reviewer checklist

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Snapshots difference summary

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

pr-commenter Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks [ tracer ]

Explanation

More details about the CI and significant changes

scenario:ComposerTelemetryBench/benchTelemetryParsing

scenario:ContextPropagationBench/benchExtractHeaders128Bit

scenario:ContextPropagationBench/benchExtractHeaders128Bit-opcache

scenario:ContextPropagationBench/benchExtractHeaders64Bit

scenario:ContextPropagationBench/benchExtractTraceContext128Bit

scenario:ContextPropagationBench/benchExtractTraceContext64Bit

scenario:ContextPropagationBench/benchInject128Bit

scenario:ContextPropagationBench/benchInject128Bit-opcache

scenario:ContextPropagationBench/benchInject64Bit

scenario:EmptyFileBench/benchEmptyFileBaseline

scenario:EmptyFileBench/benchEmptyFileDdprof

scenario:EmptyFileBench/benchEmptyFileOverhead

scenario:HookBench/benchHookOverheadInstallHookOnFunction

scenario:HookBench/benchHookOverheadInstallHookOnMethod

scenario:HookBench/benchHookOverheadTraceFunction

scenario:HookBench/benchHookOverheadTraceMethod

scenario:HookBench/benchHookOverheadTraceMethod-opcache

scenario:HookBench/benchWithoutHook

scenario:LaravelBench/benchLaravelBaseline

scenario:LaravelBench/benchLaravelDdprof

scenario:LaravelBench/benchLaravelOverhead

scenario:LogsInjectionBench/benchLogsInfoBaseline

scenario:LogsInjectionBench/benchLogsInfoBaseline-opcache

scenario:LogsInjectionBench/benchLogsInfoInjection

scenario:LogsInjectionBench/benchLogsNullBaseline

scenario:LogsInjectionBench/benchLogsNullInjection

scenario:MessagePackSerializationBench/benchMessagePackSerialization

scenario:PDOBench/benchPDOBaseline

scenario:PDOBench/benchPDOOverhead

scenario:PDOBench/benchPDOOverheadWithDBM

scenario:PHPRedisBench/benchRedisBaseline

scenario:SamplingRuleMatchingBench/benchGlobMatching1

scenario:SamplingRuleMatchingBench/benchGlobMatching2

scenario:SamplingRuleMatchingBench/benchGlobMatching3

scenario:SamplingRuleMatchingBench/benchGlobMatching4

scenario:SamplingRuleMatchingBench/benchRegexMatching1

scenario:SamplingRuleMatchingBench/benchRegexMatching2

scenario:SamplingRuleMatchingBench/benchRegexMatching3

scenario:SamplingRuleMatchingBench/benchRegexMatching4

scenario:SpanBench/benchDatadogAPI

scenario:SymfonyBench/benchSymfonyBaseline

scenario:SymfonyBench/benchSymfonyDdprof

scenario:SymfonyBench/benchSymfonyOverhead

scenario:TraceAnnotationsBench/benchTraceAnnotationOverhead

scenario:TraceAnnotationsBench/benchTraceAnnotationOverhead-opcache

scenario:TraceFlushBench/benchFlushTrace

scenario:TraceSerializationBench/benchSerializeTrace

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

estringana commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented Aug 10, 2026 •

edited

Loading

pr-commenter Bot commented Aug 14, 2026 •

edited

Loading