Add request_excluded tag to appsec.waf.requests metric

[jandro996]

What Does This Do

• Adds a new request_excluded tag to the appsec.waf.requests telemetry metric in WafMetricCollector
• Expands WAF_REQUEST_COMBINATIONS from 128 (2^7) to 256 (2^8) to accommodate the new boolean dimension
• Adds requestExcluded as the 8th parameter to wafRequest() and computeWafRequestIndex(), using bit 7 (1 << 7)
• Emits request_excluded:full when a request was excluded, request_excluded:none otherwise (always explicit per team guidance)
• Adds wafRequestExcluded field, setWafRequestExcluded(), and isWafRequestExcluded() to AppSecRequestContext, following the existing wafBlocked / wafTruncated pattern
• Wires ctx.isWafRequestExcluded() as the 8th argument in GatewayBridge when calling wafMetricCollector.wafRequest() at end-of-request
• Updates WafMetricPeriodicActionSpecification to pass the 8th argument and assert request_excluded:none in all expected tag lists

Implementation note

setWafRequestExcluded() is intentionally never called today: libddwaf 1.30.0 does not expose exclusion filter results in its output (ddwaf_result only carries events, actions, duration, timeout, attributes, keep). All requests therefore emit request_excluded:none as a baseline. The RFC itself acknowledges this: "At the time of writing, this information is not available, however the interface of libddwaf will be updated to propagate this information." The setter will be activated once libddwaf exposes that data.

Motivation

Implements the request_excluded tag defined in the In-App WAF Error Telemetry RFC for the appsec.waf.requests metric. The RFC changed this tag from a boolean to a string with values full (fully excluded) and partial (partially excluded). Per team guidance, tags must always be emitted explicitly rather than left implicit/undefined.

Jira ticket: APPSEC-62739

Additional Notes

Tag values defined by the RFC:

• full — request was fully excluded by an exclusion filter (not yet emitted, pending libddwaf update)
• partial — request was partially excluded (future use)
• none — request was not excluded (current baseline for all requests)

All 256 boolean combinations of the 8 WAF request flags are covered by the parameterized test in WafMetricCollectorTest.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors

Note: Once your PR is ready to merge, add it to the merge queue by commenting /merge. /merge -c cancels the queue request. /merge -f --reason "reason" skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.

[jandro996]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8aadb97311

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jandro996]

Fixed in b130f0d: updated all 18 wafRequest calls in WafMetricPeriodicActionSpecification to pass the 8th requestExcluded=false argument, and added request_excluded:none to all expected tag lists.

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.71 s	14.72 s	[-1.0%; +0.9%] (no difference)
startup:insecure-bank:tracing:Agent	13.51 s	13.76 s	[-2.5%; -1.2%] (significantly better)
startup:petclinic:appsec:Agent	16.93 s	16.77 s	[-0.0%; +1.9%] (no difference)
startup:petclinic:iast:Agent	16.98 s	16.96 s	[-0.7%; +1.0%] (no difference)
startup:petclinic:profiling:Agent	16.77 s	16.95 s	[-1.9%; -0.3%] (maybe better)
startup:petclinic:sca:Agent	16.36 s	16.79 s	[-7.0%; +1.8%] (no difference)
startup:petclinic:tracing:Agent	16.11 s	15.96 s	[-0.2%; +2.1%] (no difference)

Commit: 9b295705 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.