Add exclusion to solve IAST weak randomness vulnerability false positives (#8462)

jandro996 · web-flow · commit 6a2bd8d1ecc5 · 2025-02-28T14:00:59.000+01:00
Excluded by the iast instrumenter

com.azure.core.amqp.ExponentialAmqpRetryPolicy
com.azure.core.util.CoreUtils
com.azure.cosmos.implementation.directconnectivity.GoneAndRetryWithRetryPolicy$RetryWithRetryPolicy
com.azure.cosmos.implementation.directconnectivity.StoreReader
com.azure.cosmos.implementation.directconnectivity.addressEnumerator.AddressEnumeratorUsingPermutations
com.azure.cosmos.implementation.uuid.UUIDTimer
com.azure.messaging.eventhubs.EventProcessorClient
com.azure.messaging.eventhubs.PartitionBasedLoadBalancer
com.launchdarkly.shaded.com.launchdarkly.eventsource.EventSource
com.microsoft.sqlserver.jdbc.SQLServerConnection
diff --git a/dd-java-agent/instrumentation/iast-instrumenter/src/main/resources/datadog/trace/instrumentation/iastinstrumenter/iast_exclusion.trie b/dd-java-agent/instrumentation/iast-instrumenter/src/main/resources/datadog/trace/instrumentation/iastinstrumenter/iast_exclusion.trie
@@ -56,6 +56,15 @@
 1 com.apple.crypto.*
 1 com.arjuna.*
 1 com.atlassian.jira.*
+#APPSEC-56887
+1 com.azure.core.amqp.ExponentialAmqpRetryPolicy
+1 com.azure.core.util.CoreUtils
+1 com.azure.cosmos.implementation.directconnectivity.GoneAndRetryWithRetryPolicy$RetryWithRetryPolicy
+1 com.azure.cosmos.implementation.directconnectivity.StoreReader
+1 com.azure.cosmos.implementation.directconnectivity.addressEnumerator.AddressEnumeratorUsingPermutations
+1 com.azure.cosmos.implementation.uuid.UUIDTimer
+1 com.azure.messaging.eventhubs.EventProcessorClient
+1 com.azure.messaging.eventhubs.PartitionBasedLoadBalancer
 1 com.bea.*
 1 com.blogspot.*
 1 com.certicom.*
@@ -92,11 +101,15 @@
 1 com.jcraft.*
 1 com.jhlabs.*
 1 com.jprofiler.*
+#APPSEC-56887
+1 com.launchdarkly.shaded.com.launchdarkly.eventsource.EventSource
 1 com.liferay.*
 1 com.lowagie.*
 1 com.mchange.*
 # APPSEC-56323
 1 com.microsoft.azure.storage.RetryExponentialRetry
+#APPSEC-56887
+1 com.microsoft.sqlserver.jdbc.SQLServerConnection
 1 com.mongodb.*
 1 com.mysql.*
 1 com.neo4j.*
