Implement normalised http routes by estringana · Pull Request #4101 · DataDog/dd-trace-php

estringana · 2026-08-10T15:15:19Z

Description

Add _dd.appsec.normalized_route tag to HTTP framework integrations (Laravel, Slim, Symfony, Laminas, CakePHP, Yii, CodeIgniter, WordPress) per RFC-1103. The tag exposes a normalized form of the matched route, stripping concrete parameter values and framework-specific syntax (regexconstraints, optional markers) into a canonical {param} notation suitable for security analysis.

Reviewer checklist

Test coverage seems ok.
Appropriate labels assigned.

github-actions · 2026-08-10T15:16:18Z

Snapshots difference summary

The following differences have been observed in committed snapshots. It is meant to help the reviewer.
The diff is simplistic, so please check some files anyway while we improve it.

If you need to update snapshots, please refer to CONTRIBUTING.md

datadog-datadog-prod-us1-2 · 2026-08-10T15:18:47Z

✨ Unblock PR with BitsAI

⚠️ Warnings

❌ Your PR has failed checks. Please review the issues below and take necessary action before merging.

🚦 30 Pipeline jobs failed

DataDog/apm-reliability/dd-trace-php | Unit tests: [7.4] — ❄️ 5 known flaky tests

View more details · View in GitLab

↳ ❄️ testRfcExampleGoGorilla from unit.DDTrace\Tests\Unit\Util\Normalizer\RouteNormalizerTest

↳ ❄️ testRfcExampleRailsMandatoryFormat from unit.DDTrace\Tests\Unit\Util\Normalizer\RouteNormalizerTest

↳ ❄️ testWordPressMultipleCaptureGroupsInOneSegment from unit.DDTrace\Tests\Unit\Util\Normalizer\RouteNormalizerTest

↳ ❄️ testWordPressOptionalGroupNoUrlPath from unit.DDTrace\Tests\Unit\Util\Normalizer\RouteNormalizerTest

↳ ❄️ testWordPressOptionalGroupPresent from unit.DDTrace\Tests\Unit\Util\Normalizer\RouteNormalizerTest

DataDog/apm-reliability/dd-trace-php | ASAN test_c with multiple observers: [8.3] — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

DataDog/apm-reliability/dd-trace-php | Unit tests: [7.0] — 🔧 Needs a code fix, caused by this PR

View more details · View in GitLab

View all 30 failed jobs.

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 53.52% (-7.11%)

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: 0fd44d6 | Docs | View more details | Give us feedback!}

pr-commenter · 2026-08-14T12:26:32Z

Benchmarks [ tracer ]

Benchmark execution time: 2026-08-27 10:44:57

Comparing candidate commit e02670a in PR branch estringana/normalise-http-route with baseline commit 2e85cae in branch master.

Found 4 performance improvements and 38 performance regressions! Performance is the same for 151 metrics, 1 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

🟩 = significantly better candidate vs. baseline
🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:ComposerTelemetryBench/benchTelemetryParsing

🟥 mem_peak [+137.624KB; +137.624KB] or [+3.390%; +3.390%]

scenario:ContextPropagationBench/benchExtractHeaders128Bit

🟥 mem_peak [+138.168KB; +138.168KB] or [+3.402%; +3.402%]

scenario:ContextPropagationBench/benchExtractHeaders128Bit-opcache

🟩 execution_time [-939.084ns; -863.583ns] or [-52.916%; -48.662%]

scenario:ContextPropagationBench/benchExtractHeaders64Bit

🟥 mem_peak [+138.168KB; +138.168KB] or [+3.402%; +3.402%]

scenario:ContextPropagationBench/benchExtractTraceContext128Bit

🟥 mem_peak [+138.168KB; +138.168KB] or [+3.402%; +3.402%]

scenario:ContextPropagationBench/benchExtractTraceContext64Bit

🟥 mem_peak [+138.168KB; +138.168KB] or [+3.402%; +3.402%]

scenario:ContextPropagationBench/benchInject128Bit

🟥 mem_peak [+138.176KB; +138.176KB] or [+3.403%; +3.403%]

scenario:ContextPropagationBench/benchInject128Bit-opcache

🟩 execution_time [-878.340ns; -793.660ns] or [-34.662%; -31.320%]

scenario:ContextPropagationBench/benchInject64Bit

🟥 mem_peak [+138.176KB; +138.176KB] or [+3.403%; +3.403%]

scenario:EmptyFileBench/benchEmptyFileBaseline

🟥 mem_peak [+146.136KB; +146.136KB] or [+2.784%; +2.784%]

scenario:EmptyFileBench/benchEmptyFileDdprof

🟥 mem_peak [+139.278KB; +148.655KB] or [+2.647%; +2.825%]

scenario:EmptyFileBench/benchEmptyFileOverhead

🟥 mem_peak [+146.136KB; +146.136KB] or [+2.784%; +2.784%]

scenario:HookBench/benchHookOverheadInstallHookOnFunction

🟥 mem_peak [+138.040KB; +138.040KB] or [+3.399%; +3.399%]

scenario:HookBench/benchHookOverheadInstallHookOnMethod

🟥 mem_peak [+138.040KB; +138.040KB] or [+3.399%; +3.399%]

scenario:HookBench/benchHookOverheadTraceFunction

🟥 mem_peak [+146.791KB; +146.794KB] or [+3.257%; +3.257%]

scenario:HookBench/benchHookOverheadTraceMethod

🟥 mem_peak [+146.791KB; +146.794KB] or [+3.211%; +3.211%]

scenario:HookBench/benchWithoutHook

🟥 mem_peak [+138.056KB; +138.056KB] or [+3.400%; +3.400%]

scenario:LaravelBench/benchLaravelBaseline

🟥 mem_peak [+146.168KB; +146.168KB] or [+2.784%; +2.784%]

scenario:LaravelBench/benchLaravelDdprof

🟥 mem_peak [+141.993KB; +150.042KB] or [+2.698%; +2.851%]

scenario:LaravelBench/benchLaravelOverhead

🟥 mem_peak [+146.168KB; +146.168KB] or [+2.784%; +2.784%]

scenario:LogsInjectionBench/benchLogsInfoBaseline-opcache

🟥 execution_time [+188.408ns; +229.592ns] or [+11.719%; +14.281%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization

🟥 mem_peak [+146.792KB; +146.792KB] or [+3.399%; +3.399%]

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

🟩 execution_time [-11.340µs; -9.760µs] or [-10.384%; -8.938%]

scenario:PDOBench/benchPDOBaseline

🟥 mem_peak [+146.792KB; +146.792KB] or [+3.583%; +3.583%]

scenario:PHPRedisBench/benchRedisBaseline

🟥 mem_peak [+137.624KB; +137.624KB] or [+3.389%; +3.389%]

scenario:SamplingRuleMatchingBench/benchGlobMatching1

🟥 mem_peak [+141.296KB; +141.296KB] or [+3.480%; +3.480%]

scenario:SamplingRuleMatchingBench/benchGlobMatching2

🟥 mem_peak [+141.296KB; +141.296KB] or [+3.480%; +3.480%]

scenario:SamplingRuleMatchingBench/benchGlobMatching3

🟥 mem_peak [+141.296KB; +141.296KB] or [+3.480%; +3.480%]

scenario:SamplingRuleMatchingBench/benchGlobMatching3-opcache

🟥 execution_time [+97.334ns; +231.466ns] or [+3.419%; +8.130%]

scenario:SamplingRuleMatchingBench/benchGlobMatching4

🟥 mem_peak [+141.296KB; +141.296KB] or [+3.480%; +3.480%]

scenario:SamplingRuleMatchingBench/benchRegexMatching1

🟥 mem_peak [+141.296KB; +141.296KB] or [+3.480%; +3.480%]

scenario:SamplingRuleMatchingBench/benchRegexMatching2

🟥 mem_peak [+141.296KB; +141.296KB] or [+3.480%; +3.480%]

scenario:SamplingRuleMatchingBench/benchRegexMatching3

🟥 mem_peak [+141.296KB; +141.296KB] or [+3.480%; +3.480%]

scenario:SamplingRuleMatchingBench/benchRegexMatching4

🟥 mem_peak [+141.296KB; +141.296KB] or [+3.480%; +3.480%]

scenario:SpanBench/benchDatadogAPI

🟥 mem_peak [+139.528KB; +139.528KB] or [+3.437%; +3.437%]

scenario:SymfonyBench/benchSymfonyBaseline

🟥 mem_peak [+146.168KB; +146.168KB] or [+2.784%; +2.784%]

scenario:SymfonyBench/benchSymfonyDdprof

🟥 mem_peak [+113.431KB; +139.925KB] or [+2.139%; +2.638%]

scenario:SymfonyBench/benchSymfonyOverhead

🟥 mem_peak [+146.168KB; +146.168KB] or [+2.784%; +2.784%]

scenario:TraceAnnotationsBench/benchTraceAnnotationOverhead

🟥 mem_peak [+146.791KB; +146.794KB] or [+3.206%; +3.206%]

scenario:TraceFlushBench/benchFlushTrace

🟥 mem_peak [+146.792KB; +146.793KB] or [+3.543%; +3.544%]

scenario:TraceFlushBench/benchFlushTrace-opcache

🟩 execution_time [-19.360µs; -8.340µs] or [-5.332%; -2.297%]

scenario:TraceSerializationBench/benchSerializeTrace

🟥 mem_peak [+146.792KB; +146.792KB] or [+3.464%; +3.464%]

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7b7f9710a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

bwoebi · 2026-08-14T18:26:59Z

Do you have a rough estimate on the overhead of the route normalization? It seems expensive.

Laminas is obviously just slow because it does runtime route matching, but other stacks like Slim or Symfony rely on precompiled routes.
E.g. for Symfony we could make it part of the logic used in #3676. Please check if other frameworks have similar, acceptable solutions. Or consider some caching in the C code. (a LRU cache of route to normalized route with e.g. 500 routes max)

tabgok · 2026-08-18T11:03:46Z

Approving from the stance of IDM, due to the new field being introduced

Add missing Tag::APPSEC_NORMALIZED_ROUTE assertions to: - Symfony TraceSearchConfigTest (V4_4, V5_0, V5_1, V5_2, V6_2) - Laravel TraceSearchConfigTest (V4, V5_7, V5_8, V8_x) - Laravel V8_x RouteCachingTest and InternalExceptionsTest - Laravel Octane CommonScenariosTest - Yii ParameterizedRouteTest, ModuleTest, LazyLoadingIntegrationsFromYiiTest - CodeIgniter ExitTest and NoCI_ControllertTest - Fix UserAvailableConstantsTest tag ordering (APPSEC_NORMALIZED_ROUTE must appear after HTTP_ROUTE to match Tag.php declaration order) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

cataphract

It seems there are many gaps in framework support. I asked AI for failing counterexamples against the spec and got many:

https://github.com/DataDog/dd-trace-php/compare/estringana/normalise-http-route...glopes/normalise-http-route-failing?expand=1

I already removed a few that were obviously invalid (like, changing the routing type at runtime and complained about cache staleness), but the rest seem mostly valid

cataphract · 2026-08-26T14:27:09Z

-                    $locale = $request->attributes->get('_locale');
-                    if ($locale !== null) {
-                        $path = EndpointCatalog::pathForRoute($route_name . '.' . $locale, $container);
+                $cacheKey = $route_name;


Also in other frameworks: the cache key needs to be richer otherwise, for optional parameters, it caches only the first materialization of route that was found.

estringana force-pushed the estringana/normalise-http-route branch 3 times, most recently from 0cc69dd to 1fa5485 Compare August 14, 2026 10:19

estringana force-pushed the estringana/normalise-http-route branch from a2be41b to 7b7f971 Compare August 14, 2026 12:53

estringana marked this pull request as ready for review August 14, 2026 14:55

estringana requested review from a team as code owners August 14, 2026 14:55

estringana requested review from tabgok and removed request for a team August 14, 2026 14:55

chatgpt-codex-connector Bot reviewed Aug 14, 2026

View reviewed changes

bwoebi reviewed Aug 14, 2026

View reviewed changes

Comment thread src/DDTrace/Util/RouteNormalizer.php

estringana force-pushed the estringana/normalise-http-route branch from ff7f8fe to 8632abe Compare August 18, 2026 10:21

tabgok approved these changes Aug 18, 2026

View reviewed changes

estringana force-pushed the estringana/normalise-http-route branch from b57a9e9 to 2ab71bd Compare August 18, 2026 15:55

bwoebi reviewed Aug 18, 2026

View reviewed changes

Comment thread tracer/routing_cache.c Outdated

estringana and others added 10 commits August 26, 2026 12:02

Implement normalised http routes

3e61333

Fix pipeline errors

65220f2

Fix laminas

8a07b6a

Tiny up the PR

b4ac068

Fix pipeline

a71a454

Remove non required changes

c1d1fed

Fix special route

dbea861

Refine slim routes

3ba2da9

Fix codeigniter

5d777f0

estringana added 18 commits August 26, 2026 12:02

Fix wordpress

309f833

Fix pipeline

3c36a6e

Fix pipeline

ec3960b

Fix wordpress

c44b3bb

Improve pr

561896b

Fix PR

01bb9f0

Fix laminas

1d3add3

Implement a route caching system

7646665

Fix pipeline

f6bcae6

Fix pipeline

a14c69a

Fix pipeline

c7270d7

Add cache to wordpress and Slim

7209ed2

Make hashtable thread safety

39ba537

Fix pipeline

2cd7c31

Fix pipeline

750ed5d

Fix pipeline

2a85174

Fix codeigniter

e4ee771

Add appsec integration tests

f42c408

estringana force-pushed the estringana/normalise-http-route branch from 34e4e8b to f42c408 Compare August 26, 2026 10:13

estringana requested review from a team as code owners August 26, 2026 10:13

Fix integration tests

ba956c4

cataphract requested changes Aug 26, 2026

View reviewed changes

estringana added 5 commits August 27, 2026 10:27

Amend test file name

0273d76

Generate normalise routes only when appsec is enabled

e02670a

Improve route generation

cd10921

Improve laminas integration

9cdee15

Improve Symfony

0fd44d6

Uh oh!

Conversation

estringana commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Reviewer checklist

Uh oh!

github-actions Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Snapshots difference summary

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Aug 10, 2026 • edited by datadog-prod-us1-4 Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Warnings

ℹ️ Info

Uh oh!

pr-commenter Bot commented Aug 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Benchmarks [ tracer ]

Explanation

More details about the CI and significant changes

scenario:ComposerTelemetryBench/benchTelemetryParsing

scenario:ContextPropagationBench/benchExtractHeaders128Bit

scenario:ContextPropagationBench/benchExtractHeaders128Bit-opcache

scenario:ContextPropagationBench/benchExtractHeaders64Bit

scenario:ContextPropagationBench/benchExtractTraceContext128Bit

scenario:ContextPropagationBench/benchExtractTraceContext64Bit

scenario:ContextPropagationBench/benchInject128Bit

scenario:ContextPropagationBench/benchInject128Bit-opcache

scenario:ContextPropagationBench/benchInject64Bit

scenario:EmptyFileBench/benchEmptyFileBaseline

scenario:EmptyFileBench/benchEmptyFileDdprof

scenario:EmptyFileBench/benchEmptyFileOverhead

scenario:HookBench/benchHookOverheadInstallHookOnFunction

scenario:HookBench/benchHookOverheadInstallHookOnMethod

scenario:HookBench/benchHookOverheadTraceFunction

scenario:HookBench/benchHookOverheadTraceMethod

scenario:HookBench/benchWithoutHook

scenario:LaravelBench/benchLaravelBaseline

scenario:LaravelBench/benchLaravelDdprof

scenario:LaravelBench/benchLaravelOverhead

scenario:LogsInjectionBench/benchLogsInfoBaseline-opcache

scenario:MessagePackSerializationBench/benchMessagePackSerialization

scenario:MessagePackSerializationBench/benchMessagePackSerialization-opcache

scenario:PDOBench/benchPDOBaseline

scenario:PHPRedisBench/benchRedisBaseline

scenario:SamplingRuleMatchingBench/benchGlobMatching1

scenario:SamplingRuleMatchingBench/benchGlobMatching2

scenario:SamplingRuleMatchingBench/benchGlobMatching3

scenario:SamplingRuleMatchingBench/benchGlobMatching3-opcache

scenario:SamplingRuleMatchingBench/benchGlobMatching4

scenario:SamplingRuleMatchingBench/benchRegexMatching1

scenario:SamplingRuleMatchingBench/benchRegexMatching2

scenario:SamplingRuleMatchingBench/benchRegexMatching3

scenario:SamplingRuleMatchingBench/benchRegexMatching4

scenario:SpanBench/benchDatadogAPI

scenario:SymfonyBench/benchSymfonyBaseline

scenario:SymfonyBench/benchSymfonyDdprof

scenario:SymfonyBench/benchSymfonyOverhead

scenario:TraceAnnotationsBench/benchTraceAnnotationOverhead

scenario:TraceFlushBench/benchFlushTrace

scenario:TraceFlushBench/benchFlushTrace-opcache

scenario:TraceSerializationBench/benchSerializeTrace

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bwoebi commented Aug 14, 2026

Uh oh!

estringana commented Aug 10, 2026 •

edited

Loading

github-actions Bot commented Aug 10, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented Aug 10, 2026 •

edited by datadog-prod-us1-4 Bot

Loading

pr-commenter Bot commented Aug 14, 2026 •

edited

Loading