AppSec Lambda: Analyze HTTP response

[claponcet]

What Does This Do

Adds AppSec response analysis for AWS Lambda: LambdaAppSecHandler.processResponseData
parses the Lambda response object and fires the WAF gateway events (responseStarted,
responseHeader, responseHeaderDone, responseBody) with the extracted status code,
headers, and body.

Trigger-type detection (API Gateway v1/v2, ALB, Lambda URL, WebSocket) is added to
processRequestStart and stored in a ThreadLocal. processResponseData uses it to
decide whether to parse the response as an API-GW envelope or fall back to treating the
whole payload as a plain response body, matching how non-envelope HTTP triggers behave.

CoreTracer.notifyAppSecEnd is extended to receive the raw result object so it can be
forwarded to processResponseData from the Lambda handler instrumentation.

Additional extraction improvements:

• Response header keys are lowercased (Locale.ROOT) to normalise casing across API GW / ALB variants
• isBase64Encoded accepts "true" (string) in addition to Boolean.TRUE

LambdaHandlerInstrumentationTest and LambdaAppSecHandlerTest migrated from Spock/Groovy
to JUnit 5 Java, with new test cases for response analysis and trigger-type gating.

processRequestEnd now propagates ASM_KEEP for traces where the WAF set isManuallyKept() via a trace-tagging rule but produced no WAF events. In Lambda the WAF runs before the span exists, so GatewayBridge's existing guard (which gates the tag on non-empty events) never fires for this case; the fix applies the tags directly in processRequestEnd. A minimal AppSecContext interface is introduced in internal-api to expose isManuallyKept() across module boundaries.

Motivation

Allows the WAF to inspect Lambda HTTP responses for threats.

Additional Notes

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Add your completed PR to the merge queue by commenting /merge.

Jira ticket: APPSEC-60532

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.95 s	14.01 s	[-1.2%; +0.3%] (no difference)
startup:insecure-bank:tracing:Agent	12.97 s	13.08 s	[-1.6%; -0.1%] (maybe better)
startup:petclinic:appsec:Agent	16.88 s	16.22 s	[-0.2%; +8.4%] (no difference)
startup:petclinic:iast:Agent	16.84 s	16.91 s	[-1.2%; +0.4%] (no difference)
startup:petclinic:profiling:Agent	16.87 s	16.85 s	[-0.9%; +1.2%] (no difference)
startup:petclinic:sca:Agent	16.77 s	16.22 s	[-1.0%; +7.9%] (no difference)
startup:petclinic:tracing:Agent	16.13 s	16.11 s	[-1.1%; +1.3%] (no difference)

Commit: 73f50b06 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[claponcet]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3d2a12a4fb

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 868f9a139e

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[jandro996]

While reviewing the changes in this file, I noticed a few pre-existing lines (not touched by this PR) that also use fully-qualified names for classes already imported (List, Collections, Collectors): lines 669, 670, 675, 824, 853, 901, 902, 908. Not blocking this PR, just flagging in case you want to clean them up while you're in this file.