Merge branch 'master' into smola/optimize-resource-classes-circleci

.circleci/config.continue.yml.j2

@@ -28,15 +28,15 @@ debugger_test_matrix: &debugger_test_matrix
 
 system_test_matrix: &system_test_matrix
   parameters:
-    weblog-variant: [ 'spring-boot', 'spring-boot-jetty', 'spring-boot-openliberty', 'spring-boot-3-native', 'jersey-grizzly2', 'resteasy-netty3','ratpack', 'vertx3' ]
+    weblog-variant: ['akka-http', 'jersey-grizzly2', 'play', 'resteasy-netty3', 'ratpack', 'spring-boot', 'spring-boot-jetty', 'spring-boot-openliberty', 'spring-boot-payara', 'spring-boot-undertow', 'spring-boot-wildfly', 'spring-boot-3-native', 'uds-spring-boot', 'vertx3', 'vertx4']
 
 agent_integration_tests_modules: &agent_integration_tests_modules "dd-trace-core|communication|internal-api|utils"
 core_modules: &core_modules "dd-java-agent|dd-trace-core|communication|internal-api|telemetry|utils|dd-java-agent/agent-bootstrap|dd-java-agent/agent-installer|dd-java-agent/agent-tooling|dd-java-agent/agent-builder|dd-java-agent/appsec|dd-java-agent/agent-crashtracking|dd-trace-api|dd-trace-ot"
 instrumentation_modules: &instrumentation_modules "dd-java-agent/instrumentation|dd-java-agent/agent-tooling|dd-java-agent/agent-iast|dd-java-agent/agent-installer|dd-java-agent/agent-builder|dd-java-agent/agent-bootstrap|dd-java-agent/appsec|dd-java-agent/testing|dd-trace-core|dd-trace-api|internal-api|communication"
 debugger_modules: &debugger_modules "dd-java-agent/agent-debugger|dd-java-agent/agent-bootstrap|dd-java-agent/agent-builder|internal-api|communication|dd-trace-core"
 profiling_modules: &profiling_modules "dd-java-agent/agent-profiling"
 
-default_system_tests_commit: &default_system_tests_commit 1c9542783eedfed1b995d976963fbeb14ba772b9
+default_system_tests_commit: &default_system_tests_commit 15713a66e48f82b7d995cea2eb6eb78bec0270df
 
 parameters:
   nightly:

.github/workflows/add-milestone-to-pull-requests.yaml

@@ -9,7 +9,8 @@ jobs:
   add_milestone_to_merged:
     name: Add milestone to merged pull requests
     permissions:
-      issues: write # Required to update the milestone of a pull request
+      issues: read # Required to list milestones
+      pull-requests: write # Required to update the milestone of a pull request
     if: github.event.pull_request.merged && github.event.pull_request.milestone == null
     runs-on: ubuntu-latest
     steps:

dd-java-agent/agent-bootstrap/gradle.lockfile

@@ -39,7 +39,7 @@ commons-fileupload:commons-fileupload:1.5=jmhRuntimeClasspath,testCompileClasspa
 commons-io:commons-io:2.11.0=jmhRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 de.thetaphi:forbiddenapis:3.1=compileClasspath,jmhCompileClasspath
 info.picocli:picocli:4.6.3=jmhRuntimeClasspath,testRuntimeClasspath
-io.sqreen:libsqreen:10.1.0=jmhRuntimeClasspath,testRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=jmhRuntimeClasspath,testRuntimeClasspath
 javax.servlet:javax.servlet-api:3.1.0=jmhRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs
 jline:jline:2.14.6=jmhRuntimeClasspath,testRuntimeClasspath

dd-java-agent/agent-builder/gradle.lockfile

@@ -39,7 +39,7 @@ commons-fileupload:commons-fileupload:1.5=testCompileClasspath,testRuntimeClassp
 commons-io:commons-io:2.11.0=testCompileClasspath,testRuntimeClasspath
 de.thetaphi:forbiddenapis:3.1=compileClasspath
 info.picocli:picocli:4.6.3=testRuntimeClasspath
-io.sqreen:libsqreen:10.1.0=testRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=testRuntimeClasspath
 javax.servlet:javax.servlet-api:3.1.0=testCompileClasspath,testRuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs
 jline:jline:2.14.6=testRuntimeClasspath

dd-java-agent/agent-ci-visibility/gradle.lockfile

@@ -54,7 +54,7 @@ commons-io:commons-io:2.11.0=testCompileClasspath,testFixturesApiDependenciesMet
 de.thetaphi:forbiddenapis:3.1=compileClasspath,compileOnlyDependenciesMetadata
 info.picocli:picocli:4.6.3=testFixturesRuntimeClasspath,testRuntimeClasspath
 io.github.java-diff-utils:java-diff-utils:4.12=zinc
-io.sqreen:libsqreen:10.1.0=testFixturesRuntimeClasspath,testRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=testFixturesRuntimeClasspath,testRuntimeClasspath
 javax.servlet:javax.servlet-api:3.1.0=testCompileClasspath,testFixturesApiDependenciesMetadata,testFixturesCompileClasspath,testFixturesImplementationDependenciesMetadata,testFixturesRuntimeClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs
 jline:jline:2.14.6=testFixturesRuntimeClasspath,testRuntimeClasspath

dd-java-agent/agent-iast/gradle.lockfile

@@ -81,7 +81,7 @@ io.grpc:grpc-protobuf-lite:1.42.2=jmhRuntimeClasspath,testCompileClasspath,testC
 io.grpc:grpc-protobuf:1.42.2=jmhRuntimeClasspath,testCompileClasspath,testCompileProtoPath,testRuntimeClasspath
 io.grpc:protoc-gen-grpc-java:1.42.2=protobufToolsLocator_grpc
 io.perfmark:perfmark-api:0.23.0=jmhRuntimeClasspath,testCompileProtoPath,testRuntimeClasspath
-io.sqreen:libsqreen:10.1.0=jmhRuntimeClasspath,testCompileProtoPath,testFixturesCompileProtoPath,testFixturesRuntimeClasspath,testRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=jmhRuntimeClasspath,testCompileProtoPath,testFixturesCompileProtoPath,testFixturesRuntimeClasspath,testRuntimeClasspath
 javax.inject:javax.inject:1=annotationProcessor,errorprone,jmhAnnotationProcessor,testAnnotationProcessor,testFixturesAnnotationProcessor
 javax.servlet:javax.servlet-api:3.1.0=jmhRuntimeClasspath,testCompileClasspath,testCompileProtoPath,testFixturesCompileClasspath,testFixturesCompileProtoPath,testFixturesRuntimeClasspath,testRuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs

dd-java-agent/agent-tooling/gradle.lockfile

@@ -47,7 +47,7 @@ commons-fileupload:commons-fileupload:1.5=jmhRuntimeClasspath,testCompileClasspa
 commons-io:commons-io:2.11.0=jmhRuntimeClasspath,testCompileClasspath,testRuntimeClasspath,test_java11CompileClasspath,test_java11RuntimeClasspath
 de.thetaphi:forbiddenapis:3.1=compileClasspath,jmhCompileClasspath
 info.picocli:picocli:4.6.3=jmhRuntimeClasspath,testRuntimeClasspath,test_java11RuntimeClasspath
-io.sqreen:libsqreen:10.1.0=jmhRuntimeClasspath,testRuntimeClasspath,test_java11RuntimeClasspath
+io.sqreen:libsqreen:11.0.0=jmhRuntimeClasspath,testRuntimeClasspath,test_java11RuntimeClasspath
 jakarta.annotation:jakarta.annotation-api:1.3.5=jmhCompileClasspath,jmhRuntimeClasspath
 javax.servlet:javax.servlet-api:3.1.0=jmhRuntimeClasspath,testCompileClasspath,testRuntimeClasspath,test_java11CompileClasspath,test_java11RuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs

dd-java-agent/appsec/gradle.lockfile

@@ -43,7 +43,7 @@ commons-fileupload:commons-fileupload:1.5=jmhRuntimeClasspath,testCompileClasspa
 commons-io:commons-io:2.11.0=jmhRuntimeClasspath,testCompileClasspath,testFixturesCompileClasspath,testFixturesRuntimeClasspath,testRuntimeClasspath
 de.thetaphi:forbiddenapis:3.1=compileClasspath,jmhCompileClasspath
 info.picocli:picocli:4.6.3=jmhRuntimeClasspath,testFixturesRuntimeClasspath,testRuntimeClasspath
-io.sqreen:libsqreen:10.1.0=compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testFixturesRuntimeClasspath,testRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testFixturesRuntimeClasspath,testRuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs
 jline:jline:2.14.6=jmhRuntimeClasspath,testFixturesRuntimeClasspath,testRuntimeClasspath
 junit:junit-dep:4.11=jmhRuntimeClasspath,testCompileClasspath,testFixturesCompileClasspath,testFixturesRuntimeClasspath,testRuntimeClasspath

dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/AppSecRequestContext.java

@@ -11,6 +11,8 @@
 import datadog.trace.api.Config;
 import datadog.trace.api.http.StoredBodySupplier;
 import datadog.trace.api.internal.TraceSegment;
+import datadog.trace.bootstrap.instrumentation.api.AgentSpan;
+import datadog.trace.bootstrap.instrumentation.api.AgentTracer;
 import io.sqreen.powerwaf.Additive;
 import io.sqreen.powerwaf.PowerwafContext;
 import io.sqreen.powerwaf.PowerwafMetrics;
@@ -89,7 +91,7 @@ public class AppSecRequestContext implements DataBundle, Closeable {
   private String savedRawURI;
   private final Map<String, List<String>> requestHeaders = new LinkedHashMap<>();
   private final Map<String, List<String>> responseHeaders = new LinkedHashMap<>();
-  private Map<String, List<String>> collectedCookies;
+  private volatile Map<String, List<String>> collectedCookies;
   private boolean finishedRequestHeaders;
   private boolean finishedResponseHeaders;
   private String peerAddress;
@@ -106,13 +108,13 @@ public class AppSecRequestContext implements DataBundle, Closeable {
   private boolean convertedReqBodyPublished;
   private boolean respDataPublished;
   private boolean pathParamsPublished;
-  private Map<String, String> derivatives;
+  private volatile Map<String, String> derivatives;
 
   private final AtomicBoolean rateLimited = new AtomicBoolean(false);
   private volatile boolean throttled;
 
   // should be guarded by this
-  private Additive additive;
+  private volatile Additive additive;
   // set after additive is set
   private volatile PowerwafMetrics wafMetrics;
   private volatile PowerwafMetrics raspMetrics;
@@ -197,12 +199,14 @@ public Additive getOrCreateAdditive(PowerwafContext ctx, boolean createMetrics,
   }
 
   public void closeAdditive() {
-    synchronized (this) {
-      if (additive != null) {
-        try {
-          additive.close();
-        } finally {
-          additive = null;
+    if (additive != null) {
+      synchronized (this) {
+        if (additive != null) {
+          try {
+            additive.close();
+          } finally {
+            additive = null;
+          }
         }
       }
     }
@@ -419,20 +423,33 @@ public void setRespDataPublished(boolean respDataPublished) {
 
   @Override
   public void close() {
-    synchronized (this) {
-      if (additive == null) {
-        return;
-      }
-    }
-
-    log.warn("WAF object had not been closed (probably missed request-end event)");
-    closeAdditive();
+    final AgentSpan span = AgentTracer.activeSpan();
+    close(span != null && span.isRequiresPostProcessing());
   }
 
   /* end interface for GatewayBridge */
 
   /* Should be accessible from the modules */
 
+  public void close(boolean requiresPostProcessing) {
+    if (additive != null || derivatives != null) {
+      log.warn("WAF object had not been closed (probably missed request-end event)");
+      closeAdditive();
+      derivatives = null;
+    }
+
+    // check if we might need to further post process data related to the span in order to not free
+    // related data
+    if (requiresPostProcessing) {
+      return;
+    }
+
+    collectedCookies = null;
+    requestHeaders.clear();
+    responseHeaders.clear();
+    persistentData.clear();
+  }
+
   /** @return the portion of the body read so far, if any */
   public CharSequence getStoredRequestBody() {
     StoredBodySupplier storedRequestBodySupplier = this.storedRequestBodySupplier;
@@ -516,6 +533,7 @@ boolean commitDerivatives(TraceSegment traceSegment) {
       return false;
     }
     derivatives.forEach(traceSegment::setTagTop);
+    derivatives = null;
     return true;
   }
 

dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java

@@ -33,6 +33,7 @@
 import datadog.trace.api.internal.TraceSegment;
 import datadog.trace.api.telemetry.RuleType;
 import datadog.trace.api.telemetry.WafMetricCollector;
+import datadog.trace.bootstrap.instrumentation.api.AgentSpan;
 import datadog.trace.bootstrap.instrumentation.api.Tags;
 import datadog.trace.bootstrap.instrumentation.api.URIDataAdapter;
 import java.net.URI;
@@ -495,10 +496,18 @@ private NoopFlow onRequestEnded(RequestContext ctx_, IGSpanInfo spanInfo) {
       }
     }
 
-    ctx.close();
+    ctx.close(requiresPostProcessing(spanInfo));
     return NoopFlow.INSTANCE;
   }
 
+  private boolean requiresPostProcessing(final IGSpanInfo spanInfo) {
+    if (!(spanInfo instanceof AgentSpan)) {
+      return true; // be conservative
+    }
+    final AgentSpan span = (AgentSpan) spanInfo;
+    return span.isRequiresPostProcessing();
+  }
+
   private Flow<Void> onRequestHeadersDone(RequestContext ctx_) {
     AppSecRequestContext ctx = ctx_.getData(RequestContextSlot.APPSEC);
     if (ctx == null || ctx.isReqDataPublished()) {

dd-java-agent/appsec/src/main/resources/default_config.json

@@ -1,7 +1,7 @@
 {
   "version": "2.2",
   "metadata": {
-    "rules_version": "1.13.1"
+    "rules_version": "1.13.0"
   },
   "rules": [
     {
@@ -6239,6 +6239,7 @@
     {
       "id": "rasp-930-100",
       "name": "Local file inclusion exploit",
+      "enabled": false,
       "tags": {
         "type": "lfi",
         "category": "vulnerability_trigger",
@@ -6287,6 +6288,7 @@
     {
       "id": "rasp-932-100",
       "name": "Shell injection exploit",
+      "enabled": false,
       "tags": {
         "type": "command_injection",
         "category": "vulnerability_trigger",
@@ -6335,6 +6337,7 @@
     {
       "id": "rasp-934-100",
       "name": "Server-side request forgery exploit",
+      "enabled": false,
       "tags": {
         "type": "ssrf",
         "category": "vulnerability_trigger",
@@ -6383,6 +6386,7 @@
     {
       "id": "rasp-942-100",
       "name": "SQL injection exploit",
+      "enabled": false,
       "tags": {
         "type": "sql_injection",
         "category": "vulnerability_trigger",

dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/gateway/AppSecRequestContextSpecification.groovy

@@ -244,4 +244,32 @@ class AppSecRequestContextSpecification extends DDSpecification {
     0 * rateLimiter.isThrottled()
     result == result2
   }
+
+
+  void 'test that internal data is cleared on close'() {
+    setup:
+    final ctx = new AppSecRequestContext()
+    final fullCleanup = !postProcessing
+
+    when:
+    ctx.requestHeaders.put('Accept', ['*'])
+    ctx.responseHeaders.put('Content-Type', ['text/plain'])
+    ctx.collectedCookies = [cookie : ['test']]
+    ctx.persistentData.put(KnownAddresses.REQUEST_METHOD, 'GET')
+    ctx.derivatives = ['a': 'b']
+    ctx.additive = createAdditive()
+    ctx.close(postProcessing)
+
+    then:
+    ctx.additive == null
+    ctx.derivatives == null
+
+    ctx.requestHeaders.isEmpty() == fullCleanup
+    ctx.responseHeaders.isEmpty() == fullCleanup
+    ctx.cookies.isEmpty() == fullCleanup
+    ctx.persistentData.isEmpty() == fullCleanup
+
+    where:
+    postProcessing << [true, false]
+  }
 }

dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/gateway/GatewayBridgeSpecification.groovy

@@ -8,6 +8,7 @@ import com.datadog.appsec.event.data.DataBundle
 import com.datadog.appsec.event.data.KnownAddresses
 import com.datadog.appsec.report.AppSecEvent
 import com.datadog.appsec.report.AppSecEventWrapper
+import datadog.trace.api.Config
 import datadog.trace.api.function.TriConsumer
 import datadog.trace.api.function.TriFunction
 import datadog.trace.api.gateway.BlockResponseFunction
@@ -137,7 +138,7 @@ class GatewayBridgeSpecification extends DDSpecification {
     1 * spanInfo.getTags() >> ['http.client_ip':'1.1.1.1']
     1 * mockAppSecCtx.transferCollectedEvents() >> [event]
     1 * mockAppSecCtx.peerAddress >> '2001::1'
-    1 * mockAppSecCtx.close()
+    1 * mockAppSecCtx.close(false)
     1 * traceSegment.setTagTop("_dd.appsec.enabled", 1)
     1 * traceSegment.setTagTop("_dd.runtime_family", "jvm")
     1 * traceSegment.setTagTop('appsec.event', true)

dd-java-agent/cws-tls/gradle.lockfile

@@ -39,7 +39,7 @@ commons-fileupload:commons-fileupload:1.5=testCompileClasspath,testRuntimeClassp
 commons-io:commons-io:2.11.0=testCompileClasspath,testRuntimeClasspath
 de.thetaphi:forbiddenapis:3.1=compileClasspath
 info.picocli:picocli:4.6.3=testRuntimeClasspath
-io.sqreen:libsqreen:10.1.0=testRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=testRuntimeClasspath
 javax.servlet:javax.servlet-api:3.1.0=testCompileClasspath,testRuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs
 jline:jline:2.14.6=testRuntimeClasspath

dd-java-agent/instrumentation/aerospike-4/gradle.lockfile

@@ -54,7 +54,7 @@ commons-fileupload:commons-fileupload:1.5=latest7DepForkedTestCompileClasspath,l
 commons-io:commons-io:2.11.0=latest7DepForkedTestCompileClasspath,latest7DepForkedTestRuntimeClasspath,latest7DepTestCompileClasspath,latest7DepTestRuntimeClasspath,latestDepForkedTestCompileClasspath,latestDepForkedTestRuntimeClasspath,latestDepTestCompileClasspath,latestDepTestRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 de.thetaphi:forbiddenapis:3.1=compileClasspath
 info.picocli:picocli:4.6.3=latest7DepForkedTestRuntimeClasspath,latest7DepTestRuntimeClasspath,latestDepForkedTestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath
-io.sqreen:libsqreen:10.1.0=latest7DepForkedTestRuntimeClasspath,latest7DepTestRuntimeClasspath,latestDepForkedTestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=latest7DepForkedTestRuntimeClasspath,latest7DepTestRuntimeClasspath,latestDepForkedTestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath
 javax.servlet:javax.servlet-api:3.1.0=latest7DepForkedTestCompileClasspath,latest7DepForkedTestRuntimeClasspath,latest7DepTestCompileClasspath,latest7DepTestRuntimeClasspath,latestDepForkedTestCompileClasspath,latestDepForkedTestRuntimeClasspath,latestDepTestCompileClasspath,latestDepTestRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs
 jline:jline:2.14.6=latest7DepForkedTestRuntimeClasspath,latest7DepTestRuntimeClasspath,latestDepForkedTestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath

dd-java-agent/instrumentation/akka-concurrent/gradle.lockfile

@@ -63,7 +63,7 @@ commons-io:commons-io:2.11.0=akka23TestCompileClasspath,akka23TestRuntimeClasspa
 de.thetaphi:forbiddenapis:3.1=compileClasspath
 info.picocli:picocli:4.6.3=akka23TestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath
 io.github.java-diff-utils:java-diff-utils:4.12=zinc
-io.sqreen:libsqreen:10.1.0=akka23TestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=akka23TestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath
 javax.servlet:javax.servlet-api:3.1.0=akka23TestCompileClasspath,akka23TestRuntimeClasspath,latestDepTestCompileClasspath,latestDepTestRuntimeClasspath,testCompileClasspath,testRuntimeClasspath
 jaxen:jaxen:1.2.0=spotbugs
 jline:jline:2.14.6=akka23TestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath

dd-java-agent/instrumentation/akka-http-10.0/gradle.lockfile

@@ -216,7 +216,7 @@ io.netty:netty:3.10.6.Final=lagomTestCompileClasspath,lagomTestRuntimeClasspath
 io.spray:spray-json_2.11:1.3.3=baseForkedTestCompileClasspath,baseForkedTestRuntimeClasspath,baseTestCompileClasspath,baseTestRuntimeClasspath,iastTestCompileClasspath,iastTestRuntimeClasspath
 io.spray:spray-json_2.12:1.3.6=version101ForkedTestCompileClasspath,version101ForkedTestRuntimeClasspath,version101IastTestCompileClasspath,version101IastTestRuntimeClasspath,version101TestCompileClasspath,version101TestRuntimeClasspath
 io.spray:spray-json_2.13:1.3.6=latestDepTestCompileClasspath,latestDepTestRuntimeClasspath,version102Scala213TestCompileClasspath,version102Scala213TestRuntimeClasspath
-io.sqreen:libsqreen:10.1.0=baseForkedTestRuntimeClasspath,baseTestRuntimeClasspath,iastTestRuntimeClasspath,lagomTestRuntimeClasspath,latestDepIastTestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath,version101ForkedTestRuntimeClasspath,version101IastTestRuntimeClasspath,version101TestRuntimeClasspath,version102IastTestRuntimeClasspath,version102Scala213TestRuntimeClasspath
+io.sqreen:libsqreen:11.0.0=baseForkedTestRuntimeClasspath,baseTestRuntimeClasspath,iastTestRuntimeClasspath,lagomTestRuntimeClasspath,latestDepIastTestRuntimeClasspath,latestDepTestRuntimeClasspath,testRuntimeClasspath,version101ForkedTestRuntimeClasspath,version101IastTestRuntimeClasspath,version101TestRuntimeClasspath,version102IastTestRuntimeClasspath,version102Scala213TestRuntimeClasspath
 javax.cache:cache-api:1.0.0=lagomTestCompileClasspath,lagomTestRuntimeClasspath
 javax.inject:javax.inject:1=lagomTestCompileClasspath,lagomTestRuntimeClasspath
 javax.servlet:javax.servlet-api:3.1.0=baseForkedTestCompileClasspath,baseForkedTestRuntimeClasspath,baseTestCompileClasspath,baseTestRuntimeClasspath,iastTestCompileClasspath,iastTestRuntimeClasspath,lagomTestCompileClasspath,lagomTestRuntimeClasspath,latestDepIastTestCompileClasspath,latestDepIastTestRuntimeClasspath,latestDepTestCompileClasspath,latestDepTestRuntimeClasspath,testCompileClasspath,testRuntimeClasspath,version101ForkedTestCompileClasspath,version101ForkedTestRuntimeClasspath,version101IastTestCompileClasspath,version101IastTestRuntimeClasspath,version101TestCompileClasspath,version101TestRuntimeClasspath,version102IastTestCompileClasspath,version102IastTestRuntimeClasspath,version102Scala213TestCompileClasspath,version102Scala213TestRuntimeClasspath