Implement SCA Reachability runtime detection: report vulnerable classes and callsites via telemetry#11352

Draft

jandro996 wants to merge 36 commits into

alejandro.gonzalez/sca-reachability

Commits on May 12, 2026

Implement SCA Reachability: detect vulnerable library classes at runtime
jandro996
committed

Commits on May 13, 2026

Commit sca_cves.json as versioned resource; update generateScaCvesJson task
jandro996
committed
Fix Path B classpath scan for Java 9+: fall back to java.class.path
jandro996
committed
Add Java 9+ test for Path B classpath fallback; make method package-private
jandro996
committed
Implement method-level symbol detection with ASM bytecode injection
jandro996
committed
Retransform classes for method-level detection: already-loaded and version-unresolved
jandro996
committed
Fix: remove incorrect dedup from injectCallbacks; update invariants
jandro996
committed
pr-review: fix null guard, encapsulate periodicWorkCallback, update Javadoc, add retransform tests
jandro996
committed
Fix two Codex review issues: java.nio in premain and transitive JAR resolution
jandro996
committed
Refactor: extract CLASS_LEVEL_SYMBOL constant and reportClassLevelHitIfPresent helper
jandro996
committed
Move CLASS_LEVEL_SYMBOL to ScaReachabilityHit; fix misleading comment
jandro996
committed
Move java.nio comment to usage site; add tests for transitive JAR fallback
jandro996
committed
Remove dead visitCode() override and redundant CLASS_LEVEL_SYMBOL alias
jandro996
committed
Capture callsite for method-level hits (mirrors Python tracer)
jandro996
committed
Move callsite detection from bootstrap to ScaReachabilitySystem handler
jandro996
committed
Use AbstractStackWalker.isNotDatadogTraceStackElement for callsite filtering
jandro996
committed
Add tests for ScaReachabilitySystem.findCallsite(); document fallback path
jandro996
committed
Update ScaReachabilityHit Javadoc to reflect dual callsite/symbol semantics
jandro996
committed
Move findCallsite() after start() — helpers after main public method
jandro996
committed
Use ConcurrentHashMap.newKeySet() instead of verbose newSetFromMap idiom
jandro996
committed
Lazy entryHasMethodLevelSymbol check — avoid stream alloc on normal path
jandro996
committed
Remove Path B from startup scan — JDK symbols are false positive indicators
jandro996
committed
Remove dead processPathB() — never called after Path B removal
jandro996
committed
Fix dedup key to include class name for method-level hits
jandro996
committed

Commits on May 14, 2026