Reduce DBM comment buffer allocation

[amarziali]

What Does This Do

Size the DBM comment buffer from the URL-encoded fields instead of allocating a 1,024-character buffer. This reduces excess allocation for short comments and avoids buffer growth for larger comments.

Preserves the cached static prefix, encodes each dynamic value once, and keeps comment content unchanged. Applies to the shared builder used by JDBC and MongoDB.

Includes regression tests and a committed JMH benchmark with reproduction instructions.

Benchmark results for complete SQL comment injection:

Metadata	Before B/op	After B/op	Before ns/op	After ns/op
Short, without traceparent	1,987	1,059	183	152
Short, with traceparent	2,395	1,539	285	251
Long ASCII	17,331	15,657	3,636	3,530
URL-escaped	14,968	12,936	3,378	3,396

Short inputs allocate 856–928 fewer bytes per operation and take 12–17% less time. Escaped-input timing intervals overlap; that case demonstrates allocation savings only. These measurements do not establish application throughput gains.

Motivation

Additional Notes

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: [PROJ-IDENT]

[dd-octo-sts]

Hi! 👋 Thanks for your pull request! 🎉

To help us review it, please make sure to:

• Remove the issue linking keyword

If you need help, please check our contributing guidelines.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T09:15:45.154543Z	8702d7e	PR opened
🔒 Security Review	✅ Completed 2026-09-21T09:16:53.358587Z	8702d7e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-prod-us1-2]

More details

The new capacity uses each encoded value and keeps the existing comment output for large, escaped, and empty values.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 8702d7e · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.91 s	14.63 s	[+0.9%; +2.9%] (maybe worse)
startup:insecure-bank:tracing:Agent	13.59 s	13.70 s	[-1.8%; +0.2%] (no difference)
startup:petclinic:appsec:Agent	17.61 s	17.40 s	[+0.3%; +2.1%] (maybe worse)
startup:petclinic:iast:Agent	17.36 s	17.60 s	[-2.2%; -0.6%] (maybe better)
startup:petclinic:profiling:Agent	17.39 s	17.29 s	[-0.7%; +1.9%] (no difference)
startup:petclinic:sca:Agent	17.38 s	16.69 s	[-0.1%; +8.3%] (no difference)
startup:petclinic:tracing:Agent	16.51 s	16.71 s	[-2.3%; -0.1%] (maybe better)

Commit: 8702d7e5 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[vandonr]

nice perf improvement, the downside I see is that now we manually have to

• ensure values are encoded before they are appended
• keep in sync the size computation and the actual appending
  (nothing in the code enforcing those)

We could just prepare all the strings, and pass them as a list of key/value pairs to a function that'd then do one pass to encode and compute the size, and a second pass to actually append to the SB. This would mean allocating a collection though...

[amarziali]

nice perf improvement, the downside I see is that now we manually have to

• ensure values are encoded before they are appended
• keep in sync the size computation and the actual appending
  (nothing in the code enforcing those)

We could just prepare all the strings, and pass them as a list of key/value pairs to a function that'd then do one pass to encode and compute the size, and a second pass to actually append to the SB. This would mean allocating a collection though...

I think this is a fair point. For this PR, I’d prefer to keep the fixed fields explicit and avoid intermediate allocations. Missing a field from the capacity calculation would only cause buffer growth, not incorrect output. The regression tests cover encoding and comment content.

[amarziali]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-09-22 11:49:42 UTC ℹ️ Start processing command /merge

---

2026-09-22 11:49:46 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-09-22 12:53:13 UTC ℹ️ MergeQueue: This merge request was merged