Fix Play server spans losing URL tags on a malformed Host port

[dougqh]

What Does This Do

Parses the port in Play's Host header without throwing.

RequestURIDataAdapter (Play 2.3, 2.4, 2.6) split request.host() on its last : and called Integer.parseInt on the remainder, with no catch. Any malformed port threw from the constructor, and so did a bracketed IPv6 host with no port ([::1], where the last : sits inside the brackets).

• Adds HostHeader to internal-api (datadog.trace.bootstrap.instrumentation.api). It splits host, host:port, [ipv6] and [ipv6]:port without throwing, using IntStringUtils.parseNonNegativeInt for the port.
• The three Play adapters use it. A missing or malformed port is reported as 0, which is what a missing port already produced.

Motivation

The Host header comes from the client. HttpServerDecorator.onRequest calls url(request) inside a try { ... } catch (Exception), so the exception didn't reach the application, but it skipped everything after it in that block:

• http.url and http.hostname
• the URL-based resource name
• callIGCallbackURI, which passes the request URI to AppSec

So a request with a malformed Host port produced a server span without URL tags, and its URI was never passed to AppSec.

Additional Notes

• Stacked on Fix Oracle and jTDS JDBC URL parsing failures (quick fix) #12780, which adds IntStringUtils. I'll retarget this to master once Fix Oracle and jTDS JDBC URL parsing failures (quick fix) #12780 merges.
• HostHeaderTest (JUnit 5, @TableTest) covers the split, including IPv6, empty, non-numeric, negative and overflowing ports.
• The Play 2.6 suite passes on Java 8 (294 tests, 0 failures), the only JVM it supports. Play 2.3 and 2.4 compile; their adapters are identical to 2.6.
• No Play-level test sends a malformed Host header yet. The existing Play server tests are Groovy, and the adapter is now a two-line delegation to HostHeader.
• LambdaEventParser.stripPort duplicates HostHeader.host. I left it alone here because it's on a different branch of the stack.

🤖 Generated with Claude Code

[datadog-datadog-prod-us1-2]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 59.40% (-0.05%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 18793b5 | Docs | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.76 s	14.63 s	[-0.1%; +1.8%] (no difference)
startup:insecure-bank:tracing:Agent	13.63 s	13.64 s	[-0.9%; +0.7%] (no difference)
startup:petclinic:appsec:Agent	17.24 s	16.70 s	[-1.2%; +7.6%] (no difference)
startup:petclinic:iast:Agent	16.84 s	17.05 s	[-2.0%; -0.4%] (maybe better)
startup:petclinic:profiling:Agent	16.88 s	16.94 s	[-1.4%; +0.6%] (no difference)
startup:petclinic:sca:Agent	17.15 s	17.07 s	[-0.3%; +1.3%] (no difference)
startup:petclinic:tracing:Agent	16.20 s	16.20 s	[-1.0%; +1.0%] (no difference)

Commit: 18793b51 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.