Fix AppSec/IAST context dropped when trace.propagation.behavior.extract=ignore/restart (#11666)

Fix AppSec/IAST context dropped when trace.propagation.behavior.extract=ignore/restart

With IGNORE or RESTART, CoreSpanBuilder nulls the remote TagContext parent before
buildSpanContext reaches the instanceof TagContext branch that copies
requestContextDataAppSec/requestContextDataIast. The AppSec context is lost and
GatewayBridge callbacks no-op, silently bypassing WAF/RASP for all inbound requests
in AppSec-enabled services configured to ignore distributed tracing extraction.

Fix: promote the AppSec/IAST data from the TagContext into the builder fields before
nulling the parent. The builder-field path in buildSpanContext applies these after
the parent is gone, preserving the request context while still correctly dropping
trace identifiers and sampling priority.

Fixes: APMSP-3198

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Apply spotless formatting

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Merge branch 'master' into dougqh/fix-appsec-context-extract-ignore

Co-authored-by: devflow.devflow-routing-intake <devflow.devflow-routing-intake@kubernetes.us1.ddbuild.io>

Author: dougqh

dd-trace-core/src/main/java/datadog/trace/core/CoreTracer.java

@@ -1790,6 +1790,18 @@ protected static final AgentSpan startSpan(
 
       // Handle remote terminated span context as span links
       if (parentSpanContext != null && parentSpanContext.isRemote()) {
+        // Preserve AppSec/IAST request context before dropping the remote parent: when
+        // extract=IGNORE or RESTART the TagContext parent is nulled before buildSpanContext
+        // can copy requestContextDataAppSec/Iast into DDSpanContext.
+        if (parentSpanContext instanceof TagContext) {
+          TagContext tc = (TagContext) parentSpanContext;
+          if (builderRequestContextDataAppSec == null) {
+            builderRequestContextDataAppSec = tc.getRequestContextDataAppSec();
+          }
+          if (builderRequestContextDataIast == null) {
+            builderRequestContextDataIast = tc.getRequestContextDataIast();
+          }
+        }
         switch (Config.get().getTracePropagationBehaviorExtract()) {
           case RESTART:
             links = addParentSpanLink(links, parentSpanContext);

dd-trace-core/src/test/java/datadog/trace/core/CoreSpanBuilderTest.java

@@ -422,6 +422,40 @@ void buildContextFromExtractedContextWithIgnoreBehavior() {
     assertTrue(span.getLinks().isEmpty());
   }
 
+  @Test
+  @WithConfig(key = "trace.propagation.behavior.extract", value = "ignore")
+  void appSecContextPreservedFromTagContextWithIgnoreBehavior() {
+    Object appSecData = new Object();
+    Object iastData = new Object();
+    TagContext tagContext =
+        new TagContext()
+            .withRequestContextDataAppSec(appSecData)
+            .withRequestContextDataIast(iastData);
+
+    DDSpan span = (DDSpan) tracer.buildSpan("test", "op name").asChildOf(tagContext).start();
+
+    assertEquals(appSecData, span.getRequestContext().getData(RequestContextSlot.APPSEC));
+    assertEquals(iastData, span.getRequestContext().getData(RequestContextSlot.IAST));
+    span.finish();
+  }
+
+  @Test
+  @WithConfig(key = "trace.propagation.behavior.extract", value = "restart")
+  void appSecContextPreservedFromTagContextWithRestartBehavior() {
+    Object appSecData = new Object();
+    Object iastData = new Object();
+    TagContext tagContext =
+        new TagContext()
+            .withRequestContextDataAppSec(appSecData)
+            .withRequestContextDataIast(iastData);
+
+    DDSpan span = (DDSpan) tracer.buildSpan("test", "op name").asChildOf(tagContext).start();
+
+    assertEquals(appSecData, span.getRequestContext().getData(RequestContextSlot.APPSEC));
+    assertEquals(iastData, span.getRequestContext().getData(RequestContextSlot.IAST));
+    span.finish();
+  }
+
   @TableTest({
     "scenario      | origin      | tagMap      ",
     "empty tag map |             | [:]         ",