Avoid copying redacted MongoDB binary values

[amarziali]

What Does This Do

Both BSON scrubbers currently read binary payloads into memory before replacing them with "?" in the span resource name. Use BsonReader.skipValue() instead, preserving the field name and redacted output while avoiding the payload allocation and copy.

Benchmark results

Standalone JMH benchmark using the full before/after BsonScrubber34 implementations and BsonBinaryReader, with pre-encoded inputs and identical output verification:

Binary payload	Allocation before → after	Scrubbing time before → after
16 B	800 → 768 B/op	367 → 342 ns/op
4 KiB	4,880 → 768 B/op	374 → 331 ns/op
1 MiB	1,049,360 → 768 B/op	26.1 → 0.316 µs/op

JMH 1.37, Temurin 17.0.18, Apple M4 Max, BSON 3.4.0; three forks, two 1-second warmups, three 1-second measurements, one thread, 512 MiB heap, and GC profiling. Input encoding is excluded. The 4 KiB timing confidence intervals overlap; its allocation reduction is clear.

Benchmark sources and results remain outside the PR.

Motivation

Additional Notes

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: [PROJ-IDENT]

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T07:33:50.259817Z	1665229	PR opened
🔒 Security Review	✅ Completed 2026-09-21T07:34:23.557233Z	1665229	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[datadog-datadog-us1-prod]

More details

Both scrubbers skip binary data without a copy. The field name, redacted output, and reader state stay correct.

Was this helpful? React 👍 or 👎

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 1665229 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[datadog-datadog-us1-prod]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 59.10% (-0.04%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 1665229 | Docs | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	14.07 s	14.03 s	[-0.5%; +1.0%] (no difference)
startup:insecure-bank:tracing:Agent	12.92 s	13.05 s	[-1.8%; -0.2%] (maybe better)
startup:petclinic:appsec:Agent	17.66 s	17.50 s	[+0.2%; +1.6%] (maybe worse)
startup:petclinic:iast:Agent	17.44 s	17.51 s	[-1.2%; +0.4%] (no difference)
startup:petclinic:profiling:Agent	17.44 s	17.17 s	[+0.4%; +2.8%] (maybe worse)
startup:petclinic:sca:Agent	17.66 s	17.51 s	[-0.1%; +1.8%] (no difference)
startup:petclinic:tracing:Agent	16.57 s	16.84 s	[-2.7%; -0.6%] (maybe better)

Commit: 16652290 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[sarahchen6]

LGTM!