cw-datadog 2.23.0.2

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative 'gateway/request'
+require_relative '../../instrumentation/gateway'
+require_relative '../../response'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Rack request body middleware for AppSec
+        # This should be inserted just below Rack::JSONBodyParser or
+        # legacy Rack::PostBodyContentTypeParser from rack-contrib
+        class RequestBodyMiddleware
+          def initialize(app, opt = {})
+            @app = app
+          end
+
+          def call(env)
+            context = env[Datadog::AppSec::Ext::CONTEXT_KEY]
+
+            return @app.call(env) unless context
+
+            # TODO: handle exceptions, except for @app.call
+
+            http_response = nil
+            interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
+              http_response, _request = Instrumentation.gateway.push('rack.request.body', Gateway::Request.new(env)) do
+                @app.call(env)
+              end
+
+              nil
+            end
+
+            return AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack if interrupt_params
+
+            http_response
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+require 'json'
+
+require_relative 'gateway/request'
+require_relative 'gateway/response'
+
+require_relative '../../event'
+require_relative '../../response'
+require_relative '../../api_security'
+require_relative '../../security_event'
+require_relative '../../instrumentation/gateway'
+
+require_relative '../../../tracing/client_ip'
+require_relative '../../../tracing/contrib/rack/header_collection'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        WAF_VENDOR_HEADERS_TAGS = %w[
+          X-Amzn-Trace-Id
+          Cloudfront-Viewer-Ja3-Fingerprint
+          Cf-Ray
+          X-Cloud-Trace-Context
+          X-Appgw-Trace-id
+          X-SigSci-RequestID
+          X-SigSci-Tags
+          Akamai-User-Risk
+        ].map(&:downcase).freeze
+
+        # Topmost Rack middleware for AppSec
+        # This should be inserted just below Datadog::Tracing::Contrib::Rack::TraceMiddleware
+        class RequestMiddleware
+          def initialize(app, opt = {})
+            @app = app
+
+            @oneshot_tags_sent = false
+            @rack_headers = {}
+          end
+
+          # rubocop:disable Metrics/MethodLength
+          def call(env)
+            return @app.call(env) unless Datadog::AppSec.enabled?
+
+            boot = Datadog::Core::Remote::Tie.boot
+            Datadog::Core::Remote::Tie::Tracing.tag(boot, active_span)
+
+            # For a given request, keep using the first Rack stack scope for
+            # nested apps. Don't set `context` local variable so that on popping
+            # out of this nested stack we don't finalize the parent's context
+            return @app.call(env) if active_context(env)
+
+            security_engine = Datadog::AppSec.security_engine
+
+            # TODO: handle exceptions, except for @app.call
+            return @app.call(env) unless security_engine
+
+            ctx = Datadog::AppSec::Context.activate(
+              Datadog::AppSec::Context.new(active_trace, active_span, security_engine.new_runner)
+            )
+            env[Datadog::AppSec::Ext::CONTEXT_KEY] = ctx
+
+            add_appsec_tags(ctx)
+            add_request_tags(ctx, env)
+
+            http_response = nil
+            gateway_request = Gateway::Request.new(env)
+            gateway_response = nil
+
+            interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
+              # TODO: This event should be renamed into `rack.request.start` to
+              #       reflect that it's the beginning of the request-cycle
+              http_response, _gateway_request = Instrumentation.gateway.push('rack.request', gateway_request) do
+                @app.call(env)
+              end
+
+              gateway_response = Gateway::Response.new(
+                http_response[2], http_response[0], http_response[1], context: ctx
+              )
+
+              Instrumentation.gateway.push('rack.request.finish', gateway_request)
+              Instrumentation.gateway.push('rack.response', gateway_response)
+
+              nil
+            end
+
+            if interrupt_params
+              ctx.mark_as_interrupted!
+              http_response = AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack
+            end
+
+            # NOTE: This is not optimal, but in the current implementation
+            #       `gateway_response` is a container to dispatch response event
+            #       and in case of interruption it suppose to be `nil`.
+            #
+            #       `http_response` is a real response object in both cases, but
+            #       to save us some computations, we will use already pre-computed
+            #       `gateway_response` instead of re-creating it.
+            #
+            # WARNING: This part will be refactored.
+            tmp_response = if interrupt_params
+              Gateway::Response.new(http_response[2], http_response[0], http_response[1], context: ctx)
+            else
+              gateway_response
+            end
+
+            if AppSec::APISecurity.enabled? && AppSec::APISecurity.sample_trace?(ctx.trace) &&
+                AppSec::APISecurity.sample?(gateway_request.request, tmp_response.response)
+              ctx.events.push(
+                AppSec::SecurityEvent.new(ctx.extract_schema, trace: ctx.trace, span: ctx.span)
+              )
+            end
+
+            AppSec::Event.record(ctx, request: gateway_request, response: gateway_response)
+
+            http_response
+          ensure
+            if ctx
+              ctx.export_metrics
+              ctx.export_request_telemetry
+
+              Datadog::AppSec::Context.deactivate
+            end
+          end
+          # rubocop:enable Metrics/MethodLength
+
+          private
+
+          def active_context(env)
+            env[Datadog::AppSec::Ext::CONTEXT_KEY]
+          end
+
+          def active_trace
+            # TODO: factor out tracing availability detection
+
+            return unless defined?(Datadog::Tracing)
+
+            Datadog::Tracing.active_trace
+          end
+
+          def active_span
+            # TODO: factor out tracing availability detection
+
+            return unless defined?(Datadog::Tracing)
+
+            Datadog::Tracing.active_span
+          end
+
+          # standard:disable Metrics/MethodLength
+          def add_appsec_tags(context)
+            span = context.span
+            trace = context.trace
+
+            return unless trace && span
+
+            span.set_metric(Datadog::AppSec::Ext::TAG_APPSEC_ENABLED, 1)
+            span.set_tag('_dd.runtime_family', 'ruby')
+            span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
+
+            if context.waf_runner_ruleset_version
+              span.set_tag('_dd.appsec.event_rules.version', context.waf_runner_ruleset_version)
+
+              unless oneshot_tags_sent?
+                # Small race condition, but it's inoccuous: worst case the tags
+                # are sent a couple of times more than expected
+                @oneshot_tags_sent = true
+
+                span.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(context.waf_runner_known_addresses))
+
+                # Ensure these tags reach the backend
+                trace.keep!
+                trace.set_tag(
+                  Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+                  Datadog::Tracing::Sampling::Ext::Decision::ASM
+                )
+              end
+            end
+          end
+          # standard:enable Metrics/MethodLength
+
+          # standard:disable Metrics/MethodLength
+          def add_request_tags(context, env)
+            span = context.span
+
+            return unless span
+
+            # Always add WAF vendors headers
+            WAF_VENDOR_HEADERS_TAGS.each do |lowercase_header|
+              rack_header = to_rack_header(lowercase_header)
+              span.set_tag("http.request.headers.#{lowercase_header}", env[rack_header]) if env[rack_header]
+            end
+
+            if span && span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
+              request_header_collection = Datadog::Tracing::Contrib::Rack::Header::RequestHeaderCollection.new(env)
+
+              # always collect client ip, as this is part of AppSec provided functionality
+              Datadog::Tracing::ClientIp.set_client_ip_tag!(
+                span,
+                headers: request_header_collection,
+                remote_ip: env['REMOTE_ADDR']
+              )
+            end
+          end
+          # standard:enable Metrics/MethodLength
+
+          def oneshot_tags_sent?
+            @oneshot_tags_sent
+          end
+
+          def to_rack_header(header)
+            @rack_headers[header] ||= Datadog::Tracing::Contrib::Rack::Header.to_rack_header(header)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/ext.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Rails integration constants
+        module Ext
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/framework.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Rails specific framework tie
+        module Framework
+          def self.setup
+            Datadog.configuration.appsec.instrument(:rack)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/gateway/request.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require_relative '../../../instrumentation/gateway/argument'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Gateway
+          # Gateway Request argument. Normalized extration of data from ActionDispatch::Request
+          class Request < Instrumentation::Gateway::Argument
+            attr_reader :request
+
+            def initialize(request)
+              super()
+              @request = request
+            end
+
+            def env
+              request.env
+            end
+
+            def headers
+              request.headers
+            end
+
+            def host
+              request.host
+            end
+
+            def user_agent
+              request.user_agent
+            end
+
+            def remote_addr
+              request.remote_addr
+            end
+
+            def parsed_body
+              # force body parameter parsing, which is done lazily by Rails
+              request.parameters
+
+              # usually Hash<String,String> but can be a more complex
+              # Hash<String,String||Array||Hash> when e.g coming from JSON or
+              # with Rails advanced param square bracket parsing
+              body = request.env['action_dispatch.request.request_parameters']
+
+              return if body.nil?
+
+              body.reject do |k, _v|
+                request.env['action_dispatch.request.path_parameters'].key?(k)
+              end
+            end
+
+            def route_params
+              excluded = [:controller, :action]
+
+              request.env['action_dispatch.request.path_parameters'].reject do |k, _v|
+                excluded.include?(k)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require_relative '../../../event'
+require_relative '../../../trace_keeper'
+require_relative '../../../security_event'
+require_relative '../../../instrumentation/gateway'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Gateway
+          # Watcher for Rails gateway events
+          module Watcher
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
+
+                watch_request_action(gateway)
+                watch_response_body_json(gateway)
+              end
+
+              def watch_request_action(gateway = Instrumentation.gateway)
+                gateway.watch('rails.request.action', :appsec) do |stack, gateway_request|
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
+
+                  persistent_data = {
+                    'server.request.body' => gateway_request.parsed_body,
+                    'server.request.path_params' => gateway_request.route_params
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
+                    AppSec::ActionsHandler.handle(result.actions)
+                  end
+
+                  stack.call(gateway_request.request)
+                end
+              end
+
+              def watch_response_body_json(gateway = Instrumentation.gateway)
+                gateway.watch('rails.response.body.json', :appsec) do |stack, container|
+                  context = container.context
+
+                  persistent_data = {
+                    'server.response.body' => container.data
+                  }
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
+                    AppSec::ActionsHandler.handle(result.actions)
+                  end
+
+                  stack.call(container)
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/integration.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require_relative '../integration'
+
+require_relative 'patcher'
+require_relative 'request_middleware'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Description of Rails integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('4')
+
+          register_as :rails, auto_patch: false
+
+          def self.version
+            Gem.loaded_specs['railties']&.version
+          end
+
+          def self.loaded?
+            !defined?(::Rails).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            true
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -0,0 +1,171 @@
+# frozen_string_literal: true
+
+require_relative '../../../core/utils/only_once'
+
+require_relative 'framework'
+require_relative '../../response'
+require_relative '../rack/request_middleware'
+require_relative '../rack/request_body_middleware'
+require_relative 'gateway/watcher'
+require_relative 'gateway/request'
+require_relative 'patches/render_to_body_patch'
+require_relative 'patches/process_action_patch'
+require_relative '../../api_security/endpoint_collection/rails_collector'
+
+require_relative '../../../tracing/contrib/rack/middlewares'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Patcher for AppSec on Rails
+        module Patcher
+          GUARD_ACTION_CONTROLLER_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+          GUARD_ROUTES_REPORTING_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+          BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+          AFTER_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Gateway::Watcher.watch
+            patch_before_initialize
+            patch_after_initialize
+            patch_action_controller
+            subscribe_to_routes_loaded
+
+            Patcher.instance_variable_set(:@patched, true)
+          end
+
+          def patch_before_initialize
+            ::ActiveSupport.on_load(:before_initialize) do
+              Datadog::AppSec::Contrib::Rails::Patcher.before_initialize(self)
+            end
+          end
+
+          def before_initialize(app)
+            BEFORE_INITIALIZE_ONLY_ONCE_PER_APP[app].run do
+              # Middleware must be added before the application is initialized.
+              # Otherwise the middleware stack will be frozen.
+              add_middleware(app) if Datadog.configuration.tracing[:rails][:middleware]
+
+              ::ActionController::Metal.prepend(Patches::ProcessActionPatch)
+            end
+          end
+
+          def add_middleware(app)
+            # Add trace middleware
+            if include_middleware?(Datadog::Tracing::Contrib::Rack::TraceMiddleware, app)
+              app.middleware.insert_after(
+                Datadog::Tracing::Contrib::Rack::TraceMiddleware,
+                Datadog::AppSec::Contrib::Rack::RequestMiddleware
+              )
+            else
+              app.middleware.insert_before(0, Datadog::AppSec::Contrib::Rack::RequestMiddleware)
+            end
+          end
+
+          def include_middleware?(middleware, app)
+            found = false
+
+            # find tracer middleware reference in Rails::Configuration::MiddlewareStackProxy
+            app.middleware.instance_variable_get(:@operations).each do |operation|
+              args = case operation
+              when Array
+                # rails 5.2
+                _op, args = operation
+                args
+              when Proc
+                if operation.binding.local_variables.include?(:args)
+                  # rails 6.0, 6.1
+                  operation.binding.local_variable_get(:args)
+                else
+                  # rails 7.0 uses ... to pass args
+                  args_getter = Class.new do
+                    def method_missing(_op, *args) # standard:disable Style/MissingRespondToMissing
+                      args
+                    end
+                  end.new
+                  operation.call(args_getter)
+                end
+              else
+                # unknown, pass through
+                []
+              end
+
+              found = true if args.include?(middleware)
+            end
+
+            found
+          end
+
+          def inspect_middlewares(app)
+            Datadog.logger.debug { +'Rails middlewares: ' << app.middleware.map(&:inspect).inspect }
+          end
+
+          def patch_after_initialize
+            ::ActiveSupport.on_load(:after_initialize) do
+              Datadog::AppSec::Contrib::Rails::Patcher.after_initialize(self)
+            end
+          end
+
+          def after_initialize(app)
+            AFTER_INITIALIZE_ONLY_ONCE_PER_APP[app].run do
+              # Finish configuring the tracer after the application is initialized.
+              # We need to wait for some things, like application name, middleware stack, etc.
+              setup_security
+              inspect_middlewares(app)
+            end
+          end
+
+          def patch_action_controller
+            ::ActiveSupport.on_load(:action_controller) do
+              GUARD_ACTION_CONTROLLER_ONCE_PER_APP[self].run do
+                ::ActionController::Base.prepend(Patches::RenderToBodyPatch)
+              end
+
+              # Rails 7.1 adds `after_routes_loaded` hook
+              if Datadog::AppSec::Contrib::Rails::Patcher.target_version < Gem::Version.new('7.1')
+                Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(::Rails.application.routes.routes)
+              end
+            end
+          end
+
+          def subscribe_to_routes_loaded
+            ::ActiveSupport.on_load(:after_routes_loaded) do |app|
+              Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(app.routes.routes)
+            end
+          end
+
+          def report_routes_via_telemetry(routes)
+            # We do not support Rails 4.x for Endpoint Collection,
+            # mainly because the Route#verb was a Regexp before Rails 5.0
+            return if target_version < Gem::Version.new('5.0')
+            return unless Datadog.configuration.appsec.api_security.endpoint_collection.enabled
+            return unless AppSec.telemetry
+
+            GUARD_ROUTES_REPORTING_ONCE_PER_APP[::Rails.application].run do
+              AppSec.telemetry.app_endpoints_loaded(
+                APISecurity::EndpointCollection::RailsCollector.new(routes).to_enum
+              )
+            end
+          rescue => e
+            AppSec.telemetry&.report(e, description: 'failed to report application endpoints')
+          end
+
+          def setup_security
+            Datadog::AppSec::Contrib::Rails::Framework.setup
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/patches/process_action_patch.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Patches
+          # Hook into ActionController::Instrumentation#process_action, which encompasses action filters
+          module ProcessActionPatch
+            def process_action(*args)
+              context = request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
+              return super unless context
+
+              # TODO: handle exceptions, except for super
+              gateway_request = Gateway::Request.new(request)
+              http_response, _gateway_request = Instrumentation.gateway.push('rails.request.action', gateway_request) do
+                super
+              end
+
+              http_response
+            end
+          end
+        end
+      end
+    end
+  end
+end