cw-datadog 2.23.0.2

data/lib/datadog/appsec/security_engine/runner.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+require_relative 'result'
+
+module Datadog
+  module AppSec
+    module SecurityEngine
+      # A class that check input via security engine (WAF) and respond with result.
+      class Runner
+        SUCCESSFUL_EXECUTION_CODES = [:ok, :match].freeze
+
+        attr_reader :ruleset_version
+
+        def initialize(handle_ref, ruleset_version:)
+          @mutex = Mutex.new
+          @handle_ref = handle_ref
+          @waf_handle = handle_ref.acquire
+          @ruleset_version = ruleset_version
+
+          @debug_tag = "libddwaf:#{WAF::VERSION::STRING} method:ddwaf_run"
+        end
+
+        def run(persistent_data, ephemeral_data, timeout = WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
+          @mutex.lock
+
+          start_ns = Core::Utils::Time.get_time(:nanosecond)
+          persistent_data.reject! do |_, v|
+            next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)
+
+            v.nil? || v.empty?
+          end
+
+          ephemeral_data.reject! do |_, v|
+            next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)
+
+            v.nil? || v.empty?
+          end
+
+          result = try_run(persistent_data, ephemeral_data, timeout)
+          stop_ns = Core::Utils::Time.get_time(:nanosecond)
+
+          report_execution(result)
+
+          unless SUCCESSFUL_EXECUTION_CODES.include?(result.status)
+            return Result::Error.new(duration_ext_ns: stop_ns - start_ns, input_truncated: result.input_truncated?)
+          end
+
+          klass = (result.status == :match) ? Result::Match : Result::Ok
+          klass.new(
+            events: result.events,
+            actions: result.actions,
+            attributes: result.attributes,
+            keep: result.keep?,
+            timeout: result.timeout?,
+            duration_ns: result.duration,
+            duration_ext_ns: (stop_ns - start_ns),
+            input_truncated: result.input_truncated?
+          )
+        ensure
+          @mutex.unlock
+        end
+
+        def waf_context
+          @waf_context ||= @waf_handle.build_context
+        end
+
+        def waf_addresses
+          @waf_handle.known_addresses
+        end
+
+        def finalize!
+          @waf_context&.finalize!
+        ensure
+          @handle_ref.release(@waf_handle)
+        end
+
+        private
+
+        def try_run(persistent_data, ephemeral_data, timeout)
+          waf_context.run(persistent_data, ephemeral_data, timeout)
+        rescue WAF::LibDDWAFError => e
+          Datadog.logger.debug { "#{@debug_tag} execution error: #{e} backtrace: #{e.backtrace&.first(3)}" }
+          AppSec.telemetry.report(e, description: 'libddwaf-rb internal low-level error')
+
+          WAF::Result.new(
+            status: :err_internal,
+            events: [],
+            actions: {},
+            attributes: {},
+            duration: 0,
+            keep: false,
+            timeout: false
+          )
+        end
+
+        def report_execution(result)
+          Datadog.logger.debug { "#{@debug_tag} execution timed out: #{result.inspect}" } if result.timeout?
+
+          if SUCCESSFUL_EXECUTION_CODES.include?(result.status)
+            Datadog.logger.debug { "#{@debug_tag} execution result: #{result.inspect}" }
+          else
+            message = "#{@debug_tag} execution error: #{result.status.inspect}"
+
+            Datadog.logger.debug { message }
+            AppSec.telemetry.error(message)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/security_engine.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # A namespace for secutiry library we use to detect and prevent threats.
+    module SecurityEngine
+    end
+  end
+end

data/lib/datadog/appsec/security_event.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # A class that represents a security event of any kind. It could be an event
+    # representing an attack or fingerprinting results as attributes or an API
+    # security check with extracted schema.
+    class SecurityEvent
+      SCHEMA_KEY_PREFIX = '_dd.appsec.s.'
+      FINGERPRINT_KEY_PREFIX = '_dd.appsec.fp.'
+
+      attr_reader :waf_result, :trace, :span
+
+      def initialize(waf_result, trace:, span:)
+        @waf_result = waf_result
+        @trace = trace
+        @span = span
+      end
+
+      def keep?
+        @waf_result.keep?
+      end
+
+      def schema?
+        return @has_schema if defined?(@has_schema)
+
+        @has_schema = @waf_result.attributes.any? { |name, _| name.start_with?(SCHEMA_KEY_PREFIX) }
+      end
+
+      def fingerprint?
+        return @has_fingerprint if defined?(@has_fingerprint)
+
+        @has_fingerprint = @waf_result.attributes.any? { |name, _| name.start_with?(FINGERPRINT_KEY_PREFIX) }
+      end
+    end
+  end
+end

data/lib/datadog/appsec/thread_safe_ref.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # This class is used for referencing an object that might be marked
+    # for finalization in another thread.
+    #
+    # References to the object are counted, and objects marked for finalization
+    # can be safely finalized when their reference count reaches zero.
+    class ThreadSafeRef
+      def initialize(initial_obj, finalizer: :finalize!)
+        @current = initial_obj
+        @finalizer = finalizer
+
+        @counters = Hash.new(0)
+        @outdated = []
+        @mutex = Mutex.new
+      end
+
+      def acquire
+        @mutex.synchronize do
+          @counters[@current] += 1
+
+          @current
+        end
+      end
+
+      def release(obj)
+        @mutex.synchronize do
+          @counters[obj] -= 1
+
+          @outdated.reject! do |outdated_obj|
+            next unless @counters[outdated_obj].zero?
+
+            finalize(outdated_obj)
+          end
+        end
+      end
+
+      def current=(obj)
+        @mutex.synchronize do
+          @outdated << @current
+
+          @current = obj
+        end
+      end
+
+      private
+
+      def finalize(obj)
+        obj.public_send(@finalizer)
+
+        true
+      rescue => e
+        Datadog.logger.debug("Couldn't finalize #{obj.class.name} object, error: #{e.inspect}")
+
+        true
+      end
+    end
+  end
+end

data/lib/datadog/appsec/trace_keeper.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # This class is used to mark trace as manual keep and tag it as ASM product.
+    module TraceKeeper
+      def self.keep!(trace)
+        return unless trace
+
+        # NOTE: This action will not set correct decision maker value, so the
+        #       trace keeping must be done with additional steps below
+        trace.keep!
+
+        # Propagate to downstream services the information that
+        # the current distributed trace is containing at least one ASM event.
+        trace.set_tag(
+          Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+          Tracing::Sampling::Ext::Decision::ASM
+        )
+        trace.set_distributed_source(Ext::PRODUCT_BIT)
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/hash_coercion.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Utils
+      # A module for coercing arbitrary objects into hashes.
+      module HashCoercion
+        # A best effort to coerce an object to a hash with methods known to various
+        # frameworks with a fallback to standard library.
+        #
+        # @param object [Object] The object to coerce.
+        # @return [Hash, nil] The coerced `Hash` or `nil` if the object is not coercible.
+        def self.coerce(object)
+          return object.as_json if object.respond_to?(:as_json)
+          return object.to_hash if object.respond_to?(:to_hash)
+          return object.to_h if object.respond_to?(:to_h)
+
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http/media_range.rb

@@ -0,0 +1,201 @@
+# frozen_string_literal: true
+
+require_relative 'media_type'
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        # Implementation of media range for content negotiation
+        class MediaRange
+          class ParseError < ::StandardError
+          end
+
+          WILDCARD = '*'
+          WILDCARD_RE = ::Regexp.escape(WILDCARD)
+
+          # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
+          TOKEN_RE = /[-#$%&'*+.^_`|~A-Za-z0-9]+/.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
+          PARAMETER_RE = %r{ # rubocop:disable Style/RegexpLiteral
+            (?:
+              (?<parameter_name>#{TOKEN_RE})
+              =
+              (?:
+                (?<parameter_value>#{TOKEN_RE})
+                |
+                "(?<parameter_value>[^"]+)"
+              )
+            )
+          }ix.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
+          ACCEPT_EXT_RE = %r{ # rubocop:disable Style/RegexpLiteral
+            (?:
+              (?<ext_name>#{TOKEN_RE})
+              =
+              (?:
+                (?<ext_value>#{TOKEN_RE})
+                |
+                "(?<ext_value>[^"]+)"
+              )
+            )
+          }ix.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-5.3.1
+          QVALUE_RE = %r{ # rubocop:disable Style/RegexpLiteral
+            0(?:\.\d{1,3})?
+            |
+            1(?:\.0{1,3})?
+          }ix.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
+          MEDIA_RANGE_RE = %r{
+            \A
+            (?:
+              (?<type>#{WILDCARD_RE})/(?<subtype>#{WILDCARD_RE})
+              |
+              (?<type>#{TOKEN_RE})/(?<subtype>#{WILDCARD_RE})
+              |
+              (?<type>#{TOKEN_RE})/(?<subtype>#{TOKEN_RE})
+            )
+            (?<parameters>
+              (?:
+                \s*;\s*
+                (?!q=)
+                #{PARAMETER_RE}
+              )*
+            )
+            (?<accept_params>
+              (?<weight>
+                \s*;\s*
+                (?:q=
+                  (?<quality>
+                    #{QVALUE_RE}
+                  )
+                )
+              )
+              (?<accept_exts>
+                (?<accept_ext>
+                  (?:
+                    \s*;\s*
+                    (?!q=)
+                    #{ACCEPT_EXT_RE}
+                  )*
+                )
+              )
+            )?
+            \Z
+          }ix.freeze
+
+          attr_reader :type, :subtype, :quality, :parameters, :accept_ext
+
+          def initialize(media_range) # rubocop:disable Metrics/PerceivedComplexity, Metrics/CyclomaticComplexity
+            media_range_match = MEDIA_RANGE_RE.match(media_range)
+
+            raise ParseError, media_range.inspect if media_range_match.nil?
+
+            @type = (media_range_match['type'] || WILDCARD).downcase
+            @subtype = (media_range_match['subtype'] || WILDCARD).downcase
+            @quality = (media_range_match['quality'] || 1.0).to_f
+            @parameters = {}
+            @accept_ext = {}
+
+            parameters = media_range_match['parameters']
+
+            return if parameters.nil?
+
+            parameters.split(';').map(&:strip).each do |parameter|
+              parameter_match = PARAMETER_RE.match(parameter)
+
+              next if parameter_match.nil?
+
+              parameter_name = parameter_match['parameter_name']
+              parameter_value = parameter_match['parameter_value']
+
+              next if parameter_name.nil? || parameter_value.nil?
+
+              @parameters[parameter_name.downcase] = parameter_value.downcase
+            end
+
+            accept_exts = media_range_match['accept_exts']
+
+            return if accept_exts.nil?
+
+            accept_exts.split(';').map(&:strip).each do |ext|
+              ext_match = ACCEPT_EXT_RE.match(ext)
+
+              next if ext_match.nil?
+
+              ext_name = ext_match['ext_name']
+              ext_value = ext_match['ext_value']
+
+              next if ext_name.nil? || ext_value.nil?
+
+              @accept_ext[ext_name.downcase] = ext_value.downcase
+            end
+          end
+
+          # Compare two MediaRange for ordering
+          def <=>(other)
+            unless (q = quality <=> other.quality) == 0 || q.nil?
+              return q
+            end
+
+            if (s = specificity <=> other.specificity) != 0
+              return s
+            end
+
+            unless wildcard?(:type)
+              if wildcard?(:subtype) && !other.wildcard?(:subtype)
+                return -1
+              elsif !wildcard?(:subtype) && other.wildcard?(:subtype)
+                return 1
+              end
+            end
+
+            if wildcard?(:type) && !other.wildcard?(:type)
+              return -1
+            elsif !wildcard?(:type) && other.wildcard?(:type)
+              return 1
+            end
+
+            0
+          end
+
+          # Compare with a MediaType for match
+          #
+          # returns true if the MediaType is accepted by this MediaRange
+          def ===(other)
+            return self === MediaType.new(other) if other.is_a?(::String)
+
+            type == other.type && subtype == other.subtype && other.parameters.all? { |k, v| parameters[k] == v } ||
+              type == other.type && wildcard?(:subtype) ||
+              wildcard?(:type) && wildcard?(:subtype)
+          end
+
+          def specificity
+            @parameters.count
+          end
+
+          def wildcard?(field = nil)
+            return wildcard?(:type) || wildcard?(:subtype) if field.nil?
+
+            instance_variable_get(:"@#{field}") == WILDCARD
+          end
+
+          def to_s
+            s = +"#{@type}/#{@subtype}"
+
+            s << ';' << @parameters.map { |k, v| "#{k}=#{v}" }.join(';') if @parameters.count > 0
+            s << ";q=#{@quality}" if @quality < 1.0
+            s << ';' << @accept_ext.map { |k, v| "#{k}=#{v}" }.join(';') if @accept_ext.count > 0
+
+            s
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http/media_type.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        # Implementation of media type for content negotiation
+        #
+        # See:
+        # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.1
+        # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
+        class MediaType
+          class ParseError < ::StandardError
+          end
+
+          WILDCARD = '*'
+
+          # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
+          TOKEN_RE = /[-#$%&'*+.^_`|~A-Za-z0-9]+/.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
+          PARAMETER_RE = %r{ # rubocop:disable Style/RegexpLiteral
+            (?:
+              (?<parameter_name>#{TOKEN_RE})
+              =
+              (?:
+                (?<parameter_value>#{TOKEN_RE})
+                |
+                "(?<parameter_value>[^"]+)"
+              )
+            )
+          }ix.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
+          MEDIA_TYPE_RE = %r{
+            \A
+            (?<type>#{TOKEN_RE})/(?<subtype>#{TOKEN_RE})
+            (?<parameters>
+              (?:
+                \s*;\s*
+                #{PARAMETER_RE}
+              )*
+            )
+            \Z
+          }ix.freeze
+
+          attr_reader :type, :subtype, :parameters
+
+          def initialize(media_type)
+            media_type_match = MEDIA_TYPE_RE.match(media_type)
+
+            raise ParseError, media_type.inspect if media_type_match.nil?
+
+            @type = (media_type_match['type'] || WILDCARD).downcase
+            @subtype = (media_type_match['subtype'] || WILDCARD).downcase
+            @parameters = {}
+
+            parameters = media_type_match['parameters']
+
+            return if parameters.nil?
+
+            parameters.split(';').map(&:strip).each do |parameter|
+              parameter_match = PARAMETER_RE.match(parameter)
+
+              next if parameter_match.nil?
+
+              parameter_name = parameter_match['parameter_name']
+              parameter_value = parameter_match['parameter_value']
+
+              next if parameter_name.nil? || parameter_value.nil?
+
+              @parameters[parameter_name.downcase] = parameter_value.downcase
+            end
+          end
+
+          def to_s
+            s = +"#{@type}/#{@subtype}"
+
+            s << ';' << @parameters.map { |k, v| "#{k}=#{v}" }.join(';') if @parameters.count > 0
+
+            s
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Utils
+      # HTTP utilities
+      module HTTP
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # Utilities for AppSec
+    module Utils
+    end
+  end
+end

data/lib/datadog/appsec.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require_relative 'appsec/configuration'
+require_relative 'appsec/extensions'
+require_relative 'appsec/context'
+require_relative 'appsec/ext'
+require_relative 'appsec/utils'
+
+module Datadog
+  # Namespace for Datadog AppSec instrumentation
+  module AppSec
+    class << self
+      def enabled?
+        Datadog.configuration.appsec.enabled
+      end
+
+      def rasp_enabled?
+        Datadog.configuration.appsec.rasp_enabled
+      end
+
+      def active_context
+        Datadog::AppSec::Context.active
+      end
+
+      def telemetry
+        components.appsec&.telemetry
+      end
+
+      def security_engine
+        components.appsec&.security_engine
+      end
+
+      def reconfigure!
+        components.appsec&.reconfigure!
+      end
+
+      def perform_api_security_check?
+        Datadog.configuration.appsec.api_security.enabled &&
+          Datadog.configuration.appsec.api_security.sample_rate.sample?
+      end
+
+      private
+
+      def components
+        Datadog.send(:components)
+      end
+    end
+
+    # Expose AppSec to global shared objects
+    Extensions.activate!
+  end
+end
+
+# Integrations
+require_relative 'appsec/contrib/rack/integration'
+require_relative 'appsec/contrib/sinatra/integration'
+require_relative 'appsec/contrib/rails/integration'
+require_relative 'appsec/contrib/active_record/integration'
+require_relative 'appsec/contrib/devise/integration'
+require_relative 'appsec/contrib/graphql/integration'
+require_relative 'appsec/contrib/faraday/integration'
+require_relative 'appsec/contrib/excon/integration'
+require_relative 'appsec/contrib/rest_client/integration'
+
+require_relative 'appsec/autoload'

data/lib/datadog/auto_instrument.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+# Entrypoint file for auto instrumentation.
+#
+# This file's path is part of the @public_api.
+require_relative '../datadog'
+require_relative 'tracing/contrib/auto_instrument'
+
+# DI is not loaded on Ruby 2.5 and JRuby
+Datadog::DI::Contrib.load_now_or_later if defined?(Datadog::DI::Contrib)
+
+Datadog::Profiling.start_if_enabled
+
+module Datadog
+  module AutoInstrument
+    # Flag to determine if Auto Instrumentation was used
+    LOADED = true
+  end
+end

data/lib/datadog/auto_instrument_base.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Datadog
+  # base methods stubbed for adding auto instrument extensions
+  module AutoInstrumentBase
+    def add_auto_instrument
+    end
+  end
+end