datadog-lambda 3.29.0 → 3.30.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6c288d37d55d147aaca103a9ddfb7a7b6f9817aad19528a8be645ac81c879bfc
-  data.tar.gz: 0d7252abd55bbbb0075e9e560292487091c8e462027d5001d2cf89237116a761
+  metadata.gz: 16d17173aa40606df94b042f5b548443b57bc2d548a5da80d984c59a377ddcd5
+  data.tar.gz: 8ea8bf2a3559c0748405f249f169581783fb1e0a1ab23703378b119abc8362a8
 SHA512:
-  metadata.gz: 789cf5a6f51a19ffb8e0ed0e701c976669f841a186245aa58b881d9eca93865e2a76b19866f0426f3e08cda03bc552686ea41893d15ba2ad29d82e88f8f7493d
-  data.tar.gz: 1ef9d2bc286e9b7279fe55cc548f17b579eb3bad7dedbc5d6109fda28d0a4f964ebe43d8569420e084da33a28386d8c70d48faeb96721277a3f28fe773e7e82e
+  metadata.gz: f117a37f4d08a925ff382dc29b01d89d73216351e3ea6452fcb98debeba8a0c07b2cc5b004526c19e8f47bca25034cf3134466c93813d2844df8a36e889d7a1f
+  data.tar.gz: b6ea614f6057797c8af1e1ba3385c2fd744fe4c346d9ce3d1cafd21eceb98ff247d312b460f17f63322d6324b9e6940c96d2fe22d29c047f6660a03e0e2b710d

data/lib/datadog/lambda/appsec/request.rb

@@ -10,17 +10,16 @@ module Datadog
       # @see Datadog::AppSec::Event.record
       # @see Datadog::AppSec::Contrib::Rack::Gateway::Request
       class Request
-        attr_reader :host, :user_agent, :remote_addr, :headers
+        attr_reader :host, :user_agent, :remote_addr, :headers,
+                    :request_method, :path
 
         class << self
           def from_normalized(event)
-            headers = lowercase_headers(event)
-
             new(
-              host: headers['host'],
-              user_agent: headers['user-agent'],
               remote_addr: event['source_ip'],
-              headers: headers
+              headers: lowercase_headers(event),
+              request_method: event['method'],
+              path: event['path']
             )
           end
 
@@ -33,11 +32,13 @@ module Datadog
           end
         end
 
-        def initialize(host:, user_agent:, remote_addr:, headers:)
-          @host = host
-          @user_agent = user_agent
-          @remote_addr = remote_addr
+        def initialize(remote_addr:, headers:, request_method:, path:)
           @headers = headers
+          @host = headers['host']
+          @user_agent = headers['user-agent']
+          @remote_addr = remote_addr
+          @request_method = request_method
+          @path = path
         end
       end
     end

data/lib/datadog/lambda/appsec/response.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Datadog
+  module Lambda
+    module AppSec
+      # Minimal response object for AppSec event recording.
+      #
+      # WARNING: It's a minimal data for interface compliance
+      #
+      # @see Datadog::AppSec::APISecurity.sample?
+      # @see Datadog::AppSec::Contrib::Rack::Gateway::Response
+      class Response
+        attr_reader :status, :headers, :body
+
+        def self.from_normalized(normalized)
+          new(
+            status: normalized['status_code'].to_i,
+            headers: normalized['headers'] || {},
+            body: normalized['body']
+          )
+        end
+
+        def initialize(status:, headers:, body:)
+          @status = status
+          @headers = headers
+          @body = body
+        end
+      end
+    end
+  end
+end

data/lib/datadog/lambda/appsec/tagging.rb

@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+require 'json'
+
+require 'datadog/tracing/client_ip'
+require 'datadog/core/header_collection'
+require 'datadog/appsec/default_header_tags'
+
+module Datadog
+  module Lambda
+    module AppSec
+      # Applies AppSec request, response, and keep-decision tags to the Lambda span
+      module Tagging
+        module_function
+
+        def tag_request(request, context:)
+          span = context.span
+          return unless span
+
+          headers = Datadog::Core::HeaderCollection.from_hash(request.headers)
+          Datadog::AppSec::DefaultHeaderTags.tag_request(span, headers)
+
+          return if span.get_tag(Datadog::Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP)
+
+          Datadog::Tracing::ClientIp.set_client_ip_tag!(
+            span, headers: headers, remote_ip: request.remote_addr
+          )
+        end
+
+        def tag_response(response, context:)
+          span = context.span
+          return unless span
+
+          headers = Datadog::Core::HeaderCollection.from_hash(response.headers)
+          Datadog::AppSec::DefaultHeaderTags.tag_response(span, headers)
+
+          return if headers.get('content-length')
+
+          if (body = response.body)
+            span.set_tag('http.response.headers.content-length', body.bytesize.to_s)
+          end
+        end
+
+        def tag_and_keep(context, cold_start:)
+          span = context.span
+          trace = context.trace
+
+          return unless trace && span
+
+          span.set_metric(Datadog::AppSec::Ext::TAG_APPSEC_ENABLED, 1)
+          span.set_tag('_dd.runtime_family', 'ruby')
+          span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
+
+          ruleset_version = context.waf_runner_ruleset_version
+          return unless ruleset_version
+
+          span.set_tag('_dd.appsec.event_rules.version', ruleset_version)
+
+          return unless cold_start
+
+          trace.keep!
+          trace.set_tag(
+            Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+            Datadog::Tracing::Sampling::Ext::Decision::ASM
+          )
+          span.set_tag(
+            '_dd.appsec.event_rules.addresses', JSON.dump(context.waf_runner_known_addresses)
+          )
+        end
+      end
+    end
+  end
+end

data/lib/datadog/lambda/appsec.rb

@@ -1,7 +1,10 @@
 # frozen_string_literal: true
 
-require 'json'
+require 'datadog/appsec/api_security'
+
+require_relative 'appsec/tagging'
 require_relative 'appsec/request'
+require_relative 'appsec/response'
 require_relative 'appsec/event_normalizer'
 require_relative 'appsec/response_normalizer'
 
@@ -10,7 +13,7 @@ module Datadog
     # AppSec integration for AWS Lambda invocations.
     module AppSec
       class << self
-        # rubocop:disable Metrics/AbcSize
+        # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
         def on_start(event, trace:, span:, cold_start: false)
           @request = nil
           return unless enabled?
@@ -18,11 +21,12 @@ module Datadog
           context = create_context(trace, span)
           return unless Datadog::AppSec::Context.active
 
-          tag_and_keep(context, cold_start: cold_start)
+          Tagging.tag_and_keep(context, cold_start: cold_start)
 
           event = EventNormalizer.normalize(event)
           @request = Request.from_normalized(event)
 
+          Tagging.tag_request(@request, context: context)
           payload = Datadog::AppSec::Instrumentation::Gateway::DataContainer.new(
             event, context: context
           )
@@ -40,26 +44,34 @@ module Datadog
           Datadog::AppSec::Context.deactivate if context
           Datadog::Utils.logger.debug("failed to start AppSec: #{e}")
         end
-        # rubocop:enable Metrics/AbcSize
+        # rubocop:enable Metrics/AbcSize, Metrics/MethodLength
 
-        # rubocop:disable Metrics/AbcSize
+        # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity
         def on_finish(response)
           return unless enabled?
 
           context = Datadog::AppSec::Context.active
           return unless context
 
-          response = ResponseNormalizer.normalize(response)
-          payload = Datadog::AppSec::Instrumentation::Gateway::DataContainer.new(
-            response, context: context
-          )
+          normalized = ResponseNormalizer.normalize(response)
+          response = Response.from_normalized(normalized)
 
-          interrupt_params = catch(Datadog::AppSec::Ext::INTERRUPT) do
-            Datadog::AppSec::Instrumentation.gateway.push('aws_lambda.response.start', payload)
-            nil
+          interrupt_params = nil
+          unless context.interrupted?
+            Tagging.tag_response(response, context: context)
+            payload = Datadog::AppSec::Instrumentation::Gateway::DataContainer.new(
+              normalized, context: context
+            )
+
+            interrupt_params = catch(Datadog::AppSec::Ext::INTERRUPT) do
+              Datadog::AppSec::Instrumentation.gateway.push('aws_lambda.response.start', payload)
+              nil
+            end
+
+            context.mark_as_interrupted! if interrupt_params
           end
 
-          context.mark_as_interrupted! if interrupt_params
+          extract_api_security_schema(context, request: @request, response: response)
 
           Datadog::AppSec::Event.record(context, request: @request)
           context.export_metrics
@@ -71,10 +83,30 @@ module Datadog
         ensure
           Datadog::AppSec::Context.deactivate if context
         end
-        # rubocop:enable Metrics/AbcSize
+        # rubocop:enable Metrics/AbcSize, Metrics/MethodLength, Metrics/CyclomaticComplexity
+
+        def catch_interrupt
+          interrupt_params = catch(Datadog::AppSec::Ext::INTERRUPT) { return yield }
+
+          if (context = Datadog::AppSec::Context.active)
+            context.mark_as_interrupted!
+          end
+
+          response_override(interrupt_params, headers: @request.headers)
+        end
 
         private
 
+        def extract_api_security_schema(context, request:, response:)
+          return unless request && response
+
+          if Datadog::AppSec::APISecurity.enabled? &&
+             Datadog::AppSec::APISecurity.sample_trace?(context.trace) &&
+             Datadog::AppSec::APISecurity.sample?(request, response)
+            context.extract_schema!
+          end
+        end
+
         def enabled?
           defined?(Datadog::AppSec) &&
             Datadog::AppSec.respond_to?(:enabled?) &&
@@ -93,34 +125,6 @@ module Datadog
           context
         end
 
-        def tag_and_keep(context, cold_start:)
-          span = context.span
-          trace = context.trace
-
-          return unless trace && span
-
-          span.set_metric(Datadog::AppSec::Ext::TAG_APPSEC_ENABLED, 1)
-          span.set_tag('_dd.runtime_family', 'ruby')
-          span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
-
-          ruleset_version = context.waf_runner_ruleset_version
-          return unless ruleset_version
-
-          span.set_tag('_dd.appsec.event_rules.version', ruleset_version)
-
-          return unless cold_start
-
-          span.set_tag(
-            '_dd.appsec.event_rules.addresses', JSON.dump(context.waf_runner_known_addresses)
-          )
-
-          trace.keep!
-          trace.set_tag(
-            Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
-            Datadog::Tracing::Sampling::Ext::Decision::ASM
-          )
-        end
-
         def response_override(interrupt_params, headers:)
           response = Datadog::AppSec::Response.from_interrupt_params(
             interrupt_params, headers['accept']

data/lib/datadog/lambda/trace/listener.rb

@@ -61,6 +61,10 @@ module Datadog
       end
       # rubocop:enable Metrics/AbcSize
 
+      def with_appsec(&block)
+        @response_override || Datadog::Lambda::AppSec.catch_interrupt(&block)
+      end
+
       def on_end(response:, request_context:)
         if (override = Datadog::Lambda::AppSec.on_finish(response))
           @response_override = override

data/lib/datadog/lambda/version.rb

@@ -12,7 +12,7 @@ module Datadog
   module Lambda
     module VERSION
       MAJOR = 3
-      MINOR = 29
+      MINOR = 30
       PATCH = 0
       PRE = nil
 

data/lib/datadog/lambda.rb

@@ -60,7 +60,7 @@ module Datadog
     # @param event [Object] event sent to lambda
     # @param context [Object] lambda context
     # @param block [Proc] implementation of the handler function.
-    # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    # rubocop:disable Metrics/CyclomaticComplexity
     def self.wrap(event, context, &block)
       @response = nil
       @listener ||= initialize_listener
@@ -68,7 +68,7 @@ module Datadog
       begin
         cold = @is_cold_start
         @listener&.on_start(event:, request_context: context, cold_start: cold)
-        @response = @listener&.response_override || block.call
+        @response = @listener ? @listener.with_appsec(&block) : block.call
       rescue StandardError => e
         record_enhanced('errors', context)
         raise e
@@ -80,7 +80,7 @@ module Datadog
       end
       @response
     end
-    # rubocop:enable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    # rubocop:enable Metrics/CyclomaticComplexity
 
     # Gets the current tracing context
     def self.trace_context

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: datadog-lambda
 version: !ruby/object:Gem::Version
-  version: 3.29.0
+  version: 3.30.0
 platform: ruby
 authors:
 - Datadog, Inc.
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-06-01 00:00:00.000000000 Z
+date: 2026-08-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-xray-sdk
@@ -44,14 +44,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.30'
+        version: '2.40'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.30'
+        version: '2.40'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -122,7 +122,9 @@ files:
 - lib/datadog/lambda/appsec.rb
 - lib/datadog/lambda/appsec/event_normalizer.rb
 - lib/datadog/lambda/appsec/request.rb
+- lib/datadog/lambda/appsec/response.rb
 - lib/datadog/lambda/appsec/response_normalizer.rb
+- lib/datadog/lambda/appsec/tagging.rb
 - lib/datadog/lambda/metrics.rb
 - lib/datadog/lambda/trace/constants.rb
 - lib/datadog/lambda/trace/context.rb
@@ -138,7 +140,7 @@ licenses:
 - Apache-2.0
 metadata:
   allowed_push_host: https://rubygems.org
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -153,8 +155,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.5
-signing_key: 
+rubygems_version: 3.4.19
+signing_key:
 specification_version: 4
 summary: Instruments your Ruby AWS Lambda functions with Datadog
 test_files: []