datadog 2.0.0.beta1

data/lib/datadog/appsec/assets.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'pathname'
+
+module Datadog
+  module AppSec
+    # Helper methods to get vendored assets
+    module Assets
+      module_function
+
+      def waf_rules(kind = :recommended)
+        read("waf_rules/#{kind}.json")
+      end
+
+      def waf_processors
+        read('waf_rules/processors.json')
+      end
+
+      def waf_scanners
+        read('waf_rules/scanners.json')
+      end
+
+      def blocked(format: :html)
+        (@blocked ||= {})[format] ||= read("blocked.#{format}")
+      end
+
+      def path
+        Pathname.new(dir).join('assets')
+      end
+
+      def filepath(filename)
+        path.join(filename)
+      end
+
+      def read(filename, mode = 'rb')
+        File.open(filepath(filename), mode) { |f| f.read || raise('Unexpected nil IO object') }
+      end
+
+      def dir
+        # Happens only if this file is evaluated standalone, which should not happen
+        # Necessary to make type-checker happy with a non-nilable return value
+        __dir__ || raise('Unexpected file eval')
+      end
+    end
+  end
+end

data/lib/datadog/appsec/autoload.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+if %w[1 true].include?((ENV['DD_APPSEC_ENABLED'] || '').downcase)
+  begin
+    require_relative 'contrib/auto_instrument'
+    Datadog::AppSec::Contrib::AutoInstrument.patch_all
+  rescue StandardError => e
+    Kernel.warn(
+      '[datadog] AppSec failed to instrument. No security check will be performed. error: ' \
+      " #{e.class.name} #{e.message}"
+    )
+  end
+end

data/lib/datadog/appsec/component.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+require_relative 'processor'
+require_relative 'processor/rule_merger'
+require_relative 'processor/rule_loader'
+require_relative 'processor/actions'
+
+module Datadog
+  module AppSec
+    # Core-pluggable component for AppSec
+    class Component
+      class << self
+        def build_appsec_component(settings)
+          return unless settings.respond_to?(:appsec) && settings.appsec.enabled
+
+          processor = create_processor(settings)
+
+          # We want to always instrument user events when AppSec is enabled.
+          # There could be cases in which users use the DD_APPSEC_ENABLED Env variable to
+          # enable AppSec, in that case, Devise is already instrumented.
+          # In the case that users do not use DD_APPSEC_ENABLED, we have to instrument it,
+          # hence the lines above.
+          devise_integration = Datadog::AppSec::Contrib::Devise::Integration.new
+          settings.appsec.instrument(:devise) unless devise_integration.patcher.patched?
+
+          new(processor: processor)
+        end
+
+        private
+
+        def create_processor(settings)
+          rules = AppSec::Processor::RuleLoader.load_rules(ruleset: settings.appsec.ruleset)
+          return nil unless rules
+
+          actions = rules['actions']
+
+          AppSec::Processor::Actions.merge(actions) if actions
+
+          data = AppSec::Processor::RuleLoader.load_data(
+            ip_denylist: settings.appsec.ip_denylist,
+            user_id_denylist: settings.appsec.user_id_denylist,
+          )
+
+          exclusions = AppSec::Processor::RuleLoader.load_exclusions(ip_passlist: settings.appsec.ip_passlist)
+
+          ruleset = AppSec::Processor::RuleMerger.merge(
+            rules: [rules],
+            data: data,
+            exclusions: exclusions,
+          )
+
+          processor = Processor.new(ruleset: ruleset)
+          return nil unless processor.ready?
+
+          processor
+        end
+      end
+
+      attr_reader :processor
+
+      def initialize(processor:)
+        @processor = processor
+        @mutex = Mutex.new
+      end
+
+      def reconfigure(ruleset:, actions:)
+        @mutex.synchronize do
+          AppSec::Processor::Actions.merge(actions)
+
+          new = Processor.new(ruleset: ruleset)
+
+          if new && new.ready?
+            old = @processor
+            @processor = new
+            old.finalize if old
+          end
+        end
+      end
+
+      def reconfigure_lock(&block)
+        @mutex.synchronize(&block)
+      end
+
+      def shutdown!
+        @mutex.synchronize do
+          if processor && processor.ready?
+            processor.finalize
+            @processor = nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/configuration/settings.rb

@@ -0,0 +1,202 @@
+# frozen_string_literal: true
+
+require_relative '../../core/utils/duration'
+require_relative '../sample_rate'
+
+module Datadog
+  module AppSec
+    module Configuration
+      # Settings
+      module Settings
+        # rubocop:disable Layout/LineLength
+        DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'
+        DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'
+        # rubocop:enable Layout/LineLength
+        APPSEC_VALID_TRACK_USER_EVENTS_MODE = [
+          'safe',
+          'extended'
+        ].freeze
+        APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES = [
+          '1',
+          'true'
+        ].concat(APPSEC_VALID_TRACK_USER_EVENTS_MODE).freeze
+
+        def self.extended(base)
+          base = base.singleton_class unless base.is_a?(Class)
+          add_settings!(base)
+        end
+
+        # rubocop:disable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+        def self.add_settings!(base)
+          base.class_eval do
+            settings :appsec do
+              option :enabled do |o|
+                o.type :bool
+                o.env 'DD_APPSEC_ENABLED'
+                o.default false
+              end
+
+              define_method(:instrument) do |integration_name|
+                if enabled
+                  registered_integration = Datadog::AppSec::Contrib::Integration.registry[integration_name]
+                  if registered_integration
+                    klass = registered_integration.klass
+                    if klass.loaded? && klass.compatible?
+                      instance = klass.new
+                      instance.patcher.patch unless instance.patcher.patched?
+                    end
+                  end
+                end
+              end
+
+              option :ruleset do |o|
+                o.env 'DD_APPSEC_RULES'
+                o.default :recommended
+              end
+
+              option :ip_passlist do |o|
+                o.default []
+              end
+
+              option :ip_denylist do |o|
+                o.type :array
+                o.default []
+              end
+
+              option :user_id_denylist do |o|
+                o.type :array
+                o.default []
+              end
+
+              option :waf_timeout do |o|
+                o.env 'DD_APPSEC_WAF_TIMEOUT' # us
+                o.default 5_000
+                o.setter do |v|
+                  Datadog::Core::Utils::Duration.call(v.to_s, base: :us)
+                end
+              end
+
+              option :waf_debug do |o|
+                o.env 'DD_APPSEC_WAF_DEBUG'
+                o.default false
+                o.type :bool
+              end
+
+              option :trace_rate_limit do |o|
+                o.type :int
+                o.env 'DD_APPSEC_TRACE_RATE_LIMIT' # trace/s
+                o.default 100
+              end
+
+              option :obfuscator_key_regex do |o|
+                o.type :string
+                o.env 'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP'
+                o.default DEFAULT_OBFUSCATOR_KEY_REGEX
+              end
+
+              option :obfuscator_value_regex do |o|
+                o.type :string
+                o.env 'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP'
+                o.default DEFAULT_OBFUSCATOR_VALUE_REGEX
+              end
+
+              settings :block do
+                settings :templates do
+                  option :html do |o|
+                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML'
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        raise(ArgumentError, "appsec.templates.html: file not found: #{value}") unless File.exist?(value)
+
+                        File.open(value, 'rb', &:read) || ''
+                      end
+                    end
+                  end
+
+                  option :json do |o|
+                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON'
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        raise(ArgumentError, "appsec.templates.json: file not found: #{value}") unless File.exist?(value)
+
+                        File.open(value, 'rb', &:read) || ''
+                      end
+                    end
+                  end
+
+                  option :text do |o|
+                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_TEXT'
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        raise(ArgumentError, "appsec.templates.text: file not found: #{value}") unless File.exist?(value)
+
+                        File.open(value, 'rb', &:read) || ''
+                      end
+                    end
+                  end
+                end
+              end
+
+              settings :track_user_events do
+                option :enabled do |o|
+                  o.default true
+                  o.type :bool
+                  o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
+                  o.env_parser do |env_value|
+                    if env_value == 'disabled'
+                      false
+                    else
+                      APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES.include?(env_value.strip.downcase)
+                    end
+                  end
+                end
+
+                option :mode do |o|
+                  o.type :string
+                  o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
+                  o.default 'safe'
+                  o.setter do |v|
+                    if APPSEC_VALID_TRACK_USER_EVENTS_MODE.include?(v)
+                      v
+                    elsif v == 'disabled'
+                      'safe'
+                    else
+                      Datadog.logger.warn(
+                        'The appsec.track_user_events.mode value provided is not supported.' \
+                        'Supported values are: safe | extended.' \
+                        'Using default value `safe`'
+                      )
+                      'safe'
+                    end
+                  end
+                end
+              end
+
+              settings :api_security do
+                option :enabled do |o|
+                  o.type :bool
+                  o.env 'DD_EXPERIMENTAL_API_SECURITY_ENABLED'
+                  o.default false
+                end
+
+                option :sample_rate do |o|
+                  o.type :float
+                  o.env 'DD_API_SECURITY_REQUEST_SAMPLE_RATE'
+                  o.default 0.1
+                  o.setter do |value|
+                    value = 1 if value > 1
+                    SampleRate.new(value)
+                  end
+                end
+              end
+            end
+          end
+        end
+        # rubocop:enable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+      end
+    end
+  end
+end

data/lib/datadog/appsec/configuration.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require_relative 'configuration/settings'
+
+module Datadog
+  module AppSec
+    # Configuration for AppSec
+    module Configuration
+    end
+  end
+end

data/lib/datadog/appsec/contrib/auto_instrument.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      # Auto-instrumentation for security integrations
+      # TODO: this implementation is trivial, check for shareable code with tracer
+      module AutoInstrument
+        def self.patch_all
+          integrations = []
+
+          Datadog::AppSec::Contrib::Integration.registry.each do |_name, integration|
+            next unless integration.klass.auto_instrument?
+
+            integrations << integration.name
+          end
+
+          integrations.each do |integration_name|
+            Datadog.configuration.appsec.instrument integration_name
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/event.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Class to extract event information from the resource
+        class Event
+          UUID_REGEX = /^\h{8}-\h{4}-\h{4}-\h{4}-\h{12}$/.freeze
+
+          SAFE_MODE = 'safe'
+          EXTENDED_MODE = 'extended'
+
+          attr_reader :user_id
+
+          def initialize(resource, mode)
+            @resource = resource
+            @mode = mode
+            @user_id = nil
+            @email = nil
+            @username = nil
+
+            extract if @resource
+          end
+
+          def to_h
+            return @event if defined?(@event)
+
+            @event = {}
+            @event[:email] = @email if @email
+            @event[:username] = @username if @username
+            @event
+          end
+
+          private
+
+          def extract
+            @user_id = @resource.id
+
+            case @mode
+            when EXTENDED_MODE
+              @email = @resource.email
+              @username = @resource.username
+            when SAFE_MODE
+              @user_id = nil unless @user_id && @user_id.to_s =~ UUID_REGEX
+            else
+              Datadog.logger.warn(
+                "Invalid automated user evenst mode: `#{@mode}`. "\
+                              'Supported modes are: `safe` and `extended`.'
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/ext.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Devise integration constants
+        module Ext
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/integration.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require_relative '../integration'
+
+require_relative 'patcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Description of Devise integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('3.2.1')
+
+          register_as :devise, auto_patch: true
+
+          def self.version
+            Gem.loaded_specs['devise'] && Gem.loaded_specs['devise'].version
+          end
+
+          def self.loaded?
+            !defined?(::Devise).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            true
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/patcher/authenticatable_patch.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require_relative '../tracking'
+require_relative '../resource'
+require_relative '../event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        module Patcher
+          # Hook in devise validate method
+          module AuthenticatablePatch
+            # rubocop:disable Metrics/MethodLength
+            def validate(resource, &block)
+              result = super
+              return result unless AppSec.enabled?
+
+              track_user_events_configuration = Datadog.configuration.appsec.track_user_events
+
+              return result unless track_user_events_configuration.enabled
+
+              automated_track_user_events_mode = track_user_events_configuration.mode
+
+              appsec_scope = Datadog::AppSec.active_scope
+
+              return result unless appsec_scope
+
+              devise_resource = resource ? Resource.new(resource) : nil
+
+              event_information = Event.new(devise_resource, automated_track_user_events_mode)
+
+              if result
+                if event_information.user_id
+                  Datadog.logger.debug { 'User Login Event success' }
+                else
+                  Datadog.logger.debug { 'User Login Event success, but can\'t extract user ID. Tracking empty event' }
+                end
+
+                Tracking.track_login_success(
+                  appsec_scope.trace,
+                  appsec_scope.service_entry_span,
+                  user_id: event_information.user_id,
+                  **event_information.to_h
+                )
+
+                return result
+              end
+
+              user_exists = nil
+
+              if resource
+                user_exists = true
+                Datadog.logger.debug { 'User Login Event failure users exists' }
+              else
+                user_exists = false
+                Datadog.logger.debug { 'User Login Event failure user do not exists' }
+              end
+
+              Tracking.track_login_failure(
+                appsec_scope.trace,
+                appsec_scope.service_entry_span,
+                user_id: event_information.user_id,
+                user_exists: user_exists,
+                **event_information.to_h
+              )
+
+              result
+            end
+            # rubocop:enable Metrics/MethodLength
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/patcher/registration_controller_patch.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative '../tracking'
+require_relative '../resource'
+require_relative '../event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        module Patcher
+          # Hook in devise registration controller
+          module RegistrationControllerPatch
+            def create
+              return super unless AppSec.enabled?
+
+              track_user_events_configuration = Datadog.configuration.appsec.track_user_events
+
+              return super unless track_user_events_configuration.enabled
+
+              automated_track_user_events_mode = track_user_events_configuration.mode
+
+              appsec_scope = Datadog::AppSec.active_scope
+              return super unless appsec_scope
+
+              super do |resource|
+                if resource.persisted?
+                  devise_resource = Resource.new(resource)
+
+                  event_information = Event.new(devise_resource, automated_track_user_events_mode)
+
+                  if event_information.user_id
+                    Datadog.logger.debug { 'User Signup Event' }
+                  else
+                    Datadog.logger.warn { 'User Signup Event, but can\'t extract user ID. Tracking empty event' }
+                  end
+
+                  Tracking.track_signup(
+                    appsec_scope.trace,
+                    appsec_scope.service_entry_span,
+                    user_id: event_information.user_id,
+                    **event_information.to_h
+                  )
+                end
+
+                yield resource if block_given?
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/patcher.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative '../patcher'
+require_relative 'patcher/authenticatable_patch'
+require_relative 'patcher/registration_controller_patch'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Patcher for AppSec on Devise
+        module Patcher
+          include Datadog::AppSec::Contrib::Patcher
+
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            patch_authenticable_strategy
+            patch_registration_controller
+
+            Patcher.instance_variable_set(:@patched, true)
+          end
+
+          def patch_authenticable_strategy
+            ::Devise::Strategies::Authenticatable.prepend(AuthenticatablePatch)
+          end
+
+          def patch_registration_controller
+            ::ActiveSupport.on_load(:after_initialize) do
+              ::Devise::RegistrationsController.prepend(RegistrationControllerPatch)
+            end
+          end
+        end
+      end
+    end
+  end
+end