datadog 2.0.0.beta1

data/lib/datadog/appsec/response.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require_relative 'assets'
+require_relative 'utils/http/media_range'
+
+module Datadog
+  module AppSec
+    # AppSec response
+    class Response
+      attr_reader :status, :headers, :body
+
+      def initialize(status:, headers: {}, body: [])
+        @status = status
+        @headers = headers
+        @body = body
+      end
+
+      def to_rack
+        [status, headers, body]
+      end
+
+      def to_sinatra_response
+        ::Sinatra::Response.new(body, status, headers)
+      end
+
+      def to_action_dispatch_response
+        ::ActionDispatch::Response.new(status, headers, body)
+      end
+
+      class << self
+        def negotiate(env, actions)
+          # @type var configured_response: Response?
+          configured_response = nil
+          actions.each do |action|
+            # Need to use next to make steep happy :(
+            # I rather use break to stop the execution
+            next if configured_response
+
+            action_configuration = AppSec::Processor::Actions.fecth_configuration(action)
+            next unless action_configuration
+
+            configured_response = case action_configuration['type']
+                                  when 'block_request'
+                                    block_response(env, action_configuration['parameters'])
+                                  when 'redirect_request'
+                                    redirect_response(env, action_configuration['parameters'])
+                                  end
+          end
+
+          configured_response || default_response(env)
+        end
+
+        private
+
+        def default_response(env)
+          content_type = content_type(env)
+
+          body = []
+          body << content(content_type)
+
+          Response.new(
+            status: 403,
+            headers: { 'Content-Type' => content_type },
+            body: body,
+          )
+        end
+
+        def block_response(env, options)
+          content_type = if options['type'] == 'auto'
+                           content_type(env)
+                         else
+                           FORMAT_TO_CONTENT_TYPE[options['type']]
+                         end
+
+          body = []
+          body << content(content_type)
+
+          Response.new(
+            status: options['status_code'] || 403,
+            headers: { 'Content-Type' => content_type },
+            body: body,
+          )
+        end
+
+        def redirect_response(env, options)
+          if options['location'] && !options['location'].empty?
+            content_type = content_type(env)
+
+            status = options['status_code'] >= 300 && options['status_code'] < 400 ? options['status_code'] : 303
+
+            headers = {
+              'Content-Type' => content_type,
+              'Location' => options['location']
+            }
+
+            Response.new(
+              status: status,
+              headers: headers,
+              body: [],
+            )
+          else
+            default_response(env)
+          end
+        end
+
+        CONTENT_TYPE_TO_FORMAT = {
+          'application/json' => :json,
+          'text/html' => :html,
+          'text/plain' => :text,
+        }.freeze
+
+        FORMAT_TO_CONTENT_TYPE = {
+          'json' => 'application/json',
+          'html' => 'text/html',
+        }.freeze
+
+        DEFAULT_CONTENT_TYPE = 'application/json'
+
+        def content_type(env)
+          return DEFAULT_CONTENT_TYPE unless env.key?('HTTP_ACCEPT')
+
+          accept_types = env['HTTP_ACCEPT'].split(',').map(&:strip)
+
+          accepted = accept_types.map { |m| Utils::HTTP::MediaRange.new(m) }.sort!.reverse!
+
+          accepted.each do |range|
+            type_match = CONTENT_TYPE_TO_FORMAT.keys.find { |type| range === type }
+
+            return type_match if type_match
+          end
+
+          DEFAULT_CONTENT_TYPE
+        rescue Datadog::AppSec::Utils::HTTP::MediaRange::ParseError
+          DEFAULT_CONTENT_TYPE
+        end
+
+        def content(content_type)
+          content_format = CONTENT_TYPE_TO_FORMAT[content_type]
+
+          using_default = Datadog.configuration.appsec.block.templates.using_default?(content_format)
+
+          if using_default
+            Datadog::AppSec::Assets.blocked(format: content_format)
+          else
+            Datadog.configuration.appsec.block.templates.send(content_format)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/sample_rate.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # SampleRate basic sample rate
+    class SampleRate
+      attr_reader :rate
+
+      def initialize(rate)
+        @rate = rate
+      end
+
+      def sample?
+        return false if rate <= 0
+        return true if rate >= 1
+
+        Kernel.rand < rate
+      end
+    end
+  end
+end

data/lib/datadog/appsec/scope.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+require_relative 'processor'
+
+module Datadog
+  module AppSec
+    # Capture context essential to consistently call processor and report via traces
+    class Scope
+      attr_reader :trace, :service_entry_span, :processor_context
+
+      def initialize(trace, service_entry_span, processor_context)
+        @trace = trace
+        @service_entry_span = service_entry_span
+        @processor_context = processor_context
+      end
+
+      def finalize
+        @processor_context.finalize
+      end
+
+      class << self
+        def activate_scope(trace, service_entry_span, processor)
+          raise ActiveScopeError, 'another scope is active, nested scopes are not supported' if active_scope
+
+          context = Datadog::AppSec::Processor::Context.new(processor)
+
+          self.active_scope = new(trace, service_entry_span, context)
+        end
+
+        def deactivate_scope
+          raise InactiveScopeError, 'no scope is active, nested scopes are not supported' unless active_scope
+
+          scope = active_scope
+
+          reset_active_scope
+
+          scope.finalize
+        end
+
+        def active_scope
+          Thread.current[:datadog_appsec_active_scope]
+        end
+
+        private
+
+        def active_scope=(scope)
+          raise ArgumentError, 'not a Datadog::AppSec::Scope' unless scope.instance_of?(Scope)
+
+          Thread.current[:datadog_appsec_active_scope] = scope
+        end
+
+        def reset_active_scope
+          Thread.current[:datadog_appsec_active_scope] = nil
+        end
+      end
+
+      class InactiveScopeError < StandardError; end
+      class ActiveScopeError < StandardError; end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http/media_range.rb

@@ -0,0 +1,201 @@
+# frozen_string_literal: true
+
+require_relative 'media_type'
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        # Implementation of media range for content negotiation
+        class MediaRange
+          class ParseError < ::StandardError
+          end
+
+          WILDCARD = '*'
+          WILDCARD_RE = ::Regexp.escape(WILDCARD)
+
+          # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
+          TOKEN_RE = /[-#$%&'*+.^_`|~A-Za-z0-9]+/.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
+          PARAMETER_RE = %r{ # rubocop:disable Style/RegexpLiteral
+            (?:
+              (?<parameter_name>#{TOKEN_RE})
+              =
+              (?:
+                (?<parameter_value>#{TOKEN_RE})
+                |
+                "(?<parameter_value>[^"]+)"
+              )
+            )
+          }ix.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
+          ACCEPT_EXT_RE = %r{ # rubocop:disable Style/RegexpLiteral
+            (?:
+              (?<ext_name>#{TOKEN_RE})
+              =
+              (?:
+                (?<ext_value>#{TOKEN_RE})
+                |
+                "(?<ext_value>[^"]+)"
+              )
+            )
+          }ix.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-5.3.1
+          QVALUE_RE = %r{ # rubocop:disable Style/RegexpLiteral
+            0(?:\.\d{1,3})?
+            |
+            1(?:\.0{1,3})?
+          }ix.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
+          MEDIA_RANGE_RE = %r{
+            \A
+            (?:
+              (?<type>#{WILDCARD_RE})/(?<subtype>#{WILDCARD_RE})
+              |
+              (?<type>#{TOKEN_RE})/(?<subtype>#{WILDCARD_RE})
+              |
+              (?<type>#{TOKEN_RE})/(?<subtype>#{TOKEN_RE})
+            )
+            (?<parameters>
+              (?:
+                \s*;\s*
+                (?!q=)
+                #{PARAMETER_RE}
+              )*
+            )
+            (?<accept_params>
+              (?<weight>
+                \s*;\s*
+                (?:q=
+                  (?<quality>
+                    #{QVALUE_RE}
+                  )
+                )
+              )
+              (?<accept_exts>
+                (?<accept_ext>
+                  (?:
+                    \s*;\s*
+                    (?!q=)
+                    #{ACCEPT_EXT_RE}
+                  )*
+                )
+              )
+            )?
+            \Z
+          }ix.freeze
+
+          attr_reader :type, :subtype, :quality, :parameters, :accept_ext
+
+          def initialize(media_range) # rubocop:disable Metrics/PerceivedComplexity, Metrics/CyclomaticComplexity
+            media_range_match = MEDIA_RANGE_RE.match(media_range)
+
+            raise ParseError, media_range.inspect if media_range_match.nil?
+
+            @type = (media_range_match['type'] || WILDCARD).downcase
+            @subtype = (media_range_match['subtype'] || WILDCARD).downcase
+            @quality = (media_range_match['quality'] || 1.0).to_f
+            @parameters = {}
+            @accept_ext = {}
+
+            parameters = media_range_match['parameters']
+
+            return if parameters.nil?
+
+            parameters.split(';').map(&:strip).each do |parameter|
+              parameter_match = PARAMETER_RE.match(parameter)
+
+              next if parameter_match.nil?
+
+              parameter_name = parameter_match['parameter_name']
+              parameter_value = parameter_match['parameter_value']
+
+              next if parameter_name.nil? || parameter_value.nil?
+
+              @parameters[parameter_name.downcase] = parameter_value.downcase
+            end
+
+            accept_exts = media_range_match['accept_exts']
+
+            return if accept_exts.nil?
+
+            accept_exts.split(';').map(&:strip).each do |ext|
+              ext_match = ACCEPT_EXT_RE.match(ext)
+
+              next if ext_match.nil?
+
+              ext_name = ext_match['ext_name']
+              ext_value = ext_match['ext_value']
+
+              next if ext_name.nil? || ext_value.nil?
+
+              @accept_ext[ext_name.downcase] = ext_value.downcase
+            end
+          end
+
+          # Compare two MediaRange for ordering
+          def <=>(other)
+            unless (q = quality <=> other.quality) == 0 || q.nil?
+              return q
+            end
+
+            if (s = specificity <=> other.specificity) != 0
+              return s
+            end
+
+            unless wildcard?(:type)
+              if wildcard?(:subtype) && !other.wildcard?(:subtype)
+                return -1
+              elsif !wildcard?(:subtype) && other.wildcard?(:subtype)
+                return 1
+              end
+            end
+
+            if wildcard?(:type) && !other.wildcard?(:type)
+              return -1
+            elsif !wildcard?(:type) && other.wildcard?(:type)
+              return 1
+            end
+
+            0
+          end
+
+          # Compare with a MediaType for match
+          #
+          # returns true if the MediaType is accepted by this MediaRange
+          def ===(other)
+            return self === MediaType.new(other) if other.is_a?(::String)
+
+            type == other.type && subtype == other.subtype && other.parameters.all? { |k, v| parameters[k] == v } ||
+              type == other.type && wildcard?(:subtype) ||
+              wildcard?(:type) && wildcard?(:subtype)
+          end
+
+          def specificity
+            @parameters.count
+          end
+
+          def wildcard?(field = nil)
+            return wildcard?(:type) || wildcard?(:subtype) if field.nil?
+
+            instance_variable_get(:"@#{field}") == WILDCARD
+          end
+
+          def to_s
+            s = +"#{@type}/#{@subtype}"
+
+            s << ';' << @parameters.map { |k, v| "#{k}=#{v}" }.join(';') if @parameters.count > 0
+            s << ";q=#{@quality}" if @quality < 1.0
+            s << ';' << @accept_ext.map { |k, v| "#{k}=#{v}" }.join(';') if @accept_ext.count > 0
+
+            s
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http/media_type.rb

@@ -0,0 +1,87 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        # Implementation of media type for content negotiation
+        #
+        # See:
+        # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.1
+        # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
+        class MediaType
+          class ParseError < ::StandardError
+          end
+
+          WILDCARD = '*'
+
+          # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
+          TOKEN_RE = /[-#$%&'*+.^_`|~A-Za-z0-9]+/.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
+          PARAMETER_RE = %r{ # rubocop:disable Style/RegexpLiteral
+            (?:
+              (?<parameter_name>#{TOKEN_RE})
+              =
+              (?:
+                (?<parameter_value>#{TOKEN_RE})
+                |
+                "(?<parameter_value>[^"]+)"
+              )
+            )
+          }ix.freeze
+
+          # See: https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
+          MEDIA_TYPE_RE = %r{
+            \A
+            (?<type>#{TOKEN_RE})/(?<subtype>#{TOKEN_RE})
+            (?<parameters>
+              (?:
+                \s*;\s*
+                #{PARAMETER_RE}
+              )*
+            )
+            \Z
+          }ix.freeze
+
+          attr_reader :type, :subtype, :parameters
+
+          def initialize(media_type)
+            media_type_match = MEDIA_TYPE_RE.match(media_type)
+
+            raise ParseError, media_type.inspect if media_type_match.nil?
+
+            @type = (media_type_match['type'] || WILDCARD).downcase
+            @subtype = (media_type_match['subtype'] || WILDCARD).downcase
+            @parameters = {}
+
+            parameters = media_type_match['parameters']
+
+            return if parameters.nil?
+
+            parameters.split(';').map(&:strip).each do |parameter|
+              parameter_match = PARAMETER_RE.match(parameter)
+
+              next if parameter_match.nil?
+
+              parameter_name = parameter_match['parameter_name']
+              parameter_value = parameter_match['parameter_value']
+
+              next if parameter_name.nil? || parameter_value.nil?
+
+              @parameters[parameter_name.downcase] = parameter_value.downcase
+            end
+          end
+
+          def to_s
+            s = +"#{@type}/#{@subtype}"
+
+            s << ';' << @parameters.map { |k, v| "#{k}=#{v}" }.join(';') if @parameters.count > 0
+
+            s
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Utils
+      # HTTP utilities
+      module HTTP
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # Utilities for AppSec
+    module Utils
+    end
+  end
+end

data/lib/datadog/appsec.rb

@@ -0,0 +1,60 @@
+# frozen_string_literal: true
+
+require_relative 'appsec/configuration'
+require_relative 'appsec/extensions'
+require_relative 'appsec/scope'
+require_relative 'appsec/ext'
+
+module Datadog
+  # Namespace for Datadog AppSec instrumentation
+  module AppSec
+    class << self
+      def enabled?
+        Datadog.configuration.appsec.enabled
+      end
+
+      def active_scope
+        Datadog::AppSec::Scope.active_scope
+      end
+
+      def processor
+        appsec_component = components.appsec
+
+        appsec_component.processor if appsec_component
+      end
+
+      def reconfigure(ruleset:, actions:)
+        appsec_component = components.appsec
+
+        return unless appsec_component
+
+        appsec_component.reconfigure(ruleset: ruleset, actions: actions)
+      end
+
+      def reconfigure_lock(&block)
+        appsec_component = components.appsec
+
+        return unless appsec_component
+
+        appsec_component.reconfigure_lock(&block)
+      end
+
+      private
+
+      def components
+        Datadog.send(:components)
+      end
+    end
+
+    # Expose AppSec to global shared objects
+    Extensions.activate!
+  end
+end
+
+# Integrations
+require_relative 'appsec/contrib/rack/integration'
+require_relative 'appsec/contrib/sinatra/integration'
+require_relative 'appsec/contrib/rails/integration'
+require_relative 'appsec/contrib/devise/integration'
+
+require_relative 'appsec/autoload'

data/lib/datadog/auto_instrument.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+# Entrypoint file for auto instrumentation.
+#
+# This file's path is part of the @public_api.
+require_relative '../datadog'
+require_relative 'tracing/contrib/auto_instrument'
+
+Datadog::Profiling.start_if_enabled
+
+module Datadog
+  module AutoInstrument
+    # Flag to determine if Auto Instrumentation was used
+    LOADED = true
+  end
+end

data/lib/datadog/auto_instrument_base.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+module Datadog
+  # base methods stubbed for adding auto instrument extensions
+  module AutoInstrumentBase
+    def add_auto_instrument; end
+  end
+end

data/lib/datadog/core/buffer/cruby.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require_relative 'random'
+
+module Datadog
+  module Core
+    module Buffer
+      # Buffer that stores objects, has a maximum size, and
+      # can be safely used concurrently with CRuby.
+      #
+      # Because singular +Array+ operations are thread-safe in CRuby,
+      # we can implement the buffer without an explicit lock,
+      # while making the compromise of allowing the buffer to go
+      # over its maximum limit under extreme circumstances.
+      #
+      # On the following scenario:
+      # * 4.5 million spans/second.
+      # * Pushed into a single CRubyTraceBuffer from 1000 threads.
+      #
+      # This implementation allocates less memory and is faster
+      # than {Datadog::Core::Buffer::ThreadSafe}.
+      #
+      # @see spec/datadog/benchmark/buffer_benchmark_spec.rb Buffer benchmarks
+      # @see https://github.com/ruby-concurrency/concurrent-ruby/blob/c1114a0c6891d9634f019f1f9fe58dcae8658964/lib/concurrent-ruby/concurrent/array.rb#L23-L27
+      class CRuby < Random
+        # A very large number to allow us to effectively
+        # drop all items when invoking `slice!(i, FIXNUM_MAX)`.
+        FIXNUM_MAX = (1 << 62) - 1
+
+        # Add a new ``item`` in the local queue. This method doesn't block the execution
+        # even if the buffer is full. In that case, a random item is discarded.
+        def replace!(item)
+          # Ensure buffer stays within +max_size+ items.
+          # This can happen when there's concurrent modification
+          # between a call the check in `full?` and the `add!` call in
+          # `full? ? replace!(item) : add!(item)`.
+          #
+          # We can still have `@items.size > @max_size` for a short period of
+          # time, but we will always try to correct it here.
+          #
+          # `slice!` is performed before `delete_at` & `<<` to avoid always
+          # removing the item that was just inserted.
+          #
+          # DEV: `slice!` with two integer arguments is ~10% faster than
+          # `slice!` with a {Range} argument.
+          @items.slice!(@max_size, FIXNUM_MAX)
+
+          # We should replace a random item with the new one
+          replace_index = rand(@max_size)
+          @items[replace_index] = item
+        end
+      end
+    end
+  end
+end