datadog 2.10.0 → 2.11.0

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -1,10 +1,6 @@
 # frozen_string_literal: true
 
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/engine'
-require_relative '../reactive/request'
-require_relative '../reactive/request_body'
-require_relative '../reactive/response'
 require_relative '../../../event'
 
 module Datadog
@@ -25,31 +21,33 @@ module Datadog
 
               def watch_request(gateway = Instrumentation.gateway)
                 gateway.watch('rack.request', :appsec) do |stack, gateway_request|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rack::Reactive::Request.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rack::Reactive::Request.publish(engine, gateway_request)
+                  persistent_data = {
+                    'server.request.cookies' => gateway_request.cookies,
+                    'server.request.query' => gateway_request.query,
+                    'server.request.uri.raw' => gateway_request.fullpath,
+                    'server.request.headers' => gateway_request.headers,
+                    'server.request.headers.no_cookies' => gateway_request.headers.dup.tap { |h| h.delete('cookie') },
+                    'http.client_ip' => gateway_request.client_ip,
+                    'server.request.method' => gateway_request.method
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end
@@ -57,31 +55,29 @@ module Datadog
 
               def watch_response(gateway = Instrumentation.gateway)
                 gateway.watch('rack.response', :appsec) do |stack, gateway_response|
-                  event = nil
                   context = gateway_response.context
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rack::Reactive::Response.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        response: gateway_response,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rack::Reactive::Response.publish(engine, gateway_response)
+                  persistent_data = {
+                    'server.response.status' => gateway_response.status.to_s,
+                    'server.response.headers' => gateway_response.headers,
+                    'server.response.headers.no_cookies' => gateway_response.headers.dup.tap { |h| h.delete('set-cookie') }
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      response: gateway_response,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_response.response)
                 end
@@ -89,31 +85,27 @@ module Datadog
 
               def watch_request_body(gateway = Instrumentation.gateway)
                 gateway.watch('rack.request.body', :appsec) do |stack, gateway_request|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rack::Reactive::RequestBody.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rack::Reactive::RequestBody.publish(engine, gateway_request)
+                  persistent_data = {
+                    'server.request.body' => gateway_request.form_hash
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end

data/lib/datadog/appsec/contrib/rack/patcher.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative '../patcher'
 require_relative '../../monitor'
 require_relative 'gateway/watcher'
 
@@ -10,8 +9,6 @@ module Datadog
       module Rack
         # Patcher for Rack integration
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           module_function
 
           def patched?

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/engine'
-require_relative '../reactive/action'
 require_relative '../../../event'
 
 module Datadog
@@ -21,31 +19,28 @@ module Datadog
 
               def watch_request_action(gateway = Instrumentation.gateway)
                 gateway.watch('rails.request.action', :appsec) do |stack, gateway_request|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rails::Reactive::Action.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rails::Reactive::Action.publish(engine, gateway_request)
+                  persistent_data = {
+                    'server.request.body' => gateway_request.parsed_body,
+                    'server.request.path_params' => gateway_request.route_params
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -2,7 +2,6 @@
 
 require_relative '../../../core/utils/only_once'
 
-require_relative '../patcher'
 require_relative 'framework'
 require_relative '../../response'
 require_relative '../rack/request_middleware'
@@ -18,8 +17,6 @@ module Datadog
       module Rails
         # Patcher for AppSec on Rails
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
           AFTER_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
 

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -1,9 +1,6 @@
 # frozen_string_literal: true
 
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/engine'
-require_relative '../../rack/reactive/request_body'
-require_relative '../reactive/routed'
 require_relative '../../../event'
 
 module Datadog
@@ -23,31 +20,27 @@ module Datadog
 
               def watch_request_dispatch(gateway = Instrumentation.gateway)
                 gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rack::Reactive::RequestBody.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rack::Reactive::RequestBody.publish(engine, gateway_request)
+                  persistent_data = {
+                    'server.request.body' => gateway_request.form_hash
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end
@@ -55,31 +48,27 @@ module Datadog
 
               def watch_request_routed(gateway = Instrumentation.gateway)
                 gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Sinatra::Reactive::Routed.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Sinatra::Reactive::Routed.publish(engine, [gateway_request, gateway_route_params])
+                  persistent_data = {
+                    'server.request.path_params' => gateway_route_params.params
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -2,7 +2,6 @@
 
 require_relative '../../../tracing/contrib'
 
-require_relative '../patcher'
 require_relative '../../response'
 require_relative '../rack/request_middleware'
 require_relative 'framework'
@@ -102,8 +101,6 @@ module Datadog
 
         # Patcher for AppSec on Sinatra
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           module_function
 
           def patched?

data/lib/datadog/appsec/monitor/gateway/watcher.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 require_relative '../../instrumentation/gateway'
-require_relative '../../reactive/engine'
-require_relative '../reactive/set_user'
 
 module Datadog
   module AppSec
@@ -19,31 +17,27 @@ module Datadog
 
             def watch_user_id(gateway = Instrumentation.gateway)
               gateway.watch('identity.set_user', :appsec) do |stack, user|
-                event = nil
                 context = Datadog::AppSec.active_context
-                engine = AppSec::Reactive::Engine.new
-
-                Monitor::Reactive::SetUser.subscribe(engine, context) do |result|
-                  if result.match?
-                    # TODO: should this hash be an Event instance instead?
-                    event = {
-                      waf_result: result,
-                      trace: context.trace,
-                      span: context.span,
-                      user: user,
-                      actions: result.actions
-                    }
-
-                    # We want to keep the trace in case of security event
-                    context.trace.keep! if context.trace
-                    Datadog::AppSec::Event.tag_and_keep!(context, result)
-                    context.events << event
-
-                    Datadog::AppSec::ActionsHandler.handle(result.actions)
-                  end
-                end
 
-                Monitor::Reactive::SetUser.publish(engine, user)
+                persistent_data = {
+                  'usr.id' => user.id
+                }
+
+                result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                if result.match?
+                  Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                  context.events << {
+                    waf_result: result,
+                    trace: context.trace,
+                    span: context.span,
+                    user: user,
+                    actions: result.actions
+                  }
+
+                  Datadog::AppSec::ActionsHandler.handle(result.actions)
+                end
 
                 stack.call(user)
               end

data/lib/datadog/appsec/remote.rb

@@ -104,6 +104,10 @@ module Datadog
             )
 
             Datadog::AppSec.reconfigure(ruleset: ruleset, telemetry: telemetry)
+
+            repository.contents.each do |content|
+              content.applied if ASM_PRODUCTS.include?(content.path.product)
+            end
           end
 
           [receiver]

data/lib/datadog/appsec.rb

@@ -68,5 +68,7 @@ require_relative 'appsec/contrib/rails/integration'
 require_relative 'appsec/contrib/active_record/integration'
 require_relative 'appsec/contrib/devise/integration'
 require_relative 'appsec/contrib/graphql/integration'
+require_relative 'appsec/contrib/faraday/integration'
+require_relative 'appsec/contrib/excon/integration'
 
 require_relative 'appsec/autoload'

data/lib/datadog/core/configuration/components.rb

@@ -16,6 +16,8 @@ require_relative '../../appsec/component'
 require_relative '../../di/component'
 require_relative '../crashtracking/component'
 
+require_relative '../environment/agent_info'
+
 module Datadog
   module Core
     module Configuration
@@ -85,7 +87,8 @@ module Datadog
           :tracer,
           :crashtracker,
           :dynamic_instrumentation,
-          :appsec
+          :appsec,
+          :agent_info
 
         def initialize(settings)
           @logger = self.class.build_logger(settings)
@@ -96,6 +99,9 @@ module Datadog
           # the Core resolver from within your product/component's namespace.
           agent_settings = AgentSettingsResolver.call(settings, logger: @logger)
 
+          # Exposes agent capability information for detection by any components
+          @agent_info = Core::Environment::AgentInfo.new(agent_settings)
+
           @telemetry = self.class.build_telemetry(settings, agent_settings, @logger)
 
           @remote = Remote::Component.build(settings, agent_settings, telemetry: telemetry)

data/lib/datadog/core/configuration/ext.rb

@@ -37,7 +37,7 @@ module Datadog
           module UnixSocket
             ADAPTER = :unix
             DEFAULT_PATH = '/var/run/datadog/apm.socket'
-            DEFAULT_TIMEOUT_SECONDS = 1
+            DEFAULT_TIMEOUT_SECONDS = 30
           end
         end
       end

data/lib/datadog/core/configuration/option_definition.rb

@@ -79,6 +79,8 @@ module Datadog
             @deprecated_env = value
           end
 
+          # Invoked when the option is first read, and {#env} is defined.
+          # The block provided is only invoked if the environment variable is present (not-nil).
           def env_parser(&block)
             @env_parser = block
           end

data/lib/datadog/core/configuration/settings.rb

@@ -461,15 +461,31 @@ module Datadog
               end
             end
 
-            # Enables GVL profiling. This will show when threads are waiting for GVL in the timeline view.
-            #
-            # This is a preview feature and disabled by default. It requires Ruby 3.2+.
-            #
-            # @default `DD_PROFILING_PREVIEW_GVL_ENABLED` environment variable as a boolean, otherwise `false`
+            # @deprecated Use {:gvl_enabled} instead.
             option :preview_gvl_enabled do |o|
               o.type :bool
-              o.env 'DD_PROFILING_PREVIEW_GVL_ENABLED'
               o.default false
+              o.after_set do |_, _, precedence|
+                unless precedence == Datadog::Core::Configuration::Option::Precedence::DEFAULT
+                  Datadog.logger.warn(
+                    'The profiling.advanced.preview_gvl_enabled setting has been deprecated for removal and ' \
+                    'no longer does anything. Please remove it from your Datadog.configure block. ' \
+                    'GVL profiling is now controlled by the profiling.advanced.gvl_enabled setting instead.'
+                  )
+                end
+              end
+            end
+
+            # Controls GVL profiling. This will show when threads are waiting for GVL in the timeline view.
+            #
+            # This feature requires Ruby 3.2+.
+            #
+            # @default `DD_PROFILING_GVL_ENABLED` environment variable as a boolean, otherwise `true`
+            option :gvl_enabled do |o|
+              o.type :bool
+              o.deprecated_env 'DD_PROFILING_PREVIEW_GVL_ENABLED'
+              o.env 'DD_PROFILING_GVL_ENABLED'
+              o.default true
             end
 
             # Controls the smallest time period the profiler will report a thread waiting for the GVL.

data/lib/datadog/core/encoding.rb

@@ -10,6 +10,7 @@ module Datadog
       # Encoder interface that provides the logic to encode traces and service
       # @abstract
       module Encoder
+        # :nocov:
         def content_type
           raise NotImplementedError
         end
@@ -23,6 +24,13 @@ module Datadog
         def encode(_)
           raise NotImplementedError
         end
+
+        # Deserializes a value serialized with {#encode}.
+        # This method is used for debugging purposes.
+        def decode(_)
+          raise NotImplementedError
+        end
+        # :nocov:
       end
 
       # Encoder for the JSON format
@@ -41,6 +49,10 @@ module Datadog
           JSON.dump(obj)
         end
 
+        def decode(obj)
+          JSON.parse(obj)
+        end
+
         def join(encoded_data)
           "[#{encoded_data.join(',')}]"
         end
@@ -62,6 +74,10 @@ module Datadog
           MessagePack.pack(obj)
         end
 
+        def decode(obj)
+          MessagePack.unpack(obj)
+        end
+
         def join(encoded_data)
           packer = MessagePack::Packer.new
           packer.write_array_header(encoded_data.size)