datadog 2.10.0 → 2.12.2

data/lib/datadog/appsec/contrib/graphql/gateway/watcher.rb

@@ -2,8 +2,6 @@
 
 require 'json'
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/engine'
-require_relative '../reactive/multiplex'
 
 module Datadog
   module AppSec
@@ -19,16 +17,21 @@ module Datadog
                 watch_multiplex(gateway)
               end
 
-              # This time we don't throw but use next
               def watch_multiplex(gateway = Instrumentation.gateway)
                 gateway.watch('graphql.multiplex', :appsec) do |stack, gateway_multiplex|
-                  event = nil
                   context = AppSec::Context.active
-                  engine = AppSec::Reactive::Engine.new
 
                   if context
-                    GraphQL::Reactive::Multiplex.subscribe(engine, context) do |result|
-                      event = {
+                    persistent_data = {
+                      'graphql.server.all_resolvers' => gateway_multiplex.arguments
+                    }
+
+                    result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                    if result.match?
+                      Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                      context.events << {
                         waf_result: result,
                         trace: context.trace,
                         span: context.span,
@@ -36,13 +39,8 @@ module Datadog
                         actions: result.actions
                       }
 
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
                       Datadog::AppSec::ActionsHandler.handle(result.actions)
                     end
-
-                    GraphQL::Reactive::Multiplex.publish(engine, gateway_multiplex)
                   end
 
                   stack.call(gateway_multiplex.arguments)

data/lib/datadog/appsec/contrib/graphql/patcher.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative '../patcher'
 require_relative 'gateway/watcher'
 
 if Gem.loaded_specs['graphql'] && Gem.loaded_specs['graphql'].version >= Gem::Version.new('2.0.19')
@@ -13,8 +12,6 @@ module Datadog
       module GraphQL
         # Patcher for AppSec on GraphQL
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           module_function
 
           def patched?

data/lib/datadog/appsec/contrib/rack/ext.rb

@@ -6,6 +6,26 @@ module Datadog
       module Rack
         # Rack integration constants
         module Ext
+          IDENTITY_COLLECTABLE_REQUEST_HEADERS = [
+            'accept-encoding',
+            'accept-language',
+            'cf-connecting-ip',
+            'cf-connecting-ipv6',
+            'content-encoding',
+            'content-language',
+            'content-length',
+            'fastly-client-ip',
+            'forwarded',
+            'forwarded-for',
+            'host',
+            'true-client-ip',
+            'via',
+            'x-client-ip',
+            'x-cluster-client-ip',
+            'x-forwarded',
+            'x-forwarded-for',
+            'x-real-ip'
+          ].freeze
         end
       end
     end

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -1,10 +1,7 @@
 # frozen_string_literal: true
 
+require_relative '../ext'
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/engine'
-require_relative '../reactive/request'
-require_relative '../reactive/request_body'
-require_relative '../reactive/response'
 require_relative '../../../event'
 
 module Datadog
@@ -25,31 +22,33 @@ module Datadog
 
               def watch_request(gateway = Instrumentation.gateway)
                 gateway.watch('rack.request', :appsec) do |stack, gateway_request|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rack::Reactive::Request.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rack::Reactive::Request.publish(engine, gateway_request)
+                  persistent_data = {
+                    'server.request.cookies' => gateway_request.cookies,
+                    'server.request.query' => gateway_request.query,
+                    'server.request.uri.raw' => gateway_request.fullpath,
+                    'server.request.headers' => gateway_request.headers,
+                    'server.request.headers.no_cookies' => gateway_request.headers.dup.tap { |h| h.delete('cookie') },
+                    'http.client_ip' => gateway_request.client_ip,
+                    'server.request.method' => gateway_request.method
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end
@@ -57,31 +56,29 @@ module Datadog
 
               def watch_response(gateway = Instrumentation.gateway)
                 gateway.watch('rack.response', :appsec) do |stack, gateway_response|
-                  event = nil
                   context = gateway_response.context
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rack::Reactive::Response.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        response: gateway_response,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rack::Reactive::Response.publish(engine, gateway_response)
+                  persistent_data = {
+                    'server.response.status' => gateway_response.status.to_s,
+                    'server.response.headers' => gateway_response.headers,
+                    'server.response.headers.no_cookies' => gateway_response.headers.dup.tap { |h| h.delete('set-cookie') }
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      response: gateway_response,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_response.response)
                 end
@@ -89,31 +86,46 @@ module Datadog
 
               def watch_request_body(gateway = Instrumentation.gateway)
                 gateway.watch('rack.request.body', :appsec) do |stack, gateway_request|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rack::Reactive::RequestBody.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
+
+                  persistent_data = {
+                    'server.request.body' => gateway_request.form_hash
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
                   end
 
-                  Rack::Reactive::RequestBody.publish(engine, gateway_request)
+                  stack.call(gateway_request.request)
+                end
+              end
+
+              # NOTE: In the current state we unable to substibe twice to the same
+              #       event within the same group. Ideally this code should live
+              #       somewhere closer to identity related monitor.
+              # WARNING: The Gateway is a subject of refactoring
+              def watch_request_finish(gateway = Instrumentation.gateway)
+                gateway.watch('rack.request.finish', :appsec) do |stack, gateway_request|
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
+                  next stack.call(gateway_request.request) if context.span.nil? || !gateway.pushed?('identity.set_user')
+
+                  gateway_request.headers.each do |name, value|
+                    next unless Ext::IDENTITY_COLLECTABLE_REQUEST_HEADERS.include?(name)
+
+                    context.span["http.request.headers.#{name}"] = value
+                  end
 
                   stack.call(gateway_request.request)
                 end

data/lib/datadog/appsec/contrib/rack/patcher.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative '../patcher'
 require_relative '../../monitor'
 require_relative 'gateway/watcher'
 
@@ -10,8 +9,6 @@ module Datadog
       module Rack
         # Patcher for Rack integration
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           module_function
 
           def patched?

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -77,6 +77,8 @@ module Datadog
             gateway_response = nil
 
             interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
+              # TODO: This event should be renamed into `rack.request.start` to
+              #       reflect that it's the beginning of the request-cycle
               http_response, _gateway_request = Instrumentation.gateway.push('rack.request', gateway_request) do
                 @app.call(env)
               end
@@ -85,6 +87,7 @@ module Datadog
                 http_response[2], http_response[0], http_response[1], context: ctx
               )
 
+              Instrumentation.gateway.push('rack.request.finish', gateway_request)
               Instrumentation.gateway.push('rack.response', gateway_response)
 
               nil

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -1,8 +1,6 @@
 # frozen_string_literal: true
 
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/engine'
-require_relative '../reactive/action'
 require_relative '../../../event'
 
 module Datadog
@@ -21,31 +19,28 @@ module Datadog
 
               def watch_request_action(gateway = Instrumentation.gateway)
                 gateway.watch('rails.request.action', :appsec) do |stack, gateway_request|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rails::Reactive::Action.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rails::Reactive::Action.publish(engine, gateway_request)
+                  persistent_data = {
+                    'server.request.body' => gateway_request.parsed_body,
+                    'server.request.path_params' => gateway_request.route_params
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -2,7 +2,6 @@
 
 require_relative '../../../core/utils/only_once'
 
-require_relative '../patcher'
 require_relative 'framework'
 require_relative '../../response'
 require_relative '../rack/request_middleware'
@@ -18,8 +17,6 @@ module Datadog
       module Rails
         # Patcher for AppSec on Rails
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
           AFTER_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
 

data/lib/datadog/appsec/contrib/rest_client/integration.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative '../integration'
+require_relative 'patcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # This class defines properties of rest-client AppSec integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('1.8')
+
+          register_as :rest_client
+
+          def self.gem_name
+            'rest-client'
+          end
+
+          def self.version
+            Gem.loaded_specs['rest-client'] && Gem.loaded_specs['rest-client'].version
+          end
+
+          def self.loaded?
+            !defined?(::RestClient::Request).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rest_client/patcher.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # Patcher for RestClient gem
+        module Patcher
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            require_relative 'request_ssrf_detection_patch'
+
+            ::RestClient::Request.prepend(RequestSSRFDetectionPatch)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb

@@ -0,0 +1,39 @@
+# rubocop:disable Naming/FileName
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # Module that adds SSRF detection to RestClient::Request#execute
+        module RequestSSRFDetectionPatch
+          def execute(&block)
+            return super unless AppSec.rasp_enabled? && AppSec.active_context
+
+            context = AppSec.active_context
+
+            ephemeral_data = { 'server.io.net.url' => url }
+            result = context.run_rasp(Ext::RASP_SSRF, {}, ephemeral_data, Datadog.configuration.appsec.waf_timeout)
+
+            if result.match?
+              Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+              context.events << {
+                waf_result: result,
+                trace: context.trace,
+                span: context.span,
+                request_url: url,
+                actions: result.actions
+              }
+
+              ActionsHandler.handle(result.actions)
+            end
+
+            super(&block)
+          end
+        end
+      end
+    end
+  end
+end
+# rubocop:enable Naming/FileName

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -1,9 +1,6 @@
 # frozen_string_literal: true
 
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/engine'
-require_relative '../../rack/reactive/request_body'
-require_relative '../reactive/routed'
 require_relative '../../../event'
 
 module Datadog
@@ -23,31 +20,27 @@ module Datadog
 
               def watch_request_dispatch(gateway = Instrumentation.gateway)
                 gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Rack::Reactive::RequestBody.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Rack::Reactive::RequestBody.publish(engine, gateway_request)
+                  persistent_data = {
+                    'server.request.body' => gateway_request.form_hash
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end
@@ -55,31 +48,27 @@ module Datadog
 
               def watch_request_routed(gateway = Instrumentation.gateway)
                 gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
-                  event = nil
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
-                  engine = AppSec::Reactive::Engine.new
-
-                  Sinatra::Reactive::Routed.subscribe(engine, context) do |result|
-                    if result.match?
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: context.trace,
-                        span: context.span,
-                        request: gateway_request,
-                        actions: result.actions
-                      }
-
-                      # We want to keep the trace in case of security event
-                      context.trace.keep! if context.trace
-                      Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.events << event
-
-                      Datadog::AppSec::ActionsHandler.handle(result.actions)
-                    end
-                  end
 
-                  Sinatra::Reactive::Routed.publish(engine, [gateway_request, gateway_route_params])
+                  persistent_data = {
+                    'server.request.path_params' => gateway_route_params.params
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    Datadog::AppSec::Event.tag_and_keep!(context, result)
+
+                    context.events << {
+                      waf_result: result,
+                      trace: context.trace,
+                      span: context.span,
+                      request: gateway_request,
+                      actions: result.actions
+                    }
+
+                    Datadog::AppSec::ActionsHandler.handle(result.actions)
+                  end
 
                   stack.call(gateway_request.request)
                 end

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -2,7 +2,6 @@
 
 require_relative '../../../tracing/contrib'
 
-require_relative '../patcher'
 require_relative '../../response'
 require_relative '../rack/request_middleware'
 require_relative 'framework'
@@ -102,8 +101,6 @@ module Datadog
 
         # Patcher for AppSec on Sinatra
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           module_function
 
           def patched?

data/lib/datadog/appsec/instrumentation/gateway/middleware.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Instrumentation
+      class Gateway
+        # NOTE: This class extracted as-is and will be deprecated
+        # Instrumentation gateway middleware
+        class Middleware
+          attr_reader :key, :block
+
+          def initialize(key, &block)
+            @key = key
+            @block = block
+          end
+
+          def call(stack, env)
+            @block.call(stack, env)
+          end
+        end
+      end
+    end
+  end
+end