datadog 2.12.1 → 2.19.0

data/ext/libdatadog_api/library_config.c

@@ -0,0 +1,164 @@
+#include <ruby.h>
+#include <datadog/library-config.h>
+
+#include "library_config.h"
+#include "datadog_ruby_common.h"
+
+static VALUE _native_configurator_new(VALUE klass);
+static VALUE _native_configurator_get(VALUE self);
+
+// Used for testing in RSpec
+static VALUE _native_configurator_with_local_path(DDTRACE_UNUSED VALUE _self, VALUE rb_configurator, VALUE path);
+static VALUE _native_configurator_with_fleet_path(DDTRACE_UNUSED VALUE _self, VALUE rb_configurator, VALUE path);
+
+static VALUE config_vec_class = Qnil;
+
+// ddog_Configurator memory management
+static void configurator_free(void *configurator_ptr) {
+  ddog_Configurator *configurator = (ddog_Configurator *)configurator_ptr;
+
+  ddog_library_configurator_drop(configurator);
+}
+
+static const rb_data_type_t configurator_typed_data = {
+  .wrap_struct_name = "Datadog::Core::Configuration::StableConfig::Configurator",
+  .function = {
+    .dfree = configurator_free,
+    .dsize = NULL,
+  },
+  .flags = RUBY_TYPED_FREE_IMMEDIATELY
+};
+
+// ddog_Vec_LibraryConfig memory management
+static void config_vec_free(void *config_vec_ptr) {
+  ddog_Vec_LibraryConfig *config_vec = (ddog_Vec_LibraryConfig *)config_vec_ptr;
+
+  ddog_library_config_drop(*config_vec);
+  ruby_xfree(config_vec_ptr);
+}
+
+static const rb_data_type_t config_vec_typed_data = {
+  .wrap_struct_name = "Datadog::Core::Configuration::StableConfigVec",
+  .function = {
+    .dfree = config_vec_free,
+    .dsize = NULL,
+  },
+  .flags = RUBY_TYPED_FREE_IMMEDIATELY
+};
+
+void library_config_init(VALUE core_module) {
+  rb_global_variable(&config_vec_class);
+  VALUE configuration_module = rb_define_module_under(core_module, "Configuration");
+  VALUE stable_config_module = rb_define_module_under(configuration_module, "StableConfig");
+  VALUE configurator_class = rb_define_class_under(stable_config_module, "Configurator", rb_cObject);
+  config_vec_class = rb_define_class_under(configuration_module, "StableConfigVec", rb_cObject);
+
+  rb_define_alloc_func(configurator_class, _native_configurator_new);
+  rb_define_method(configurator_class, "get", _native_configurator_get, 0);
+
+  // Used for testing in RSpec
+  VALUE testing_module = rb_define_module_under(stable_config_module, "Testing");
+  rb_define_singleton_method(testing_module, "with_local_path", _native_configurator_with_local_path, 2);
+  rb_define_singleton_method(testing_module, "with_fleet_path", _native_configurator_with_fleet_path, 2);
+
+  rb_undef_alloc_func(config_vec_class); // It cannot be created from Ruby code and only serves as an intermediate object for the Ruby GC
+}
+
+static VALUE _native_configurator_new(VALUE klass) {
+  ddog_Configurator *configurator = ddog_library_configurator_new(false, DDOG_CHARSLICE_C("ruby"));
+
+  ddog_library_configurator_with_detect_process_info(configurator);
+
+  return TypedData_Wrap_Struct(klass, &configurator_typed_data, configurator);
+}
+
+static VALUE _native_configurator_with_local_path(DDTRACE_UNUSED VALUE _self, VALUE rb_configurator, VALUE path) {
+  ddog_Configurator *configurator;
+  TypedData_Get_Struct(rb_configurator, ddog_Configurator, &configurator_typed_data, configurator);
+
+  ENFORCE_TYPE(path, T_STRING);
+
+  ddog_library_configurator_with_local_path(configurator, cstr_from_ruby_string(path));
+
+  return Qnil;
+}
+
+static VALUE _native_configurator_with_fleet_path(DDTRACE_UNUSED VALUE _self, VALUE rb_configurator, VALUE path) {
+  ddog_Configurator *configurator;
+  TypedData_Get_Struct(rb_configurator, ddog_Configurator, &configurator_typed_data, configurator);
+
+  ENFORCE_TYPE(path, T_STRING);
+
+  ddog_library_configurator_with_fleet_path(configurator, cstr_from_ruby_string(path));
+
+  return Qnil;
+}
+
+static VALUE _native_configurator_get(VALUE self) {
+  ddog_Configurator *configurator;
+  TypedData_Get_Struct(self, ddog_Configurator, &configurator_typed_data, configurator);
+
+  ddog_Result_VecLibraryConfig configurator_result = ddog_library_configurator_get(configurator);
+
+  if (configurator_result.tag == DDOG_RESULT_VEC_LIBRARY_CONFIG_ERR_VEC_LIBRARY_CONFIG) {
+    ddog_Error err = configurator_result.err;
+    VALUE message = get_error_details_and_drop(&err);
+    if (is_config_loaded()) {
+      log_warning(message);
+    } else {
+      log_warning_without_config(message);
+    }
+    return rb_hash_new();
+  }
+
+  // Wrapping config_vec into a Ruby object enables the Ruby GC to manage its memory
+  // We need to allocate memory for config_vec because once it is out of scope, it will be freed (at the end of this function)
+  // So we cannot reference it with &config_vec
+  // We are doing this in case one of the ruby API raises an exception before the end of this function,
+  // so the allocated memory will still be freed
+  ddog_Vec_LibraryConfig *config_vec = ruby_xmalloc(sizeof(ddog_Vec_LibraryConfig));
+  *config_vec = configurator_result.ok;
+  VALUE config_vec_rb = TypedData_Wrap_Struct(config_vec_class, &config_vec_typed_data, config_vec);
+
+  VALUE local_config_hash = rb_hash_new();
+  VALUE fleet_config_hash = rb_hash_new();
+
+  bool local_config_id_set = false;
+  bool fleet_config_id_set = false;
+  VALUE local_hash = rb_hash_new();
+  VALUE fleet_hash = rb_hash_new();
+  for (uintptr_t i = 0; i < config_vec->len; i++) {
+    ddog_LibraryConfig config = config_vec->ptr[i];
+    VALUE selected_hash;
+    if (config.source == DDOG_LIBRARY_CONFIG_SOURCE_LOCAL_STABLE_CONFIG) {
+      selected_hash = local_config_hash;
+      if (!local_config_id_set) {
+        local_config_id_set = true;
+        if (config.config_id.length > 0) {
+          rb_hash_aset(local_hash, ID2SYM(rb_intern("id")), rb_utf8_str_new_cstr(config.config_id.ptr));
+        }
+      }
+    }
+    else {
+      selected_hash = fleet_config_hash;
+      if (!fleet_config_id_set) {
+        fleet_config_id_set = true;
+        if (config.config_id.length > 0) {
+          rb_hash_aset(fleet_hash, ID2SYM(rb_intern("id")), rb_utf8_str_new_cstr(config.config_id.ptr));
+        }
+      }
+    }
+
+    rb_hash_aset(selected_hash, rb_utf8_str_new_cstr(config.name.ptr), rb_utf8_str_new_cstr(config.value.ptr));
+  }
+
+  rb_hash_aset(local_hash, ID2SYM(rb_intern("config")), local_config_hash);
+  rb_hash_aset(fleet_hash, ID2SYM(rb_intern("config")), fleet_config_hash);
+
+  VALUE result = rb_hash_new();
+  rb_hash_aset(result, ID2SYM(rb_intern("local")), local_hash);
+  rb_hash_aset(result, ID2SYM(rb_intern("fleet")), fleet_hash);
+
+  RB_GC_GUARD(config_vec_rb);
+  return result;
+}

data/ext/libdatadog_api/library_config.h

@@ -0,0 +1,25 @@
+#pragma once
+
+#include "datadog_ruby_common.h"
+
+void library_config_init(VALUE core_module);
+
+static inline bool is_config_loaded(void) {
+  VALUE datadog_module = rb_const_get(rb_cObject, rb_intern("Datadog"));
+  VALUE is_config_loaded = rb_funcall(datadog_module, rb_intern("configuration?"), 0);
+
+  return is_config_loaded == Qtrue;
+}
+
+static inline VALUE log_warning_without_config(VALUE warning) {
+  VALUE datadog_module = rb_const_get(rb_cObject, rb_intern("Datadog"));
+  VALUE logger = rb_funcall(datadog_module, rb_intern("logger_without_configuration"), 0);
+
+  return rb_funcall(logger, rb_intern("warn"), 1, warning);
+}
+
+static inline ddog_CStr cstr_from_ruby_string(VALUE string) {
+  ENFORCE_TYPE(string, T_STRING);
+  ddog_CStr cstr = {.ptr = RSTRING_PTR(string), .length = RSTRING_LEN(string)};
+  return cstr;
+}

data/ext/libdatadog_api/macos_development.md

@@ -17,9 +17,9 @@ export DD_RUBY_PLATFORM=`ruby -e 'puts Gem::Platform.local.to_s'`
 mkdir -p my-libdatadog-build/$DD_RUBY_PLATFORM
 ```
 
-5. Build libdatadog into this folder: `./build-profiling-ffi.sh my-libdatadog-build/$DD_RUBY_PLATFORM`
-6. Tell the Ruby where to find libdatadog: `export LIBDATADOG_VENDOR_OVERRIDE=/full/path/to/my-libdatadog-build/` (Notice no platform here)
-7. Run `bundle exec rake clean compile`
+5. From inside of the libdatadog repo, build libdatadog into this folder: `./build-profiling-ffi.sh my-libdatadog-build/$DD_RUBY_PLATFORM`
+6. Tell Ruby where to find libdatadog: `export LIBDATADOG_VENDOR_OVERRIDE=/full/path/to/my-libdatadog-build/` (Notice no platform here)
+7. From dd-trace-rb, run `bundle exec rake clean compile`
 
 If you additionally want to run the profiler test suite, also remember to `export DD_PROFILING_MACOS_TESTING=true` and re-run `rake clean compile`.
 

data/ext/libdatadog_api/process_discovery.c

@@ -0,0 +1,112 @@
+#include <errno.h>
+#include <stdlib.h>
+#include <ruby.h>
+#include <datadog/library-config.h>
+
+#include "datadog_ruby_common.h"
+
+static VALUE _native_store_tracer_metadata(int argc, VALUE *argv, DDTRACE_UNUSED VALUE _self);
+static VALUE _native_to_rb_int(DDTRACE_UNUSED VALUE _self, VALUE tracer_memfd);
+static VALUE _native_close_tracer_memfd(DDTRACE_UNUSED VALUE _self, VALUE tracer_memfd, VALUE logger);
+
+static void tracer_memfd_free(void *ptr) {
+  int *fd = (int *)ptr;
+  if (*fd != -1) {
+    close(*fd);
+  }
+  ruby_xfree(ptr);
+}
+
+static const rb_data_type_t tracer_memfd_type = {
+  .wrap_struct_name = "Datadog::Core::ProcessDiscovery::TracerMemfd",
+  .function = {
+    .dfree = tracer_memfd_free,
+    .dsize = NULL,
+  },
+  .flags = RUBY_TYPED_FREE_IMMEDIATELY
+};
+
+void process_discovery_init(VALUE core_module) {
+  VALUE process_discovery_class = rb_define_class_under(core_module, "ProcessDiscovery", rb_cObject);
+  VALUE tracer_memfd_class = rb_define_class_under(process_discovery_class, "TracerMemfd", rb_cObject);
+  rb_undef_alloc_func(tracer_memfd_class); // Class cannot be instantiated from Ruby
+
+  rb_define_singleton_method(process_discovery_class, "_native_store_tracer_metadata", _native_store_tracer_metadata, -1);
+  rb_define_singleton_method(process_discovery_class, "_native_to_rb_int", _native_to_rb_int, 1);
+  rb_define_singleton_method(process_discovery_class, "_native_close_tracer_memfd", _native_close_tracer_memfd, 2);
+}
+
+static VALUE _native_store_tracer_metadata(int argc, VALUE *argv, VALUE self) {
+  VALUE logger;
+  VALUE options;
+  rb_scan_args(argc, argv, "1:", &logger, &options);
+  if (options == Qnil) options = rb_hash_new();
+
+  VALUE schema_version = rb_hash_fetch(options, ID2SYM(rb_intern("schema_version")));
+  VALUE runtime_id = rb_hash_fetch(options, ID2SYM(rb_intern("runtime_id")));
+  VALUE tracer_language = rb_hash_fetch(options, ID2SYM(rb_intern("tracer_language")));
+  VALUE tracer_version = rb_hash_fetch(options, ID2SYM(rb_intern("tracer_version")));
+  VALUE hostname = rb_hash_fetch(options, ID2SYM(rb_intern("hostname")));
+  VALUE service_name = rb_hash_fetch(options, ID2SYM(rb_intern("service_name")));
+  VALUE service_env = rb_hash_fetch(options, ID2SYM(rb_intern("service_env")));
+  VALUE service_version = rb_hash_fetch(options, ID2SYM(rb_intern("service_version")));
+
+  ENFORCE_TYPE(schema_version, T_FIXNUM);
+  ENFORCE_TYPE(runtime_id, T_STRING);
+  ENFORCE_TYPE(tracer_language, T_STRING);
+  ENFORCE_TYPE(tracer_version, T_STRING);
+  ENFORCE_TYPE(hostname, T_STRING);
+  ENFORCE_TYPE(service_name, T_STRING);
+  ENFORCE_TYPE(service_env, T_STRING);
+  ENFORCE_TYPE(service_version, T_STRING);
+
+  ddog_Result_TracerMemfdHandle result = ddog_store_tracer_metadata(
+    (uint8_t) NUM2UINT(schema_version),
+    char_slice_from_ruby_string(runtime_id),
+    char_slice_from_ruby_string(tracer_language),
+    char_slice_from_ruby_string(tracer_version),
+    char_slice_from_ruby_string(hostname),
+    char_slice_from_ruby_string(service_name),
+    char_slice_from_ruby_string(service_env),
+    char_slice_from_ruby_string(service_version)
+  );
+
+  if (result.tag == DDOG_RESULT_TRACER_MEMFD_HANDLE_ERR_TRACER_MEMFD_HANDLE) {
+    rb_funcall(logger, rb_intern("debug"), 1, rb_sprintf("Failed to store the tracer configuration in a memory file descriptor: %"PRIsVALUE, get_error_details_and_drop(&result.err)));
+    return Qnil;
+  }
+
+  // &result.ok is a ddog_TracerMemfdHandle, which is a struct only containing int fd, which is a file descriptor
+  // We should just return the fd
+  int *fd = ruby_xmalloc(sizeof(int));
+
+  *fd = result.ok.fd;
+  VALUE tracer_memfd_class = rb_const_get(self, rb_intern("TracerMemfd"));
+  VALUE tracer_memfd = TypedData_Wrap_Struct(tracer_memfd_class, &tracer_memfd_type, fd);
+  return tracer_memfd;
+}
+
+static VALUE _native_to_rb_int(DDTRACE_UNUSED VALUE _self, VALUE tracer_memfd) {
+  int *fd;
+  TypedData_Get_Struct(tracer_memfd, int, &tracer_memfd_type, fd);
+  return INT2NUM(*fd);
+}
+
+static VALUE _native_close_tracer_memfd(DDTRACE_UNUSED VALUE _self, VALUE tracer_memfd, VALUE logger) {
+  int *fd;
+  TypedData_Get_Struct(tracer_memfd, int, &tracer_memfd_type, fd);
+  if (*fd == -1) {
+    rb_funcall(logger, rb_intern("debug"), 1, rb_sprintf("The tracer configuration memory file descriptor has already been closed"));
+    return Qnil;
+  }
+
+  int close_result = close(*fd);
+  *fd = -1;
+
+  if (close_result == -1) {
+    rb_funcall(logger, rb_intern("debug"), 1, rb_sprintf("Failed to close the tracer configuration memory file descriptor: %s", strerror(errno)));
+    return Qnil;
+  }
+
+  return Qnil;
+}

data/ext/libdatadog_api/process_discovery.h

@@ -0,0 +1,5 @@
+#pragma once
+
+#include "datadog_ruby_common.h"
+
+void process_discovery_init(VALUE core_module);

data/ext/libdatadog_extconf_helpers.rb

@@ -8,7 +8,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = '~> 16.0.1.1.0'
+    LIBDATADOG_VERSION = '~> 18.1.0.1.0'
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.
@@ -104,7 +104,7 @@ module Datadog
 
     # mkmf sets $PKGCONFIG after the `pkg_config` gets used in extconf.rb. When `pkg_config` is unsuccessful, we use
     # this helper to decide if we can show more specific error message vs a generic "something went wrong".
-    def self.pkg_config_missing?(command: $PKGCONFIG) # rubocop:disable Style/GlobalVars
+    def self.pkg_config_missing?(command: $PKGCONFIG) # standard:disable Style/GlobalVars
       pkg_config_available = command && xsystem("#{command} --version")
 
       pkg_config_available != true

data/lib/datadog/appsec/actions_handler/serializable_backtrace.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module ActionsHandler
+      # This module serves encapsulates MessagePack serialization for caller locations.
+      #
+      # It serializes part of the stack:
+      # up to 32 frames (configurable)
+      # keeping frames from top and bottom of the stack (75% to 25%, configurable).
+      #
+      # It represents the stack trace that is added to span metastruct field.
+      class SerializableBacktrace
+        CLASS_AND_FUNCTION_NAME_REGEX = /\b((?:\w+::)*\w+)?[#.]?\b(\w+)\z/.freeze
+
+        def initialize(locations:, stack_id:)
+          @stack_id = stack_id
+          @locations = locations
+        end
+
+        def to_msgpack(packer = nil)
+          # JRuby doesn't pass the packer
+          packer ||= MessagePack::Packer.new
+
+          packer.write_map_header(3)
+
+          packer.write('id')
+          packer.write(@stack_id.encode('UTF-8'))
+
+          packer.write('language')
+          packer.write('ruby'.encode('UTF-8'))
+
+          serializable_locations_map = build_serializable_locations_map
+
+          packer.write('frames')
+          packer.write_array_header(serializable_locations_map.size)
+
+          serializable_locations_map.each do |frame_id, location|
+            packer.write_map_header(6)
+
+            packer.write('id')
+            packer.write(frame_id)
+
+            packer.write('text')
+            packer.write(location.to_s.encode('UTF-8'))
+
+            packer.write('file')
+            packer.write(location.path&.encode('UTF-8'))
+
+            packer.write('line')
+            packer.write(location.lineno)
+
+            class_name, function_name = location.label&.match(CLASS_AND_FUNCTION_NAME_REGEX)&.captures
+
+            packer.write('class_name')
+            packer.write(class_name&.encode('UTF-8'))
+
+            packer.write('function')
+            packer.write(function_name&.encode('UTF-8'))
+          end
+
+          packer
+        end
+
+        private
+
+        def build_serializable_locations_map
+          max_depth = Datadog.configuration.appsec.stack_trace.max_depth
+          top_percent = Datadog.configuration.appsec.stack_trace.top_percentage
+
+          drop_from_idx = max_depth * top_percent / 100
+          drop_until_idx = @locations.size - (max_depth - drop_from_idx)
+
+          frame_idx = -1
+          @locations.each_with_object({}) do |location, map|
+            # we are dropping frames from library code without increasing frame index
+            next if location.path&.include?('lib/datadog')
+
+            frame_idx += 1
+
+            next if max_depth != 0 && frame_idx >= drop_from_idx && frame_idx < drop_until_idx
+
+            map[frame_idx] = location
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/actions_handler.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative 'actions_handler/serializable_backtrace'
+
 module Datadog
   module AppSec
     # this module encapsulates functions for handling actions that libddawf returns
@@ -19,9 +21,29 @@ module Datadog
         throw(Datadog::AppSec::Ext::INTERRUPT, action_params)
       end
 
-      def generate_stack(_action_params); end
+      def generate_stack(action_params)
+        return unless Datadog.configuration.appsec.stack_trace.enabled
+
+        stack_id = action_params['stack_id']
+        return unless stack_id
+
+        active_span = AppSec.active_context&.span
+        return unless active_span
+
+        event_category = Ext::EXPLOIT_PREVENTION_EVENT_CATEGORY
+        tag_key = Ext::TAG_METASTRUCT_STACK_TRACE
 
-      def generate_schema(_action_params); end
+        existing_stack_data = active_span.get_metastruct_tag(tag_key).dup || {event_category => []}
+        max_stack_traces = Datadog.configuration.appsec.stack_trace.max_stack_traces
+        return if max_stack_traces != 0 && existing_stack_data[event_category].count >= max_stack_traces
+
+        backtrace = SerializableBacktrace.new(locations: Array(caller_locations), stack_id: stack_id)
+        existing_stack_data[event_category] << backtrace
+        active_span.set_metastruct_tag(tag_key, existing_stack_data)
+      end
+
+      def generate_schema(_action_params)
+      end
     end
   end
 end

data/lib/datadog/appsec/anonymizer.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'digest/sha2'
+
+module Datadog
+  module AppSec
+    # Manual anonymization of the potential PII data
+    module Anonymizer
+      def self.anonymize(payload)
+        raise ArgumentError, "expected String, received #{payload.class}" unless payload.is_a?(String)
+
+        "anon_#{Digest::SHA256.hexdigest(payload)[0, 32]}"
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/lru_cache.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require 'forwardable'
+
+module Datadog
+  module AppSec
+    module APISecurity
+      # An LRU (Least Recently Used) cache implementation that relies on the
+      # Ruby 1.9+ `Hash` implementation that guarantees insertion order.
+      #
+      # WARNING: This implementation is NOT thread-safe and should be used
+      #          in a single-threaded context.
+      class LRUCache
+        extend Forwardable
+
+        def_delegators :@store, :clear, :empty?
+
+        def initialize(max_size)
+          raise ArgumentError, 'max_size must be an Integer' unless max_size.is_a?(Integer)
+          raise ArgumentError, 'max_size must be greater than 0' if max_size <= 0
+
+          @max_size = max_size
+          @store = {}
+        end
+
+        # NOTE: Accessing a key moves it to the end of the list.
+        def [](key)
+          if (entry = @store.delete(key))
+            @store[key] = entry
+          end
+        end
+
+        def store(key, value)
+          return @store[key] = value if @store.delete(key)
+
+          # NOTE: evict the oldest entry if store reached the maximum allowed size
+          @store.shift if @store.size >= @max_size
+          @store[key] = value
+        end
+
+        # NOTE: If the key exists, it's moved to the end of the list and
+        #       if does not, the given block will be executed and the result
+        #       will be stored (which will add it to the end of the list).
+        def fetch_or_store(key)
+          if (entry = @store.delete(key))
+            return @store[key] = entry
+          end
+
+          # NOTE: evict the oldest entry if store reached the maximum allowed size
+          @store.shift if @store.size >= @max_size
+          @store[key] = yield
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/route_extractor.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module APISecurity
+      # This is a helper module to extract the route pattern from the Rack::Request.
+      module RouteExtractor
+        SINATRA_ROUTE_KEY = 'sinatra.route'
+        SINATRA_ROUTE_SEPARATOR = ' '
+        GRAPE_ROUTE_KEY = 'grape.routing_args'
+        RAILS_ROUTE_KEY = 'action_dispatch.route_uri_pattern'
+        RAILS_ROUTES_KEY = 'action_dispatch.routes'
+        RAILS_PATH_PARAMS_KEY = 'action_dispatch.request.path_parameters'
+        RAILS_FORMAT_SUFFIX = '(.:format)'
+
+        # HACK: We rely on the fact that each contrib will modify `request.env`
+        #       and store information sufficient to compute the canonical
+        #       route (ex: `/users/:id`).
+        #
+        #       When contribs like Sinatra or Grape are used, they could be mounted
+        #       into the Rails app, hence you can see the use of the `script_name`
+        #       that will contain the path prefix of the mounted app.
+        #
+        #       Rack
+        #         does not support named arguments, so we have to use `path`
+        #       Sinatra
+        #         uses `sinatra.route` with a string like "GET /users/:id"
+        #       Grape
+        #         uses `grape.routing_args` with a hash with a `:route_info` key
+        #         that contains a `Grape::Router::Route` object that contains
+        #         `Grape::Router::Pattern` object with an `origin` method
+        #       Rails < 7.1 (slow path)
+        #         uses `action_dispatch.routes` to store `ActionDispatch::Routing::RouteSet`
+        #         which can recognize requests
+        #       Rails > 7.1 (fast path)
+        #         uses `action_dispatch.route_uri_pattern` with a string like
+        #         "/users/:id(.:format)"
+        #
+        # WARNING: This method works only *after* the request has been routed.
+        #
+        # WARNING: In Rails > 7.1 when a route was not found,
+        #          action_dispatch.route_uri_pattern will not be set.
+        #          In Rails < 7.1 it also will not be set even if a route was found,
+        #          but in this case  action_dispatch.request.path_parameters won't be empty.
+        def self.route_pattern(request)
+          if request.env.key?(GRAPE_ROUTE_KEY)
+            pattern = request.env[GRAPE_ROUTE_KEY][:route_info]&.pattern&.origin
+            "#{request.script_name}#{pattern}"
+          elsif request.env.key?(SINATRA_ROUTE_KEY)
+            pattern = request.env[SINATRA_ROUTE_KEY].split(SINATRA_ROUTE_SEPARATOR, 2)[1]
+            "#{request.script_name}#{pattern}"
+          elsif request.env.key?(RAILS_ROUTE_KEY)
+            request.env[RAILS_ROUTE_KEY].delete_suffix(RAILS_FORMAT_SUFFIX)
+          elsif request.env.key?(RAILS_ROUTES_KEY) && !request.env.fetch(RAILS_PATH_PARAMS_KEY, {}).empty?
+            pattern = request.env[RAILS_ROUTES_KEY].router
+              .recognize(request) { |route, _| break route.path.spec.to_s }
+
+            # NOTE: If rails is unable to recognize request it returns empty Array
+            pattern = nil if pattern&.empty?
+
+            # NOTE: If rails can't recognize the request, we are going to fallback
+            #       to generic request path
+            (pattern || request.path).delete_suffix(RAILS_FORMAT_SUFFIX)
+          else
+            request.path
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/sampler.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require 'zlib'
+require_relative 'lru_cache'
+require_relative 'route_extractor'
+require_relative '../../core/utils/time'
+
+module Datadog
+  module AppSec
+    module APISecurity
+      # A thread-local sampler for API security based on defined delay between
+      # samples with caching capability.
+      class Sampler
+        THREAD_KEY = :datadog_appsec_api_security_sampler
+        MAX_CACHE_SIZE = 4096
+
+        class << self
+          def thread_local
+            sampler = Thread.current.thread_variable_get(THREAD_KEY)
+            return sampler unless sampler.nil?
+
+            Thread.current.thread_variable_set(THREAD_KEY, new(sample_delay))
+          end
+
+          # @api private
+          def reset!
+            Thread.current.thread_variable_set(THREAD_KEY, nil)
+          end
+
+          private
+
+          def sample_delay
+            Datadog.configuration.appsec.api_security.sample_delay
+          end
+        end
+
+        def initialize(sample_delay)
+          raise ArgumentError, 'sample_delay must be an Integer' unless sample_delay.is_a?(Integer)
+
+          @cache = LRUCache.new(MAX_CACHE_SIZE)
+          @sample_delay_seconds = sample_delay
+        end
+
+        def sample?(request, response)
+          return true if @sample_delay_seconds.zero?
+
+          key = Zlib.crc32("#{request.request_method}#{RouteExtractor.route_pattern(request)}#{response.status}")
+          current_timestamp = Core::Utils::Time.now.to_i
+          cached_timestamp = @cache[key] || 0
+
+          return false if current_timestamp - cached_timestamp <= @sample_delay_seconds
+
+          @cache.store(key, current_timestamp)
+          true
+        end
+      end
+    end
+  end
+end