datadog 2.17.0 → 2.37.0

data/lib/datadog/appsec/api_security/endpoint_collection/sinatra_route_serializer.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module APISecurity
+      module EndpointCollection
+        # This module serializes Sinatra routes.
+        module SinatraRouteSerializer
+          module_function
+
+          def serialize(route, method:, path_prefix: '')
+            path = path_prefix + route.safe_string
+
+            {
+              type: "REST",
+              resource_name: "#{method} #{path}",
+              operation_name: "http.request",
+              method: method,
+              path: path
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/endpoint_collection.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module APISecurity
+      module EndpointCollection
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/route_extractor.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require_relative '../../tracing/contrib/rack/route_inference'
+
+module Datadog
+  module AppSec
+    module APISecurity
+      # This is a helper module to extract the route pattern from the Rack::Request.
+      module RouteExtractor
+        SINATRA_ROUTE_KEY = 'sinatra.route'
+        SINATRA_ROUTE_SEPARATOR = ' '
+        GRAPE_ROUTE_KEY = 'grape.routing_args'
+        RAILS_ROUTE_URI_PATTERN_KEY = 'action_dispatch.route_uri_pattern'
+        RAILS_ROUTE_KEY = 'action_dispatch.route' # Rails 8.1.1+
+        RAILS_ROUTES_KEY = 'action_dispatch.routes'
+        RAILS_PATH_PARAMS_KEY = 'action_dispatch.request.path_parameters'
+        RAILS_FORMAT_SUFFIX = '(.:format)'
+        DATADOG_RAILS_ROUTE_KEY = 'datadog.action_dispatch.route'
+
+        # HACK: We rely on the fact that each contrib will modify `request.env`
+        #       and store information sufficient to compute the canonical
+        #       route (ex: `/users/:id`).
+        #
+        #       When contribs like Sinatra or Grape are used, they could be mounted
+        #       into the Rails app, hence you can see the use of the `script_name`
+        #       that will contain the path prefix of the mounted app.
+        #
+        #       Rack
+        #         does not support named arguments, so we have to use `path`
+        #       Sinatra
+        #         uses `sinatra.route` with a string like "GET /users/:id"
+        #       Grape
+        #         uses `grape.routing_args` with a hash with a `:route_info` key
+        #         that contains a {Grape::Router::Route} object that contains
+        #         {Grape::Router::Pattern} object with an `origin` method
+        #       Rails with `action_pack` tracing contrib (fast path)
+        #         `datadog.action_dispatch.route` stores the {Journey::Route}
+        #         object set by the tracer at routing time
+        #       Rails < 7.1 (slow path)
+        #         uses `action_dispatch.routes` to store {ActionDispatch::Routing::RouteSet}
+        #         which can recognize requests
+        #       Rails > 7.1 (fast path)
+        #         uses `action_dispatch.route_uri_pattern` with a string like
+        #         "/users/:id(.:format)"
+        #       Rails > 8.1.1 (fast path)
+        #         uses `action_dispatch.route` to store the {ActionDispatch::Journey::Route}
+        #         that matched when the request was routed
+        #
+        # WARNING: This method works only *after* the request has been routed.
+        #
+        # WARNING: In Rails > 7.1 when a route was not found,
+        #          `action_dispatch.route_uri_pattern` will not be set.
+        #          In Rails < 7.1 it also will not be set even if a route was found,
+        #          but in this case `action_dispatch.request.path_parameters` won't be empty.
+        def self.route_pattern(request)
+          # NOTE: Requests from contribs like AWS Lambda don't provide a usable
+          #       `::Rack::Request#env`, so infer the route from the path instead
+          unless request.respond_to?(:env)
+            return Tracing::Contrib::Rack::RouteInference.infer(request.path.to_s)
+          end
+
+          if request.env.key?(GRAPE_ROUTE_KEY)
+            pattern = request.env[GRAPE_ROUTE_KEY][:route_info]&.pattern&.origin
+            "#{request.script_name}#{pattern}"
+          elsif request.env.key?(SINATRA_ROUTE_KEY)
+            pattern = request.env[SINATRA_ROUTE_KEY].split(SINATRA_ROUTE_SEPARATOR, 2)[1]
+            "#{request.script_name}#{pattern}"
+          elsif request.env.key?(DATADOG_RAILS_ROUTE_KEY)
+            request.env[DATADOG_RAILS_ROUTE_KEY].path.spec.to_s.delete_suffix(RAILS_FORMAT_SUFFIX)
+          elsif request.env.key?(RAILS_ROUTE_KEY)
+            request.env[RAILS_ROUTE_KEY].path.spec.to_s.delete_suffix(RAILS_FORMAT_SUFFIX)
+          elsif request.env.key?(RAILS_ROUTE_URI_PATTERN_KEY)
+            request.env[RAILS_ROUTE_URI_PATTERN_KEY].delete_suffix(RAILS_FORMAT_SUFFIX)
+          elsif request.env.key?(RAILS_ROUTES_KEY) && !request.env.fetch(RAILS_PATH_PARAMS_KEY, {}).empty?
+            # NOTE: In Rails < 7.1 this `request` argument will be a Rack::Request,
+            #       it does not have all the methods that ActionDispatch::Request has.
+            #       Before trying to use the router to recognize the route, we need to
+            #       create a new ActionDispatch::Request from the request env
+            #
+            # NOTE: Rails mutates HEAD request by changing the method to GET
+            #       and uses it for route recognition to check if the route is defined
+            request = request.env[RAILS_ROUTES_KEY].request_class.new(request.env)
+
+            pattern = request.env[RAILS_ROUTES_KEY].router
+              .recognize(request) { |route, _| break route.path.spec.to_s }
+
+            # NOTE: If rails is unable to recognize request it returns empty Array
+            pattern = nil if pattern&.empty?
+
+            # NOTE: If rails can't recognize the request, we are going to fallback
+            #       to generic request path
+            (pattern || request.path).delete_suffix(RAILS_FORMAT_SUFFIX)
+          else
+            Tracing::Contrib::Rack::RouteInference.read_or_infer(request.env)
+          end
+        rescue => e
+          AppSec.telemetry&.report(e, description: 'AppSec: Could not extract route pattern')
+
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/sampler.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'zlib'
+require_relative 'route_extractor'
+require_relative '../../core/utils/time'
+require_relative '../../core/utils/lru_cache'
+
+module Datadog
+  module AppSec
+    module APISecurity
+      # A thread-local sampler for API security based on defined delay between
+      # samples with caching capability.
+      class Sampler
+        THREAD_KEY = :datadog_appsec_api_security_sampler
+        MAX_CACHE_SIZE = 4096
+
+        class << self
+          def thread_local
+            sampler = Thread.current.thread_variable_get(THREAD_KEY)
+            return sampler unless sampler.nil?
+
+            Thread.current.thread_variable_set(THREAD_KEY, new(sample_delay))
+          end
+
+          # @api private
+          def reset!
+            Thread.current.thread_variable_set(THREAD_KEY, nil)
+          end
+
+          private
+
+          def sample_delay
+            Datadog.configuration.appsec.api_security.sample_delay
+          end
+        end
+
+        def initialize(sample_delay)
+          raise ArgumentError, 'sample_delay must be an Integer' unless sample_delay.is_a?(Integer)
+
+          @cache = Core::Utils::LRUCache.new(MAX_CACHE_SIZE)
+          @sample_delay_seconds = sample_delay
+        end
+
+        def sample?(request, response)
+          return true if @sample_delay_seconds.zero?
+          return false if response.status == 404
+
+          route_pattern = RouteExtractor.route_pattern(request).to_s
+
+          key = Zlib.crc32("#{request.request_method}#{route_pattern}#{response.status}")
+          current_timestamp = Core::Utils::Time.now.to_i
+          cached_timestamp = @cache[key] || 0
+
+          return false if current_timestamp - cached_timestamp <= @sample_delay_seconds
+
+          @cache[key] = current_timestamp
+          true
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security.rb

@@ -1,9 +1,23 @@
 # frozen_string_literal: true
 
+require_relative 'api_security/sampler'
+
 module Datadog
   module AppSec
     # A namespace for API Security features.
     module APISecurity
+      def self.enabled?
+        Datadog.configuration.appsec.api_security.enabled?
+      end
+
+      def self.sample?(request, response)
+        Sampler.thread_local.sample?(request, response)
+      end
+
+      def self.sample_trace?(trace)
+        # NOTE: Reads as "if trace is priority sampled or if in standalone mode"
+        trace&.priority_sampled? || !Datadog.configuration.apm.tracing.enabled
+      end
     end
   end
 end

data/lib/datadog/appsec/assets/blocked.html

@@ -82,17 +82,26 @@
         footer p {
             font-size: 16px
         }
+
+        .security-response-id {
+            font-size:14px;
+            color:#999;
+            margin-top:20px;
+            font-family:monospace
+        }
     </style>
 </head>
 
 <body>
     <main>
         <p>Sorry, you cannot access this page. Please contact the customer service team.</p>
+        <p class="security-response-id">Security Response ID: [security_response_id]</p>
     </main>
     <footer>
         <p>Security provided by <a
                 href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/"
-                target="_blank">Datadog</a></p>
+                target="_blank"
+                rel="noopener noreferrer">Datadog</a></p>
     </footer>
 </body>
 

data/lib/datadog/appsec/assets/blocked.json

@@ -1 +1 @@
-{"errors": [{"title": "You've been blocked", "detail": "Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}
+{"errors":[{"title":"You've been blocked","detail":"Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}],"security_response_id":"[security_response_id]"}

data/lib/datadog/appsec/assets/blocked.text

@@ -1,5 +1,7 @@
-You've been blocked
+You've been blocked.
 
 Sorry, you cannot access this page. Please contact the customer service team.
 
+Security Response ID: [security_response_id]
+
 Security provided by Datadog.

data/lib/datadog/appsec/assets/waf_rules/README.md

@@ -2,51 +2,45 @@ AppSec WAF rules based on [appsec-event-rules](https://github.com/datadog/appsec
 
 ## How to update
 
-> [!WARNING]
-> This process is a temporary workaround to maintain compatibility with the existing code structure and will be changed.
+In order to update rules, download `recommended.json` and `strict.json` of the desired version from [appsec-event-rules](https://github.com/datadog/appsec-event-rules) (example: [v1.13.3](https://github.com/DataDog/appsec-event-rules/tree/1.13.3/build))
 
-1. Download `recommended.json` and `strict.json` of the desired version from [appsec-event-rules](https://github.com/datadog/appsec-event-rules) (example: [v1.13.3](https://github.com/DataDog/appsec-event-rules/tree/1.13.3/build))
-2. Run the script below inside `waf_rules` folder to extract scanners and processors into separate files
+You can store the following code as a `Rakefile` under `lib/datadog/appsec/assets/waf_rules`
 
-    ```ruby
-    require 'json'
+```ruby
+def download(filename)
+  build_path = 'repos/DataDog/appsec-event-rules/contents/build'
 
-    recommended_rules = JSON.parse(File.read(File.expand_path('recommended.json', __dir__)))
-    strict_rules = JSON.parse(File.read(File.expand_path('strict.json', __dir__)))
+  system("gh api #{build_path}/#{filename} --jq '.content' | base64 -d > #{filename}")
+end
 
-    recommended_processors = recommended_rules.delete('processors')
-    strict_processors = strict_rules.delete('processors')
+task default: :update
 
-    if recommended_processors.sort_by { |processor| processor['id'] } !=
-        strict_processors.sort_by { |processor| processor['id'] }
-      raise 'Processors are not the same, unable to extract them'
-    end
+task :verify_dependencies do
+  next if system('which gh 1>/dev/null')
 
-    puts 'Extracting processors...'
-    File.open(File.expand_path('processors.json', __dir__), 'wb') do |file|
-      file.write(JSON.pretty_generate(recommended_processors))
-    end
+  abort <<~MESSAGE
+    \033[0;33mNOTE: To successfully execute that task make sure you have
+          GitHub CLI installed and authenticated https://cli.github.com/\033[0m
+  MESSAGE
+end
 
-    recommended_scanners = recommended_rules.delete('scanners')
-    strict_scanners = strict_rules.delete('scanners')
+desc 'Update recommended.json and strict.json to the latest version'
+task update: :verify_dependencies do
+  download('strict.json')
+  download('recommended.json')
 
-    if recommended_scanners.sort_by { |processor| processor['id'] } !=
-        strict_scanners.sort_by { |processor| processor['id'] }
-      raise 'Scanners are not the same, unable to extract them'
-    end
+  puts "\033[0;32mSuccess!\033[0m"
+end
+```
 
-    puts 'Extracting scanners...'
-    File.open(File.expand_path('scanners.json', __dir__), 'wb') do |file|
-      file.write(JSON.pretty_generate(recommended_scanners))
-    end
+And run the following command
 
-    puts 'Updating rules...'
+> [!IMPORTANT]
+> To run that command you will need to install GitHub CLI tool and authenticate it
+> See: https://cli.github.com/ (or ddtool)
 
-    File.open(File.expand_path('recommended.json', __dir__), 'wb') do |file|
-      file.write(JSON.pretty_generate(recommended_rules))
-    end
 
-    File.open(File.expand_path('strict.json', __dir__), 'wb') do |file|
-      file.write(JSON.pretty_generate(strict_rules))
-    end
-    ```
+```console
+$ bundle exec rake update
+Success!
+```