datadog 2.17.0 → 2.37.0

data/lib/datadog/appsec/assets/waf_rules/strict.json

@@ -1,7 +1,7 @@
 {
   "version": "2.2",
   "metadata": {
-    "rules_version": "1.13.3"
+    "rules_version": "1.15.1"
   },
   "rules": [
     {
@@ -1746,28 +1746,12 @@
       "transformers": []
     }
   ],
+  "rules_compat": [],
   "processors": [
     {
       "id": "http-endpoint-fingerprint",
       "generator": "http_endpoint_fingerprint",
-      "conditions": [
-        {
-          "operator": "exists",
-          "parameters": {
-            "inputs": [
-              {
-                "address": "waf.context.event"
-              },
-              {
-                "address": "server.business_logic.users.login.failure"
-              },
-              {
-                "address": "server.business_logic.users.login.success"
-              }
-            ]
-          }
-        }
-      ],
+      "conditions": [],
       "parameters": {
         "mappings": [
           {
@@ -1795,7 +1779,7 @@
           }
         ]
       },
-      "evaluate": false,
+      "evaluate": true,
       "output": true
     },
     {
@@ -1951,24 +1935,7 @@
     {
       "id": "http-header-fingerprint",
       "generator": "http_header_fingerprint",
-      "conditions": [
-        {
-          "operator": "exists",
-          "parameters": {
-            "inputs": [
-              {
-                "address": "waf.context.event"
-              },
-              {
-                "address": "server.business_logic.users.login.failure"
-              },
-              {
-                "address": "server.business_logic.users.login.success"
-              }
-            ]
-          }
-        }
-      ],
+      "conditions": [],
       "parameters": {
         "mappings": [
           {
@@ -1981,30 +1948,35 @@
           }
         ]
       },
-      "evaluate": false,
+      "evaluate": true,
       "output": true
     },
     {
-      "id": "http-network-fingerprint",
-      "generator": "http_network_fingerprint",
-      "conditions": [
-        {
-          "operator": "exists",
-          "parameters": {
+      "id": "decode-auth-jwt",
+      "generator": "jwt_decode",
+      "min_version": "1.25.0",
+      "parameters": {
+        "mappings": [
+          {
             "inputs": [
               {
-                "address": "waf.context.event"
-              },
-              {
-                "address": "server.business_logic.users.login.failure"
-              },
-              {
-                "address": "server.business_logic.users.login.success"
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "authorization"
+                ]
               }
-            ]
+            ],
+            "output": "server.request.jwt"
           }
-        }
-      ],
+        ]
+      },
+      "evaluate": true,
+      "output": false
+    },
+    {
+      "id": "http-network-fingerprint",
+      "generator": "http_network_fingerprint",
+      "conditions": [],
       "parameters": {
         "mappings": [
           {
@@ -2017,30 +1989,13 @@
           }
         ]
       },
-      "evaluate": false,
+      "evaluate": true,
       "output": true
     },
     {
       "id": "session-fingerprint",
       "generator": "session_fingerprint",
-      "conditions": [
-        {
-          "operator": "exists",
-          "parameters": {
-            "inputs": [
-              {
-                "address": "waf.context.event"
-              },
-              {
-                "address": "server.business_logic.users.login.failure"
-              },
-              {
-                "address": "server.business_logic.users.login.success"
-              }
-            ]
-          }
-        }
-      ],
+      "conditions": [],
       "parameters": {
         "mappings": [
           {
@@ -2063,7 +2018,7 @@
           }
         ]
       },
-      "evaluate": false,
+      "evaluate": true,
       "output": true
     }
   ],
@@ -2862,6 +2817,24 @@
         "category": "payment"
       }
     },
+    {
+      "id": "c542c147-3883-43d6-a067-178e4a7bd65d",
+      "name": "Password",
+      "key": {
+        "operator": "match_regex",
+        "parameters": {
+          "regex": "\\bpass(?:[_-]?word|wd)?\\b|\\bpwd\\b",
+          "options": {
+            "case_sensitive": false,
+            "min_length": 3
+          }
+        }
+      },
+      "tags": {
+        "type": "password",
+        "category": "credentials"
+      }
+    },
     {
       "id": "18b608bd7a764bff5b2344c0",
       "name": "Phone number",

data/lib/datadog/appsec/assets.rb

@@ -21,7 +21,7 @@ module Datadog
       end
 
       def blocked(format: :html)
-        (@blocked ||= {})[format] ||= read("blocked.#{format}")
+        (@blocked ||= {})[format] ||= read("blocked.#{format}").freeze
       end
 
       def path

data/lib/datadog/appsec/autoload.rb

@@ -1,13 +1,13 @@
 # frozen_string_literal: true
 
-if %w[1 true].include?((ENV['DD_APPSEC_ENABLED'] || '').downcase)
+if %w[1 true].include?((Datadog::DATADOG_ENV['DD_APPSEC_ENABLED'] || '').downcase)
   begin
     require_relative 'contrib/auto_instrument'
     Datadog::AppSec::Contrib::AutoInstrument.patch_all
   rescue => e
     Kernel.warn(
       '[datadog] AppSec failed to instrument. No security check will be performed. error: ' \
-      " #{e.class.name} #{e.message}"
+      " #{e.class}: #{e.message}"
     )
   end
 end

data/lib/datadog/appsec/component.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
 
-require_relative 'processor'
-require_relative 'processor/rule_merger'
+require_relative 'security_engine/engine'
+require_relative 'security_engine/runner'
 require_relative 'processor/rule_loader'
 require_relative 'actions_handler'
+require_relative 'thread_safe_ref'
 
 module Datadog
   module AppSec
@@ -21,7 +22,7 @@ module Datadog
             return
           end
 
-          if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') && ffi_version < Gem::Version.new('1.16.0')
+          if RubyVersion.is?('>= 3.3') && ffi_version < Gem::Version.new('1.16.0')
             Datadog.logger.warn(
               'AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, ' \
               'and will be forcibly disabled due to a memory leak in `ffi`. ' \
@@ -32,7 +33,8 @@ module Datadog
             return
           end
 
-          processor = create_processor(settings, telemetry)
+          require_libddwaf(telemetry: telemetry)
+          Datadog::AppSec::WAF.logger = Datadog.logger if Datadog.logger.debug? && settings.appsec.waf_debug
 
           # We want to always instrument user events when AppSec is enabled.
           # There could be cases in which users use the DD_APPSEC_ENABLED Env variable to
@@ -42,81 +44,52 @@ module Datadog
           devise_integration = Datadog::AppSec::Contrib::Devise::Integration.new
           settings.appsec.instrument(:devise) unless devise_integration.patcher.patched?
 
-          new(processor, telemetry)
+          security_engine = SecurityEngine::Engine.new(appsec_settings: settings.appsec, telemetry: telemetry)
+          new(security_engine: security_engine)
+        # NOTE: At this point we should capture all possible exceptions and
+        #       gracefully fail component initialization, preventing propagation
+        #       into the host application code.
+        rescue Exception => e # standard:disable Lint/RescueException
+          Datadog.logger.warn("AppSec is disabled: #{e.class}: #{e.message}; there may be additional logged errors above")
+
+          # Not reporting to telemetry here because some of the rescued exceptions
+          # have already been reported by the code that raised them
+          # (e.g. SecurityEngine::Engine.new reports WAF init failures).
+          # TODO: reconsider whether telemetry reporting belongs here
+          # (single catch-all) or in the downstream code (as it is now).
+          nil
         end
 
         private
 
-        def create_processor(settings, telemetry)
-          rules = AppSec::Processor::RuleLoader.load_rules(
-            telemetry: telemetry,
-            ruleset: settings.appsec.ruleset
-          )
-          return nil unless rules
-
-          data = AppSec::Processor::RuleLoader.load_data(
-            ip_denylist: settings.appsec.ip_denylist,
-            user_id_denylist: settings.appsec.user_id_denylist,
-          )
-
-          exclusions = AppSec::Processor::RuleLoader.load_exclusions(ip_passlist: settings.appsec.ip_passlist)
-
-          # NOTE: This is a temporary solution before the RuleMerger refactoring
-          #       with new RemoteConfig setup
-          processors = rules['processors']
-          scanners = rules['scanners']
-
-          ruleset = AppSec::Processor::RuleMerger.merge(
-            rules: [rules],
-            data: data,
-            scanners: scanners,
-            processors: processors,
-            exclusions: exclusions,
-            telemetry: telemetry
-          )
-
-          processor = Processor.new(ruleset: ruleset, telemetry: telemetry)
-          return nil unless processor.ready?
-
-          processor
-        end
-      end
+        def require_libddwaf(telemetry:)
+          require('libddwaf')
+        rescue LoadError => e
+          libddwaf_platform = Gem.loaded_specs['libddwaf']&.platform || 'unknown'
+          ruby_platforms = Gem.platforms.map(&:to_s)
 
-      attr_reader :processor, :telemetry
+          error_message = "libddwaf failed to load - installed platform: #{libddwaf_platform}, " \
+            "ruby platforms: #{ruby_platforms}"
 
-      def initialize(processor, telemetry)
-        @processor = processor
-        @telemetry = telemetry
+          Datadog.logger.error("#{error_message}, error #{e.inspect}")
+          telemetry.report(e, description: error_message)
 
-        @mutex = Mutex.new
+          raise e
+        end
       end
 
-      def reconfigure(ruleset:, telemetry:)
-        @mutex.synchronize do
-          new_processor = Processor.new(ruleset: ruleset, telemetry: telemetry)
-
-          if new_processor&.ready?
-            old_processor = @processor
-
-            @telemetry = telemetry
-            @processor = new_processor
+      attr_reader :security_engine
 
-            old_processor&.finalize
-          end
-        end
+      def initialize(security_engine:)
+        @security_engine = security_engine
       end
 
-      def reconfigure_lock(&block)
-        @mutex.synchronize(&block)
+      def reconfigure!
+        security_engine&.reconfigure!
       end
 
       def shutdown!
-        @mutex.synchronize do
-          if processor&.ready?
-            processor.finalize
-            @processor = nil
-          end
-        end
+        # no-op
       end
     end
   end

data/lib/datadog/appsec/compressed_json.rb

@@ -4,11 +4,11 @@ require 'json'
 require 'zlib'
 require 'stringio'
 
-require_relative '../core/utils/base64'
+require_relative '../core/utils/base64_codec'
 
 module Datadog
   module AppSec
-    # Converts derivative schema payloads into JSON and compresses them into a
+    # Converts complex schema payloads into JSON and compresses them into a
     # base64 encoded string if the payload is worth compressing.
     #
     # See: https://github.com/DataDog/dd-trace-rb/pull/3177#issuecomment-1747221082
@@ -27,7 +27,7 @@ module Datadog
       end
 
       private_class_method def self.compress_and_encode(payload)
-        Core::Utils::Base64.strict_encode64(
+        Core::Utils::Base64Codec.strict_encode64(
           Zlib.gzip(payload, level: Zlib::BEST_SPEED, strategy: Zlib::DEFAULT_STRATEGY)
         )
       rescue Zlib::Error, TypeError => e