datadog 2.17.0 → 2.37.0

data/lib/datadog/appsec/configuration/settings.rb

@@ -1,342 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../../core/utils/duration'
-require_relative '../sample_rate'
-
-module Datadog
-  module AppSec
-    module Configuration
-      # Settings
-      module Settings
-        # rubocop:disable Layout/LineLength
-        DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)pass|pw(?:or)?d|secret|(?:api|private|public|access)[_-]?key|token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\.net[_-]sessionid|sid|jwt'
-        DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key(?:[_-]?id)?|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?|jsessionid|phpsessid|asp\.net(?:[_-]|-)sessionid|sid|jwt)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'
-        # rubocop:enable Layout/LineLength
-
-        DISABLED_AUTO_USER_INSTRUMENTATION_MODE = 'disabled'
-        ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE = 'anonymization'
-        IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE = 'identification'
-        AUTO_USER_INSTRUMENTATION_MODES = [
-          DISABLED_AUTO_USER_INSTRUMENTATION_MODE,
-          ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
-          IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
-        ].freeze
-        AUTO_USER_INSTRUMENTATION_MODES_ALIASES = {
-          'ident' => IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE,
-          'anon' => ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
-        }.freeze
-
-        # NOTE: These two constants are deprecated
-        SAFE_TRACK_USER_EVENTS_MODE = 'safe'
-        EXTENDED_TRACK_USER_EVENTS_MODE = 'extended'
-        APPSEC_VALID_TRACK_USER_EVENTS_MODE = [
-          SAFE_TRACK_USER_EVENTS_MODE, EXTENDED_TRACK_USER_EVENTS_MODE
-        ].freeze
-        APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES = ['1', 'true'].concat(
-          APPSEC_VALID_TRACK_USER_EVENTS_MODE
-        ).freeze
-
-        def self.extended(base)
-          base = base.singleton_class unless base.is_a?(Class)
-          add_settings!(base)
-        end
-
-        # rubocop:disable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
-        def self.add_settings!(base)
-          base.class_eval do
-            settings :appsec do
-              option :enabled do |o|
-                o.type :bool
-                o.env 'DD_APPSEC_ENABLED'
-                o.default false
-              end
-
-              define_method(:instrument) do |integration_name|
-                if enabled
-                  registered_integration = Datadog::AppSec::Contrib::Integration.registry[integration_name]
-                  if registered_integration
-                    klass = registered_integration.klass
-                    if klass.loaded? && klass.compatible?
-                      instance = klass.new
-                      instance.patcher.patch unless instance.patcher.patched?
-                    end
-                  end
-                end
-              end
-
-              # RASP or Runtime Application Self-Protection
-              # is a collection of techniques and heuristics aimed at detecting malicious inputs and preventing
-              # any potential side-effects on the application resulting from the use of said malicious inputs.
-              option :rasp_enabled do |o|
-                o.type :bool, nilable: true
-                o.env 'DD_APPSEC_RASP_ENABLED'
-                o.default true
-              end
-
-              option :ruleset do |o|
-                o.env 'DD_APPSEC_RULES'
-                o.default :recommended
-              end
-
-              option :ip_passlist do |o|
-                o.default []
-              end
-
-              option :ip_denylist do |o|
-                o.type :array
-                o.default []
-              end
-
-              option :user_id_denylist do |o|
-                o.type :array
-                o.default []
-              end
-
-              option :waf_timeout do |o|
-                o.env 'DD_APPSEC_WAF_TIMEOUT' # us
-                o.default 5_000
-                o.setter do |v|
-                  Datadog::Core::Utils::Duration.call(v.to_s, base: :us)
-                end
-              end
-
-              option :waf_debug do |o|
-                o.env 'DD_APPSEC_WAF_DEBUG'
-                o.default false
-                o.type :bool
-              end
-
-              option :trace_rate_limit do |o|
-                o.type :int
-                o.env 'DD_APPSEC_TRACE_RATE_LIMIT' # trace/s
-                o.default 100
-              end
-
-              option :obfuscator_key_regex do |o|
-                o.type :string
-                o.env 'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP'
-                o.default DEFAULT_OBFUSCATOR_KEY_REGEX
-              end
-
-              option :obfuscator_value_regex do |o|
-                o.type :string
-                o.env 'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP'
-                o.default DEFAULT_OBFUSCATOR_VALUE_REGEX
-              end
-
-              settings :block do
-                settings :templates do
-                  option :html do |o|
-                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML'
-                    o.type :string, nilable: true
-                    o.setter do |value|
-                      if value
-                        unless File.exist?(value)
-                          raise(ArgumentError,
-                            "appsec.templates.html: file not found: #{value}")
-                        end
-
-                        File.binread(value) || ''
-                      end
-                    end
-                  end
-
-                  option :json do |o|
-                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON'
-                    o.type :string, nilable: true
-                    o.setter do |value|
-                      if value
-                        unless File.exist?(value)
-                          raise(ArgumentError,
-                            "appsec.templates.json: file not found: #{value}")
-                        end
-
-                        File.binread(value) || ''
-                      end
-                    end
-                  end
-
-                  option :text do |o|
-                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_TEXT'
-                    o.type :string, nilable: true
-                    o.setter do |value|
-                      if value
-                        unless File.exist?(value)
-                          raise(ArgumentError,
-                            "appsec.templates.text: file not found: #{value}")
-                        end
-
-                        File.binread(value) || ''
-                      end
-                    end
-                  end
-                end
-              end
-
-              settings :stack_trace do
-                option :enabled do |o|
-                  o.type :bool
-                  o.env 'DD_APPSEC_STACK_TRACE_ENABLED'
-                  o.default true
-                end
-
-                # The maximum number of stack trace frames to collect for each stack trace.
-                #
-                # If the stack trace exceeds this limit, the frames are dropped from the middle of the stack trace:
-                # 75% of the frames are kept from the top of the stack trace and 25% from the bottom
-                # (this percentage is also configurable).
-                #
-                # Minimum value is 10.
-                # Set to zero if you don't want any frames to be dropped.
-                #
-                # Default value is 32
-                option :max_depth do |o|
-                  o.type :int
-                  o.env 'DD_APPSEC_MAX_STACK_TRACE_DEPTH'
-                  o.default 32
-
-                  o.setter do |value|
-                    value = 0 if value < 0
-                    value
-                  end
-                end
-
-                # The percentage of frames to keep from the top of the stack trace.
-                #
-                # Default value is 75
-                option :top_percentage do |o|
-                  o.type :int
-                  o.env 'DD_APPSEC_MAX_STACK_TRACE_DEPTH_TOP_PERCENT'
-                  o.default 75
-
-                  o.setter do |value|
-                    value = 100 if value > 100
-                    value = 0 if value.negative?
-                    value
-                  end
-                end
-
-                # Maximum number of stack traces to collect per span.
-                #
-                # Set to zero if you want to collect all stack traces.
-                #
-                # Default value is 2
-                option :max_stack_traces do |o|
-                  o.type :int
-                  o.env 'DD_APPSEC_MAX_STACK_TRACES'
-                  o.default 2
-
-                  o.setter do |value|
-                    value = 0 if value < 0
-                    value
-                  end
-                end
-              end
-
-              settings :auto_user_instrumentation do
-                define_method(:enabled?) { get_option(:mode) != DISABLED_AUTO_USER_INSTRUMENTATION_MODE }
-
-                option :mode do |o|
-                  o.type :string
-                  o.env 'DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE'
-                  o.default IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
-                  o.setter do |value|
-                    mode = AUTO_USER_INSTRUMENTATION_MODES_ALIASES.fetch(value, value)
-                    next mode if AUTO_USER_INSTRUMENTATION_MODES.include?(mode)
-
-                    Datadog.logger.warn(
-                      'The appsec.auto_user_instrumentation.mode value provided is not supported. ' \
-                      "Supported values are: #{AUTO_USER_INSTRUMENTATION_MODES.join(" | ")}. " \
-                      "Using value: #{DISABLED_AUTO_USER_INSTRUMENTATION_MODE}."
-                    )
-
-                    DISABLED_AUTO_USER_INSTRUMENTATION_MODE
-                  end
-                end
-              end
-
-              # DEV-3.0: Remove `track_user_events.enabled` and `track_user_events.mode` options
-              settings :track_user_events do
-                option :enabled do |o|
-                  o.default true
-                  o.type :bool
-                  o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
-                  o.env_parser do |env_value|
-                    if env_value == 'disabled'
-                      false
-                    else
-                      APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES.include?(env_value.strip.downcase)
-                    end
-                  end
-                  o.after_set do |_, _, precedence|
-                    unless precedence == Datadog::Core::Configuration::Option::Precedence::DEFAULT
-                      Core.log_deprecation(key: :appsec_track_user_events_enabled) do
-                        'The appsec.track_user_events.enabled setting is deprecated. ' \
-                        'Please remove it from your Datadog.configure block and use ' \
-                        'appsec.auto_user_instrumentation.mode instead.'
-                      end
-                    end
-                  end
-                end
-
-                option :mode do |o|
-                  o.type :string
-                  o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
-                  o.default SAFE_TRACK_USER_EVENTS_MODE
-                  o.setter do |v|
-                    if APPSEC_VALID_TRACK_USER_EVENTS_MODE.include?(v)
-                      v
-                    elsif v == 'disabled'
-                      SAFE_TRACK_USER_EVENTS_MODE
-                    else
-                      Datadog.logger.warn(
-                        'The appsec.track_user_events.mode value provided is not supported.' \
-                        "Supported values are: #{APPSEC_VALID_TRACK_USER_EVENTS_MODE.join(" | ")}." \
-                        "Using default value: #{SAFE_TRACK_USER_EVENTS_MODE}."
-                      )
-
-                      SAFE_TRACK_USER_EVENTS_MODE
-                    end
-                  end
-                  o.after_set do |_, _, precedence|
-                    unless precedence == Datadog::Core::Configuration::Option::Precedence::DEFAULT
-                      Core.log_deprecation(key: :appsec_track_user_events_mode) do
-                        'The appsec.track_user_events.mode setting is deprecated. ' \
-                        'Please remove it from your Datadog.configure block and use ' \
-                        'appsec.auto_user_instrumentation.mode instead.'
-                      end
-                    end
-                  end
-                end
-              end
-
-              settings :api_security do
-                option :enabled do |o|
-                  o.type :bool
-                  o.env 'DD_EXPERIMENTAL_API_SECURITY_ENABLED'
-                  o.default false
-                end
-
-                option :sample_rate do |o|
-                  o.type :float
-                  o.env 'DD_API_SECURITY_REQUEST_SAMPLE_RATE'
-                  o.default 0.1
-                  o.setter do |value|
-                    value = 1 if value > 1
-                    SampleRate.new(value)
-                  end
-                end
-              end
-
-              option :sca_enabled do |o|
-                o.type :bool, nilable: true
-                o.env 'DD_APPSEC_SCA_ENABLED'
-              end
-            end
-          end
-        end
-        # rubocop:enable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/rails/ext.rb

@@ -1,13 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Rails
-        # Rails integration constants
-        module Ext
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/processor/rule_merger.rb

@@ -1,171 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../assets'
-
-module Datadog
-  module AppSec
-    class Processor
-      # RuleMerger merge different sources of information
-      # into the rules payload
-      module RuleMerger
-        # RuleVersionMismatchError
-        class RuleVersionMismatchError < StandardError
-          def initialize(version1, version2)
-            msg = 'Merging rule files with different version could lead to unkown behaviour. ' \
-              "We have receieve two rule files with versions: #{version1}, #{version2}. " \
-              'Please validate the configuration is correct and try again.'
-            super(msg)
-          end
-        end
-
-        class << self
-          # TODO: `processors` and `scanners` are not provided by the caller, consider removing them
-          def merge(
-            telemetry:,
-            rules:, actions: [], data: [], overrides: [], exclusions: [], custom_rules: [],
-            processors: nil, scanners: nil
-          )
-            processors ||= begin
-              default_waf_processors
-            rescue => e
-              Datadog.logger.error("libddwaf rulemerger failed to parse default waf processors. Error: #{e.inspect}")
-              telemetry.report(
-                e,
-                description: 'libddwaf rulemerger failed to parse default waf processors'
-              )
-              []
-            end
-
-            scanners ||= begin
-              default_waf_scanners
-            rescue => e
-              Datadog.logger.error("libddwaf rulemerger failed to parse default waf scanners. Error: #{e.inspect}")
-              telemetry.report(
-                e,
-                description: 'libddwaf rulemerger failed to parse default waf scanners'
-              )
-              []
-            end
-
-            combined_rules = combine_rules(rules)
-
-            combined_data = combine_data(data) if data.any?
-            combined_overrides = combine_overrides(overrides) if overrides.any?
-            combined_exclusions = combine_exclusions(exclusions) if exclusions.any?
-            combined_custom_rules = combine_custom_rules(custom_rules) if custom_rules.any?
-
-            combined_rules['actions'] = actions if actions.any?
-            combined_rules['rules_data'] = combined_data if combined_data
-            combined_rules['rules_override'] = combined_overrides if combined_overrides
-            combined_rules['exclusions'] = combined_exclusions if combined_exclusions
-            combined_rules['custom_rules'] = combined_custom_rules if combined_custom_rules
-            combined_rules['processors'] = processors
-            combined_rules['scanners'] = scanners
-            combined_rules
-          end
-
-          def default_waf_processors
-            @default_waf_processors ||= JSON.parse(Datadog::AppSec::Assets.waf_processors)
-          end
-
-          def default_waf_scanners
-            @default_waf_scanners ||= JSON.parse(Datadog::AppSec::Assets.waf_scanners)
-          end
-
-          private
-
-          def combine_rules(rules)
-            return rules[0].dup if rules.size == 1
-
-            final_rules = []
-            # @type var final_version: ::String
-            final_version = (_ = nil)
-
-            rules.each do |rule_file|
-              version = rule_file['version']
-
-              if version && !final_version
-                final_version = version
-              elsif final_version != version
-                raise RuleVersionMismatchError.new(final_version, version)
-              end
-
-              final_rules.concat(rule_file['rules'])
-            end
-
-            {
-              'version' => final_version,
-              'rules' => final_rules
-            }
-          end
-
-          def combine_data(data)
-            result = []
-
-            data.each do |data_entry|
-              data_entry.each do |value|
-                existing_data = result.find { |x| x['id'] == value['id'] }
-
-                if existing_data && existing_data['type'] == value['type']
-                  # Duplicate entry base on type and id
-                  # We need to merge the existing data with the new one
-                  # and make sure to remove duplicates
-                  merged_data = merge_data_base_on_expiration(existing_data['data'], value['data'])
-                  existing_data['data'] = merged_data
-                else
-                  result << value
-                end
-              end
-            end
-
-            return unless result.any?
-
-            result
-          end
-
-          def merge_data_base_on_expiration(data1, data2)
-            result = data1.each_with_object({}) do |value, acc|
-              acc[value['value']] = value['expiration']
-            end
-
-            data2.each do |data|
-              if result.key?(data['value'])
-                # The value is duplicated so we need to keep
-                # the one with the highest expiration value
-                # We replace it if the expiration is higher than the current one
-                # or if no experiration
-                current_expiration = result[data['value']]
-                new_expiration = data['expiration']
-
-                if new_expiration.nil? || current_expiration && new_expiration > current_expiration
-                  result[data['value']] = new_expiration
-                end
-              else
-                result[data['value']] = data['expiration']
-              end
-            end
-
-            result.each_with_object([]) do |entry, acc|
-              value = {'value' => entry[0]}
-              value['expiration'] = entry[1] if entry[1]
-
-              acc << value
-            end
-          end
-
-          def combine_overrides(overrides)
-            overrides.flatten
-          end
-
-          def combine_exclusions(exclusions)
-            exclusions.flatten
-          end
-
-          def combine_custom_rules(custom_rules)
-            custom_rules.flatten
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/processor.rb

@@ -1,107 +0,0 @@
-# frozen_string_literal: true
-
-require_relative 'security_engine/runner'
-
-module Datadog
-  module AppSec
-    # Processor integrates libddwaf into datadog/appsec
-    # NOTE: This class will be moved under AppSec::SecurityEngine namespace
-    class Processor
-      attr_reader :diagnostics, :addresses
-
-      def initialize(ruleset:, telemetry:)
-        @telemetry = telemetry
-        @diagnostics = nil
-        @addresses = []
-
-        settings = Datadog.configuration.appsec
-
-        # TODO: Refactor to make it easier to test
-        unless require_libddwaf && libddwaf_provides_waf? && create_waf_handle(settings, ruleset)
-          Datadog.logger.warn('AppSec is disabled, see logged errors above')
-        end
-      end
-
-      def ready?
-        !@handle.nil?
-      end
-
-      def finalize
-        @handle.finalize
-      end
-
-      def new_runner
-        SecurityEngine::Runner.new(@handle, telemetry: @telemetry)
-      end
-
-      private
-
-      # libddwaf raises a LoadError on unsupported platforms; it may at some
-      # point succeed in being required yet not provide a specific needed feature.
-      def require_libddwaf
-        Datadog.logger.debug { "libddwaf platform: #{libddwaf_platform}" }
-
-        require 'libddwaf'
-
-        true
-      rescue LoadError => e
-        Datadog.logger.error do
-          'libddwaf failed to load,' \
-            "installed platform: #{libddwaf_platform} ruby platforms: #{ruby_platforms} error: #{e.inspect}"
-        end
-        @telemetry.report(e, description: 'libddwaf failed to load')
-
-        false
-      end
-
-      # check whether libddwaf is required *and* able to provide the needed feature
-      def libddwaf_provides_waf?
-        defined?(Datadog::AppSec::WAF) ? true : false
-      end
-
-      def create_waf_handle(settings, ruleset)
-        # TODO: this may need to be reset if the main Datadog logging level changes after initialization
-        Datadog::AppSec::WAF.logger = Datadog.logger if Datadog.logger.debug? && settings.waf_debug
-
-        obfuscator_config = {
-          key_regex: settings.obfuscator_key_regex,
-          value_regex: settings.obfuscator_value_regex,
-        }
-
-        @handle = Datadog::AppSec::WAF::Handle.new(ruleset, obfuscator: obfuscator_config)
-        @diagnostics = @handle.diagnostics
-        @addresses = @handle.required_addresses
-
-        true
-      rescue WAF::LibDDWAF::Error => e
-        Datadog.logger.error do
-          "libddwaf failed to initialize, error: #{e.inspect}"
-        end
-        @telemetry.report(e, description: 'libddwaf failed to initialize')
-
-        @diagnostics = e.diagnostics if e.diagnostics
-
-        false
-      rescue => e
-        Datadog.logger.error do
-          "libddwaf failed to initialize, error: #{e.inspect}"
-        end
-        @telemetry.report(e, description: 'libddwaf failed to initialize')
-
-        false
-      end
-
-      def libddwaf_platform
-        if Gem.loaded_specs['libddwaf']
-          Gem.loaded_specs['libddwaf'].platform.to_s
-        else
-          'unknown'
-        end
-      end
-
-      def ruby_platforms
-        Gem.platforms.map(&:to_s)
-      end
-    end
-  end
-end

data/lib/datadog/core/remote/transport/http/api.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../../../encoding'
-require_relative '../../../transport/http/api/map'
-require_relative '../../../transport/http/api/instance'
-require_relative '../../../transport/http/api/spec'
-require_relative 'negotiation'
-require_relative 'config'
-
-module Datadog
-  module Core
-    module Remote
-      module Transport
-        module HTTP
-          # Namespace for API components
-          module API
-            # Default API versions
-            ROOT = 'root'
-            V7 = 'v0.7'
-
-            module_function
-
-            def defaults
-              Core::Transport::HTTP::API::Map[
-                ROOT => Spec.new do |s|
-                  s.info = Negotiation::API::Endpoint.new(
-                    '/info',
-                  )
-                end,
-                V7 => Spec.new do |s|
-                  s.config = Config::API::Endpoint.new(
-                    '/v0.7/config',
-                    Core::Encoding::JSONEncoder,
-                  )
-                end,
-              ]
-            end
-
-            class Instance < Core::Transport::HTTP::API::Instance
-              include Config::API::Instance
-              include Negotiation::API::Instance
-            end
-
-            class Spec < Core::Transport::HTTP::API::Spec
-              include Config::API::Spec
-              include Negotiation::API::Spec
-            end
-          end
-        end
-      end
-    end
-  end
-end