datadog 2.19.0 → 2.21.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9c533682b9a96989e1ad8d4eb96339af4bffdb5fd9cbfe447bd0a034bc387c03
-  data.tar.gz: 5d7808aa6b7fd5f9c68e453fef4fff8c5345c62fb26a7f7839d630ec0da2fe9f
+  metadata.gz: e804b0ea5131eba47b865f95a6540c84a2c20e061a9d25a9bf1f2841895c46c6
+  data.tar.gz: 7c7b61bb061c943aad519ede1f4900351db8b79e7111368c3d85f23ac73fafb8
 SHA512:
-  metadata.gz: 6b35d7ef1ce2f9e565727037f9e5b329d019202ff20c01a15bb5096cf14253b3ab9812d4fc84fc23e265ec2e7e0096e34acc6a845ad510b215ef7df4093107e7
-  data.tar.gz: 72fff247b51de201e4373638627fa419a3a679979f880dfa44c73d1c9a7c062991746045d41cbe5fa47d824b025fb9cad2f34c0139e034df1b85ddb4a07bccd9
+  metadata.gz: 669cc7248fe15fbd07ab98e71d20e3ec97d644b27ef43be9b7fe7b047c60bd8794c903db3cfe1f4580f7877f7a1491f5028743a618e649930ff10d14756ae820
+  data.tar.gz: e5a2e28ebcc390f1e2277299b883946c4f0baec35754216bbea4da4df437fa06e8c2b6cc0aa5f7847256e0b500903076a19ec7456c7979e7759fc7a4fb8836d3

data/CHANGELOG.md

@@ -2,6 +2,42 @@
 
 ## [Unreleased]
 
+## [2.21.0] - 2025-09-17
+
+### Added
+
+* Tracing: Generate metrics for GraphQL operation execution ([#4862][])
+
+### Changed
+
+* Tracing: The `graphql.execute` span resource now includes the operation type ([#4862][])
+
+### Fixed
+
+* Tracing: Fix Service Discovery capabilities on forked processes ([#4877][])
+* Tracing: Fix an unclosed trace issue when the Rack application has proxy spans and raises an exception. This caused traces that encompassed multiple requests ([#4779][])
+* AppSec: Fix API Security route extraction for Rails ([#4887][])
+* AppSec: Fix a bug with non-string Hash keys conversion ([#4893][])
+* Dynamic Instrumentation: Fix incorrect template expression evaluation in some cases ([#4884][])
+
+## [2.20.0] - 2025-09-04
+
+### Added
+
+* Tracing: Add capability to add [W3C Baggage](https://www.w3.org/TR/baggage/#example) headers to the local root span as span tags ([#4716][])
+* AppSec: Add WAF analysis of the responses with JSON body ([#4848][])
+* Dynamic Instrumentation: Live Debugger: Add support for specifying probes in a file via `DD_DYNAMIC_INSTRUMENTATION_PROBE_FILE` environment variable ([#4838][])
+
+### Changed
+
+* Core: Expand generated warning and error messages during `libdatadog` build ([#4831][])
+* AppSec: Rework handling of Remote Config updates for multi-threaded web servers ([#4833][])
+* AppSec: Update security tags for Business Logic Events and User Events SDK v1 and v2 ([#4851][])
+
+### Fixed
+
+* Tracing: Fix constants resolution for Rails runner ([#4863][])
+
 ## [2.19.0] - 2025-07-24
 
 ### Added
@@ -3297,7 +3333,9 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
 Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 
 
-[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.19.0...master
+[Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v2.21.0...master
+[2.21.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.20.0...v2.21.0
+[2.20.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.19.0...v2.20.0
 [2.19.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.18.0...v2.19.0
 [2.18.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.17.0...v2.18.0
 [2.17.0]: https://github.com/DataDog/dd-trace-rb/compare/v2.16.0...v2.17.0
@@ -4863,6 +4901,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4693]: https://github.com/DataDog/dd-trace-rb/issues/4693
 [#4697]: https://github.com/DataDog/dd-trace-rb/issues/4697
 [#4699]: https://github.com/DataDog/dd-trace-rb/issues/4699
+[#4716]: https://github.com/DataDog/dd-trace-rb/issues/4716
 [#4718]: https://github.com/DataDog/dd-trace-rb/issues/4718
 [#4721]: https://github.com/DataDog/dd-trace-rb/issues/4721
 [#4728]: https://github.com/DataDog/dd-trace-rb/issues/4728
@@ -4874,6 +4913,7 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4771]: https://github.com/DataDog/dd-trace-rb/issues/4771
 [#4772]: https://github.com/DataDog/dd-trace-rb/issues/4772
 [#4776]: https://github.com/DataDog/dd-trace-rb/issues/4776
+[#4779]: https://github.com/DataDog/dd-trace-rb/issues/4779
 [#4783]: https://github.com/DataDog/dd-trace-rb/issues/4783
 [#4785]: https://github.com/DataDog/dd-trace-rb/issues/4785
 [#4786]: https://github.com/DataDog/dd-trace-rb/issues/4786
@@ -4884,6 +4924,17 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
 [#4813]: https://github.com/DataDog/dd-trace-rb/issues/4813
 [#4814]: https://github.com/DataDog/dd-trace-rb/issues/4814
 [#4819]: https://github.com/DataDog/dd-trace-rb/issues/4819
+[#4831]: https://github.com/DataDog/dd-trace-rb/issues/4831
+[#4833]: https://github.com/DataDog/dd-trace-rb/issues/4833
+[#4838]: https://github.com/DataDog/dd-trace-rb/issues/4838
+[#4848]: https://github.com/DataDog/dd-trace-rb/issues/4848
+[#4851]: https://github.com/DataDog/dd-trace-rb/issues/4851
+[#4862]: https://github.com/DataDog/dd-trace-rb/issues/4862
+[#4863]: https://github.com/DataDog/dd-trace-rb/issues/4863
+[#4877]: https://github.com/DataDog/dd-trace-rb/issues/4877
+[#4884]: https://github.com/DataDog/dd-trace-rb/issues/4884
+[#4887]: https://github.com/DataDog/dd-trace-rb/issues/4887
+[#4893]: https://github.com/DataDog/dd-trace-rb/issues/4893
 [@AdrianLC]: https://github.com/AdrianLC
 [@Azure7111]: https://github.com/Azure7111
 [@BabyGroot]: https://github.com/BabyGroot

data/README.md

@@ -1,7 +1,6 @@
 # Datadog Trace Client
 
 [![Gem](https://img.shields.io/gem/v/datadog)](https://rubygems.org/gems/datadog/)
-[![codecov](https://codecov.io/gh/DataDog/dd-trace-rb/branch/master/graph/badge.svg)](https://app.codecov.io/gh/DataDog/dd-trace-rb/branch/master)
 [![YARD documentation](https://img.shields.io/badge/YARD-documentation-blue)][api docs]
 
 ``datadog`` is Datadog's client library for Ruby. It includes a suite of tools which provide visibility into the performance and security of Ruby applications, to enable Ruby developers to identify bottlenecks and other issues.

data/ext/libdatadog_api/extconf.rb

@@ -26,7 +26,9 @@ if ENV['DD_NO_EXTENSION'].to_s.strip.downcase == 'true'
 end
 skip_building_extension!('current Ruby VM is not supported') if RUBY_ENGINE != 'ruby'
 skip_building_extension!('Microsoft Windows is not supported') if Gem.win_platform?
-skip_building_extension!('issue setting up `libdatadog` gem') if Datadog::LibdatadogExtconfHelpers.libdatadog_issue?
+
+libdatadog_issue = Datadog::LibdatadogExtconfHelpers.load_libdatadog_or_get_issue
+skip_building_extension!("issue setting up `libdatadog` gem: #{libdatadog_issue}") if libdatadog_issue
 
 require 'mkmf'
 

data/ext/libdatadog_api/process_discovery.c

@@ -27,13 +27,13 @@ static const rb_data_type_t tracer_memfd_type = {
 };
 
 void process_discovery_init(VALUE core_module) {
-  VALUE process_discovery_class = rb_define_class_under(core_module, "ProcessDiscovery", rb_cObject);
-  VALUE tracer_memfd_class = rb_define_class_under(process_discovery_class, "TracerMemfd", rb_cObject);
+  VALUE process_discovery_module = rb_define_module_under(core_module, "ProcessDiscovery");
+  VALUE tracer_memfd_class = rb_define_class_under(process_discovery_module, "TracerMemfd", rb_cObject);
   rb_undef_alloc_func(tracer_memfd_class); // Class cannot be instantiated from Ruby
 
-  rb_define_singleton_method(process_discovery_class, "_native_store_tracer_metadata", _native_store_tracer_metadata, -1);
-  rb_define_singleton_method(process_discovery_class, "_native_to_rb_int", _native_to_rb_int, 1);
-  rb_define_singleton_method(process_discovery_class, "_native_close_tracer_memfd", _native_close_tracer_memfd, 2);
+  rb_define_module_function(process_discovery_module, "_native_store_tracer_metadata", _native_store_tracer_metadata, -1);
+  rb_define_module_function(process_discovery_module, "_native_to_rb_int", _native_to_rb_int, 1);
+  rb_define_module_function(process_discovery_module, "_native_close_tracer_memfd", _native_close_tracer_memfd, 2);
 }
 
 static VALUE _native_store_tracer_metadata(int argc, VALUE *argv, VALUE self) {

data/ext/libdatadog_extconf_helpers.rb

@@ -5,6 +5,8 @@ require 'pathname'
 
 module Datadog
   # Contains a bunch of shared helpers that get used during building of extensions that link to libdatadog
+  #
+  # Note: Specs for this file currently live in `spec/datadog/profiling/native_extension_helpers_spec.rb`.
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
@@ -122,9 +124,17 @@ module Datadog
       end
     end
 
-    def self.libdatadog_issue?
-      try_loading_libdatadog { |_exception| return true }
-      Libdatadog.pkgconfig_folder.nil?
+    # Note: This helper is currently only used in the `libdatadog_api/extconf.rb` BUT still lives here to enable testing.
+    def self.load_libdatadog_or_get_issue
+      try_loading_libdatadog do |exception|
+        return "There was an error loading `libdatadog`: #{exception.class} #{exception.message}"
+      end
+
+      unless Libdatadog.pkgconfig_folder
+        "The `libdatadog` gem installed on your system is missing binaries for your platform variant. " \
+          "Your platform: " \
+          "`#{Libdatadog.current_platform}`; available binaries: `#{Libdatadog.available_binaries.join("`, `")}`"
+      end
     end
   end
 end

data/lib/datadog/appsec/api_security/route_extractor.rb

@@ -39,9 +39,9 @@ module Datadog
         # WARNING: This method works only *after* the request has been routed.
         #
         # WARNING: In Rails > 7.1 when a route was not found,
-        #          action_dispatch.route_uri_pattern will not be set.
+        #          `action_dispatch.route_uri_pattern` will not be set.
         #          In Rails < 7.1 it also will not be set even if a route was found,
-        #          but in this case  action_dispatch.request.path_parameters won't be empty.
+        #          but in this case `action_dispatch.request.path_parameters` won't be empty.
         def self.route_pattern(request)
           if request.env.key?(GRAPE_ROUTE_KEY)
             pattern = request.env[GRAPE_ROUTE_KEY][:route_info]&.pattern&.origin
@@ -52,6 +52,10 @@ module Datadog
           elsif request.env.key?(RAILS_ROUTE_KEY)
             request.env[RAILS_ROUTE_KEY].delete_suffix(RAILS_FORMAT_SUFFIX)
           elsif request.env.key?(RAILS_ROUTES_KEY) && !request.env.fetch(RAILS_PATH_PARAMS_KEY, {}).empty?
+            # NOTE: Rails mutate HEAD request in order to understand that route is supported.
+            #       It will assing GET request method and run the route recognition.
+            request = request.env[RAILS_ROUTES_KEY].request_class.new(request.env) if request.head?
+
             pattern = request.env[RAILS_ROUTES_KEY].router
               .recognize(request) { |route, _| break route.path.spec.to_s }
 

data/lib/datadog/appsec/autoload.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-if %w[1 true].include?((ENV['DD_APPSEC_ENABLED'] || '').downcase)
+if %w[1 true].include?((Datadog::DATADOG_ENV['DD_APPSEC_ENABLED'] || '').downcase)
   begin
     require_relative 'contrib/auto_instrument'
     Datadog::AppSec::Contrib::AutoInstrument.patch_all

data/lib/datadog/appsec/component.rb

@@ -4,6 +4,7 @@ require_relative 'security_engine/engine'
 require_relative 'security_engine/runner'
 require_relative 'processor/rule_loader'
 require_relative 'actions_handler'
+require_relative 'thread_safe_ref'
 
 module Datadog
   module AppSec
@@ -74,25 +75,14 @@ module Datadog
       def initialize(security_engine:, telemetry:)
         @security_engine = security_engine
         @telemetry = telemetry
-
-        @mutex = Mutex.new
       end
 
       def reconfigure!
-        @mutex.synchronize do
-          security_engine.reconfigure!
-        end
-      end
-
-      def reconfigure_lock(&block)
-        @mutex.synchronize(&block)
+        security_engine.reconfigure!
       end
 
       def shutdown!
-        @mutex.synchronize do
-          security_engine.finalize!
-          @security_engine = nil
-        end
+        # no-op
       end
     end
   end

data/lib/datadog/appsec/context.rb

@@ -37,6 +37,7 @@ module Datadog
         @events = []
         @waf_runner = waf_runner
         @metrics = Metrics::Collector.new
+        @interrupted = false
       end
 
       def run_waf(persistent_data, ephemeral_data, timeout = WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
@@ -55,6 +56,22 @@ module Datadog
         result
       end
 
+      def mark_as_interrupted!
+        @interrupted = true
+      end
+
+      def interrupted?
+        @interrupted
+      end
+
+      def waf_runner_ruleset_version
+        @waf_runner.ruleset_version
+      end
+
+      def waf_runner_known_addresses
+        @waf_runner.waf_addresses
+      end
+
       def extract_schema
         @waf_runner.run({'waf.context.processor' => {'extract-schema' => true}}, {})
       end
@@ -66,6 +83,12 @@ module Datadog
         Metrics::Exporter.export_rasp_metrics(@metrics.rasp, @span)
       end
 
+      def export_request_telemetry
+        return if @trace.nil?
+
+        Metrics::TelemetryExporter.export_waf_request_metrics(@metrics.waf, self)
+      end
+
       def finalize!
         @waf_runner.finalize!
       end

data/lib/datadog/appsec/contrib/devise/patches/signin_tracking_patch.rb

@@ -3,6 +3,7 @@
 require_relative '../ext'
 require_relative '../configuration'
 require_relative '../data_extractor'
+require_relative '../../../trace_keeper'
 
 module Datadog
   module AppSec
@@ -25,7 +26,7 @@ module Datadog
                 return result
               end
 
-              context.trace.keep!
+              TraceKeeper.keep!(context.trace)
 
               if result
                 record_successful_signin(context, resource)

data/lib/datadog/appsec/contrib/devise/patches/signup_tracking_patch.rb

@@ -3,6 +3,7 @@
 require_relative '../ext'
 require_relative '../configuration'
 require_relative '../data_extractor'
+require_relative '../../../trace_keeper'
 
 module Datadog
   module AppSec
@@ -26,7 +27,7 @@ module Datadog
 
                 next yield(resource) if resource.new_record? && block_given?
 
-                context.trace.keep!
+                TraceKeeper.keep!(context.trace)
                 record_successful_signup(context, resource)
                 Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_SIGNUP)
 

data/lib/datadog/appsec/contrib/excon/ssrf_detection_middleware.rb

@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 require 'excon'

data/lib/datadog/appsec/contrib/faraday/ssrf_detection_middleware.rb

@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 require_relative '../../event'

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -46,33 +46,22 @@ module Datadog
             boot = Datadog::Core::Remote::Tie.boot
             Datadog::Core::Remote::Tie::Tracing.tag(boot, active_span)
 
-            security_engine = nil
-            ready = false
-            ctx = nil
-
             # For a given request, keep using the first Rack stack scope for
             # nested apps. Don't set `context` local variable so that on popping
             # out of this nested stack we don't finalize the parent's context
             return @app.call(env) if active_context(env)
 
-            Datadog::AppSec.reconfigure_lock do
-              security_engine = Datadog::AppSec.security_engine
-
-              if security_engine
-                ctx = Datadog::AppSec::Context.activate(
-                  Datadog::AppSec::Context.new(active_trace, active_span, security_engine.new_runner)
-                )
-
-                env[Datadog::AppSec::Ext::CONTEXT_KEY] = ctx
-                ready = true
-              end
-            end
+            security_engine = Datadog::AppSec.security_engine
 
             # TODO: handle exceptions, except for @app.call
+            return @app.call(env) unless security_engine
 
-            return @app.call(env) unless ready
+            ctx = Datadog::AppSec::Context.activate(
+              Datadog::AppSec::Context.new(active_trace, active_span, security_engine.new_runner)
+            )
+            env[Datadog::AppSec::Ext::CONTEXT_KEY] = ctx
 
-            add_appsec_tags(security_engine, ctx)
+            add_appsec_tags(ctx)
             add_request_tags(ctx, env)
 
             http_response = nil
@@ -97,6 +86,7 @@ module Datadog
             end
 
             if interrupt_params
+              ctx.mark_as_interrupted!
               http_response = AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack
             end
 
@@ -128,6 +118,8 @@ module Datadog
           ensure
             if ctx
               ctx.export_metrics
+              ctx.export_request_telemetry
+
               Datadog::AppSec::Context.deactivate
             end
           end
@@ -156,7 +148,7 @@ module Datadog
           end
 
           # standard:disable Metrics/MethodLength
-          def add_appsec_tags(security_engine, context)
+          def add_appsec_tags(context)
             span = context.span
             trace = context.trace
 
@@ -166,15 +158,15 @@ module Datadog
             span.set_tag('_dd.runtime_family', 'ruby')
             span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
 
-            if security_engine.ruleset_version
-              span.set_tag('_dd.appsec.event_rules.version', security_engine.ruleset_version)
+            if context.waf_runner_ruleset_version
+              span.set_tag('_dd.appsec.event_rules.version', context.waf_runner_ruleset_version)
 
               unless @oneshot_tags_sent
                 # Small race condition, but it's inoccuous: worst case the tags
                 # are sent a couple of times more than expected
                 @oneshot_tags_sent = true
 
-                span.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(security_engine.waf_addresses))
+                span.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(context.waf_runner_known_addresses))
 
                 # Ensure these tags reach the backend
                 trace.keep!

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -16,6 +16,7 @@ module Datadog
                 gateway = Instrumentation.gateway
 
                 watch_request_action(gateway)
+                watch_response_body_json(gateway)
               end
 
               def watch_request_action(gateway = Instrumentation.gateway)
@@ -29,18 +30,38 @@ module Datadog
 
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
-                  if result.match? || !result.derivatives.empty?
+                  if result.match?
                     context.events.push(
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
                     )
+
+                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::ActionsHandler.handle(result.actions)
                   end
 
+                  stack.call(gateway_request.request)
+                end
+              end
+
+              def watch_response_body_json(gateway = Instrumentation.gateway)
+                gateway.watch('rails.response.body.json', :appsec) do |stack, container|
+                  context = container.context
+
+                  persistent_data = {
+                    'server.response.body' => container.data
+                  }
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
                   if result.match?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+
                     AppSec::Event.tag_and_keep!(context, result)
                     AppSec::ActionsHandler.handle(result.actions)
                   end
 
-                  stack.call(gateway_request.request)
+                  stack.call(container)
                 end
               end
             end

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -8,6 +8,8 @@ require_relative '../rack/request_middleware'
 require_relative '../rack/request_body_middleware'
 require_relative 'gateway/watcher'
 require_relative 'gateway/request'
+require_relative 'patches/render_to_body_patch'
+require_relative 'patches/process_action_patch'
 
 require_relative '../../../tracing/contrib/rack/middlewares'
 
@@ -17,6 +19,7 @@ module Datadog
       module Rails
         # Patcher for AppSec on Rails
         module Patcher
+          GUARD_ACTION_CONTROLLER_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
           BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
           AFTER_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
 
@@ -34,6 +37,7 @@ module Datadog
             Gateway::Watcher.watch
             patch_before_initialize
             patch_after_initialize
+            patch_action_controller
 
             Patcher.instance_variable_set(:@patched, true)
           end
@@ -49,7 +53,8 @@ module Datadog
               # Middleware must be added before the application is initialized.
               # Otherwise the middleware stack will be frozen.
               add_middleware(app) if Datadog.configuration.tracing[:rails][:middleware]
-              patch_process_action
+
+              ::ActionController::Metal.prepend(Patches::ProcessActionPatch)
             end
           end
 
@@ -65,31 +70,6 @@ module Datadog
             end
           end
 
-          # Hook into ActionController::Instrumentation#process_action, which encompasses action filters
-          module ProcessActionPatch
-            def process_action(*args)
-              env = request.env
-
-              context = env[Datadog::AppSec::Ext::CONTEXT_KEY]
-
-              return super unless context
-
-              # TODO: handle exceptions, except for super
-
-              gateway_request = Gateway::Request.new(request)
-
-              http_response, _gateway_request = Instrumentation.gateway.push('rails.request.action', gateway_request) do
-                super
-              end
-
-              http_response
-            end
-          end
-
-          def patch_process_action
-            ::ActionController::Metal.prepend(ProcessActionPatch)
-          end
-
           def include_middleware?(middleware, app)
             found = false
 
@@ -143,6 +123,14 @@ module Datadog
             end
           end
 
+          def patch_action_controller
+            ::ActiveSupport.on_load(:action_controller) do
+              GUARD_ACTION_CONTROLLER_ONCE_PER_APP[self].run do
+                ::ActionController::Base.prepend(Patches::RenderToBodyPatch)
+              end
+            end
+          end
+
           def setup_security
             Datadog::AppSec::Contrib::Rails::Framework.setup
           end

data/lib/datadog/appsec/contrib/rails/patches/process_action_patch.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Patches
+          # Hook into ActionController::Instrumentation#process_action, which encompasses action filters
+          module ProcessActionPatch
+            def process_action(*args)
+              context = request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
+              return super unless context
+
+              # TODO: handle exceptions, except for super
+              gateway_request = Gateway::Request.new(request)
+              http_response, _gateway_request = Instrumentation.gateway.push('rails.request.action', gateway_request) do
+                super
+              end
+
+              http_response
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/patches/render_to_body_patch.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require_relative '../../../utils/hash_coercion'
+require_relative '../../../instrumentation/gateway/argument'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Patches
+          # A patch targeting `AbstractController::Rendering#render_to_body`
+          # method to capture JSON response body right before it is serialized.
+          module RenderToBodyPatch
+            def render_to_body(options = {})
+              return super unless options.key?(:json)
+
+              context = request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
+              return super unless context
+
+              data = Utils::HashCoercion.coerce(options[:json])
+              return super unless data
+
+              container = Instrumentation::Gateway::DataContainer.new(data, context: context)
+              Instrumentation.gateway.push('rails.response.body.json', container)
+
+              super
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb

@@ -1,4 +1,3 @@
-# rubocop:disable Naming/FileName
 # frozen_string_literal: true
 
 require_relative '../../event'

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -17,6 +17,7 @@ module Datadog
 
                 watch_request_dispatch(gateway)
                 watch_request_routed(gateway)
+                watch_response_body_json(gateway)
               end
 
               def watch_request_dispatch(gateway = Instrumentation.gateway)
@@ -67,6 +68,28 @@ module Datadog
                   stack.call(gateway_request.request)
                 end
               end
+
+              def watch_response_body_json(gateway = Instrumentation.gateway)
+                gateway.watch('sinatra.response.body.json', :appsec) do |stack, container|
+                  context = container.context
+
+                  persistent_data = {
+                    'server.response.body' => container.data
+                  }
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+
+                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::ActionsHandler.handle(result.actions)
+                  end
+
+                  stack.call(container)
+                end
+              end
             end
           end
         end