datadog 2.21.0 → 2.38.0

data/lib/datadog/appsec/contrib/rack/gateway/request.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative '../input_peeker'
 require_relative '../../../instrumentation/gateway/argument'
 require_relative '../../../../core/header_collection'
 require_relative '../../../../tracing/client_ip'
@@ -23,16 +24,12 @@ module Datadog
             end
 
             def query
-              # Downstream libddwaf expects keys and values to be extractable
-              # separately so we can't use [[k, v], ...]. We also want to allow
-              # duplicate keys, so we use {k => [v, ...], ...} instead, taking into
-              # account that {k => [v1, v2, ...], ...} is possible for duplicate keys.
-              request.query_string.split('&').each.with_object({}) do |e, hash|
-                k, v = e.split('=').map { |s| CGI.unescape(s) }
-                hash[k] ||= []
-
-                hash[k] << v
-              end
+              ::Rack::Utils.parse_query(request.query_string)
+            rescue => e
+              Datadog.logger.debug { "AppSec: Failed to parse request query string: #{e.class}: #{e.message}" }
+              AppSec.telemetry.report(e, description: 'AppSec: Failed to parse request query string')
+
+              {}
             end
 
             def method
@@ -79,12 +76,54 @@ module Datadog
             end
 
             def form_hash
-              # force form data processing
+              # NOTE: Rack populates `rack.request.form_hash` only as a side effect
+              #       of {::Rack::Request#POST}, which reads and parses the body.
               request.POST if request.form_data?
 
-              # usually Hash<String,String> but can be a more complex
-              # Hash<String,String||Array||Hash> when e.g coming from JSON
+              # usually Hash[String, String] but can be a more complex
+              # Hash[String, (String|Array|Hash)] when e.g coming from JSON
               env['rack.request.form_hash']
+            rescue => e
+              Datadog.logger.debug { "AppSec: Failed to parse request body: #{e.class}: #{e.message}" }
+              AppSec.telemetry.report(e, description: 'AppSec: Failed to parse request body')
+
+              nil
+            end
+
+            # Returns the request body size in bytes using all available methods,
+            # or nil when the size cannot be measured within the limit
+            #
+            # NOTE: The priority of the measurement is the following:
+            #       size if it's known, content-length if provided, and buffering
+            #       to the limit if unknown-length
+            #
+            # WARNING: The buffering path adds overhead for streaming web-servers
+            #          (Rack 3+) when the body length is unknown
+            def body_bytesize(limit)
+              io = request.body
+
+              return 0 unless io
+              return io.size if io.respond_to?(:size)
+
+              # NOTE: {::Rack::Request#content_length} is a plain `CONTENT_LENGTH`
+              #       getter forces no body read
+              content_length = request.content_length
+              return content_length.to_i if content_length
+
+              # NOTE: A parsed-body cache without a raw byte count means the input
+              #       stream was consumed before measurement, consider it unknown-length
+              return if env.key?('rack.request.form_hash')
+
+              InputPeeker.peek_bytesize(env, limit: limit)
+            end
+
+            # Whether a request body can be collected without forcing a parse:
+            # either form data parseable on demand, or a body already parsed upstream
+            #
+            # NOTE: Rack does not parse JSON itself, a body parser middleware such as
+            #       {Rack::JSONBodyParser} populates the form hash read by {#form_hash}
+            def collectable_body?
+              request.form_data? || request.parseable_data? || env.key?('rack.request.form_hash')
             end
 
             def client_ip

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -2,6 +2,7 @@
 
 require_relative '../ext'
 require_relative '../../../event'
+require_relative '../../../trace_keeper'
 require_relative '../../../security_event'
 require_relative '../../../instrumentation/gateway'
 
@@ -23,7 +24,7 @@ module Datadog
               end
 
               def watch_request(gateway = Instrumentation.gateway)
-                gateway.watch('rack.request', :appsec) do |stack, gateway_request|
+                gateway.watch('rack.request') do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
 
                   persistent_data = {
@@ -38,14 +39,16 @@ module Datadog
 
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
-                  if result.match? || !result.derivatives.empty?
+                  if result.match? || !result.attributes.empty?
                     context.events.push(
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
                     )
                   end
 
                   if result.match?
-                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
                     AppSec::ActionsHandler.handle(result.actions)
                   end
 
@@ -54,7 +57,7 @@ module Datadog
               end
 
               def watch_response(gateway = Instrumentation.gateway)
-                gateway.watch('rack.response', :appsec) do |stack, gateway_response|
+                gateway.watch('rack.response') do |stack, gateway_response|
                   context = gateway_response.context
 
                   persistent_data = {
@@ -66,7 +69,8 @@ module Datadog
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
                   if result.match?
-                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
 
                     context.events.push(
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
@@ -80,17 +84,39 @@ module Datadog
               end
 
               def watch_request_body(gateway = Instrumentation.gateway)
-                gateway.watch('rack.request.body', :appsec) do |stack, gateway_request|
+                gateway.watch('rack.request.body') do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
 
-                  persistent_data = {
-                    'server.request.body' => gateway_request.form_hash
-                  }
+                  request = gateway_request.request
+                  next stack.call(request) unless gateway_request.collectable_body?
+
+                  # NOTE: A limit of 0 disables request body collection entirely.
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
+                  next stack.call(request) if limit.zero?
+
+                  persistent_data = {}
+                  byte_length = gateway_request.body_bytesize(limit)
+
+                  if byte_length
+                    persistent_data['server.request.body.byte_length'] = byte_length
+
+                    if byte_length <= limit
+                      body = gateway_request.form_hash
+                      persistent_data['server.request.body'] = body if body
+                    end
+                  # NOTE: Body was parsed before measurement, keep byte_length unset
+                  elsif gateway_request.env.key?('rack.request.form_hash')
+                    body = gateway_request.env['rack.request.form_hash']
+                    persistent_data['server.request.body'] = body if body
+                  end
+
+                  next stack.call(request) if persistent_data.empty?
 
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
                   if result.match?
-                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
 
                     context.events.push(
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
@@ -108,20 +134,15 @@ module Datadog
               #       somewhere closer to identity related monitor.
               # WARNING: The Gateway is a subject of refactoring
               def watch_request_finish(gateway = Instrumentation.gateway)
-                gateway.watch('rack.request.finish', :appsec) do |stack, gateway_request|
+                gateway.watch('rack.request.finish') do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
 
-                  if context.span.nil? || !gateway.pushed?('appsec.events.user_lifecycle')
-                    next stack.call(gateway_request.request)
-                  end
+                  next stack.call(gateway_request.request) if context.span.nil?
 
                   gateway_request.headers.each do |name, value|
-                    if !Ext::COLLECTABLE_REQUEST_HEADERS.include?(name) &&
-                        !Ext::IDENTITY_COLLECTABLE_REQUEST_HEADERS.include?(name)
-                      next
+                    if context.state[:has_identity_event] && Ext::IDENTITY_COLLECTABLE_REQUEST_HEADERS.include?(name)
+                      context.span["http.request.headers.#{name}"] ||= value
                     end
-
-                    context.span["http.request.headers.#{name}"] ||= value
                   end
 
                   stack.call(gateway_request.request)

data/lib/datadog/appsec/contrib/rack/input_peeker.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require 'stringio'
+require_relative 'buffered_input'
+require_relative '../../utils/http/body_reader'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Peeks at `rack.input` without changing what downstream Rack code can read
+        #
+        # @api private
+        module InputPeeker
+          module_function
+
+          # Peeks at `env['rack.input']` and returns the body bytesize when it
+          # can be measured within the given limit
+          #
+          # NOTE: Over-limit bodies cannot be fully measured, so returning `nil`
+          #       is the tradeoff we accept
+          #
+          # WARNING: For forward-only input, replaces `env['rack.input']` with a
+          #          replay stream over the peeked bytes, preserving the rest
+          #          of the original stream
+          #
+          # @param env [Hash] Rack environment
+          # @param limit [Integer] Maximum body bytesize to measure
+          # @return [Integer, nil] `Integer` bytesize when measured within
+          #   `limit`, including `0`; `nil` when input is missing, over the
+          #   limit, or cannot be preserved for downstream reads
+          def peek_bytesize(env, limit:)
+            rack_input = env['rack.input']
+            return unless rack_input
+
+            rewindable = rewind? && rack_input.respond_to?(:rewind)
+
+            # NOTE: Rack 2 requires `rack.input` to be rewindable. Rewind before peeking
+            #       in case an upstream framework already consumed part of the stream
+            return if rewindable && !rewind(rack_input)
+
+            # NOTE: Read one byte past the limit to distinguish an exact-limit body
+            #       from an over-limit body without reading the whole stream.
+            buffer = Utils::HTTP::BodyReader.read_stream(rack_input, limit: limit)
+            over_limit = buffer.bytesize > limit
+
+            if rewindable
+              # NOTE: If we cannot rewind after peeking, downstream code would observe
+              #       a partially consumed body. Treat it as not safely collectable
+              return unless rewind(rack_input)
+            else
+              env['rack.input'] = if over_limit
+                BufferedInput.new(rack_input, buffer: StringIO.new(buffer))
+              else
+                StringIO.new(buffer)
+              end
+            end
+
+            over_limit ? nil : buffer.bytesize
+          end
+
+          private_class_method def rewind?
+            return @rewind if defined?(@rewind)
+
+            @rewind = ::Gem::Version.new(::Rack.release) < ::Gem::Version.new('3')
+          end
+
+          private_class_method def rewind(io)
+            io.rewind
+            true
+          rescue => e
+            Datadog.logger.debug { "AppSec: Failed to rewind `rack.input`: #{e.class}: #{e.message}" }
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/integration.rb

@@ -27,7 +27,7 @@ module Datadog
           end
 
           def self.compatible?
-            super && version >= MINIMUM_VERSION
+            !!(super && (version&.>= MINIMUM_VERSION))
           end
 
           def self.auto_instrument?

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -2,15 +2,19 @@
 
 require 'json'
 
+require_relative 'response_body'
 require_relative 'gateway/request'
 require_relative 'gateway/response'
 
 require_relative '../../event'
 require_relative '../../response'
 require_relative '../../api_security'
+require_relative '../../default_header_tags'
+require_relative '../../route_normalizer'
 require_relative '../../security_event'
 require_relative '../../instrumentation/gateway'
 
+require_relative '../../../core/header_collection'
 require_relative '../../../tracing/client_ip'
 require_relative '../../../tracing/contrib/rack/header_collection'
 
@@ -18,17 +22,6 @@ module Datadog
   module AppSec
     module Contrib
       module Rack
-        WAF_VENDOR_HEADERS_TAGS = %w[
-          X-Amzn-Trace-Id
-          Cloudfront-Viewer-Ja3-Fingerprint
-          Cf-Ray
-          X-Cloud-Trace-Context
-          X-Appgw-Trace-id
-          X-SigSci-RequestID
-          X-SigSci-Tags
-          Akamai-User-Risk
-        ].map(&:downcase).freeze
-
         # Topmost Rack middleware for AppSec
         # This should be inserted just below Datadog::Tracing::Contrib::Rack::TraceMiddleware
         class RequestMiddleware
@@ -36,7 +29,6 @@ module Datadog
             @app = app
 
             @oneshot_tags_sent = false
-            @rack_headers = {}
           end
 
           # rubocop:disable Metrics/MethodLength
@@ -85,6 +77,8 @@ module Datadog
               nil
             end
 
+            add_normalized_route_tag(ctx, env)
+
             if interrupt_params
               ctx.mark_as_interrupted!
               http_response = AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack
@@ -107,13 +101,12 @@ module Datadog
 
             if AppSec::APISecurity.enabled? && AppSec::APISecurity.sample_trace?(ctx.trace) &&
                 AppSec::APISecurity.sample?(gateway_request.request, tmp_response.response)
-              ctx.events.push(
-                AppSec::SecurityEvent.new(ctx.extract_schema, trace: ctx.trace, span: ctx.span)
-              )
+              ctx.extract_schema!
             end
 
-            AppSec::Event.record(ctx, request: gateway_request, response: gateway_response)
+            AppSec::Event.record(ctx, request: gateway_request)
 
+            add_response_tags(ctx, tmp_response)
             http_response
           ensure
             if ctx
@@ -161,7 +154,7 @@ module Datadog
             if context.waf_runner_ruleset_version
               span.set_tag('_dd.appsec.event_rules.version', context.waf_runner_ruleset_version)
 
-              unless @oneshot_tags_sent
+              unless oneshot_tags_sent?
                 # Small race condition, but it's inoccuous: worst case the tags
                 # are sent a couple of times more than expected
                 @oneshot_tags_sent = true
@@ -179,33 +172,55 @@ module Datadog
           end
           # standard:enable Metrics/MethodLength
 
-          # standard:disable Metrics/MethodLength
           def add_request_tags(context, env)
             span = context.span
-
             return unless span
 
-            # Always add WAF vendors headers
-            WAF_VENDOR_HEADERS_TAGS.each do |lowercase_header|
-              rack_header = to_rack_header(lowercase_header)
-              span.set_tag("http.request.headers.#{lowercase_header}", env[rack_header]) if env[rack_header]
-            end
-
-            if span && span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
-              request_header_collection = Datadog::Tracing::Contrib::Rack::Header::RequestHeaderCollection.new(env)
+            headers = Tracing::Contrib::Rack::Header::RequestHeaderCollection.new(env)
+            AppSec::DefaultHeaderTags.tag_request(span, headers)
 
+            if span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
               # always collect client ip, as this is part of AppSec provided functionality
               Datadog::Tracing::ClientIp.set_client_ip_tag!(
-                span,
-                headers: request_header_collection,
-                remote_ip: env['REMOTE_ADDR']
+                span, headers: headers, remote_ip: env['REMOTE_ADDR']
               )
             end
           end
-          # standard:enable Metrics/MethodLength
 
-          def to_rack_header(header)
-            @rack_headers[header] ||= Datadog::Tracing::Contrib::Rack::Header.to_rack_header(header)
+          def add_response_tags(context, response)
+            span = context.span
+            return unless span
+
+            AppSec::DefaultHeaderTags.tag_response(
+              span, Datadog::Core::HeaderCollection.from_hash(response.headers)
+            )
+
+            unless response.headers.key?('content-length')
+              length = ResponseBody.content_length(response.body)
+              span.set_tag('http.response.headers.content-length', length.to_s) if length
+            end
+          end
+
+          def add_normalized_route_tag(context, env)
+            return unless AppSec::APISecurity.enabled?
+
+            span = context.span
+            return unless span
+
+            pattern = context.trace&.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE)
+            return unless pattern
+
+            # NOTE: To build full path that covers mounted engines we need to add
+            #       pre-computed by Tracer route path tag to the normalized route
+            prefix = context.trace&.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH) || env['SCRIPT_NAME']
+            normalized_route = RouteNormalizer.extract_normalized_route(env, prefix: prefix, pattern: pattern)
+            return unless normalized_route
+
+            span.set_tag(AppSec::Ext::TAG_NORMALIZED_ROUTE, "#{prefix}#{normalized_route}")
+          end
+
+          def oneshot_tags_sent?
+            @oneshot_tags_sent
           end
         end
       end

data/lib/datadog/appsec/contrib/rack/response_body.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module ResponseBody
+          # NOTE: We compute content length only for fixed-size response bodies,
+          #       ignoring streaming bodies to avoid buffering.
+          #
+          #       On Rack 3.x, `body.to_ary` on a BodyProxy triggers `close` on all
+          #       nested BodyProxy layers. This is safe because web servers, like Puma
+          #       handles already-closed bodies (its own `to_ary` becomes a no-op).
+          #
+          # @see Puma::Response#prepare_response
+          # @see https://github.com/puma/puma/blob/b1271222cbf21868f3fb64154caa4d03936a7b9e/lib/puma/response.rb#L165-L168
+          def self.content_length(body)
+            return unless body.respond_to?(:to_ary)
+
+            # NOTE: When `to_ary` exists but returns `nil`, the body will be
+            #       transferred in chunks and we can't compute content length
+            #       without buffering it.
+            body_ary = body.to_ary
+            return unless body_ary.is_a?(Array)
+
+            body_ary.sum { |part| part.is_a?(String) ? part.bytesize : 0 }
+          rescue => e
+            AppSec.telemetry.report(e, description: 'AppSec: Failed to compute body content length')
+
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/gateway/request.rb

@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative '../../rack/input_peeker'
 require_relative '../../../instrumentation/gateway/argument'
 
 module Datadog
@@ -46,19 +47,57 @@ module Datadog
               body = request.env['action_dispatch.request.request_parameters']
 
               return if body.nil?
+              return body unless request.env['action_dispatch.request.path_parameters']
 
               body.reject do |k, _v|
                 request.env['action_dispatch.request.path_parameters'].key?(k)
               end
+            rescue => e
+              Datadog.logger.debug { "AppSec: Failed to parse request body: #{e.class}: #{e.message}" }
+              AppSec.telemetry.report(e, description: 'AppSec: Failed to parse request body')
+
+              nil
             end
 
             def route_params
               excluded = [:controller, :action]
 
-              request.env['action_dispatch.request.path_parameters'].reject do |k, _v|
+              request.env.fetch('action_dispatch.request.path_parameters', {}).reject do |k, _v|
                 excluded.include?(k)
               end
             end
+
+            # Returns the request body size in bytes using all available methods,
+            # or nil when the size cannot be measured within the limit
+            #
+            # NOTE: The priority of the measurement is the following:
+            #       raw posted data, raw form vars, size if known, raw
+            #       Content-Length, then buffering to the limit if unknown-length
+            def body_bytesize(limit)
+              raw_body = env['RAW_POST_DATA']
+              return raw_body.bytesize if raw_body
+
+              form_vars = env['rack.request.form_vars']
+              return form_vars.bytesize if form_vars
+
+              io = request.body
+              return 0 unless io
+              return io.size if io.respond_to?(:size)
+
+              # NOTE: Read raw `CONTENT_LENGTH` as {ActionDispatch::Request#content_length}
+              #       drains `rack.input` into `RAW_POST_DATA` on chunked Transfer-Encoding
+              content_length = env['CONTENT_LENGTH']
+              return content_length.to_i if content_length
+
+              # NOTE: An already-read body (e.g. late-parsed multipart on Rack 3+) peeks
+              #       as 0, so we skip byte_length but still collect the parsed body
+              begin
+                Rack::InputPeeker.peek_bytesize(env, limit: limit)
+              rescue => e
+                Datadog.logger.debug { "AppSec: Failed to measure Rails request body: #{e.class}: #{e.message}" }
+                nil
+              end
+            end
           end
         end
       end

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative '../../../event'
+require_relative '../../../trace_keeper'
 require_relative '../../../security_event'
 require_relative '../../../instrumentation/gateway'
 
@@ -20,14 +21,30 @@ module Datadog
               end
 
               def watch_request_action(gateway = Instrumentation.gateway)
-                gateway.watch('rails.request.action', :appsec) do |stack, gateway_request|
+                gateway.watch('rails.request.action') do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
 
                   persistent_data = {
-                    'server.request.body' => gateway_request.parsed_body,
                     'server.request.path_params' => gateway_request.route_params
                   }
 
+                  unless limit.zero?
+                    byte_length = gateway_request.body_bytesize(limit)
+
+                    if byte_length
+                      # NOTE: Params may be parsed before this hook, leaving the
+                      #       body stream at EOF. Keep byte_length unset for that
+                      #       case, but still inspect cached params
+                      persistent_data['server.request.body.byte_length'] = byte_length if byte_length.positive?
+
+                      if byte_length <= limit
+                        body = gateway_request.parsed_body
+                        persistent_data['server.request.body'] = body unless body.nil? || body.empty?
+                      end
+                    end
+                  end
+
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
                   if result.match?
@@ -35,7 +52,9 @@ module Datadog
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
                     )
 
-                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
                     AppSec::ActionsHandler.handle(result.actions)
                   end
 
@@ -44,7 +63,7 @@ module Datadog
               end
 
               def watch_response_body_json(gateway = Instrumentation.gateway)
-                gateway.watch('rails.response.body.json', :appsec) do |stack, container|
+                gateway.watch('rails.response.body.json') do |stack, container|
                   context = container.context
 
                   persistent_data = {
@@ -57,7 +76,9 @@ module Datadog
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
                     )
 
-                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
                     AppSec::ActionsHandler.handle(result.actions)
                   end
 

data/lib/datadog/appsec/contrib/rails/integration.rb

@@ -26,7 +26,7 @@ module Datadog
           end
 
           def self.compatible?
-            super && version >= MINIMUM_VERSION
+            !!(super && (version&.>= MINIMUM_VERSION))
           end
 
           def self.auto_instrument?