datadog 2.21.0 → 2.38.0

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -10,6 +10,7 @@ require_relative 'gateway/watcher'
 require_relative 'gateway/request'
 require_relative 'patches/render_to_body_patch'
 require_relative 'patches/process_action_patch'
+require_relative '../../api_security/endpoint_collection/rails_collector'
 
 require_relative '../../../tracing/contrib/rack/middlewares'
 
@@ -20,6 +21,7 @@ module Datadog
         # Patcher for AppSec on Rails
         module Patcher
           GUARD_ACTION_CONTROLLER_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+          GUARD_ROUTES_REPORTING_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
           BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
           AFTER_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
 
@@ -38,6 +40,7 @@ module Datadog
             patch_before_initialize
             patch_after_initialize
             patch_action_controller
+            subscribe_to_routes_loaded
 
             Patcher.instance_variable_set(:@patched, true)
           end
@@ -128,7 +131,42 @@ module Datadog
               GUARD_ACTION_CONTROLLER_ONCE_PER_APP[self].run do
                 ::ActionController::Base.prepend(Patches::RenderToBodyPatch)
               end
+
+              # Rails 7.1 adds `after_routes_loaded` hook
+              if Datadog::AppSec::Contrib::Rails::Patcher.target_version < Gem::Version.new('7.1')
+                Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(::Rails.application.routes.routes)
+              end
+            rescue => e
+              error_message = 'Failed to get application routes'
+              Datadog.logger.error("#{error_message}, #{e.class}: #{e.message}")
+              AppSec.telemetry.report(e, description: error_message)
+            end
+          end
+
+          def subscribe_to_routes_loaded
+            ::ActiveSupport.on_load(:after_routes_loaded) do
+              Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(::Rails.application.routes.routes)
+            rescue => e
+              error_message = 'Failed to get application routes'
+              Datadog.logger.error("#{error_message}, #{e.class}: #{e.message}")
+              AppSec.telemetry.report(e, description: error_message)
+            end
+          end
+
+          def report_routes_via_telemetry(routes)
+            # We do not support Rails 4.x for Endpoint Collection,
+            # mainly because the Route#verb was a Regexp before Rails 5.0
+            return if target_version < Gem::Version.new('5.0')
+            return unless Datadog.configuration.appsec.api_security.endpoint_collection.enabled
+            return unless AppSec.telemetry
+
+            GUARD_ROUTES_REPORTING_ONCE_PER_APP[::Rails.application].run do
+              AppSec.telemetry.app_endpoints_loaded(
+                APISecurity::EndpointCollection::RailsCollector.new(routes).to_enum
+              )
             end
+          rescue => e
+            AppSec.telemetry&.report(e, description: 'failed to report application endpoints')
           end
 
           def setup_security

data/lib/datadog/appsec/contrib/rails/patches/process_action_patch.rb

@@ -11,6 +11,8 @@ module Datadog
               context = request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
               return super unless context
 
+              context.state[:web_framework] = 'rails'
+
               # TODO: handle exceptions, except for super
               gateway_request = Gateway::Request.new(request)
               http_response, _gateway_request = Instrumentation.gateway.push('rails.request.action', gateway_request) do

data/lib/datadog/appsec/contrib/rest_client/integration.rb

@@ -28,7 +28,7 @@ module Datadog
           end
 
           def self.compatible?
-            super && version >= MINIMUM_VERSION
+            super && !!(version&.>= MINIMUM_VERSION)
           end
 
           def self.auto_instrument?

data/lib/datadog/appsec/contrib/rest_client/patcher.rb

@@ -9,7 +9,7 @@ module Datadog
           module_function
 
           def patched?
-            Patcher.instance_variable_get(:@patched)
+            !!Patcher.instance_variable_get(:@patched)
           end
 
           def target_version
@@ -20,6 +20,8 @@ module Datadog
             require_relative 'request_ssrf_detection_patch'
 
             ::RestClient::Request.prepend(RequestSSRFDetectionPatch)
+
+            Patcher.instance_variable_set(:@patched, true)
           end
         end
       end

data/lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb

@@ -1,7 +1,11 @@
 # frozen_string_literal: true
 
 require_relative '../../event'
+require_relative '../../trace_keeper'
 require_relative '../../security_event'
+require_relative '../../utils/http/body'
+require_relative '../../utils/http/body_reader'
+require_relative '../../utils/http/media_type'
 
 module Datadog
   module AppSec
@@ -9,29 +13,181 @@ module Datadog
       module RestClient
         # Module that adds SSRF detection to RestClient::Request#execute
         module RequestSSRFDetectionPatch
+          REDIRECT_STATUS_CODES = (300..399).freeze
+
           def execute(&block)
-            return super unless AppSec.rasp_enabled? && AppSec.active_context
+            context = AppSec.active_context
+            return super unless context && AppSec.rasp_enabled?
+
+            headers = normalize_request_headers
+            # @type var ephemeral_data: ::Datadog::AppSec::Context::input_data
+            ephemeral_data = {
+              'server.io.net.url' => url,
+              'server.io.net.request.method' => method.to_s.upcase,
+              'server.io.net.request.headers' => headers
+            }
+
+            is_redirect = context.state[:downstream_redirect_url] == url
+            if is_redirect
+              context.state.delete(:downstream_redirect_url)
+              sample_body = true
+            else
+              sample_body = mark_body_sampling!(context)
+            end
+
+            if !is_redirect && sample_body
+              body = parse_request_body(payload, content_type: headers['content-type'])
+              ephemeral_data['server.io.net.request.body'] = body if body
+            end
+
+            timeout = Datadog.configuration.appsec.waf_timeout
+            result = context.run_rasp(Ext::RASP_SSRF, {}, ephemeral_data, timeout, phase: Ext::RASP_REQUEST_PHASE)
+            handle(result, context: context) if result.match?
+
+            # NOTE: RestClient raises exceptions for non-2xx responses. For POST/PUT/PATCH
+            #       requests with 3xx redirects, RestClient raises instead of auto-following.
+            #       We rescue to process the response before re-raising.
+            begin
+              response = super
+            rescue ::RestClient::Exception => e
+              response = e.response
+              process_response(response, sample_body: sample_body) if response.is_a?(::RestClient::AbstractResponse)
+
+              raise
+            end
+
+            process_response(response, sample_body: sample_body) if response.is_a?(::RestClient::AbstractResponse)
+            response
+          end
 
+          def process_response(response, sample_body:)
             context = AppSec.active_context
+            return unless context
+
+            headers = normalize_response_headers(response)
+            # @type var ephemeral_data: ::Datadog::AppSec::Context::input_data
+            ephemeral_data = {
+              'server.io.net.response.status' => response.code.to_s,
+              'server.io.net.response.headers' => headers
+            }
+
+            is_redirect = REDIRECT_STATUS_CODES.cover?(response.code.to_i) && headers.key?('location')
+            context.state[:downstream_redirect_url] = URI.join(url, headers['location']).to_s if is_redirect && sample_body
+
+            if sample_body && !is_redirect
+              body = parse_response_body(response.body, headers: headers, context: context)
+              ephemeral_data['server.io.net.response.body'] = body if body
+            end
+
+            timeout = Datadog.configuration.appsec.waf_timeout
+            result = context.run_rasp(Ext::RASP_SSRF, {}, ephemeral_data, timeout, phase: Ext::RASP_RESPONSE_PHASE)
+            handle(result, context: context) if result.match?
+          end
+
+          private
+
+          def mark_body_sampling!(context)
+            max = Datadog.configuration.appsec.api_security.downstream_body_analysis.max_requests
+            return false if context.state[:downstream_body_analyzed_count] >= max
+            return false unless context.downstream_body_sampler.sample?
 
-            ephemeral_data = {'server.io.net.url' => url}
-            result = context.run_rasp(Ext::RASP_SSRF, {}, ephemeral_data, Datadog.configuration.appsec.waf_timeout)
+            context.state[:downstream_body_analyzed_count] += 1
+            true
+          end
+
+          def parse_request_body(body, content_type:)
+            media_type = Utils::HTTP::MediaType.parse(content_type)
+            return unless media_type
 
-            if result.match?
-              AppSec::Event.tag_and_keep!(context, result)
+            # NOTE: Request body analysis is best-effort, non-rewindable payloads are skipped
+            limit = Datadog.configuration.appsec.api_security.downstream_body_analysis.max_downstream_body_bytes
+            content = read_body(body, limit: limit)
+            return if content.nil? || content.bytesize > limit
 
-              context.events.push(
-                AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
-              )
+            Utils::HTTP::Body.parse(content, media_type: media_type)
+          end
 
-              AppSec::ActionsHandler.handle(result.actions)
+          def parse_response_body(body, headers:, context:)
+            return unless readable_body?(body)
+
+            media_type = Utils::HTTP::MediaType.parse(headers['content-type'])
+            if !media_type || media_type.type != 'application'
+              context.metrics.record_ignored_downstream_response_body(:content_type_invalid)
+              return
+            end
+
+            subtype = media_type.subtype
+            if subtype != 'json' && !subtype.end_with?('+json') && subtype != 'x-www-form-urlencoded'
+              context.metrics.record_ignored_downstream_response_body(:content_type_invalid)
+              return
+            end
+
+            content_length_value = headers['content-length']
+            if !content_length_value.is_a?(String) || !content_length_value.match?(/\A[1-9][0-9]*\z/)
+              context.metrics.record_ignored_downstream_response_body(:content_length_missing)
+              return
+            end
+
+            content_length = content_length_value.to_i
+            max = Datadog.configuration.appsec.api_security.downstream_body_analysis.max_downstream_body_bytes
+            if content_length > max
+              context.metrics.record_ignored_downstream_response_body(:content_length_too_big)
+              return
+            end
+
+            content = read_body(body, limit: content_length)
+            return if content.nil?
+
+            if content.bytesize > content_length
+              context.metrics.record_ignored_downstream_response_body(:content_exceed_content_length)
+              return
             end
 
-            super
+            Utils::HTTP::Body.parse(content, media_type: media_type)
+          end
+
+          def readable_body?(body)
+            body.is_a?(String) || (body.respond_to?(:read) && body.respond_to?(:rewind))
+          end
+
+          def read_body(body, limit:)
+            Utils::HTTP::BodyReader.read(body, limit: limit, rewind_before_read: true)
+          rescue
+            nil
+          end
+
+          # NOTE: Starting version 2.1.0 headers are already normalized via internal
+          #       variable `@processed_headers_lowercase`. In case it's available,
+          #       we use it to avoid unnecessary transformation.
+          def normalize_request_headers
+            return @processed_headers_lowercase if defined?(@processed_headers_lowercase)
+
+            processed_headers.transform_keys(&:downcase)
+          end
+
+          # NOTE: Headers values are always an `Array` in `Net::HTTPResponse`,
+          #       but we want to avoid accidents and will wrap them in no-op
+          #       `Array` call just in case of a breaking change in the future
+          #
+          # FIXME: Steep has issues with `transform_values!` modifying the original
+          #        type and it failed with "Cannot allow block body" error
+          def normalize_response_headers(response) # steep:ignore MethodBodyTypeMismatch
+            response.net_http_res.to_hash
+              .transform_values! { |value| Array(value).join(', ') } # steep:ignore BlockBodyTypeMismatch
+          end
+
+          def handle(result, context:)
+            AppSec::Event.tag(context, result)
+            TraceKeeper.keep!(context.trace) if result.keep?
+
+            context.events.push(
+              AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+            )
+
+            AppSec::ActionsHandler.handle(result.actions)
           end
         end
       end
     end
   end
 end
-# rubocop:enable Naming/FileName

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative '../../../event'
+require_relative '../../../trace_keeper'
 require_relative '../../../security_event'
 require_relative '../../../instrumentation/gateway'
 
@@ -21,23 +22,48 @@ module Datadog
               end
 
               def watch_request_dispatch(gateway = Instrumentation.gateway)
-                gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
-                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
+                gateway.watch('sinatra.request.dispatch') do |stack, gateway_request|
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY] # : Context
 
-                  persistent_data = {
-                    'server.request.body' => gateway_request.form_hash
-                  }
+                  context.state[:web_framework] = 'sinatra'
+
+                  request = gateway_request.request
+                  next stack.call(request) unless gateway_request.collectable_body?
+
+                  # NOTE: A limit of 0 disables request body collection entirely.
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
+                  next stack.call(request) if limit.zero?
+
+                  persistent_data = {}
+                  byte_length = gateway_request.body_bytesize(limit)
+
+                  if byte_length
+                    persistent_data['server.request.body.byte_length'] = byte_length
+
+                    if byte_length <= limit
+                      body = gateway_request.form_hash
+                      persistent_data['server.request.body'] = body if body
+                    end
+                  # NOTE: Body was parsed before measurement, keep byte_length unset
+                  elsif gateway_request.env.key?('rack.request.form_hash')
+                    body = gateway_request.env['rack.request.form_hash']
+                    persistent_data['server.request.body'] = body if body
+                  end
+
+                  next stack.call(request) if persistent_data.empty?
 
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
-                  if result.match? || !result.derivatives.empty?
+                  if result.match? || !result.attributes.empty?
                     context.events.push(
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
                     )
                   end
 
                   if result.match?
-                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
                     AppSec::ActionsHandler.handle(result.actions)
                   end
 
@@ -46,8 +72,9 @@ module Datadog
               end
 
               def watch_request_routed(gateway = Instrumentation.gateway)
-                gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
-                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
+                gateway.watch('sinatra.request.routed') do |stack, args|
+                  gateway_request, gateway_route_params = args # : [Gateway::Request, Gateway::RouteParams]
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY] # : Context
 
                   persistent_data = {
                     'server.request.path_params' => gateway_route_params.params
@@ -56,7 +83,8 @@ module Datadog
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
                   if result.match?
-                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
 
                     context.events.push(
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
@@ -70,8 +98,8 @@ module Datadog
               end
 
               def watch_response_body_json(gateway = Instrumentation.gateway)
-                gateway.watch('sinatra.response.body.json', :appsec) do |stack, container|
-                  context = container.context
+                gateway.watch('sinatra.response.body.json') do |stack, container|
+                  context = container.context # : Context
 
                   persistent_data = {
                     'server.response.body' => container.data
@@ -83,7 +111,9 @@ module Datadog
                       AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
                     )
 
-                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
                     AppSec::ActionsHandler.handle(result.actions)
                   end
 

data/lib/datadog/appsec/contrib/sinatra/integration.rb

@@ -26,7 +26,7 @@ module Datadog
           end
 
           def self.compatible?
-            super && version >= MINIMUM_VERSION
+            !!(super && (version&.>= MINIMUM_VERSION))
           end
 
           def self.auto_instrument?

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -71,7 +71,7 @@ module Datadog
         # path params are returned by pattern.params in process_route, then
         # merged with normal params, so we get both
         module RoutePatch
-          def process_route(*)
+          def process_route(*args)
             env = @request.env
 
             context = env[Datadog::AppSec::Ext::CONTEXT_KEY]
@@ -83,7 +83,7 @@ module Datadog
             # Capture normal params.
             base_params = params
 
-            super do |*args|
+            super do |*super_args|
               # This block is called only once the route is found.
               # At this point params has both route params and normal params.
               route_params = params.each.with_object({}) { |(k, v), h| h[k] = v unless base_params.key?(k) }
@@ -93,7 +93,7 @@ module Datadog
 
               Instrumentation.gateway.push('sinatra.request.routed', [gateway_request, gateway_route_params])
 
-              yield(*args)
+              yield(*super_args)
             end
           end
         end
@@ -123,7 +123,7 @@ module Datadog
           end
 
           def patch_json?
-            defined?(::Sinatra::JSON) && ::Sinatra::Base < ::Sinatra::JSON
+            !!(defined?(::Sinatra::JSON) && ::Sinatra::Base < ::Sinatra::JSON)
           end
         end
       end

data/lib/datadog/appsec/contrib/sinatra/patches/json_patch.rb

@@ -12,7 +12,7 @@ module Datadog
           # body right before it is serialized.
           module JsonPatch
             def json(object, options = {})
-              context = @request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
+              context = @request.env[Datadog::AppSec::Ext::CONTEXT_KEY] # : Context?
               return super unless context
 
               data = Utils::HashCoercion.coerce(object)

data/lib/datadog/appsec/counter_sampler.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative '../core/knuth_sampler'
+
+module Datadog
+  module AppSec
+    # Sampler that uses an internal counter to make deterministic sampling decisions.
+    #
+    # Each call to {#sample?} increments the counter and uses it as input to
+    # the underlying Knuth multiplicative hash algorithm.
+    #
+    # @api private
+    class CounterSampler
+      def initialize(rate = 1.0)
+        @sampler = Core::KnuthSampler.new(rate)
+        @counter = 0
+      end
+
+      def sample?
+        @counter += 1
+        @sampler.sample?(@counter)
+      end
+    end
+  end
+end

data/lib/datadog/appsec/default_header_tags.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # Sets the always-on span tags built from a fixed allowlist of request and
+    # response headers.
+    #
+    # NOTE: Unlike {Event#record}, which reports request headers only when
+    #       a security event fires, these are tagged on every request/response
+    #
+    # @api private
+    module DefaultHeaderTags
+      # NOTE: Contains additional WAF vendor headers
+      REQUEST_HEADERS_TAGS = %w[
+        accept
+        content-type
+        user-agent
+        akamai-user-risk
+        x-amzn-trace-id
+        x-cloud-trace-context
+        x-appgw-trace-id
+        x-sigsci-requestid
+        x-sigsci-tags
+        cf-ray
+        cloudfront-viewer-ja3-fingerprint
+      ].freeze
+
+      RESPONSE_HEADERS_TAGS = %w[
+        content-type
+        content-length
+        content-encoding
+        content-language
+      ].freeze
+
+      module_function
+
+      def tag_request(span, headers)
+        REQUEST_HEADERS_TAGS.each do |name|
+          value = headers.get(name)
+          span.set_tag("http.request.headers.#{name}", value) if value
+        end
+      end
+
+      def tag_response(span, headers)
+        RESPONSE_HEADERS_TAGS.each do |name|
+          value = headers.get(name)
+          span.set_tag("http.response.headers.#{name}", value.to_s) if value
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/event.rb

@@ -9,8 +9,8 @@ module Datadog
   module AppSec
     # AppSec event
     module Event
-      DERIVATIVE_SCHEMA_KEY_PREFIX = '_dd.appsec.s.'
-      DERIVATIVE_SCHEMA_MAX_COMPRESSED_SIZE = 25000
+      ATTRIBUTES_SCHEMA_KEY_PREFIX = '_dd.appsec.s.'
+      ATTRIBUTES_SCHEMA_MAX_COMPRESSED_SIZE = 25000
       ALLOWED_REQUEST_HEADERS = %w[
         x-forwarded-for
         x-client-ip
@@ -32,27 +32,18 @@ module Datadog
         accept-language
       ].freeze
 
-      ALLOWED_RESPONSE_HEADERS = %w[
-        content-length
-        content-type
-        content-encoding
-        content-language
-      ].freeze
-
       class << self
-        def tag_and_keep!(context, waf_result)
-          TraceKeeper.keep!(context.trace)
+        def tag(context, waf_result)
+          return if context.span.nil?
 
-          if context.span
-            if waf_result.actions.key?('block_request') || waf_result.actions.key?('redirect_request')
-              context.span.set_tag('appsec.blocked', 'true')
-            end
-
-            context.span.set_tag('appsec.event', 'true')
+          if waf_result.actions.key?('block_request') || waf_result.actions.key?('redirect_request')
+            context.span.set_tag('appsec.blocked', 'true')
           end
+
+          context.span.set_tag('appsec.event', 'true')
         end
 
-        def record(context, request: nil, response: nil)
+        def record(context, request: nil)
           return if context.events.empty? || context.span.nil?
 
           Datadog::AppSec::RateLimiter.thread_local.limit do
@@ -63,12 +54,11 @@ module Datadog
                 end
               end
 
-              if event_group.any? { |event| event.attack? || event.schema? }
+              if event_group.any? { |event| event.keep? || event.schema? }
                 TraceKeeper.keep!(trace)
 
                 context.span['_dd.origin'] = 'appsec'
                 context.span.set_tags(request_tags(request)) if request
-                context.span.set_tags(response_tags(response)) if response
               end
 
               context.span.set_tags(waf_tags(event_group))
@@ -92,27 +82,19 @@ module Datadog
           end
         end
 
-        def response_tags(response)
-          response.headers.each_with_object({}) do |(name, value), memo|
-            next unless ALLOWED_RESPONSE_HEADERS.include?(name)
-
-            memo["http.response.headers.#{name}"] = value
-          end
-        end
-
         def waf_tags(security_events)
           triggers = []
 
           tags = security_events.each_with_object({}) do |security_event, memo|
             triggers.concat(security_event.waf_result.events)
 
-            security_event.waf_result.derivatives.each do |key, value|
-              next memo[key] = value unless key.start_with?(DERIVATIVE_SCHEMA_KEY_PREFIX)
+            security_event.waf_result.attributes.each do |key, value|
+              next memo[key] = value unless key.start_with?(ATTRIBUTES_SCHEMA_KEY_PREFIX)
 
               value = CompressedJson.dump(value)
               next if value.nil?
 
-              if value.size >= DERIVATIVE_SCHEMA_MAX_COMPRESSED_SIZE
+              if value.size >= ATTRIBUTES_SCHEMA_MAX_COMPRESSED_SIZE
                 Datadog.logger.debug { "AppSec: Schema key '#{key}' will not be included into span tags due to it's size" }
                 next
               end

data/lib/datadog/appsec/ext.rb

@@ -6,6 +6,8 @@ module Datadog
       RASP_SQLI = 'sql_injection'
       RASP_LFI = 'lfi'
       RASP_SSRF = 'ssrf'
+      RASP_REQUEST_PHASE = 'request'
+      RASP_RESPONSE_PHASE = 'response'
 
       PRODUCT_BIT = 0b00000010
 
@@ -15,6 +17,7 @@ module Datadog
       EXPLOIT_PREVENTION_EVENT_CATEGORY = 'exploit'
 
       TAG_APPSEC_ENABLED = '_dd.appsec.enabled'
+      TAG_NORMALIZED_ROUTE = '_dd.appsec.normalized_route'
       TAG_METASTRUCT_STACK_TRACE = '_dd.stack'
 
       TELEMETRY_METRICS_NAMESPACE = 'appsec'

data/lib/datadog/appsec/instrumentation/gateway/middleware.rb

@@ -7,10 +7,9 @@ module Datadog
         # NOTE: This class extracted as-is and will be deprecated
         # Instrumentation gateway middleware
         class Middleware
-          attr_reader :key, :block
+          attr_reader :block
 
-          def initialize(key, &block)
-            @key = key
+          def initialize(&block)
             @block = block
           end