datadog 2.21.0 → 2.38.0

data/lib/datadog/appsec/security_engine/runner.rb

@@ -27,13 +27,13 @@ module Datadog
           persistent_data.reject! do |_, v|
             next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)
 
-            v.nil? || v.empty?
+            v.nil? || (v.respond_to?(:empty?) && v.empty?)
           end
 
           ephemeral_data.reject! do |_, v|
             next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)
 
-            v.nil? || v.empty?
+            v.nil? || (v.respond_to?(:empty?) && v.empty?)
           end
 
           result = try_run(persistent_data, ephemeral_data, timeout)
@@ -42,17 +42,19 @@ module Datadog
           report_execution(result)
 
           unless SUCCESSFUL_EXECUTION_CODES.include?(result.status)
-            return Result::Error.new(duration_ext_ns: stop_ns - start_ns)
+            return Result::Error.new(duration_ext_ns: stop_ns - start_ns, input_truncated: result.input_truncated?)
           end
 
           klass = (result.status == :match) ? Result::Match : Result::Ok
           klass.new(
             events: result.events,
             actions: result.actions,
-            derivatives: result.derivatives,
-            timeout: result.timeout,
-            duration_ns: result.total_runtime,
-            duration_ext_ns: (stop_ns - start_ns)
+            attributes: result.attributes,
+            keep: result.keep?,
+            timeout: result.timeout?,
+            duration_ns: result.duration,
+            duration_ext_ns: (stop_ns - start_ns),
+            input_truncated: result.input_truncated?
           )
         ensure
           @mutex.unlock
@@ -77,14 +79,22 @@ module Datadog
         def try_run(persistent_data, ephemeral_data, timeout)
           waf_context.run(persistent_data, ephemeral_data, timeout)
         rescue WAF::LibDDWAFError => e
-          Datadog.logger.debug { "#{@debug_tag} execution error: #{e} backtrace: #{e.backtrace&.first(3)}" }
+          Datadog.logger.debug { "#{@debug_tag} execution error: #{e.class}: #{e.message} backtrace: #{e.backtrace&.first(3)}" }
           AppSec.telemetry.report(e, description: 'libddwaf-rb internal low-level error')
 
-          WAF::Result.new(:err_internal, [], 0, false, [], [])
+          WAF::Result.new(
+            status: :err_internal,
+            events: [],
+            actions: {},
+            attributes: {},
+            duration: 0,
+            keep: false,
+            timeout: false
+          )
         end
 
         def report_execution(result)
-          Datadog.logger.debug { "#{@debug_tag} execution timed out: #{result.inspect}" } if result.timeout
+          Datadog.logger.debug { "#{@debug_tag} execution timed out: #{result.inspect}" } if result.timeout?
 
           if SUCCESSFUL_EXECUTION_CODES.include?(result.status)
             Datadog.logger.debug { "#{@debug_tag} execution result: #{result.inspect}" }

data/lib/datadog/appsec/security_event.rb

@@ -3,7 +3,7 @@
 module Datadog
   module AppSec
     # A class that represents a security event of any kind. It could be an event
-    # representing an attack or fingerprinting results as derivatives or an API
+    # representing an attack or fingerprinting results as attributes or an API
     # security check with extracted schema.
     class SecurityEvent
       SCHEMA_KEY_PREFIX = '_dd.appsec.s.'
@@ -17,22 +17,20 @@ module Datadog
         @span = span
       end
 
-      def attack?
-        return @is_attack if defined?(@is_attack)
-
-        @is_attack = @waf_result.is_a?(SecurityEngine::Result::Match)
+      def keep?
+        @waf_result.keep?
       end
 
       def schema?
         return @has_schema if defined?(@has_schema)
 
-        @has_schema = @waf_result.derivatives.any? { |name, _| name.start_with?(SCHEMA_KEY_PREFIX) }
+        @has_schema = @waf_result.attributes.any? { |name, _| name.start_with?(SCHEMA_KEY_PREFIX) }
       end
 
       def fingerprint?
         return @has_fingerprint if defined?(@has_fingerprint)
 
-        @has_fingerprint = @waf_result.derivatives.any? { |name, _| name.start_with?(FINGERPRINT_KEY_PREFIX) }
+        @has_fingerprint = @waf_result.attributes.any? { |name, _| name.start_with?(FINGERPRINT_KEY_PREFIX) }
       end
     end
   end

data/lib/datadog/appsec/trace_keeper.rb

@@ -7,16 +7,28 @@ module Datadog
       def self.keep!(trace)
         return unless trace
 
+        previous_dm = trace.get_tag(Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER)
+
         # NOTE: This action will not set correct decision maker value, so the
         #       trace keeping must be done with additional steps below
         trace.keep!
 
-        # Propagate to downstream services the information that
-        # the current distributed trace is containing at least one ASM event.
-        trace.set_tag(
-          Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
-          Tracing::Sampling::Ext::Decision::ASM
-        )
+        # NOTE: Preserve decision maker if already set by another product.
+        #       As `trace.keep!` resets `_dd.p.dm` to `MANUAL`, we restore the
+        #       previous value when another product has already claimed the
+        #       decision maker.
+        if previous_dm.nil? || previous_dm == Tracing::Sampling::Ext::Decision::MANUAL
+          trace.set_tag(
+            Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+            Tracing::Sampling::Ext::Decision::ASM
+          )
+        else
+          trace.set_tag(
+            Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+            previous_dm,
+          )
+        end
+
         trace.set_distributed_source(Ext::PRODUCT_BIT)
       end
     end

data/lib/datadog/appsec/utils/http/body.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+require 'json'
+require 'cgi'
+
+require_relative 'url_encoded'
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        # Module for handling HTTP body parsing
+        module Body
+          def self.parse(body, media_type:)
+            return if body.nil?
+
+            body.rewind if body.respond_to?(:rewind) # steep:ignore NoMethod
+            # @type var content: ::String?
+            content = body.respond_to?(:read) ? body.read : body # steep:ignore NoMethod, IncompatibleAssignment
+            body.rewind if body.respond_to?(:rewind) # steep:ignore NoMethod
+
+            return if content.nil? || content.empty?
+
+            if media_type.subtype == 'json' || media_type.subtype.end_with?('+json')
+              JSON.parse(content)
+            elsif media_type.subtype == 'x-www-form-urlencoded'
+              URLEncoded.parse(content)
+            end
+          rescue => e
+            AppSec.telemetry.report(e, description: 'AppSec: Failed to parse body')
+
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http/body_reader.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        module BodyReader
+          module_function
+
+          def read(body, limit:, rewind_before_read: false)
+            return body.byteslice(0, limit + 1) if body.is_a?(String)
+            return if body.nil? || !body.respond_to?(:read)
+            return if rewind_before_read && !body.respond_to?(:rewind)
+
+            read_stream(body, limit: limit, rewind_before_read: rewind_before_read)
+          end
+
+          def read_stream(body, limit:, rewind_before_read: false)
+            # @type var rewound: bool
+            rewound = false
+
+            if rewind_before_read
+              return unless rewind(body)
+
+              rewound = true
+            end
+
+            buffer = +''.b
+            max = limit + 1
+
+            while buffer.bytesize <= limit
+              chunk = body.read(max - buffer.bytesize)
+              break if chunk.nil? || chunk.empty?
+
+              buffer << chunk
+            end
+
+            buffer
+          rescue => e
+            Datadog.logger.debug { "AppSec: Failed to read body: #{e.class}: #{e.message}" }
+
+            raise
+          ensure
+            rewind(body) if rewound
+          end
+
+          private_class_method def rewind(body)
+            return false unless body.respond_to?(:rewind)
+
+            # NOTE: Steep can't narrow interfaces via `respond_to?` guard-clause
+            body.rewind # steep:ignore
+            true
+          rescue => e
+            Datadog.logger.debug { "AppSec: Failed to rewind body: #{e.class}: #{e.message}" }
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http/media_range.rb

@@ -168,7 +168,8 @@ module Datadog
           #
           # returns true if the MediaType is accepted by this MediaRange
           def ===(other)
-            return self === MediaType.new(other) if other.is_a?(::String)
+            return false if other.nil?
+            return self === MediaType.parse(other) if other.is_a?(::String)
 
             type == other.type && subtype == other.subtype && other.parameters.all? { |k, v| parameters[k] == v } ||
               type == other.type && wildcard?(:subtype) ||

data/lib/datadog/appsec/utils/http/media_type.rb

@@ -4,22 +4,19 @@ module Datadog
   module AppSec
     module Utils
       module HTTP
-        # Implementation of media type for content negotiation
+        # Implementation of media type for HTTP headers
         #
         # See:
         # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.1
         # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
         class MediaType
-          class ParseError < ::StandardError
-          end
-
           WILDCARD = '*'
 
           # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
           TOKEN_RE = /[-#$%&'*+.^_`|~A-Za-z0-9]+/.freeze
 
           # See: https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
-          PARAMETER_RE = %r{ # rubocop:disable Style/RegexpLiteral
+          PARAMETER_RE = %r{
             (?:
               (?<parameter_name>#{TOKEN_RE})
               =
@@ -46,39 +43,48 @@ module Datadog
 
           attr_reader :type, :subtype, :parameters
 
-          def initialize(media_type)
-            media_type_match = MEDIA_TYPE_RE.match(media_type)
+          def self.parse(media)
+            match = MEDIA_TYPE_RE.match(media)
+            return if match.nil?
 
-            raise ParseError, media_type.inspect if media_type_match.nil?
+            type = match['type'] || WILDCARD
+            type.downcase!
 
-            @type = (media_type_match['type'] || WILDCARD).downcase
-            @subtype = (media_type_match['subtype'] || WILDCARD).downcase
-            @parameters = {}
+            subtype = match['subtype'] || WILDCARD
+            subtype.downcase!
 
-            parameters = media_type_match['parameters']
+            parameters = {}
+            params = match['parameters']
 
-            return if parameters.nil?
+            unless params.nil? || params.empty?
+              params.scan(PARAMETER_RE) do |name, unquoted_value, quoted_value|
+                # NOTE: Order of unquoted_value and quoted_value does not matter,
+                #       as they are mutually exclusive by the regex.
+                # @type var value: ::String?
+                value = unquoted_value || quoted_value
+                next if name.nil? || value.nil?
 
-            parameters.split(';').map(&:strip).each do |parameter|
-              parameter_match = PARAMETER_RE.match(parameter)
+                # See https://github.com/soutaro/steep/issues/2051
+                name.downcase! # steep:ignore NoMethod
+                value.downcase!
 
-              next if parameter_match.nil?
-
-              parameter_name = parameter_match['parameter_name']
-              parameter_value = parameter_match['parameter_value']
+                parameters[name] = value
+              end
+            end
 
-              next if parameter_name.nil? || parameter_value.nil?
+            new(type: type, subtype: subtype, parameters: parameters)
+          end
 
-              @parameters[parameter_name.downcase] = parameter_value.downcase
-            end
+          def initialize(type:, subtype:, parameters: {})
+            @type = type
+            @subtype = subtype
+            @parameters = parameters
           end
 
           def to_s
-            s = +"#{@type}/#{@subtype}"
-
-            s << ';' << @parameters.map { |k, v| "#{k}=#{v}" }.join(';') if @parameters.count > 0
+            return "#{@type}/#{@subtype}" if @parameters.empty?
 
-            s
+            "#{@type}/#{@subtype};#{@parameters.map { |k, v| "#{k}=#{v}" }.join(";")}"
           end
         end
       end

data/lib/datadog/appsec/utils/http/url_encoded.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require 'cgi'
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        # Module for parsing URL encoded payloads
+        module URLEncoded
+          # Parses a URL encoded payload (query string or form data) into a hash
+          # of keys and values, merging duplicate keys.
+          #
+          # Example:
+          #
+          #   URLEncoded.parse("foo=bar&foo=baz&qux=quux") # => {"foo" => ["bar", "baz"], "qux" => "quux"}
+          #
+          # NOTE: Use it in the absence of `Rack::Utils.parse_query`
+          #
+          # WARNING: This method doesn't limit params byte size.
+          #          See: https://github.com/rack/rack/blob/603b799de38b5eb9b2ff1657c8036a20f4c4db7b/lib/rack/query_parser.rb#L231-L233
+          def self.parse(payload)
+            return {} if payload.nil? || payload.empty?
+
+            payload.split('&').each_with_object({}) do |pair, memo|
+              next if pair.empty?
+
+              # NOTE: Steep has issues with mutation methods
+              #       See https://github.com/ruby/rbs/issues/2819
+              #
+              # @type var key: ::String
+              # @type var value: ::String
+              key, value = pair.split('=', 2).map! do |val|
+                CGI.unescape(val)
+              end #: [::String, ::String]
+
+              if (stored = memo[key])
+                if stored.is_a?(Array)
+                  stored.push(value)
+                else
+                  memo[key] = [stored, value]
+                end
+              else
+                memo[key] = value
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec.rb

@@ -11,11 +11,13 @@ module Datadog
   module AppSec
     class << self
       def enabled?
-        Datadog.configuration.appsec.enabled
+        !!components.appsec
       end
 
       def rasp_enabled?
-        Datadog.configuration.appsec.rasp_enabled
+        # TODO this should take rasp_enabled flag from the settings in
+        # the appsec component rather than reading global configuration.
+        enabled? && Datadog.configuration.appsec.rasp_enabled
       end
 
       def active_context
@@ -23,7 +25,7 @@ module Datadog
       end
 
       def telemetry
-        components.appsec&.telemetry
+        components.telemetry
       end
 
       def security_engine
@@ -61,5 +63,6 @@ require_relative 'appsec/contrib/graphql/integration'
 require_relative 'appsec/contrib/faraday/integration'
 require_relative 'appsec/contrib/excon/integration'
 require_relative 'appsec/contrib/rest_client/integration'
+require_relative 'appsec/contrib/aws_lambda/integration'
 
 require_relative 'appsec/autoload'

data/lib/datadog/core/configuration/agentless_settings_resolver.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# rubocop:disable Style/*
+# rubocop:disable Style
 
 require 'uri'
 
@@ -173,4 +173,4 @@ module Datadog
   end
 end
 
-# rubocop:enable Style/*
+# rubocop:enable Style

data/lib/datadog/core/configuration/base.rb

@@ -24,9 +24,21 @@ module Datadog
           # e.g. `settings :foo { option :bar }` --> `config.foo.bar`
           # @param [Symbol] name option name. Methods will be created based on this name.
           def settings(name, &block)
-            settings_class = new_settings_class(name, &block)
-
-            option(name) do |o|
+            nested_settings_path = settings_path ? "#{settings_path}.#{name}" : name.to_s
+            settings_class = new_settings_class(name, nested_settings_path, &block)
+            # Record the child settings class on the owning class so
+            # Options::ClassMethods#settings_path= can later propagate any path
+            # changes down to nested settings classes.
+            #
+            # Example:
+            #   settings :cache_key { option :enabled }
+            # creates a child class whose initial settings_path is "cache_key".
+            # If a contrib integration later assigns the parent path to
+            # "tracing.active_support", settings_children lets us update the
+            # nested class to "tracing.active_support.cache_key" as well.
+            settings_children[name] = settings_class
+
+            option(name, is_settings: true) do |o|
               o.default { settings_class.new }
 
               o.resetter do |value|
@@ -40,9 +52,9 @@ module Datadog
 
           private
 
-          def new_settings_class(name, &block)
+          def new_settings_class(name, settings_path, &block)
             Class.new { include Configuration::Base }.tap do |klass|
-              klass.instance_variable_set(:@settings_name, name)
+              klass.instance_variable_set(:@settings_path, settings_path)
               klass.instance_eval(&block) if block
             end
           end