datadog 2.28.0 → 2.41.0

data/lib/datadog/appsec/api_security/endpoint_collection/grape_route_serializer.rb

@@ -8,7 +8,7 @@ module Datadog
         module GrapeRouteSerializer
           module_function
 
-          def serialize(route, path_prefix: '')
+          def serialize(route, path_prefix: "")
             path = path_prefix + route.pattern.origin
 
             {
@@ -16,7 +16,7 @@ module Datadog
               resource_name: "#{route.request_method} #{path}",
               operation_name: "http.request",
               method: route.request_method,
-              path: path
+              path: path,
             }
           end
         end

data/lib/datadog/appsec/api_security/endpoint_collection/rails_collector.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative 'rails_route_serializer'
-require_relative 'grape_route_serializer'
-require_relative 'sinatra_route_serializer'
+require_relative "rails_route_serializer"
+require_relative "grape_route_serializer"
+require_relative "sinatra_route_serializer"
 
 module Datadog
   module AppSec
@@ -19,9 +19,9 @@ module Datadog
             Enumerator.new do |yielder|
               @routes.each do |route|
                 if route.dispatcher?
-                  if route.verb.include?('|')
+                  if route.verb.include?("|")
                     # report separate route for each method for multi-method routes
-                    route.verb.split('|').each do |method|
+                    route.verb.split("|").each do |method|
                       yielder.yield RailsRouteSerializer.serialize(route, method_override: method)
                     end
                   else
@@ -33,7 +33,7 @@ module Datadog
                   end
                 elsif mounted_sinatra_app?(route.app.rack_app)
                   route.app.rack_app.routes.each do |method, sinatra_routes|
-                    next if method == 'HEAD'
+                    next if method == "HEAD"
 
                     sinatra_routes.each do |sinatra_route, _, _|
                       yielder.yield SinatraRouteSerializer.serialize(

data/lib/datadog/appsec/api_security/endpoint_collection/rails_route_serializer.rb

@@ -26,7 +26,7 @@ module Datadog
               resource_name: "#{method} #{path}",
               operation_name: "http.request",
               method: method,
-              path: path
+              path: path,
             }
           end
         end

data/lib/datadog/appsec/api_security/endpoint_collection/sinatra_route_serializer.rb

@@ -8,7 +8,7 @@ module Datadog
         module SinatraRouteSerializer
           module_function
 
-          def serialize(route, method:, path_prefix: '')
+          def serialize(route, method:, path_prefix: "")
             path = path_prefix + route.safe_string
 
             {
@@ -16,7 +16,7 @@ module Datadog
               resource_name: "#{method} #{path}",
               operation_name: "http.request",
               method: method,
-              path: path
+              path: path,
             }
           end
         end

data/lib/datadog/appsec/api_security/route_extractor.rb

@@ -1,20 +1,21 @@
 # frozen_string_literal: true
 
-require_relative '../../tracing/contrib/rack/route_inference'
+require_relative "../../tracing/contrib/rack/route_inference"
 
 module Datadog
   module AppSec
     module APISecurity
       # This is a helper module to extract the route pattern from the Rack::Request.
       module RouteExtractor
-        SINATRA_ROUTE_KEY = 'sinatra.route'
-        SINATRA_ROUTE_SEPARATOR = ' '
-        GRAPE_ROUTE_KEY = 'grape.routing_args'
-        RAILS_ROUTE_URI_PATTERN_KEY = 'action_dispatch.route_uri_pattern'
-        RAILS_ROUTE_KEY = 'action_dispatch.route' # Rails 8.1.1+
-        RAILS_ROUTES_KEY = 'action_dispatch.routes'
-        RAILS_PATH_PARAMS_KEY = 'action_dispatch.request.path_parameters'
-        RAILS_FORMAT_SUFFIX = '(.:format)'
+        SINATRA_ROUTE_KEY = "sinatra.route"
+        SINATRA_ROUTE_SEPARATOR = " "
+        GRAPE_ROUTE_KEY = "grape.routing_args"
+        RAILS_ROUTE_URI_PATTERN_KEY = "action_dispatch.route_uri_pattern"
+        RAILS_ROUTE_KEY = "action_dispatch.route" # Rails 8.1.1+
+        RAILS_ROUTES_KEY = "action_dispatch.routes"
+        RAILS_PATH_PARAMS_KEY = "action_dispatch.request.path_parameters"
+        RAILS_FORMAT_SUFFIX = "(.:format)"
+        DATADOG_RAILS_ROUTE_KEY = "datadog.action_dispatch.route"
 
         # HACK: We rely on the fact that each contrib will modify `request.env`
         #       and store information sufficient to compute the canonical
@@ -30,16 +31,19 @@ module Datadog
         #         uses `sinatra.route` with a string like "GET /users/:id"
         #       Grape
         #         uses `grape.routing_args` with a hash with a `:route_info` key
-        #         that contains a `Grape::Router::Route` object that contains
-        #         `Grape::Router::Pattern` object with an `origin` method
+        #         that contains a {Grape::Router::Route} object that contains
+        #         {Grape::Router::Pattern} object with an `origin` method
+        #       Rails with `action_pack` tracing contrib (fast path)
+        #         `datadog.action_dispatch.route` stores the {Journey::Route}
+        #         object set by the tracer at routing time
         #       Rails < 7.1 (slow path)
-        #         uses `action_dispatch.routes` to store `ActionDispatch::Routing::RouteSet`
+        #         uses `action_dispatch.routes` to store {ActionDispatch::Routing::RouteSet}
         #         which can recognize requests
         #       Rails > 7.1 (fast path)
         #         uses `action_dispatch.route_uri_pattern` with a string like
         #         "/users/:id(.:format)"
         #       Rails > 8.1.1 (fast path)
-        #         uses `action_dispatch.route` to store the ActionDispatch::Journey::Route
+        #         uses `action_dispatch.route` to store the {ActionDispatch::Journey::Route}
         #         that matched when the request was routed
         #
         # WARNING: This method works only *after* the request has been routed.
@@ -49,12 +53,20 @@ module Datadog
         #          In Rails < 7.1 it also will not be set even if a route was found,
         #          but in this case `action_dispatch.request.path_parameters` won't be empty.
         def self.route_pattern(request)
+          # NOTE: Requests from contribs like AWS Lambda don't provide a usable
+          #       `::Rack::Request#env`, so infer the route from the path instead
+          unless request.respond_to?(:env)
+            return Tracing::Contrib::Rack::RouteInference.infer(request.path.to_s)
+          end
+
           if request.env.key?(GRAPE_ROUTE_KEY)
             pattern = request.env[GRAPE_ROUTE_KEY][:route_info]&.pattern&.origin
             "#{request.script_name}#{pattern}"
           elsif request.env.key?(SINATRA_ROUTE_KEY)
             pattern = request.env[SINATRA_ROUTE_KEY].split(SINATRA_ROUTE_SEPARATOR, 2)[1]
             "#{request.script_name}#{pattern}"
+          elsif request.env.key?(DATADOG_RAILS_ROUTE_KEY)
+            request.env[DATADOG_RAILS_ROUTE_KEY].path.spec.to_s.delete_suffix(RAILS_FORMAT_SUFFIX)
           elsif request.env.key?(RAILS_ROUTE_KEY)
             request.env[RAILS_ROUTE_KEY].path.spec.to_s.delete_suffix(RAILS_FORMAT_SUFFIX)
           elsif request.env.key?(RAILS_ROUTE_URI_PATTERN_KEY)
@@ -82,7 +94,7 @@ module Datadog
             Tracing::Contrib::Rack::RouteInference.read_or_infer(request.env)
           end
         rescue => e
-          AppSec.telemetry&.report(e, description: 'AppSec: Could not extract route pattern')
+          AppSec.telemetry&.report(e, description: "AppSec: Could not extract route pattern")
 
           nil
         end

data/lib/datadog/appsec/api_security/sampler.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require 'zlib'
-require_relative 'route_extractor'
-require_relative '../../core/utils/time'
-require_relative '../../core/utils/lru_cache'
+require "zlib"
+require_relative "route_extractor"
+require_relative "../../core/utils/time"
+require_relative "../../core/utils/lru_cache"
 
 module Datadog
   module AppSec
@@ -35,7 +35,7 @@ module Datadog
         end
 
         def initialize(sample_delay)
-          raise ArgumentError, 'sample_delay must be an Integer' unless sample_delay.is_a?(Integer)
+          raise ArgumentError, "sample_delay must be an Integer" unless sample_delay.is_a?(Integer)
 
           @cache = Core::Utils::LRUCache.new(MAX_CACHE_SIZE)
           @sample_delay_seconds = sample_delay

data/lib/datadog/appsec/api_security.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'api_security/sampler'
+require_relative "api_security/sampler"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/assets/blocked.html

@@ -100,7 +100,8 @@
     <footer>
         <p>Security provided by <a
                 href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/"
-                target="_blank">Datadog</a></p>
+                target="_blank"
+                rel="noopener noreferrer">Datadog</a></p>
     </footer>
 </body>
 

data/lib/datadog/appsec/assets.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'pathname'
+require "pathname"
 
 module Datadog
   module AppSec
@@ -13,11 +13,11 @@ module Datadog
       end
 
       def waf_processors
-        read('waf_rules/processors.json')
+        read("waf_rules/processors.json")
       end
 
       def waf_scanners
-        read('waf_rules/scanners.json')
+        read("waf_rules/scanners.json")
       end
 
       def blocked(format: :html)
@@ -25,21 +25,21 @@ module Datadog
       end
 
       def path
-        Pathname.new(dir).join('assets')
+        Pathname.new(dir).join("assets")
       end
 
       def filepath(filename)
         path.join(filename)
       end
 
-      def read(filename, mode = 'rb')
-        File.open(filepath(filename), mode) { |f| f.read || raise('Unexpected nil IO object') }
+      def read(filename, mode = "rb")
+        File.open(filepath(filename), mode) { |f| f.read || raise("Unexpected nil IO object") }
       end
 
       def dir
         # Happens only if this file is evaluated standalone, which should not happen
         # Necessary to make type-checker happy with a non-nilable return value
-        __dir__ || raise('Unexpected file eval')
+        __dir__ || raise("Unexpected file eval")
       end
     end
   end

data/lib/datadog/appsec/autoload.rb

@@ -1,13 +1,13 @@
 # frozen_string_literal: true
 
-if %w[1 true].include?((Datadog::DATADOG_ENV['DD_APPSEC_ENABLED'] || '').downcase)
+if %w[1 true].include?((Datadog::DATADOG_ENV["DD_APPSEC_ENABLED"] || "").downcase)
   begin
-    require_relative 'contrib/auto_instrument'
+    require_relative "contrib/auto_instrument"
     Datadog::AppSec::Contrib::AutoInstrument.patch_all
   rescue => e
     Kernel.warn(
-      '[datadog] AppSec failed to instrument. No security check will be performed. error: ' \
-      " #{e.class.name} #{e.message}"
+      "[datadog] AppSec failed to instrument. No security check will be performed. error: " \
+      " #{e.class}: #{e.message}"
     )
   end
 end

data/lib/datadog/appsec/component.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require_relative 'security_engine/engine'
-require_relative 'security_engine/runner'
-require_relative 'processor/rule_loader'
-require_relative 'actions_handler'
-require_relative 'thread_safe_ref'
+require_relative "security_engine/engine"
+require_relative "security_engine/runner"
+require_relative "processor/rule_loader"
+require_relative "actions_handler"
+require_relative "thread_safe_ref"
 
 module Datadog
   module AppSec
@@ -14,21 +14,21 @@ module Datadog
         def build_appsec_component(settings, telemetry:)
           return if !settings.respond_to?(:appsec) || !settings.appsec.enabled
 
-          ffi_version = Gem.loaded_specs['ffi']&.version
+          ffi_version = Gem.loaded_specs["ffi"]&.version
           unless ffi_version
-            Datadog.logger.warn('FFI gem is not loaded, AppSec will be disabled.')
-            telemetry.error('AppSec: Component not loaded, due to missing FFI gem')
+            Datadog.logger.warn("FFI gem is not loaded, AppSec will be disabled.")
+            telemetry.error("AppSec: Component not loaded, due to missing FFI gem")
 
             return
           end
 
-          if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') && ffi_version < Gem::Version.new('1.16.0')
+          if RubyVersion.is?(">= 3.3") && ffi_version < Gem::Version.new("1.16.0")
             Datadog.logger.warn(
-              'AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, ' \
-              'and will be forcibly disabled due to a memory leak in `ffi`. ' \
-              'Please upgrade your `ffi` version to 1.16.0 or higher.'
+              "AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, " \
+              "and will be forcibly disabled due to a memory leak in `ffi`. " \
+              "Please upgrade your `ffi` version to 1.16.0 or higher."
             )
-            telemetry.error('AppSec: Component not loaded, ffi version is leaky with ruby > 3.3.0')
+            telemetry.error("AppSec: Component not loaded, ffi version is leaky with ruby > 3.3.0")
 
             return
           end
@@ -45,19 +45,27 @@ module Datadog
           settings.appsec.instrument(:devise) unless devise_integration.patcher.patched?
 
           security_engine = SecurityEngine::Engine.new(appsec_settings: settings.appsec, telemetry: telemetry)
-          new(security_engine: security_engine, telemetry: telemetry)
-        rescue
-          Datadog.logger.warn('AppSec is disabled, see logged errors above')
-
+          new(security_engine: security_engine)
+        # NOTE: At this point we should capture all possible exceptions and
+        #       gracefully fail component initialization, preventing propagation
+        #       into the host application code.
+        rescue Exception => e # standard:disable Lint/RescueException
+          Datadog.logger.warn("AppSec is disabled: #{e.class}: #{e.message}; there may be additional logged errors above")
+
+          # Not reporting to telemetry here because some of the rescued exceptions
+          # have already been reported by the code that raised them
+          # (e.g. SecurityEngine::Engine.new reports WAF init failures).
+          # TODO: reconsider whether telemetry reporting belongs here
+          # (single catch-all) or in the downstream code (as it is now).
           nil
         end
 
         private
 
         def require_libddwaf(telemetry:)
-          require('libddwaf')
+          require("libddwaf")
         rescue LoadError => e
-          libddwaf_platform = Gem.loaded_specs['libddwaf']&.platform || 'unknown'
+          libddwaf_platform = Gem.loaded_specs["libddwaf"]&.platform || "unknown"
           ruby_platforms = Gem.platforms.map(&:to_s)
 
           error_message = "libddwaf failed to load - installed platform: #{libddwaf_platform}, " \
@@ -70,11 +78,10 @@ module Datadog
         end
       end
 
-      attr_reader :security_engine, :telemetry
+      attr_reader :security_engine
 
-      def initialize(security_engine:, telemetry:)
+      def initialize(security_engine:)
         @security_engine = security_engine
-        @telemetry = telemetry
       end
 
       def reconfigure!

data/lib/datadog/appsec/compressed_json.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require 'json'
-require 'zlib'
-require 'stringio'
+require "json"
+require "zlib"
+require "stringio"
 
-require_relative '../core/utils/base64'
+require_relative "../core/utils/base64_codec"
 
 module Datadog
   module AppSec
@@ -21,17 +21,17 @@ module Datadog
 
         compress_and_encode(value)
       rescue ArgumentError, Encoding::UndefinedConversionError, JSON::JSONError => e
-        AppSec.telemetry.report(e, description: 'AppSec: Failed to convert value into JSON')
+        AppSec.telemetry.report(e, description: "AppSec: Failed to convert value into JSON")
 
         nil
       end
 
       private_class_method def self.compress_and_encode(payload)
-        Core::Utils::Base64.strict_encode64(
+        Core::Utils::Base64Codec.strict_encode64(
           Zlib.gzip(payload, level: Zlib::BEST_SPEED, strategy: Zlib::DEFAULT_STRATEGY)
         )
       rescue Zlib::Error, TypeError => e
-        AppSec.telemetry.report(e, description: 'AppSec: Failed to compress and encode value')
+        AppSec.telemetry.report(e, description: "AppSec: Failed to compress and encode value")
 
         nil
       end