datadog 2.30.0 → 2.45.0

data/lib/datadog/appsec/assets.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'pathname'
+require "pathname"
 
 module Datadog
   module AppSec
@@ -13,11 +13,11 @@ module Datadog
       end
 
       def waf_processors
-        read('waf_rules/processors.json')
+        read("waf_rules/processors.json")
       end
 
       def waf_scanners
-        read('waf_rules/scanners.json')
+        read("waf_rules/scanners.json")
       end
 
       def blocked(format: :html)
@@ -25,21 +25,21 @@ module Datadog
       end
 
       def path
-        Pathname.new(dir).join('assets')
+        Pathname.new(dir).join("assets")
       end
 
       def filepath(filename)
         path.join(filename)
       end
 
-      def read(filename, mode = 'rb')
-        File.open(filepath(filename), mode) { |f| f.read || raise('Unexpected nil IO object') }
+      def read(filename, mode = "rb")
+        File.open(filepath(filename), mode) { |f| f.read || raise("Unexpected nil IO object") }
       end
 
       def dir
         # Happens only if this file is evaluated standalone, which should not happen
         # Necessary to make type-checker happy with a non-nilable return value
-        __dir__ || raise('Unexpected file eval')
+        __dir__ || raise("Unexpected file eval")
       end
     end
   end

data/lib/datadog/appsec/autoload.rb

@@ -1,13 +1,13 @@
 # frozen_string_literal: true
 
-if %w[1 true].include?((Datadog::DATADOG_ENV['DD_APPSEC_ENABLED'] || '').downcase)
+if %w[1 true].include?((Datadog::DATADOG_ENV["DD_APPSEC_ENABLED"] || "").downcase)
   begin
-    require_relative 'contrib/auto_instrument'
+    require_relative "contrib/auto_instrument"
     Datadog::AppSec::Contrib::AutoInstrument.patch_all
   rescue => e
     Kernel.warn(
-      '[datadog] AppSec failed to instrument. No security check will be performed. error: ' \
-      " #{e.class.name} #{e.message}"
+      "[datadog] AppSec failed to instrument. No security check will be performed. error: " \
+      " #{e.class}: #{e.message}"
     )
   end
 end

data/lib/datadog/appsec/component.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require_relative 'security_engine/engine'
-require_relative 'security_engine/runner'
-require_relative 'processor/rule_loader'
-require_relative 'actions_handler'
-require_relative 'thread_safe_ref'
+require_relative "security_engine/engine"
+require_relative "security_engine/runner"
+require_relative "processor/rule_loader"
+require_relative "actions_handler"
+require_relative "thread_safe_ref"
 
 module Datadog
   module AppSec
@@ -14,21 +14,21 @@ module Datadog
         def build_appsec_component(settings, telemetry:)
           return if !settings.respond_to?(:appsec) || !settings.appsec.enabled
 
-          ffi_version = Gem.loaded_specs['ffi']&.version
+          ffi_version = Gem.loaded_specs["ffi"]&.version
           unless ffi_version
-            Datadog.logger.warn('FFI gem is not loaded, AppSec will be disabled.')
-            telemetry.error('AppSec: Component not loaded, due to missing FFI gem')
+            Datadog.logger.warn("FFI gem is not loaded, AppSec will be disabled.")
+            telemetry.error("AppSec: Component not loaded, due to missing FFI gem")
 
             return
           end
 
-          if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') && ffi_version < Gem::Version.new('1.16.0')
+          if RubyVersion.is?(">= 3.3") && ffi_version < Gem::Version.new("1.16.0")
             Datadog.logger.warn(
-              'AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, ' \
-              'and will be forcibly disabled due to a memory leak in `ffi`. ' \
-              'Please upgrade your `ffi` version to 1.16.0 or higher.'
+              "AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, " \
+              "and will be forcibly disabled due to a memory leak in `ffi`. " \
+              "Please upgrade your `ffi` version to 1.16.0 or higher."
             )
-            telemetry.error('AppSec: Component not loaded, ffi version is leaky with ruby > 3.3.0')
+            telemetry.error("AppSec: Component not loaded, ffi version is leaky with ruby > 3.3.0")
 
             return
           end
@@ -45,19 +45,27 @@ module Datadog
           settings.appsec.instrument(:devise) unless devise_integration.patcher.patched?
 
           security_engine = SecurityEngine::Engine.new(appsec_settings: settings.appsec, telemetry: telemetry)
-          new(security_engine: security_engine, telemetry: telemetry)
-        rescue
-          Datadog.logger.warn('AppSec is disabled, see logged errors above')
-
+          new(security_engine: security_engine)
+        # NOTE: At this point we should capture all possible exceptions and
+        #       gracefully fail component initialization, preventing propagation
+        #       into the host application code.
+        rescue Exception => e # standard:disable Lint/RescueException
+          Datadog.logger.warn("AppSec is disabled: #{e.class}: #{e.message}; there may be additional logged errors above")
+
+          # Not reporting to telemetry here because some of the rescued exceptions
+          # have already been reported by the code that raised them
+          # (e.g. SecurityEngine::Engine.new reports WAF init failures).
+          # TODO: reconsider whether telemetry reporting belongs here
+          # (single catch-all) or in the downstream code (as it is now).
           nil
         end
 
         private
 
         def require_libddwaf(telemetry:)
-          require('libddwaf')
+          require("libddwaf")
         rescue LoadError => e
-          libddwaf_platform = Gem.loaded_specs['libddwaf']&.platform || 'unknown'
+          libddwaf_platform = Gem.loaded_specs["libddwaf"]&.platform || "unknown"
           ruby_platforms = Gem.platforms.map(&:to_s)
 
           error_message = "libddwaf failed to load - installed platform: #{libddwaf_platform}, " \
@@ -70,11 +78,10 @@ module Datadog
         end
       end
 
-      attr_reader :security_engine, :telemetry
+      attr_reader :security_engine
 
-      def initialize(security_engine:, telemetry:)
+      def initialize(security_engine:)
         @security_engine = security_engine
-        @telemetry = telemetry
       end
 
       def reconfigure!

data/lib/datadog/appsec/compressed_json.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require 'json'
-require 'zlib'
-require 'stringio'
+require "json"
+require "zlib"
+require "stringio"
 
-require_relative '../core/utils/base64'
+require_relative "../core/utils/base64_codec"
 
 module Datadog
   module AppSec
@@ -21,17 +21,17 @@ module Datadog
 
         compress_and_encode(value)
       rescue ArgumentError, Encoding::UndefinedConversionError, JSON::JSONError => e
-        AppSec.telemetry.report(e, description: 'AppSec: Failed to convert value into JSON')
+        AppSec.telemetry.report(e, description: "AppSec: Failed to convert value into JSON")
 
         nil
       end
 
       private_class_method def self.compress_and_encode(payload)
-        Core::Utils::Base64.strict_encode64(
+        Core::Utils::Base64Codec.strict_encode64(
           Zlib.gzip(payload, level: Zlib::BEST_SPEED, strategy: Zlib::DEFAULT_STRATEGY)
         )
       rescue Zlib::Error, TypeError => e
-        AppSec.telemetry.report(e, description: 'AppSec: Failed to compress and encode value')
+        AppSec.telemetry.report(e, description: "AppSec: Failed to compress and encode value")
 
         nil
       end

data/lib/datadog/appsec/configuration.rb

@@ -1,11 +1,446 @@
 # frozen_string_literal: true
 
-require_relative 'configuration/settings'
+require_relative "../core/utils/duration"
+require_relative "sample_rate"
 
 module Datadog
   module AppSec
     # Configuration for AppSec
     module Configuration
+      # Settings
+      module Settings
+        # rubocop:disable Layout/LineLength
+        DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)pass|pw(?:or)?d|secret|(?:api|private|public|access)[_-]?key|token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\.net[_-]sessionid|sid|jwt'
+        DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key(?:[_-]?id)?|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?|jsessionid|phpsessid|asp\.net(?:[_-]|-)sessionid|sid|jwt)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'
+        # rubocop:enable Layout/LineLength
+
+        DISABLED_AUTO_USER_INSTRUMENTATION_MODE = "disabled"
+        ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE = "anonymization"
+        IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE = "identification"
+        AUTO_USER_INSTRUMENTATION_MODES = [
+          DISABLED_AUTO_USER_INSTRUMENTATION_MODE,
+          ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
+          IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE,
+        ].freeze
+        AUTO_USER_INSTRUMENTATION_MODES_ALIASES = {
+          "ident" => IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE,
+          "anon" => ANONYMIZATION_AUTO_USER_INSTRUMENTATION_MODE,
+        }.freeze
+
+        # NOTE: These two constants are deprecated
+        SAFE_TRACK_USER_EVENTS_MODE = "safe"
+        EXTENDED_TRACK_USER_EVENTS_MODE = "extended"
+        APPSEC_VALID_TRACK_USER_EVENTS_MODE = [
+          SAFE_TRACK_USER_EVENTS_MODE, EXTENDED_TRACK_USER_EVENTS_MODE,
+        ].freeze
+        APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES = ["1", "true"].concat(
+          APPSEC_VALID_TRACK_USER_EVENTS_MODE
+        ).freeze
+
+        def self.extended(base)
+          base = base.singleton_class unless base.is_a?(Class)
+          add_settings!(base)
+        end
+
+        # rubocop:disable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+        def self.add_settings!(base)
+          base.class_eval do
+            settings :appsec do
+              option :enabled do |o|
+                o.type :bool
+                o.env "DD_APPSEC_ENABLED"
+                o.default false
+              end
+
+              # NOTE: Marker set by the agentic onboarding tooling.
+              #       Has no effect here — we just report its value in telemetry,
+              #       so onboarding can be detected at runtime
+              option :agentic_onboarding do |o|
+                o.type :string
+                o.env "DD_APPSEC_AGENTIC_ONBOARDING"
+                o.default ""
+              end
+
+              define_method(:instrument) do |integration_name|
+                if enabled
+                  registered_integration = Datadog::AppSec::Contrib::Integration.registry[integration_name]
+                  if registered_integration
+                    klass = registered_integration.klass
+                    if klass.loaded? && klass.compatible?
+                      instance = klass.new
+                      instance.patcher.patch unless instance.patcher.patched?
+                    end
+                  end
+                end
+              end
+
+              # RASP or Runtime Application Self-Protection
+              # is a collection of techniques and heuristics aimed at detecting malicious inputs and preventing
+              # any potential side-effects on the application resulting from the use of said malicious inputs.
+              option :rasp_enabled do |o|
+                o.type :bool, nilable: true
+                o.env "DD_APPSEC_RASP_ENABLED"
+                o.default true
+              end
+
+              option :ruleset do |o|
+                o.env "DD_APPSEC_RULES"
+                o.default :recommended
+              end
+
+              option :ip_passlist do |o|
+                o.default []
+
+                o.setter do |value|
+                  next value if value.nil? || value.empty?
+
+                  Datadog::Core.log_deprecation(disallowed_next_major: false) do
+                    "The ip_passlist setting is deprecated and will be removed in the next release. " \
+                    "Please migrate this configuration to your service settings via the Datadog UI"
+                  end
+
+                  value
+                end
+              end
+
+              option :ip_denylist do |o|
+                o.type :array
+                o.default []
+
+                o.setter do |value|
+                  next value if value.nil? || value.empty?
+
+                  Datadog::Core.log_deprecation(disallowed_next_major: false) do
+                    "The ip_denylist setting is deprecated and will be removed in the next release. " \
+                    "Please migrate this configuration to your service settings via the Datadog UI"
+                  end
+
+                  value
+                end
+              end
+
+              option :user_id_denylist do |o|
+                o.type :array
+                o.default []
+
+                o.setter do |value|
+                  next value if value.nil? || value.empty?
+
+                  Datadog::Core.log_deprecation(disallowed_next_major: false) do
+                    "The user_id_denylist setting is deprecated and will be removed in the next release. " \
+                    "Please migrate this configuration to your service settings via the Datadog UI"
+                  end
+
+                  value
+                end
+              end
+
+              option :waf_timeout do |o|
+                o.env "DD_APPSEC_WAF_TIMEOUT" # us
+                o.default 5_000
+                o.setter do |v|
+                  Datadog::Core::Utils::Duration.call(v.to_s, base: :us)
+                end
+              end
+
+              # NOTE: A value of 0 (or less) disables request body collection
+              option :body_parsing_size_limit do |o|
+                o.type :int
+                o.env "DD_APPSEC_BODY_PARSING_SIZE_LIMIT" # bytes
+                o.default 10_485_760
+              end
+
+              option :waf_debug do |o|
+                o.env "DD_APPSEC_WAF_DEBUG"
+                o.default false
+                o.type :bool
+              end
+
+              option :trace_rate_limit do |o|
+                o.type :int
+                o.env "DD_APPSEC_TRACE_RATE_LIMIT" # trace/s
+                o.default 100
+              end
+
+              option :obfuscator_key_regex do |o|
+                o.type :string
+                o.env "DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP"
+                o.default DEFAULT_OBFUSCATOR_KEY_REGEX
+              end
+
+              option :obfuscator_value_regex do |o|
+                o.type :string
+                o.env "DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP"
+                o.default DEFAULT_OBFUSCATOR_VALUE_REGEX
+              end
+
+              settings :block do
+                settings :templates do
+                  option :html do |o|
+                    o.env "DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML"
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        unless File.exist?(value)
+                          raise(ArgumentError,
+                            "appsec.templates.html: file not found: #{value}")
+                        end
+
+                        File.binread(value) || ""
+                      end
+                    end
+                  end
+
+                  option :json do |o|
+                    o.env "DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON"
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        unless File.exist?(value)
+                          raise(ArgumentError,
+                            "appsec.templates.json: file not found: #{value}")
+                        end
+
+                        File.binread(value) || ""
+                      end
+                    end
+                  end
+
+                  option :text do |o|
+                    o.env "DD_APPSEC_HTTP_BLOCKED_TEMPLATE_TEXT"
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        unless File.exist?(value)
+                          raise(ArgumentError,
+                            "appsec.templates.text: file not found: #{value}")
+                        end
+
+                        File.binread(value) || ""
+                      end
+                    end
+                  end
+                end
+              end
+
+              settings :stack_trace do
+                option :enabled do |o|
+                  o.type :bool
+                  o.env "DD_APPSEC_STACK_TRACE_ENABLED"
+                  o.default true
+                end
+
+                # The maximum number of stack trace frames to collect for each stack trace.
+                #
+                # If the stack trace exceeds this limit, the frames are dropped from the middle of the stack trace:
+                # 75% of the frames are kept from the top of the stack trace and 25% from the bottom
+                # (this percentage is also configurable).
+                #
+                # Minimum value is 10.
+                # Set to zero if you don't want any frames to be dropped.
+                #
+                # Default value is 32
+                option :max_depth do |o|
+                  o.type :int
+                  o.env "DD_APPSEC_MAX_STACK_TRACE_DEPTH"
+                  o.default 32
+
+                  o.setter do |value|
+                    value = 0 if value < 0
+                    value
+                  end
+                end
+
+                # The percentage of frames to keep from the top of the stack trace.
+                #
+                # Default value is 75
+                option :top_percentage do |o|
+                  o.type :int
+                  o.env "DD_APPSEC_MAX_STACK_TRACE_DEPTH_TOP_PERCENT"
+                  o.default 75
+
+                  o.setter do |value|
+                    value = 100 if value > 100
+                    value = 0 if value.negative?
+                    value
+                  end
+                end
+
+                # Maximum number of stack traces to collect per span.
+                #
+                # Set to zero if you want to collect all stack traces.
+                #
+                # Default value is 2
+                option :max_stack_traces do |o|
+                  o.type :int
+                  o.env "DD_APPSEC_MAX_STACK_TRACES"
+                  o.default 2
+
+                  o.setter do |value|
+                    value = 0 if value < 0
+                    value
+                  end
+                end
+              end
+
+              settings :auto_user_instrumentation do
+                define_method(:enabled?) { get_option(:mode) != DISABLED_AUTO_USER_INSTRUMENTATION_MODE }
+
+                option :mode do |o|
+                  o.type :string
+                  o.env "DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE"
+                  o.default IDENTIFICATION_AUTO_USER_INSTRUMENTATION_MODE
+                  o.setter do |value|
+                    mode = AUTO_USER_INSTRUMENTATION_MODES_ALIASES.fetch(value, value)
+                    next mode if AUTO_USER_INSTRUMENTATION_MODES.include?(mode)
+
+                    Datadog.logger.warn(
+                      "The appsec.auto_user_instrumentation.mode value provided is not supported. " \
+                      "Supported values are: #{AUTO_USER_INSTRUMENTATION_MODES.join(" | ")}. " \
+                      "Using value: #{DISABLED_AUTO_USER_INSTRUMENTATION_MODE}."
+                    )
+
+                    DISABLED_AUTO_USER_INSTRUMENTATION_MODE
+                  end
+                end
+              end
+
+              # DEV-3.0: Remove `track_user_events.enabled` and `track_user_events.mode` options
+              settings :track_user_events do
+                option :enabled do |o|
+                  o.default true
+                  o.type :bool
+                  o.env "DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING"
+                  o.env_parser do |env_value|
+                    if env_value == "disabled"
+                      false
+                    else
+                      APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES.include?(env_value.strip.downcase)
+                    end
+                  end
+                  o.after_set do |_, _, precedence|
+                    unless precedence == Datadog::Core::Configuration::Option::Precedence::DEFAULT
+                      Core.log_deprecation(key: :appsec_track_user_events_enabled) do
+                        "The appsec.track_user_events.enabled setting is deprecated. " \
+                        "Please remove it from your Datadog.configure block and use " \
+                        "appsec.auto_user_instrumentation.mode instead."
+                      end
+                    end
+                  end
+                end
+
+                option :mode do |o|
+                  o.type :string
+                  o.env "DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING"
+                  o.default SAFE_TRACK_USER_EVENTS_MODE
+                  o.setter do |v|
+                    if APPSEC_VALID_TRACK_USER_EVENTS_MODE.include?(v)
+                      v
+                    elsif v == "disabled"
+                      SAFE_TRACK_USER_EVENTS_MODE
+                    else
+                      Datadog.logger.warn(
+                        "The appsec.track_user_events.mode value provided is not supported." \
+                        "Supported values are: #{APPSEC_VALID_TRACK_USER_EVENTS_MODE.join(" | ")}." \
+                        "Using default value: #{SAFE_TRACK_USER_EVENTS_MODE}."
+                      )
+
+                      SAFE_TRACK_USER_EVENTS_MODE
+                    end
+                  end
+                  o.after_set do |_, _, precedence|
+                    unless precedence == Datadog::Core::Configuration::Option::Precedence::DEFAULT
+                      Core.log_deprecation(key: :appsec_track_user_events_mode) do
+                        "The appsec.track_user_events.mode setting is deprecated. " \
+                        "Please remove it from your Datadog.configure block and use " \
+                        "appsec.auto_user_instrumentation.mode instead."
+                      end
+                    end
+                  end
+                end
+              end
+
+              settings :api_security do
+                define_method(:enabled?) { get_option(:enabled) }
+
+                option :enabled do |o|
+                  o.type :bool
+                  o.env "DD_API_SECURITY_ENABLED"
+                  o.default true
+                end
+
+                settings :endpoint_collection do
+                  # Enables reporting of application routes at application start via telemetry
+                  option :enabled do |o|
+                    o.type :bool, nilable: true
+                    o.env "DD_API_SECURITY_ENDPOINT_COLLECTION_ENABLED"
+                    o.default true
+                  end
+                end
+
+                # NOTE: Unfortunately, we have to go with Float due to other libs
+                #       setup, even tho we don't plan to support sub-second delays.
+                #
+                # WARNING: The value will be converted to Integer.
+                option :sample_delay do |o|
+                  o.type :float
+                  o.env "DD_API_SECURITY_SAMPLE_DELAY"
+                  o.default 30
+                  o.setter do |value|
+                    value.to_i
+                  end
+                end
+
+                # DEV-3.0: Remove `api_security.sample_rate` option
+                option :sample_rate do |o|
+                  o.type :float
+                  o.env "DD_API_SECURITY_REQUEST_SAMPLE_RATE"
+                  o.default 0.1
+                  o.setter do |value|
+                    value = 1 if value > 1
+                    SampleRate.new(value)
+                  end
+                  o.after_set do |_, _, precedence|
+                    next if precedence == Datadog::Core::Configuration::Option::Precedence::DEFAULT
+
+                    Core.log_deprecation(key: :appsec_api_security_sample_rate) do
+                      "The appsec.api_security.sample_rate setting is deprecated. " \
+                      "Please remove it from your Datadog.configure block and use " \
+                      "appsec.api_security.sample_delay instead."
+                    end
+                  end
+                end
+
+                settings :downstream_body_analysis do
+                  option :sample_rate do |o|
+                    o.type :float
+                    o.env "DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE"
+                    o.default 0.5
+                  end
+
+                  option :max_requests do |o|
+                    o.type :int
+                    o.env "DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS"
+                    o.default 1
+                  end
+
+                  option :max_downstream_body_bytes do |o|
+                    o.type :int
+                    o.env "DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES"
+                    o.default 10_485_760
+                  end
+                end
+              end
+
+              option :sca_enabled do |o|
+                o.type :bool, nilable: true
+                o.env "DD_APPSEC_SCA_ENABLED"
+              end
+            end
+          end
+        end
+        # rubocop:enable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+      end
     end
   end
 end