datadog 2.30.0 → 2.45.0

data/lib/datadog/appsec/contrib/rack/input_peeker.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+
+require "stringio"
+require_relative "buffered_input"
+require_relative "../../utils/http/body_reader"
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Peeks at `rack.input` without changing what downstream Rack code can read
+        #
+        # @api private
+        module InputPeeker
+          module_function
+
+          # Peeks at `env['rack.input']` and returns the body bytesize when it
+          # can be measured within the given limit
+          #
+          # NOTE: Over-limit bodies cannot be fully measured, so returning `nil`
+          #       is the tradeoff we accept
+          #
+          # WARNING: For forward-only input, replaces `env['rack.input']` with a
+          #          replay stream over the peeked bytes, preserving the rest
+          #          of the original stream
+          #
+          # @param env [Hash] Rack environment
+          # @param limit [Integer] Maximum body bytesize to measure
+          # @return [Integer, nil] `Integer` bytesize when measured within
+          #   `limit`, including `0`; `nil` when input is missing, over the
+          #   limit, or cannot be preserved for downstream reads
+          def peek_bytesize(env, limit:)
+            rack_input = env["rack.input"]
+            return unless rack_input
+
+            rewindable = rewind? && rack_input.respond_to?(:rewind)
+
+            # NOTE: Rack 2 requires `rack.input` to be rewindable. Rewind before peeking
+            #       in case an upstream framework already consumed part of the stream
+            return if rewindable && !rewind(rack_input)
+
+            # NOTE: Read one byte past the limit to distinguish an exact-limit body
+            #       from an over-limit body without reading the whole stream.
+            buffer = Utils::HTTP::BodyReader.read_stream(rack_input, limit: limit)
+            over_limit = buffer.bytesize > limit
+
+            if rewindable
+              # NOTE: If we cannot rewind after peeking, downstream code would observe
+              #       a partially consumed body. Treat it as not safely collectable
+              return unless rewind(rack_input)
+            else
+              env["rack.input"] = if over_limit
+                BufferedInput.new(rack_input, buffer: StringIO.new(buffer))
+              else
+                StringIO.new(buffer)
+              end
+            end
+
+            over_limit ? nil : buffer.bytesize
+          end
+
+          private_class_method def rewind?
+            return @rewind if defined?(@rewind)
+
+            @rewind = ::Gem::Version.new(::Rack.release) < ::Gem::Version.new("3")
+          end
+
+          private_class_method def rewind(io)
+            io.rewind
+            true
+          rescue => e
+            Datadog.logger.debug { "AppSec: Failed to rewind `rack.input`: #{e.class}: #{e.message}" }
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/integration.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
+require_relative "../integration"
 
-require_relative 'patcher'
-require_relative 'request_middleware'
-require_relative 'request_body_middleware'
+require_relative "patcher"
+require_relative "request_middleware"
+require_relative "request_body_middleware"
 
 module Datadog
   module AppSec
@@ -14,12 +14,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('1.1.0')
+          MINIMUM_VERSION = Gem::Version.new("1.1.0")
 
           register_as :rack, auto_patch: false
 
           def self.version
-            Gem.loaded_specs['rack']&.version
+            Gem.loaded_specs["rack"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/rack/patcher.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../monitor'
-require_relative 'gateway/watcher'
+require_relative "../../monitor"
+require_relative "gateway/watcher"
 
 module Datadog
   module AppSec
@@ -12,7 +12,7 @@ module Datadog
           module_function
 
           def patched?
-            Patcher.instance_variable_get(:@patched) # TODO: Patcher.flag_patched
+            !!Patcher.instance_variable_get(:@patched) # TODO: Patcher.flag_patched
           end
 
           def target_version

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative 'gateway/request'
-require_relative '../../instrumentation/gateway'
-require_relative '../../response'
+require_relative "gateway/request"
+require_relative "../../instrumentation/gateway"
+require_relative "../../response"
 
 module Datadog
   module AppSec
@@ -12,7 +12,8 @@ module Datadog
         # This should be inserted just below Rack::JSONBodyParser or
         # legacy Rack::PostBodyContentTypeParser from rack-contrib
         class RequestBodyMiddleware
-          def initialize(app, opt = {})
+          # TODO: opt is never used, it can probably be safely removed
+          def initialize(app, opt = {}) # steep:ignore DifferentMethodParameterKind
             @app = app
           end
 
@@ -23,18 +24,20 @@ module Datadog
 
             # TODO: handle exceptions, except for @app.call
 
-            http_response = nil
+            http_response = nil #: Rack::response?
             interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
-              http_response, _request = Instrumentation.gateway.push('rack.request.body', Gateway::Request.new(env)) do
+              http_response, _request = Instrumentation.gateway.push("rack.request.body", Gateway::Request.new(env)) do
                 @app.call(env)
               end
 
               nil
             end
 
-            return AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack if interrupt_params
+            return AppSec::Response.from_interrupt_params(interrupt_params, env["HTTP_ACCEPT"]).to_rack if interrupt_params
 
-            http_response
+            # Steep can't see that the catch block always populates http_response
+            # when no interrupt is thrown.
+            http_response #: Rack::response
           end
         end
       end

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -1,42 +1,27 @@
 # frozen_string_literal: true
 
-require 'json'
+require "json"
 
-require_relative 'response_body'
-require_relative 'gateway/request'
-require_relative 'gateway/response'
+require_relative "response_body"
+require_relative "gateway/request"
+require_relative "gateway/response"
 
-require_relative '../../event'
-require_relative '../../response'
-require_relative '../../api_security'
-require_relative '../../security_event'
-require_relative '../../instrumentation/gateway'
+require_relative "../../event"
+require_relative "../../response"
+require_relative "../../api_security"
+require_relative "../../default_header_tags"
+require_relative "../../route_normalizer"
+require_relative "../../security_event"
+require_relative "../../instrumentation/gateway"
 
-require_relative '../../../tracing/client_ip'
-require_relative '../../../tracing/contrib/rack/header_collection'
+require_relative "../../../core/header_collection"
+require_relative "../../../tracing/client_ip"
+require_relative "../../../tracing/contrib/rack/header_collection"
 
 module Datadog
   module AppSec
     module Contrib
       module Rack
-        RESPONSE_HEADERS_TAGS = %w[
-          content-length
-          content-type
-          content-encoding
-          content-language
-        ].freeze
-
-        WAF_VENDOR_HEADERS_TAGS = %w[
-          X-Amzn-Trace-Id
-          Cloudfront-Viewer-Ja3-Fingerprint
-          Cf-Ray
-          X-Cloud-Trace-Context
-          X-Appgw-Trace-id
-          X-SigSci-RequestID
-          X-SigSci-Tags
-          Akamai-User-Risk
-        ].map(&:downcase).freeze
-
         # Topmost Rack middleware for AppSec
         # This should be inserted just below Datadog::Tracing::Contrib::Rack::TraceMiddleware
         class RequestMiddleware
@@ -44,7 +29,6 @@ module Datadog
             @app = app
 
             @oneshot_tags_sent = false
-            @rack_headers = {}
           end
 
           # rubocop:disable Metrics/MethodLength
@@ -79,7 +63,7 @@ module Datadog
             interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
               # TODO: This event should be renamed into `rack.request.start` to
               #       reflect that it's the beginning of the request-cycle
-              http_response, _gateway_request = Instrumentation.gateway.push('rack.request', gateway_request) do
+              http_response, _gateway_request = Instrumentation.gateway.push("rack.request", gateway_request) do
                 @app.call(env)
               end
 
@@ -87,15 +71,17 @@ module Datadog
                 http_response[2], http_response[0], http_response[1], context: ctx
               )
 
-              Instrumentation.gateway.push('rack.request.finish', gateway_request)
-              Instrumentation.gateway.push('rack.response', gateway_response)
+              Instrumentation.gateway.push("rack.request.finish", gateway_request)
+              Instrumentation.gateway.push("rack.response", gateway_response)
 
               nil
             end
 
+            add_normalized_route_tag(ctx, env)
+
             if interrupt_params
               ctx.mark_as_interrupted!
-              http_response = AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack
+              http_response = AppSec::Response.from_interrupt_params(interrupt_params, env["HTTP_ACCEPT"]).to_rack
             end
 
             # NOTE: This is not optimal, but in the current implementation
@@ -162,18 +148,18 @@ module Datadog
             return unless trace && span
 
             span.set_metric(Datadog::AppSec::Ext::TAG_APPSEC_ENABLED, 1)
-            span.set_tag('_dd.runtime_family', 'ruby')
-            span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
+            span.set_tag("_dd.runtime_family", "ruby")
+            span.set_tag("_dd.appsec.waf.version", Datadog::AppSec::WAF::VERSION::BASE_STRING)
 
             if context.waf_runner_ruleset_version
-              span.set_tag('_dd.appsec.event_rules.version', context.waf_runner_ruleset_version)
+              span.set_tag("_dd.appsec.event_rules.version", context.waf_runner_ruleset_version)
 
               unless oneshot_tags_sent?
                 # Small race condition, but it's inoccuous: worst case the tags
                 # are sent a couple of times more than expected
                 @oneshot_tags_sent = true
 
-                span.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(context.waf_runner_known_addresses))
+                span.set_tag("_dd.appsec.event_rules.addresses", JSON.dump(context.waf_runner_known_addresses))
 
                 # Ensure these tags reach the backend
                 trace.keep!
@@ -186,51 +172,55 @@ module Datadog
           end
           # standard:enable Metrics/MethodLength
 
-          # standard:disable Metrics/MethodLength
           def add_request_tags(context, env)
             span = context.span
             return unless span
 
-            # Always add WAF vendors headers
-            WAF_VENDOR_HEADERS_TAGS.each do |lowercase_header|
-              rack_header = to_rack_header(lowercase_header)
-              span.set_tag("http.request.headers.#{lowercase_header}", env[rack_header]) if env[rack_header]
-            end
-
-            if span && span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
-              request_header_collection = Datadog::Tracing::Contrib::Rack::Header::RequestHeaderCollection.new(env)
+            headers = Tracing::Contrib::Rack::Header::RequestHeaderCollection.new(env)
+            AppSec::DefaultHeaderTags.tag_request(span, headers)
 
+            if span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
               # always collect client ip, as this is part of AppSec provided functionality
               Datadog::Tracing::ClientIp.set_client_ip_tag!(
-                span,
-                headers: request_header_collection,
-                remote_ip: env['REMOTE_ADDR']
+                span, headers: headers, remote_ip: env["REMOTE_ADDR"]
               )
             end
           end
-          # standard:enable Metrics/MethodLength
 
           def add_response_tags(context, response)
             span = context.span
             return unless span
 
-            RESPONSE_HEADERS_TAGS.each do |name|
-              value = response.headers[name]
-              span.set_tag("http.response.headers.#{name}", value.to_s) if value
-            end
+            AppSec::DefaultHeaderTags.tag_response(
+              span, Datadog::Core::HeaderCollection.from_hash(response.headers)
+            )
 
-            unless response.headers.key?('content-length')
+            unless response.headers.key?("content-length")
               length = ResponseBody.content_length(response.body)
-              span.set_tag('http.response.headers.content-length', length.to_s) if length
+              span.set_tag("http.response.headers.content-length", length.to_s) if length
             end
           end
 
-          def oneshot_tags_sent?
-            @oneshot_tags_sent
+          def add_normalized_route_tag(context, env)
+            return unless AppSec::APISecurity.enabled?
+
+            span = context.span
+            return unless span
+
+            pattern = context.trace&.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE)
+            return unless pattern
+
+            # NOTE: To build full path that covers mounted engines we need to add
+            #       pre-computed by Tracer route path tag to the normalized route
+            prefix = context.trace&.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH) || env["SCRIPT_NAME"]
+            normalized_route = RouteNormalizer.extract_normalized_route(env, prefix: prefix, pattern: pattern)
+            return unless normalized_route
+
+            span.set_tag(AppSec::Ext::TAG_NORMALIZED_ROUTE, "#{prefix}#{normalized_route}")
           end
 
-          def to_rack_header(header)
-            @rack_headers[header] ||= Datadog::Tracing::Contrib::Rack::Header.to_rack_header(header)
+          def oneshot_tags_sent?
+            @oneshot_tags_sent
           end
         end
       end

data/lib/datadog/appsec/contrib/rack/response_body.rb

@@ -25,7 +25,7 @@ module Datadog
 
             body_ary.sum { |part| part.is_a?(String) ? part.bytesize : 0 }
           rescue => e
-            AppSec.telemetry.report(e, description: 'AppSec: Failed to compute body content length')
+            AppSec.telemetry.report(e, description: "AppSec: Failed to compute body content length")
 
             nil
           end

data/lib/datadog/appsec/contrib/rails/gateway/request.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../../instrumentation/gateway/argument'
+require_relative "../../rack/input_peeker"
+require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
   module AppSec
@@ -43,22 +44,60 @@ module Datadog
               # usually Hash<String,String> but can be a more complex
               # Hash<String,String||Array||Hash> when e.g coming from JSON or
               # with Rails advanced param square bracket parsing
-              body = request.env['action_dispatch.request.request_parameters']
+              body = request.env["action_dispatch.request.request_parameters"]
 
               return if body.nil?
+              return body unless request.env["action_dispatch.request.path_parameters"]
 
               body.reject do |k, _v|
-                request.env['action_dispatch.request.path_parameters'].key?(k)
+                request.env["action_dispatch.request.path_parameters"].key?(k)
               end
+            rescue => e
+              Datadog.logger.debug { "AppSec: Failed to parse request body: #{e.class}: #{e.message}" }
+              AppSec.telemetry.report(e, description: "AppSec: Failed to parse request body")
+
+              nil
             end
 
             def route_params
               excluded = [:controller, :action]
 
-              request.env['action_dispatch.request.path_parameters'].reject do |k, _v|
+              request.env.fetch("action_dispatch.request.path_parameters", {}).reject do |k, _v|
                 excluded.include?(k)
               end
             end
+
+            # Returns the request body size in bytes using all available methods,
+            # or nil when the size cannot be measured within the limit
+            #
+            # NOTE: The priority of the measurement is the following:
+            #       raw posted data, raw form vars, size if known, raw
+            #       Content-Length, then buffering to the limit if unknown-length
+            def body_bytesize(limit)
+              raw_body = env["RAW_POST_DATA"]
+              return raw_body.bytesize if raw_body
+
+              form_vars = env["rack.request.form_vars"]
+              return form_vars.bytesize if form_vars
+
+              io = request.body
+              return 0 unless io
+              return io.size if io.respond_to?(:size)
+
+              # NOTE: Read raw `CONTENT_LENGTH` as {ActionDispatch::Request#content_length}
+              #       drains `rack.input` into `RAW_POST_DATA` on chunked Transfer-Encoding
+              content_length = env["CONTENT_LENGTH"]
+              return content_length.to_i if content_length
+
+              # NOTE: An already-read body (e.g. late-parsed multipart on Rack 3+) peeks
+              #       as 0, so we skip byte_length but still collect the parsed body
+              begin
+                Rack::InputPeeker.peek_bytesize(env, limit: limit)
+              rescue => e
+                Datadog.logger.debug { "AppSec: Failed to measure Rails request body: #{e.class}: #{e.message}" }
+                nil
+              end
+            end
           end
         end
       end

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../../../event'
-require_relative '../../../trace_keeper'
-require_relative '../../../security_event'
-require_relative '../../../instrumentation/gateway'
+require_relative "../../../event"
+require_relative "../../../trace_keeper"
+require_relative "../../../security_event"
+require_relative "../../../instrumentation/gateway"
 
 module Datadog
   module AppSec
@@ -21,14 +21,30 @@ module Datadog
               end
 
               def watch_request_action(gateway = Instrumentation.gateway)
-                gateway.watch('rails.request.action') do |stack, gateway_request|
+                gateway.watch("rails.request.action") do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
 
                   persistent_data = {
-                    'server.request.body' => gateway_request.parsed_body,
-                    'server.request.path_params' => gateway_request.route_params
+                    "server.request.path_params" => gateway_request.route_params,
                   }
 
+                  unless limit.zero?
+                    byte_length = gateway_request.body_bytesize(limit)
+
+                    if byte_length
+                      # NOTE: Params may be parsed before this hook, leaving the
+                      #       body stream at EOF. Keep byte_length unset for that
+                      #       case, but still inspect cached params
+                      persistent_data["server.request.body.byte_length"] = byte_length if byte_length.positive?
+
+                      if byte_length <= limit
+                        body = gateway_request.parsed_body
+                        persistent_data["server.request.body"] = body unless body.nil? || body.empty?
+                      end
+                    end
+                  end
+
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
                   if result.match?
@@ -47,11 +63,11 @@ module Datadog
               end
 
               def watch_response_body_json(gateway = Instrumentation.gateway)
-                gateway.watch('rails.response.body.json') do |stack, container|
+                gateway.watch("rails.response.body.json") do |stack, container|
                   context = container.context
 
                   persistent_data = {
-                    'server.response.body' => container.data
+                    "server.response.body" => container.data,
                   }
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 

data/lib/datadog/appsec/contrib/rails/integration.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
+require_relative "../integration"
 
-require_relative 'patcher'
-require_relative 'request_middleware'
+require_relative "patcher"
+require_relative "request_middleware"
 
 module Datadog
   module AppSec
@@ -13,12 +13,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('4')
+          MINIMUM_VERSION = Gem::Version.new("4")
 
           register_as :rails, auto_patch: false
 
           def self.version
-            Gem.loaded_specs['railties']&.version
+            Gem.loaded_specs["railties"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -1,18 +1,18 @@
 # frozen_string_literal: true
 
-require_relative '../../../core/utils/only_once'
+require_relative "../../../core/utils/only_once"
 
-require_relative 'framework'
-require_relative '../../response'
-require_relative '../rack/request_middleware'
-require_relative '../rack/request_body_middleware'
-require_relative 'gateway/watcher'
-require_relative 'gateway/request'
-require_relative 'patches/render_to_body_patch'
-require_relative 'patches/process_action_patch'
-require_relative '../../api_security/endpoint_collection/rails_collector'
+require_relative "framework"
+require_relative "../../response"
+require_relative "../rack/request_middleware"
+require_relative "../rack/request_body_middleware"
+require_relative "gateway/watcher"
+require_relative "gateway/request"
+require_relative "patches/render_to_body_patch"
+require_relative "patches/process_action_patch"
+require_relative "../../api_security/endpoint_collection/rails_collector"
 
-require_relative '../../../tracing/contrib/rack/middlewares'
+require_relative "../../../tracing/contrib/rack/middlewares"
 
 module Datadog
   module AppSec
@@ -108,7 +108,7 @@ module Datadog
           end
 
           def inspect_middlewares(app)
-            Datadog.logger.debug { +'Rails middlewares: ' << app.middleware.map(&:inspect).inspect }
+            Datadog.logger.debug { +"Rails middlewares: " << app.middleware.map(&:inspect).inspect }
           end
 
           def patch_after_initialize
@@ -133,11 +133,11 @@ module Datadog
               end
 
               # Rails 7.1 adds `after_routes_loaded` hook
-              if Datadog::AppSec::Contrib::Rails::Patcher.target_version < Gem::Version.new('7.1')
+              if Datadog::AppSec::Contrib::Rails::Patcher.target_version < Gem::Version.new("7.1")
                 Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(::Rails.application.routes.routes)
               end
             rescue => e
-              error_message = 'Failed to get application routes'
+              error_message = "Failed to get application routes"
               Datadog.logger.error("#{error_message}, #{e.class}: #{e.message}")
               AppSec.telemetry.report(e, description: error_message)
             end
@@ -147,7 +147,7 @@ module Datadog
             ::ActiveSupport.on_load(:after_routes_loaded) do
               Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(::Rails.application.routes.routes)
             rescue => e
-              error_message = 'Failed to get application routes'
+              error_message = "Failed to get application routes"
               Datadog.logger.error("#{error_message}, #{e.class}: #{e.message}")
               AppSec.telemetry.report(e, description: error_message)
             end
@@ -156,7 +156,7 @@ module Datadog
           def report_routes_via_telemetry(routes)
             # We do not support Rails 4.x for Endpoint Collection,
             # mainly because the Route#verb was a Regexp before Rails 5.0
-            return if target_version < Gem::Version.new('5.0')
+            return if target_version < Gem::Version.new("5.0")
             return unless Datadog.configuration.appsec.api_security.endpoint_collection.enabled
             return unless AppSec.telemetry
 
@@ -166,7 +166,7 @@ module Datadog
               )
             end
           rescue => e
-            AppSec.telemetry&.report(e, description: 'failed to report application endpoints')
+            AppSec.telemetry&.report(e, description: "failed to report application endpoints")
           end
 
           def setup_security

data/lib/datadog/appsec/contrib/rails/patches/process_action_patch.rb

@@ -11,11 +11,11 @@ module Datadog
               context = request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
               return super unless context
 
-              context.state[:web_framework] = 'rails'
+              context.state[:web_framework] = "rails"
 
               # TODO: handle exceptions, except for super
               gateway_request = Gateway::Request.new(request)
-              http_response, _gateway_request = Instrumentation.gateway.push('rails.request.action', gateway_request) do
+              http_response, _gateway_request = Instrumentation.gateway.push("rails.request.action", gateway_request) do
                 super
               end
 

data/lib/datadog/appsec/contrib/rails/patches/render_to_body_patch.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../../utils/hash_coercion'
-require_relative '../../../instrumentation/gateway/argument'
+require_relative "../../../utils/hash_coercion"
+require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
   module AppSec
@@ -21,7 +21,7 @@ module Datadog
               return super unless data
 
               container = Instrumentation::Gateway::DataContainer.new(data, context: context)
-              Instrumentation.gateway.push('rails.response.body.json', container)
+              Instrumentation.gateway.push("rails.response.body.json", container)
 
               super
             end