datadog 2.35.0 → 2.37.0

data/ext/datadog_profiling_native_extension/ruby_helpers.c

@@ -21,42 +21,40 @@ void ruby_helpers_init(void) {
   to_s_id = rb_intern("to_s");
 }
 
-// Internal helper for raising pre-formatted syserr exceptions
-static NORETURN(void private_raise_syserr_formatted(int syserr_errno, const char *detailed_message, const char *static_message)) {
-  VALUE exception = rb_syserr_new(syserr_errno, detailed_message);
-  private_raise_exception(exception, static_message);
-}
-
 // Use `raise_syserr` the macro instead, as it provides additional argument checks.
 void private_raise_syserr(int syserr_errno, const char *fmt, ...) {
-  FORMAT_VA_ERROR_MESSAGE(detailed_message, fmt);
-  private_raise_syserr_formatted(syserr_errno, detailed_message, fmt);
+  va_list args;
+  va_start(args, fmt);
+  VALUE detailed_message = rb_vsprintf(fmt, args);
+  va_end(args);
+
+  VALUE exception = rb_syserr_new_str(syserr_errno, detailed_message);
+  private_raise_exception(exception, fmt);
 }
 
 typedef struct {
   VALUE exception_class;
   int syserr_errno;
-  char exception_message[MAX_RAISE_MESSAGE_SIZE];
-  char telemetry_message[MAX_RAISE_MESSAGE_SIZE];
+  const char *format_string;
+  va_list va_args;
 } raise_args;
 
+// Called via rb_thread_call_with_gvl from private_grab_gvl_and_raise.
+// Formats the message with rb_vsprintf (which requires the GVL) and raises.
 static void *trigger_raise(void *raise_arguments) {
   raise_args *args = (raise_args *) raise_arguments;
 
+  VALUE detailed_message = rb_vsprintf(args->format_string, args->va_args);
+
+  VALUE exception;
   if (args->syserr_errno) {
-    private_raise_syserr_formatted(
-      args->syserr_errno,
-      args->exception_message,
-      args->telemetry_message
-    );
+    exception = rb_syserr_new_str(args->syserr_errno, detailed_message);
   } else {
-    private_raise_error_formatted(
-      args->exception_class,
-      args->exception_message,
-      args->telemetry_message
-    );
+    exception = rb_exc_new_str(args->exception_class, detailed_message);
   }
 
+  private_raise_exception(exception, args->format_string);
+
   return NULL;
 }
 
@@ -71,11 +69,17 @@ void private_grab_gvl_and_raise(VALUE exception_class, int syserr_errno, const c
     args.syserr_errno = 0;
   }
 
-  FORMAT_VA_ERROR_MESSAGE(formatted_exception_message, format_string);
-  snprintf(args.exception_message, MAX_RAISE_MESSAGE_SIZE, "%s", formatted_exception_message);
-  snprintf(args.telemetry_message, MAX_RAISE_MESSAGE_SIZE, "%s", format_string);
+  args.format_string = format_string;
+  va_start(args.va_args, format_string);
 
   if (is_current_thread_holding_the_gvl()) {
+    VALUE detailed_message = rb_vsprintf(format_string, args.va_args);
+    va_end(args.va_args);
+
+    VALUE wrapped_message = rb_sprintf(
+      "grab_gvl_and_raise called by thread holding the global VM lock: %"PRIsVALUE,
+      detailed_message
+    );
     char telemetry_message[MAX_RAISE_MESSAGE_SIZE];
     snprintf(
       telemetry_message,
@@ -83,20 +87,14 @@ void private_grab_gvl_and_raise(VALUE exception_class, int syserr_errno, const c
       "grab_gvl_and_raise called by thread holding the global VM lock: %s",
       format_string
     );
-    char exception_message[MAX_RAISE_MESSAGE_SIZE];
-    snprintf(
-      exception_message,
-      MAX_RAISE_MESSAGE_SIZE,
-      "grab_gvl_and_raise called by thread holding the global VM lock: %s",
-      args.exception_message
-    );
-    VALUE exception = rb_exc_new_cstr(rb_eRuntimeError, exception_message);
+    VALUE exception = rb_exc_new_str(rb_eRuntimeError, wrapped_message);
     private_raise_exception(exception, telemetry_message);
   }
 
   rb_thread_call_with_gvl(trigger_raise, &args);
 
-  rb_bug("[ddtrace] Unexpected: Reached the end of grab_gvl_and_raise while raising '%s'\n", args.exception_message);
+  va_end(args.va_args);
+  rb_bug("[ddtrace] Unexpected: Reached the end of grab_gvl_and_raise while raising '%s'\n", format_string);
 }
 
 void private_raise_enforce_syserr(
@@ -107,10 +105,11 @@ void private_raise_enforce_syserr(
   int line,
   const char *function_name
 ) {
+  const char *format = "Failure returned by '%s' at %s:%d:in `%s'";
   if (have_gvl) {
-    rb_exc_raise(rb_syserr_new_str(syserr_errno, rb_sprintf("Failure returned by '%s' at %s:%d:in `%s'", expression, file, line, function_name)));
+    private_raise_exception(rb_syserr_new_str(syserr_errno, rb_sprintf(format, expression, file, line, function_name)), format);
   } else {
-    private_grab_gvl_and_raise(Qnil, syserr_errno, "Failure returned by '%s' at %s:%d:in `%s'", expression, file, line, function_name);
+    private_grab_gvl_and_raise(Qnil, syserr_errno, format, expression, file, line, function_name);
   }
 }
 
@@ -163,9 +162,16 @@ size_t rb_obj_memsize_of(VALUE obj);
 size_t ruby_obj_memsize_of(VALUE obj) {
   switch (rb_type(obj)) {
     case T_OBJECT:
+    // On Ruby 4.0, computing the size of a class/module/iclass seems to not be safe: `rb_obj_memsize_of` walks the
+    // per-namespace class extensions (`rb_class_classext_foreach` -> `classext_memsize` -> `rb_id_table_memsize`)
+    // and can crash the VM when called on objects tracked by heap profiling.
+    // See https://github.com/DataDog/dd-trace-rb/issues/5936. Class objects contribute negligibly to heap size,
+    // so we skip them (fall through to the `default` branch, returning 0) rather than risk a SIGSEGV.
+    #ifndef NO_SAFE_CLASS_MEMSIZE
     case T_MODULE:
     case T_CLASS:
     case T_ICLASS:
+    #endif
     case T_STRING:
     case T_ARRAY:
     case T_HASH:

data/ext/datadog_profiling_native_extension/stack_recorder.c

@@ -9,6 +9,7 @@
 #include "time_helpers.h"
 #include "heap_recorder.h"
 #include "encoded_profile.h"
+#include "collectors_thread_context.h"
 
 // Used to wrap a ddog_prof_Profile in a Ruby object and expose Ruby-level serialization APIs
 // This file implements the native bits of the Datadog::Profiling::StackRecorder class
@@ -177,6 +178,10 @@ typedef struct {
   heap_recorder *heap_recorder;
   bool heap_clean_after_gc_enabled;
 
+  // When set, _native_serialize will call thread_context_collector_on_serialize on this instance
+  // before serializing, so that threads suspended across the whole profile period still get sampled.
+  VALUE thread_context_collector_instance;
+
   pthread_mutex_t mutex_slot_one;
   profile_slot profile_slot_one;
   pthread_mutex_t mutex_slot_two;
@@ -320,6 +325,7 @@ static VALUE _native_new(VALUE klass) {
   // being leaked.
 
   state->heap_clean_after_gc_enabled = false;
+  state->thread_context_collector_instance = Qnil;
 
   ddog_prof_Slice_SampleType sample_types = {.ptr = all_sample_types, .len = ALL_VALUE_TYPES_COUNT};
 
@@ -391,6 +397,7 @@ static void initialize_profiles(stack_recorder_state *state, ddog_prof_Slice_Sam
 static void stack_recorder_typed_data_mark(void *state_ptr) {
   stack_recorder_state *state = (stack_recorder_state *) state_ptr;
 
+  rb_gc_mark(state->thread_context_collector_instance);
   heap_recorder_mark_pending_recordings(state->heap_recorder);
 }
 
@@ -515,12 +522,16 @@ static VALUE _native_serialize(DDTRACE_UNUSED VALUE _self, VALUE recorder_instan
   TypedData_Get_Struct(recorder_instance, stack_recorder_state, &stack_recorder_typed_data, state);
 
   ddog_Timespec finish_timestamp = system_epoch_now_timespec();
-  // Need to do this while still holding on to the Global VM Lock; see comments on method for why
+  // Need to do this while still holding the Global VM Lock; see comments on method for why
   serializer_set_start_timestamp_for_next_profile(state, finish_timestamp);
 
+  if (state->thread_context_collector_instance != Qnil) {
+    thread_context_collector_on_serialize(state->thread_context_collector_instance);
+  }
+
   long heap_iteration_prep_start_time_ns = monotonic_wall_time_now_ns(DO_NOT_RAISE_ON_FAILURE);
   // Prepare the iteration on heap recorder we'll be doing outside the GVL. The preparation needs to
-  // happen while holding on to the GVL.
+  // happen while holding the GVL.
   // NOTE: While rare, it's possible for the GVL to be released inside this function (see comments on `heap_recorder_update`)
   // and thus don't assume this is an "atomic" step -- other threads may get some running time in the meanwhile.
   heap_recorder_prepare_iteration(state->heap_recorder);
@@ -548,7 +559,7 @@ static VALUE _native_serialize(DDTRACE_UNUSED VALUE _self, VALUE recorder_instan
     rb_thread_call_without_gvl2(call_serialize_without_gvl, &args, NULL /* No interruption function needed in this case */, NULL /* Not needed */);
   }
 
-  // Cleanup after heap recorder iteration. This needs to happen while holding on to the GVL.
+  // Cleanup after heap recorder iteration. This needs to happen while holding the GVL.
   heap_recorder_finish_iteration(state->heap_recorder);
 
   // NOTE: We are focusing on the serialization time outside of the GVL in this stat here. This doesn't
@@ -894,6 +905,9 @@ static ddog_Timespec system_epoch_now_timespec(void) {
 //
 // Assumption: This method gets called BEFORE restarting profiling -- e.g. there are no components attempting to
 // trigger samples at the same time.
+//
+// Note that tests call this method directly in the same process without forking,
+// and in such a case non-current Threads keep running.
 static VALUE _native_reset_after_fork(DDTRACE_UNUSED VALUE self, VALUE recorder_instance) {
   stack_recorder_state *state;
   TypedData_Get_Struct(recorder_instance, stack_recorder_state, &stack_recorder_typed_data, state);
@@ -1147,3 +1161,10 @@ static VALUE _native_finalize_pending_heap_recordings(DDTRACE_UNUSED VALUE _self
 
   return Qtrue;
 }
+
+void recorder_install_on_serialize(VALUE recorder_instance, VALUE thread_context_collector_instance) {
+  stack_recorder_state *state;
+  TypedData_Get_Struct(recorder_instance, stack_recorder_state, &stack_recorder_typed_data, state);
+
+  state->thread_context_collector_instance = enforce_thread_context_collector_instance(thread_context_collector_instance);
+}

data/ext/datadog_profiling_native_extension/stack_recorder.h

@@ -29,4 +29,5 @@ void record_endpoint(VALUE recorder_instance, uint64_t local_root_span_id, ddog_
 __attribute__((warn_unused_result)) bool track_object(VALUE recorder_instance, VALUE new_object, unsigned int sample_weight, ddog_CharSlice alloc_class);
 void recorder_after_sample(VALUE recorder_instance);
 void recorder_after_gc_step(VALUE recorder_instance);
+void recorder_install_on_serialize(VALUE recorder_instance, VALUE thread_context_collector_instance);
 VALUE enforce_recorder_instance(VALUE object);

data/ext/datadog_profiling_native_extension/unsafe_api_calls_check.h

@@ -4,7 +4,7 @@
 //
 // Specifically, when the profiler is sampling, we're never supposed to call into Ruby code (e.g. methods
 // implemented using Ruby code) or allocate Ruby objects.
-// That's because those events introduce thread switch points, and really we don't the VM switching between threads
+// That's because those events introduce thread switch points, and really we don't want the VM switching between threads
 // in the middle of the profiler sampling. This includes raising exceptions.
 //
 // Raising exceptions as the very last operation, to stop the profiler is ok, but comes a caveat: raising exceptions
@@ -18,10 +18,12 @@
 // in most (all?) thread switch points, Ruby will check for interrupts and run the postponed jobs.
 //
 // Thus, if we set a flag while we're sampling (inside_unsafe_context), trigger the postponed job, and then only unset
-// the flag after sampling, he correct thing to happen is that the postponed job should never see the flag.
+// the flag after sampling, the correct thing to happen is that the postponed job should never see the flag.
 //
 // If, however, we have a bug and there's a thread switch point, our postponed job will see the flag and immediately
 // stop the Ruby VM before further damage happens (and hopefully giving us a stack trace clearly pointing to the culprit).
+//
+// Note that this check currently does not detect Ruby object allocations, as those do not check for interrupts.
 
 void unsafe_api_calls_check_init(void);
 

data/ext/libdatadog_api/datadog_ruby_common.c

@@ -29,16 +29,15 @@ void private_raise_exception(VALUE exception, const char *static_message) {
   rb_exc_raise(exception);
 }
 
-// Helper for raising pre-formatted exceptions
-void private_raise_error_formatted(VALUE exception_class, const char *detailed_message, const char *static_message) {
-  VALUE exception = rb_exc_new_cstr(exception_class, detailed_message);
-  private_raise_exception(exception, static_message);
-}
-
 // Use `raise_error` the macro instead, as it provides additional argument checks.
 void private_raise_error(VALUE exception_class, const char *fmt, ...) {
-  FORMAT_VA_ERROR_MESSAGE(detailed_message, fmt);
-  private_raise_error_formatted(exception_class, detailed_message, fmt);
+  va_list args;
+  va_start(args, fmt);
+  VALUE detailed_message = rb_vsprintf(fmt, args);
+  va_end(args);
+
+  VALUE exception = rb_exc_new_str(exception_class, detailed_message);
+  private_raise_exception(exception, fmt);
 }
 
 VALUE datadog_gem_version(void) {

data/ext/libdatadog_api/datadog_ruby_common.h

@@ -47,11 +47,6 @@ NORETURN(
   __attribute__ ((format (printf, 2, 3)));
 );
 
-// Internal helper for raising pre-formatted exceptions
-NORETURN(
-  void private_raise_error_formatted(VALUE exception_class, const char *detailed_message, const char *static_message)
-);
-
 // Raises an exception with separate telemetry-safe and detailed messages.
 // NOTE: Raising an exception always invokes Ruby code so it requires the GVL and is not compatible with "debug_enter_unsafe_context".
 // @see debug_enter_unsafe_context
@@ -61,13 +56,6 @@ NORETURN(
 
 #define MAX_RAISE_MESSAGE_SIZE 256
 
-#define FORMAT_VA_ERROR_MESSAGE(buf, fmt) \
-  char buf[MAX_RAISE_MESSAGE_SIZE]; \
-  va_list buf##_args; \
-  va_start(buf##_args, fmt); \
-  vsnprintf(buf, MAX_RAISE_MESSAGE_SIZE, fmt, buf##_args); \
-  va_end(buf##_args);
-
 // Helper to retrieve Datadog::VERSION::STRING
 VALUE datadog_gem_version(void);
 

data/ext/libdatadog_api/di.c

@@ -21,6 +21,12 @@ void rb_objspace_each_objects(
 // from standard library exception classes like NameError.
 static ID id_mesg;
 
+// ID for the fiber-local key that backs the method-probe re-entrancy guard.
+// Storage is the same hashtable that backs Thread#[] / Thread#[]=, but accessed
+// directly via rb_thread_local_aref / rb_thread_local_aset so that user-installed
+// method probes on Thread#[] / Thread#[]= cannot intercept guard reads/writes.
+static ID id_datadog_di_in_probe;
+
 // Returns whether the argument is an IMEMO of type ISEQ.
 static bool ddtrace_imemo_iseq_p(VALUE v) {
   return rb_objspace_internal_object_p(v) && RB_TYPE_P(v, T_IMEMO) && ddtrace_imemo_type(v) == IMEMO_TYPE_ISEQ;
@@ -75,6 +81,71 @@ static VALUE exception_message(DDTRACE_UNUSED VALUE _self, VALUE exception) {
   return rb_ivar_get(exception, id_mesg);
 }
 
+/*
+ * call-seq:
+ *   DI.in_probe? -> true | false
+ *
+ * Returns whether the current fiber is currently inside DI probe processing.
+ * Reads the same fiber-local storage as Thread.current[:datadog_di_in_probe]
+ * but bypasses Thread#[] method dispatch — a user method probe on Thread#[]
+ * cannot observe or intercept this call.
+ *
+ * @api private
+ */
+static VALUE in_probe_p(DDTRACE_UNUSED VALUE _self) {
+  VALUE v = rb_thread_local_aref(rb_thread_current(), id_datadog_di_in_probe);
+  return RTEST(v) ? Qtrue : Qfalse;
+}
+
+/*
+ * call-seq:
+ *   DI.enter_probe -> nil
+ *
+ * Marks the current fiber as inside DI probe processing. Writes to the same
+ * fiber-local storage as Thread.current[:datadog_di_in_probe] = true, but
+ * bypasses Thread#[]= method dispatch — a user method probe on Thread#[]=
+ * cannot observe or intercept this call.
+ *
+ * @api private
+ */
+static VALUE enter_probe(DDTRACE_UNUSED VALUE _self) {
+  rb_thread_local_aset(rb_thread_current(), id_datadog_di_in_probe, Qtrue);
+  return Qnil;
+}
+
+/*
+ * call-seq:
+ *   DI.leave_probe -> nil
+ *
+ * Marks the current fiber as no longer inside DI probe processing. Writes to
+ * the same fiber-local storage as Thread.current[:datadog_di_in_probe] = nil,
+ * but bypasses Thread#[]= method dispatch — a user method probe on Thread#[]=
+ * cannot observe or intercept this call.
+ *
+ * @api private
+ */
+static VALUE leave_probe(DDTRACE_UNUSED VALUE _self) {
+  rb_thread_local_aset(rb_thread_current(), id_datadog_di_in_probe, Qnil);
+  return Qnil;
+}
+
+/*
+ * call-seq:
+ *   DI.hash?(obj) -> true | false
+ *
+ * Returns whether the given object is a Hash via a direct type check
+ * (RB_TYPE_P), bypassing Kernel#is_a? method dispatch. Used in the method
+ * probe wrapper (the Ruby < 3 argument-serialization split) to test whether
+ * the trailing argument is a hash without giving a user-installed method
+ * probe on Kernel#is_a? a chance to recurse. Matches Hash and its
+ * subclasses, like is_a?(Hash), since their instances are still T_HASH.
+ *
+ * @api private
+ */
+static VALUE is_hash(DDTRACE_UNUSED VALUE _self, VALUE obj) {
+  return RB_TYPE_P(obj, T_HASH) ? Qtrue : Qfalse;
+}
+
 // rb_iseq_type was added in Ruby 3.1 (commit 89a02d89 by Koichi Sasada,
 // 2021-12-19). It returns the iseq type as a Symbol. On Ruby < 3.1 this
 // function does not exist, so have_func('rb_iseq_type') in extconf.rb
@@ -117,10 +188,15 @@ static VALUE iseq_type(DDTRACE_UNUSED VALUE _self, VALUE iseq_val) {
 
 void di_init(VALUE datadog_module) {
   id_mesg = rb_intern("mesg");
+  id_datadog_di_in_probe = rb_intern("datadog_di_in_probe");
 
   VALUE di_module = rb_define_module_under(datadog_module, "DI");
   rb_define_singleton_method(di_module, "all_iseqs", all_iseqs, 0);
   rb_define_singleton_method(di_module, "exception_message", exception_message, 1);
+  rb_define_singleton_method(di_module, "in_probe?", in_probe_p, 0);
+  rb_define_singleton_method(di_module, "enter_probe", enter_probe, 0);
+  rb_define_singleton_method(di_module, "leave_probe", leave_probe, 0);
+  rb_define_singleton_method(di_module, "hash?", is_hash, 1);
 #ifdef HAVE_RB_ISEQ_TYPE
   rb_define_singleton_method(di_module, "iseq_type", iseq_type, 1);
 #endif

data/ext/libdatadog_api/extconf.rb

@@ -41,6 +41,12 @@ Datadog::LibdatadogExtconfHelpers.dump_mkmf_log_on_failure!
 # But we can enable it in CI, so that we quickly spot any new warnings that just got introduced.
 append_cflags '-Werror' if ENV['DATADOG_GEM_CI'] == 'true'
 
+# TEMPORARY STOPGAP: libdatadog v36's vendored `common.h` ships duplicate typedefs
+# (a header-dedup regression), which `-Werror` turns into fatal
+# `-Wtypedef-redefinition` errors under C11/gnu11. Keep it a warning until a fixed
+# header lands upstream in libdatadog/libdatadog-rb. Remove this once that ships.
+append_cflags '-Wno-error=typedef-redefinition' if ENV['DATADOG_GEM_CI'] == 'true'
+
 # Older gcc releases may not default to C99 and we need to ask for this. This is also used:
 # * by upstream Ruby -- search for gnu99 in the codebase
 # * by msgpack, another datadog gem dependency

data/ext/libdatadog_extconf_helpers.rb

@@ -10,7 +10,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = '~> 33.0.0.1.0'
+    LIBDATADOG_VERSION = '~> 36.0.0.1.0'
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.

data/lib/datadog/ai_guard/api_client.rb

@@ -17,11 +17,13 @@ module Datadog
 
         @endpoint_uri = if endpoint
           URI(endpoint) #: URI::HTTP
+        elsif Datadog.configuration.site
+          host = Datadog.configuration.site.dup
+          host.prepend("app.") if host.count(".") == 1
+
+          URI::HTTPS.build(host: host, path: DEFAULT_PATH)
         else
-          URI::HTTPS.build(
-            host: Datadog.configuration.site || DEFAULT_SITE,
-            path: DEFAULT_PATH
-          )
+          URI::HTTPS.build(host: DEFAULT_SITE, path: DEFAULT_PATH)
         end
 
         @headers = {

data/lib/datadog/appsec/api_security/route_extractor.rb

@@ -31,16 +31,19 @@ module Datadog
         #         uses `sinatra.route` with a string like "GET /users/:id"
         #       Grape
         #         uses `grape.routing_args` with a hash with a `:route_info` key
-        #         that contains a `Grape::Router::Route` object that contains
-        #         `Grape::Router::Pattern` object with an `origin` method
+        #         that contains a {Grape::Router::Route} object that contains
+        #         {Grape::Router::Pattern} object with an `origin` method
+        #       Rails with `action_pack` tracing contrib (fast path)
+        #         `datadog.action_dispatch.route` stores the {Journey::Route}
+        #         object set by the tracer at routing time
         #       Rails < 7.1 (slow path)
-        #         uses `action_dispatch.routes` to store `ActionDispatch::Routing::RouteSet`
+        #         uses `action_dispatch.routes` to store {ActionDispatch::Routing::RouteSet}
         #         which can recognize requests
         #       Rails > 7.1 (fast path)
         #         uses `action_dispatch.route_uri_pattern` with a string like
         #         "/users/:id(.:format)"
         #       Rails > 8.1.1 (fast path)
-        #         uses `action_dispatch.route` to store the ActionDispatch::Journey::Route
+        #         uses `action_dispatch.route` to store the {ActionDispatch::Journey::Route}
         #         that matched when the request was routed
         #
         # WARNING: This method works only *after* the request has been routed.
@@ -50,6 +53,12 @@ module Datadog
         #          In Rails < 7.1 it also will not be set even if a route was found,
         #          but in this case `action_dispatch.request.path_parameters` won't be empty.
         def self.route_pattern(request)
+          # NOTE: Requests from contribs like AWS Lambda don't provide a usable
+          #       `::Rack::Request#env`, so infer the route from the path instead
+          unless request.respond_to?(:env)
+            return Tracing::Contrib::Rack::RouteInference.infer(request.path.to_s)
+          end
+
           if request.env.key?(GRAPE_ROUTE_KEY)
             pattern = request.env[GRAPE_ROUTE_KEY][:route_info]&.pattern&.origin
             "#{request.script_name}#{pattern}"

data/lib/datadog/appsec/component.rb

@@ -22,7 +22,7 @@ module Datadog
             return
           end
 
-          if Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('3.3') && ffi_version < Gem::Version.new('1.16.0')
+          if RubyVersion.is?('>= 3.3') && ffi_version < Gem::Version.new('1.16.0')
             Datadog.logger.warn(
               'AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, ' \
               'and will be forcibly disabled due to a memory leak in `ffi`. ' \

data/lib/datadog/appsec/configuration.rb

@@ -134,6 +134,13 @@ module Datadog
                 end
               end
 
+              # NOTE: A value of 0 (or less) disables request body collection
+              option :body_parsing_size_limit do |o|
+                o.type :int
+                o.env 'DD_APPSEC_BODY_PARSING_SIZE_LIMIT' # bytes
+                o.default 10_485_760
+              end
+
               option :waf_debug do |o|
                 o.env 'DD_APPSEC_WAF_DEBUG'
                 o.default false
@@ -407,6 +414,12 @@ module Datadog
                     o.env 'DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS'
                     o.default 1
                   end
+
+                  option :max_downstream_body_bytes do |o|
+                    o.type :int
+                    o.env 'DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES'
+                    o.default 10_485_760
+                  end
                 end
               end
 

data/lib/datadog/appsec/context.rb

@@ -20,7 +20,7 @@ module Datadog
       ActiveContextError = Class.new(StandardError) # steep:ignore IncompatibleAssignment
 
       # TODO: add delegators for active trace span
-      attr_reader :trace, :span
+      attr_reader :trace, :span, :metrics
 
       # Shared mutable storage for counters, flags, and data accumulated during
       # the request's lifecycle.
@@ -103,7 +103,8 @@ module Datadog
       end
 
       def extract_schema!
-        waf_result = @waf_runner.run({'waf.context.processor' => {'extract-schema' => true}}, {})
+        persistent_data = {'waf.context.processor' => {'extract-schema' => true}}
+        waf_result = run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
         security_event = AppSec::SecurityEvent.new(waf_result, trace: trace, span: span)
 
         @state[:schema_extracted] = security_event.schema?
@@ -116,6 +117,7 @@ module Datadog
 
         Metrics::Exporter.export_waf_metrics(@metrics.waf, @span)
         Metrics::Exporter.export_rasp_metrics(@metrics.rasp, @span)
+        Metrics::Exporter.export_downstream_response_metrics(@metrics.downstream_responses, @span)
       end
 
       def export_request_telemetry

data/lib/datadog/appsec/contrib/aws_lambda/waf_addresses.rb

@@ -15,6 +15,10 @@ module Datadog
         # Extracts WAF input addresses from normalized AWS Lambda API Gateway event payloads.
         # @api private
         module WAFAddresses
+          BASE64_CHARS_PER_GROUP = 4
+          BASE64_BYTES_PER_GROUP = 3
+          BASE64_PADDING_BYTE = "=".ord
+
           module_function
 
           def from_request(payload)
@@ -27,10 +31,11 @@ module Datadog
               'server.request.uri.raw' => build_fullpath(payload),
               'server.request.headers' => headers,
               'server.request.headers.no_cookies' => headers.dup.tap { |h| h.delete('cookie') },
-              'http.client_ip' => extract_client_ip(payload['source_ip'], headers),
               'server.request.method' => payload['method'],
               'server.request.body' => parse_body(payload, headers),
-              'server.request.path_params' => payload['path_params']
+              'server.request.body.byte_length' => body_byte_length(payload),
+              'server.request.path_params' => payload['path_params'],
+              'http.client_ip' => extract_client_ip(payload['source_ip'], headers)
             }
 
             data.compact!
@@ -44,7 +49,9 @@ module Datadog
             data = {
               'server.response.status' => payload['status_code']&.to_s,
               'server.response.headers' => headers,
-              'server.response.headers.no_cookies' => headers.dup.tap { |h| h.delete('set-cookie') }
+              'server.response.headers.no_cookies' => headers.dup.tap { |h| h.delete('set-cookie') },
+              'server.response.body' => parse_body(payload, headers),
+              'server.response.body.byte_length' => body_byte_length(payload)
             }
 
             data.compact!
@@ -94,7 +101,9 @@ module Datadog
             body = payload['body']
             return unless body
 
-            body = Core::Utils::Base64Codec.strict_decode64(body) if payload['base64_encoded']
+            if (byte_length = body_byte_length(payload))
+              return if byte_length > Datadog.configuration.appsec.body_parsing_size_limit
+            end
 
             content_type = headers['content-type']
             return unless content_type
@@ -102,7 +111,31 @@ module Datadog
             media_type = AppSec::Utils::HTTP::MediaType.parse(content_type)
             return unless media_type
 
+            body = Core::Utils::Base64Codec.strict_decode64(body) if payload['base64_encoded']
             AppSec::Utils::HTTP::Body.parse(body, media_type: media_type)
+          rescue ArgumentError => e
+            AppSec.telemetry.report(e, description: 'AppSec: Failed to decode base64 body')
+
+            nil
+          end
+
+          def body_byte_length(payload)
+            body = payload['body']
+
+            return unless body
+            return body.bytesize unless payload['base64_encoded']
+
+            # NOTE: Base64 packs every 3 bytes into 4 characters and pads the last
+            #       group with up to two "=" bytes. The decoded length is therefore
+            #       derivable from the encoded length, letting us measure the raw
+            #       body size without allocating the decoded string.
+            padding = 0
+            if body.getbyte(-1) == BASE64_PADDING_BYTE
+              padding = 1
+              padding = 2 if body.getbyte(-2) == BASE64_PADDING_BYTE
+            end
+
+            body.bytesize / BASE64_CHARS_PER_GROUP * BASE64_BYTES_PER_GROUP - padding
           end
         end
       end