datadog 2.36.0 → 2.40.0

data/lib/datadog/appsec/security_engine/runner.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'result'
+require_relative "result"
 
 module Datadog
   module AppSec
@@ -80,7 +80,7 @@ module Datadog
           waf_context.run(persistent_data, ephemeral_data, timeout)
         rescue WAF::LibDDWAFError => e
           Datadog.logger.debug { "#{@debug_tag} execution error: #{e.class}: #{e.message} backtrace: #{e.backtrace&.first(3)}" }
-          AppSec.telemetry.report(e, description: 'libddwaf-rb internal low-level error')
+          AppSec.telemetry.report(e, description: "libddwaf-rb internal low-level error")
 
           WAF::Result.new(
             status: :err_internal,

data/lib/datadog/appsec/security_event.rb

@@ -6,8 +6,8 @@ module Datadog
     # representing an attack or fingerprinting results as attributes or an API
     # security check with extracted schema.
     class SecurityEvent
-      SCHEMA_KEY_PREFIX = '_dd.appsec.s.'
-      FINGERPRINT_KEY_PREFIX = '_dd.appsec.fp.'
+      SCHEMA_KEY_PREFIX = "_dd.appsec.s."
+      FINGERPRINT_KEY_PREFIX = "_dd.appsec.fp."
 
       attr_reader :waf_result, :trace, :span
 

data/lib/datadog/appsec/utils/http/body.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require 'json'
-require 'cgi'
+require "json"
+require "cgi"
 
-require_relative 'url_encoded'
+require_relative "url_encoded"
 
 module Datadog
   module AppSec
@@ -11,7 +11,10 @@ module Datadog
       module HTTP
         # Module for handling HTTP body parsing
         module Body
-          def self.parse(body, media_type:)
+          # Matches Rack's default query bytesize limit
+          DEFAULT_BYTESIZE_LIMIT = 4 * 1024 * 1024
+
+          def self.parse(body, media_type:, limit: DEFAULT_BYTESIZE_LIMIT)
             return if body.nil?
 
             body.rewind if body.respond_to?(:rewind) # steep:ignore NoMethod
@@ -21,13 +24,13 @@ module Datadog
 
             return if content.nil? || content.empty?
 
-            if media_type.subtype == 'json' || media_type.subtype.end_with?('+json')
+            if media_type.subtype == "json" || media_type.subtype.end_with?("+json")
               JSON.parse(content)
-            elsif media_type.subtype == 'x-www-form-urlencoded'
-              URLEncoded.parse(content)
+            elsif media_type.subtype == "x-www-form-urlencoded"
+              URLEncoded.parse(content, limit: limit)
             end
           rescue => e
-            AppSec.telemetry.report(e, description: 'AppSec: Failed to parse body')
+            AppSec.telemetry.report(e, description: "AppSec: Failed to parse body")
 
             nil
           end

data/lib/datadog/appsec/utils/http/body_reader.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        module BodyReader
+          module_function
+
+          def read(body, limit:, rewind_before_read: false)
+            return body.byteslice(0, limit + 1) if body.is_a?(String)
+            return if body.nil? || !body.respond_to?(:read)
+            return if rewind_before_read && !body.respond_to?(:rewind)
+
+            read_stream(body, limit: limit, rewind_before_read: rewind_before_read)
+          end
+
+          def read_stream(body, limit:, rewind_before_read: false)
+            # @type var rewound: bool
+            rewound = false
+
+            if rewind_before_read
+              return unless rewind(body)
+
+              rewound = true
+            end
+
+            buffer = +"".b
+            max = limit + 1
+
+            while buffer.bytesize <= limit
+              chunk = body.read(max - buffer.bytesize)
+              break if chunk.nil? || chunk.empty?
+
+              buffer << chunk
+            end
+
+            buffer
+          rescue => e
+            Datadog.logger.debug { "AppSec: Failed to read body: #{e.class}: #{e.message}" }
+
+            raise
+          ensure
+            rewind(body) if rewound
+          end
+
+          private_class_method def rewind(body)
+            return false unless body.respond_to?(:rewind)
+
+            # NOTE: Steep can't narrow interfaces via `respond_to?` guard-clause
+            body.rewind # steep:ignore
+            true
+          rescue => e
+            Datadog.logger.debug { "AppSec: Failed to rewind body: #{e.class}: #{e.message}" }
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils/http/media_range.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'media_type'
+require_relative "media_type"
 
 module Datadog
   module AppSec
@@ -11,7 +11,7 @@ module Datadog
           class ParseError < ::StandardError
           end
 
-          WILDCARD = '*'
+          WILDCARD = "*"
           WILDCARD_RE = ::Regexp.escape(WILDCARD)
 
           # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
@@ -96,40 +96,40 @@ module Datadog
 
             raise ParseError, media_range.inspect if media_range_match.nil?
 
-            @type = (media_range_match['type'] || WILDCARD).downcase
-            @subtype = (media_range_match['subtype'] || WILDCARD).downcase
-            @quality = (media_range_match['quality'] || 1.0).to_f
+            @type = (media_range_match["type"] || WILDCARD).downcase
+            @subtype = (media_range_match["subtype"] || WILDCARD).downcase
+            @quality = (media_range_match["quality"] || 1.0).to_f
             @parameters = {}
             @accept_ext = {}
 
-            parameters = media_range_match['parameters']
+            parameters = media_range_match["parameters"]
 
             return if parameters.nil?
 
-            parameters.split(';').map(&:strip).each do |parameter|
+            parameters.split(";").map(&:strip).each do |parameter|
               parameter_match = PARAMETER_RE.match(parameter)
 
               next if parameter_match.nil?
 
-              parameter_name = parameter_match['parameter_name']
-              parameter_value = parameter_match['parameter_value']
+              parameter_name = parameter_match["parameter_name"]
+              parameter_value = parameter_match["parameter_value"]
 
               next if parameter_name.nil? || parameter_value.nil?
 
               @parameters[parameter_name.downcase] = parameter_value.downcase
             end
 
-            accept_exts = media_range_match['accept_exts']
+            accept_exts = media_range_match["accept_exts"]
 
             return if accept_exts.nil?
 
-            accept_exts.split(';').map(&:strip).each do |ext|
+            accept_exts.split(";").map(&:strip).each do |ext|
               ext_match = ACCEPT_EXT_RE.match(ext)
 
               next if ext_match.nil?
 
-              ext_name = ext_match['ext_name']
-              ext_value = ext_match['ext_value']
+              ext_name = ext_match["ext_name"]
+              ext_value = ext_match["ext_value"]
 
               next if ext_name.nil? || ext_value.nil?
 
@@ -189,9 +189,9 @@ module Datadog
           def to_s
             s = +"#{@type}/#{@subtype}"
 
-            s << ';' << @parameters.map { |k, v| "#{k}=#{v}" }.join(';') if @parameters.count > 0
+            s << ";" << @parameters.map { |k, v| "#{k}=#{v}" }.join(";") if @parameters.count > 0
             s << ";q=#{@quality}" if @quality < 1.0
-            s << ';' << @accept_ext.map { |k, v| "#{k}=#{v}" }.join(';') if @accept_ext.count > 0
+            s << ";" << @accept_ext.map { |k, v| "#{k}=#{v}" }.join(";") if @accept_ext.count > 0
 
             s
           end

data/lib/datadog/appsec/utils/http/media_type.rb

@@ -10,7 +10,7 @@ module Datadog
         # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.1
         # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
         class MediaType
-          WILDCARD = '*'
+          WILDCARD = "*"
 
           # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
           TOKEN_RE = /[-#$%&'*+.^_`|~A-Za-z0-9]+/.freeze
@@ -47,14 +47,14 @@ module Datadog
             match = MEDIA_TYPE_RE.match(media)
             return if match.nil?
 
-            type = match['type'] || WILDCARD
+            type = match["type"] || WILDCARD
             type.downcase!
 
-            subtype = match['subtype'] || WILDCARD
+            subtype = match["subtype"] || WILDCARD
             subtype.downcase!
 
             parameters = {}
-            params = match['parameters']
+            params = match["parameters"]
 
             unless params.nil? || params.empty?
               params.scan(PARAMETER_RE) do |name, unquoted_value, quoted_value|

data/lib/datadog/appsec/utils/http/url_encoded.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'cgi'
+require "cgi"
 
 module Datadog
   module AppSec
@@ -8,6 +8,15 @@ module Datadog
       module HTTP
         # Module for parsing URL encoded payloads
         module URLEncoded
+          module_function
+
+          # Matches Rack's default query bytesize limit, so parsing our own
+          # payloads keeps the same guard against CPU/memory exhaustion.
+          DEFAULT_BYTESIZE_LIMIT = 4 * 1024 * 1024
+
+          AMPERSAND_BYTE = 0x26
+          EQUALS_BYTE = 0x3D
+
           # Parses a URL encoded payload (query string or form data) into a hash
           # of keys and values, merging duplicate keys.
           #
@@ -15,34 +24,80 @@ module Datadog
           #
           #   URLEncoded.parse("foo=bar&foo=baz&qux=quux") # => {"foo" => ["bar", "baz"], "qux" => "quux"}
           #
-          # NOTE: Use it in the absence of `Rack::Utils.parse_query`
-          #
-          # WARNING: This method doesn't limit params byte size.
-          #          See: https://github.com/rack/rack/blob/603b799de38b5eb9b2ff1657c8036a20f4c4db7b/lib/rack/query_parser.rb#L231-L233
-          def self.parse(payload)
-            return {} if payload.nil? || payload.empty?
-
-            payload.split('&').each_with_object({}) do |pair, memo|
-              next if pair.empty?
-
-              # NOTE: Steep has issues with mutation methods
-              #       See https://github.com/ruby/rbs/issues/2819
-              #
-              # @type var key: ::String
-              # @type var value: ::String
-              key, value = pair.split('=', 2).map! do |val|
-                CGI.unescape(val)
-              end #: [::String, ::String]
-
-              if (stored = memo[key])
-                if stored.is_a?(Array)
-                  stored.push(value)
+          # Parsing stops once +limit+ bytes have been read, and the pair being
+          # read at that point is discarded. This returns the pairs decoded so
+          # far rather than raising or discarding the whole payload.
+          def parse(payload, limit: DEFAULT_BYTESIZE_LIMIT)
+            raise ArgumentError, "limit must not be negative" if limit < 0
+
+            return {} if payload.nil? || payload.empty? || limit.zero?
+
+            # @type var result: URLEncoded::params
+            result = {}
+            payload_bytesize = payload.bytesize
+            bytes_to_parse = (payload_bytesize < limit) ? payload_bytesize : limit
+
+            index = 0
+            param_start = 0
+            equals_index = nil # : Integer?
+
+            payload.each_byte do |byte|
+              break if index >= bytes_to_parse
+
+              if byte == AMPERSAND_BYTE
+                param_end = index
+
+                if equals_index
+                  key = payload.byteslice(param_start, equals_index - param_start) # : String
+                  value = payload.byteslice(equals_index + 1, param_end - equals_index - 1) # : String?
                 else
-                  memo[key] = [stored, value]
+                  key = payload.byteslice(param_start, param_end - param_start) # : String
+                  value = nil
+                end
+
+                if !key.empty? || value
+                  key = CGI.unescape(key)
+                  value = CGI.unescape(value) if value
+
+                  add_param(result, key, value)
                 end
+
+                param_start = index + 1
+                equals_index = nil
+              elsif byte == EQUALS_BYTE
+                equals_index ||= index
+              end
+
+              index += 1
+            end
+
+            if bytes_to_parse == payload_bytesize && param_start < index
+              param_end = index
+
+              if equals_index
+                key = payload.byteslice(param_start, equals_index - param_start) # : String
+                value = payload.byteslice(equals_index + 1, param_end - equals_index - 1) # : String?
               else
-                memo[key] = value
+                key = payload.byteslice(param_start, param_end - param_start) # : String
+                value = nil
               end
+
+              if !key.empty? || value
+                key = CGI.unescape(key)
+                value = CGI.unescape(value) if value
+
+                add_param(result, key, value)
+              end
+            end
+
+            result
+          end
+
+          private_class_method def add_param(params, key, value)
+            case existing = params[key]
+            when ::Array then existing.push(value)
+            when nil then params[key] = value
+            else params[key] = [existing, value]
             end
           end
         end

data/lib/datadog/appsec.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require_relative 'appsec/configuration'
-require_relative 'appsec/extensions'
-require_relative 'appsec/context'
-require_relative 'appsec/ext'
-require_relative 'appsec/utils'
+require_relative "appsec/configuration"
+require_relative "appsec/extensions"
+require_relative "appsec/context"
+require_relative "appsec/ext"
+require_relative "appsec/utils"
 
 module Datadog
   # Namespace for Datadog AppSec instrumentation
@@ -54,15 +54,15 @@ module Datadog
 end
 
 # Integrations
-require_relative 'appsec/contrib/rack/integration'
-require_relative 'appsec/contrib/sinatra/integration'
-require_relative 'appsec/contrib/rails/integration'
-require_relative 'appsec/contrib/active_record/integration'
-require_relative 'appsec/contrib/devise/integration'
-require_relative 'appsec/contrib/graphql/integration'
-require_relative 'appsec/contrib/faraday/integration'
-require_relative 'appsec/contrib/excon/integration'
-require_relative 'appsec/contrib/rest_client/integration'
-require_relative 'appsec/contrib/aws_lambda/integration'
+require_relative "appsec/contrib/rack/integration"
+require_relative "appsec/contrib/sinatra/integration"
+require_relative "appsec/contrib/rails/integration"
+require_relative "appsec/contrib/active_record/integration"
+require_relative "appsec/contrib/devise/integration"
+require_relative "appsec/contrib/graphql/integration"
+require_relative "appsec/contrib/faraday/integration"
+require_relative "appsec/contrib/excon/integration"
+require_relative "appsec/contrib/rest_client/integration"
+require_relative "appsec/contrib/aws_lambda/integration"
 
-require_relative 'appsec/autoload'
+require_relative "appsec/autoload"

data/lib/datadog/auto_instrument.rb

@@ -3,8 +3,8 @@
 # Entrypoint file for auto instrumentation.
 #
 # This file's path is part of the @public_api.
-require_relative '../datadog'
-require_relative 'tracing/contrib/auto_instrument'
+require_relative "../datadog"
+require_relative "tracing/contrib/auto_instrument"
 
 # DI is not loaded on Ruby 2.5 and JRuby
 Datadog::DI::Contrib.load_now_or_later if defined?(Datadog::DI::Contrib)

data/lib/datadog/core/buffer/cruby.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'random'
+require_relative "random"
 
 module Datadog
   module Core

data/lib/datadog/core/buffer/thread_safe.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'random'
+require_relative "random"
 
 module Datadog
   module Core

data/lib/datadog/core/configuration/agent_settings.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'ext'
+require_relative "ext"
 
 module Datadog
   module Core

data/lib/datadog/core/configuration/agent_settings_resolver.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require 'uri'
+require "uri"
 
-require_relative 'settings'
-require_relative 'ext'
-require_relative 'agent_settings'
-require_relative '../transport/ext'
+require_relative "settings"
+require_relative "ext"
+require_relative "agent_settings"
+require_relative "../transport/ext"
 
 module Datadog
   module Core
@@ -117,7 +117,7 @@ module Datadog
             ),
             try_parsing_as_integer(
               friendly_name: "#{Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_TIMEOUT_SECONDS} " \
-                'environment variable',
+                "environment variable",
               value: DATADOG_ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_TIMEOUT_SECONDS],
             )
           )
@@ -141,7 +141,7 @@ module Datadog
         def parsed_url_ssl?
           return nil if parsed_url.nil?
 
-          parsed_url.scheme == 'https'
+          parsed_url.scheme == "https"
         end
 
         def try_parsing_as_integer(value:, friendly_name:)
@@ -189,10 +189,10 @@ module Datadog
           path = parsed_url.to_s
           # Some versions of the built-in uri gem leave the original url untouched, and others remove the //, so this
           # supports both
-          if path.start_with?('unix://')
-            path.sub('unix://', '')
+          if path.start_with?("unix://")
+            path.sub("unix://", "")
           else
-            path.sub('unix:', '')
+            path.sub("unix:", "")
           end
         end
 
@@ -232,11 +232,11 @@ module Datadog
             warn_if_configuration_mismatch(
               [
                 DetectedConfiguration.new(
-                  friendly_name: 'configuration for unix domain socket',
+                  friendly_name: "configuration for unix domain socket",
                   value: parsed_url.to_s,
                 ),
                 DetectedConfiguration.new(
-                  friendly_name: 'configuration of hostname/port for http/https use',
+                  friendly_name: "configuration of hostname/port for http/https use",
                   value: "hostname: '#{hostname}', port: '#{port}'",
                 ),
               ]
@@ -294,7 +294,7 @@ module Datadog
           return unless detected_configurations_in_priority_order.map(&:value).uniq.size > 1
 
           log_warning(
-            'Configuration mismatch: values differ between ' \
+            "Configuration mismatch: values differ between " \
             "#{detected_configurations_in_priority_order
               .map { |config| "#{config.friendly_name} (#{config.value.inspect})" }.join(" and ")}" \
             ". Using #{detected_configurations_in_priority_order.first.value.inspect} and ignoring other configuration."
@@ -306,7 +306,7 @@ module Datadog
         end
 
         def http_scheme?(uri)
-          ['http', 'https'].include?(uri.scheme)
+          ["http", "https"].include?(uri.scheme)
         end
 
         # Expected to return nil (not false!) when it's not http
@@ -315,7 +315,7 @@ module Datadog
         end
 
         def unix_scheme?(uri)
-          uri.scheme == 'unix'
+          uri.scheme == "unix"
         end
 
         # Represents a given configuration value and where we got it from

data/lib/datadog/core/configuration/agentless_settings_resolver.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# rubocop:disable Style/*
+# rubocop:disable Style
 
 require 'uri'
 
@@ -173,4 +173,4 @@ module Datadog
   end
 end
 
-# rubocop:enable Style/*
+# rubocop:enable Style

data/lib/datadog/core/configuration/base.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'options'
+require_relative "options"
 
 module Datadog
   module Core
@@ -86,7 +86,7 @@ module Datadog
 
           # Retrieves a nested option from a list of symbols
           def dig(*options)
-            raise ArgumentError, 'expected at least one option' if options.empty?
+            raise ArgumentError, "expected at least one option" if options.empty?
 
             options.inject(self) do |receiver, option|
               receiver.send(option)