datadog 2.36.0 → 2.40.0

data/ext/libdatadog_api/trace_exporter.h

@@ -0,0 +1,5 @@
+#pragma once
+
+#include "datadog_ruby_common.h"
+
+void trace_exporter_init(VALUE tracing_module);

data/ext/libdatadog_extconf_helpers.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require 'rubygems'
-require 'pathname'
+require "rubygems"
+require "pathname"
 
 module Datadog
   # Contains a bunch of shared helpers that get used during building of extensions that link to libdatadog
@@ -10,7 +10,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = '~> 35.0.0.1.0'
+    LIBDATADOG_VERSION = "~> 36.0.0.1.0"
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.
@@ -151,8 +151,8 @@ module Datadog
     # rubocop:enable Style/GlobalVars
 
     def self.try_loading_libdatadog
-      gem 'libdatadog', LIBDATADOG_VERSION
-      require 'libdatadog'
+      gem "libdatadog", LIBDATADOG_VERSION
+      require "libdatadog"
       nil
     rescue Exception => e # rubocop:disable Lint/RescueException
       if block_given?
@@ -175,7 +175,7 @@ module Datadog
     # prints the failure.
     def self.dump_mkmf_log_on_failure!
       # Doesn't work on 2.5/2.6 and not worth extra complexity to support
-      return if RUBY_VERSION < '2.7'
+      return if RUBY_VERSION < "2.7"
 
       MakeMakefile.prepend(DumpMkmfLogOnFailure)
     end
@@ -184,12 +184,12 @@ module Datadog
     # See `dump_mkmf_log_on_failure!` for details.
     module DumpMkmfLogOnFailure
       def mkmf_failed(path)
-        unless $makefile_created || File.exist?('Makefile')
-          log_path = File.expand_path('mkmf.log')
+        unless $makefile_created || File.exist?("Makefile")
+          log_path = File.expand_path("mkmf.log")
           if File.exist?(log_path)
             # The full log is very verbose so let's grab only the last check which should be the one that failed
             entries = File.read(log_path).split(/^-{20}$\n?/)
-            last_entry = entries.reverse.find { |e| !e.strip.empty? } || ''
+            last_entry = entries.reverse.find { |e| !e.strip.empty? } || ""
 
             $stderr.puts(
               "+------------------------------------------------------------------------------+\n" \

data/lib/datadog/ai_guard/api_client.rb

@@ -17,11 +17,13 @@ module Datadog
 
         @endpoint_uri = if endpoint
           URI(endpoint) #: URI::HTTP
+        elsif Datadog.configuration.site
+          host = Datadog.configuration.site.dup
+          host.prepend("app.") if host.count(".") == 1
+
+          URI::HTTPS.build(host: host, path: DEFAULT_PATH)
         else
-          URI::HTTPS.build(
-            host: Datadog.configuration.site || DEFAULT_SITE,
-            path: DEFAULT_PATH
-          )
+          URI::HTTPS.build(host: DEFAULT_SITE, path: DEFAULT_PATH)
         end
 
         @headers = {
@@ -59,7 +61,7 @@ module Datadog
         else
           error_message = begin
             parsed_body = JSON.parse(response.body)
-            Array(parsed_body.fetch('errors')).join(', ')
+            Array(parsed_body.fetch("errors")).join(", ")
           rescue JSON::ParserError, KeyError
             response.body
           end
@@ -75,7 +77,7 @@ module Datadog
       end
 
       def use_ssl?
-        @endpoint_uri.scheme == 'https'
+        @endpoint_uri.scheme == "https"
       end
     end
   end

data/lib/datadog/ai_guard/component.rb

@@ -1,15 +1,15 @@
 # frozen_string_literal: true
 
-require_relative 'api_client'
-require_relative 'evaluation'
-require_relative 'evaluation/request'
-require_relative 'evaluation/result'
-require_relative 'evaluation/no_op_result'
-require_relative 'evaluation/message'
-require_relative 'evaluation/tool_call'
-require_relative 'evaluation/content_part'
-require_relative 'evaluation/content_builder'
-require_relative 'ext'
+require_relative "api_client"
+require_relative "evaluation"
+require_relative "evaluation/request"
+require_relative "evaluation/result"
+require_relative "evaluation/no_op_result"
+require_relative "evaluation/message"
+require_relative "evaluation/tool_call"
+require_relative "evaluation/content_part"
+require_relative "evaluation/content_builder"
+require_relative "ext"
 
 module Datadog
   module AIGuard

data/lib/datadog/ai_guard/evaluation.rb

@@ -15,6 +15,7 @@ module Datadog
               Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
               Tracing::Sampling::Ext::Decision::AI_GUARD
             )
+            trace.set_distributed_source(Ext::PRODUCT_BIT)
             trace.set_tag(Ext::EVENT_TAG, true)
             trace.set_tag(Ext::TRACE_EXECUTED_TAG, "1")
 

data/lib/datadog/ai_guard/ext.rb

@@ -4,6 +4,8 @@ module Datadog
   module AIGuard
     # AI Guard specific constants
     module Ext
+      PRODUCT_BIT = 0x20
+
       SPAN_NAME = "ai_guard"
       TARGET_TAG = "ai_guard.target"
       TOOL_NAME_TAG = "ai_guard.tool_name"

data/lib/datadog/appsec/actions_handler/serializable_backtrace.rb

@@ -24,39 +24,39 @@ module Datadog
 
           packer.write_map_header(3)
 
-          packer.write('id')
-          packer.write(@stack_id.encode('UTF-8'))
+          packer.write("id")
+          packer.write(@stack_id.encode("UTF-8"))
 
-          packer.write('language')
-          packer.write('ruby'.encode('UTF-8'))
+          packer.write("language")
+          packer.write("ruby".encode("UTF-8"))
 
           serializable_locations_map = build_serializable_locations_map
 
-          packer.write('frames')
+          packer.write("frames")
           packer.write_array_header(serializable_locations_map.size)
 
           serializable_locations_map.each do |frame_id, location|
             packer.write_map_header(6)
 
-            packer.write('id')
+            packer.write("id")
             packer.write(frame_id)
 
-            packer.write('text')
-            packer.write(location.to_s.encode('UTF-8'))
+            packer.write("text")
+            packer.write(location.to_s.encode("UTF-8"))
 
-            packer.write('file')
-            packer.write(location.path&.encode('UTF-8'))
+            packer.write("file")
+            packer.write(location.path&.encode("UTF-8"))
 
-            packer.write('line')
+            packer.write("line")
             packer.write(location.lineno)
 
             class_name, function_name = location.label&.match(CLASS_AND_FUNCTION_NAME_REGEX)&.captures
 
-            packer.write('class_name')
-            packer.write(class_name&.encode('UTF-8'))
+            packer.write("class_name")
+            packer.write(class_name&.encode("UTF-8"))
 
-            packer.write('function')
-            packer.write(function_name&.encode('UTF-8'))
+            packer.write("function")
+            packer.write(function_name&.encode("UTF-8"))
           end
 
           packer
@@ -74,7 +74,7 @@ module Datadog
           frame_idx = -1
           @locations.each_with_object({}) do |location, map|
             # we are dropping frames from library code without increasing frame index
-            next if location.path&.include?('lib/datadog')
+            next if location.path&.include?("lib/datadog")
 
             frame_idx += 1
 

data/lib/datadog/appsec/actions_handler.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'actions_handler/serializable_backtrace'
+require_relative "actions_handler/serializable_backtrace"
 
 module Datadog
   module AppSec
@@ -11,10 +11,10 @@ module Datadog
       def handle(actions_hash)
         # handle actions according their precedence
         # stack and schema generation should be done before we throw an interrupt signal
-        generate_stack(actions_hash['generate_stack']) if actions_hash.key?('generate_stack')
-        generate_schema(actions_hash['generate_schema']) if actions_hash.key?('generate_schema')
-        interrupt_execution(actions_hash['redirect_request']) if actions_hash.key?('redirect_request')
-        interrupt_execution(actions_hash['block_request']) if actions_hash.key?('block_request')
+        generate_stack(actions_hash["generate_stack"]) if actions_hash.key?("generate_stack")
+        generate_schema(actions_hash["generate_schema"]) if actions_hash.key?("generate_schema")
+        interrupt_execution(actions_hash["redirect_request"]) if actions_hash.key?("redirect_request")
+        interrupt_execution(actions_hash["block_request"]) if actions_hash.key?("block_request")
       end
 
       def interrupt_execution(action_params)
@@ -24,7 +24,7 @@ module Datadog
       def generate_stack(action_params)
         return unless Datadog.configuration.appsec.stack_trace.enabled
 
-        stack_id = action_params['stack_id']
+        stack_id = action_params["stack_id"]
         return unless stack_id
 
         active_span = AppSec.active_context&.span

data/lib/datadog/appsec/anonymizer.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'digest/sha2'
+require "digest/sha2"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/api_security/endpoint_collection/grape_route_serializer.rb

@@ -8,7 +8,7 @@ module Datadog
         module GrapeRouteSerializer
           module_function
 
-          def serialize(route, path_prefix: '')
+          def serialize(route, path_prefix: "")
             path = path_prefix + route.pattern.origin
 
             {

data/lib/datadog/appsec/api_security/endpoint_collection/rails_collector.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative 'rails_route_serializer'
-require_relative 'grape_route_serializer'
-require_relative 'sinatra_route_serializer'
+require_relative "rails_route_serializer"
+require_relative "grape_route_serializer"
+require_relative "sinatra_route_serializer"
 
 module Datadog
   module AppSec
@@ -19,9 +19,9 @@ module Datadog
             Enumerator.new do |yielder|
               @routes.each do |route|
                 if route.dispatcher?
-                  if route.verb.include?('|')
+                  if route.verb.include?("|")
                     # report separate route for each method for multi-method routes
-                    route.verb.split('|').each do |method|
+                    route.verb.split("|").each do |method|
                       yielder.yield RailsRouteSerializer.serialize(route, method_override: method)
                     end
                   else
@@ -33,7 +33,7 @@ module Datadog
                   end
                 elsif mounted_sinatra_app?(route.app.rack_app)
                   route.app.rack_app.routes.each do |method, sinatra_routes|
-                    next if method == 'HEAD'
+                    next if method == "HEAD"
 
                     sinatra_routes.each do |sinatra_route, _, _|
                       yielder.yield SinatraRouteSerializer.serialize(

data/lib/datadog/appsec/api_security/endpoint_collection/sinatra_route_serializer.rb

@@ -8,7 +8,7 @@ module Datadog
         module SinatraRouteSerializer
           module_function
 
-          def serialize(route, method:, path_prefix: '')
+          def serialize(route, method:, path_prefix: "")
             path = path_prefix + route.safe_string
 
             {

data/lib/datadog/appsec/api_security/route_extractor.rb

@@ -1,21 +1,21 @@
 # frozen_string_literal: true
 
-require_relative '../../tracing/contrib/rack/route_inference'
+require_relative "../../tracing/contrib/rack/route_inference"
 
 module Datadog
   module AppSec
     module APISecurity
       # This is a helper module to extract the route pattern from the Rack::Request.
       module RouteExtractor
-        SINATRA_ROUTE_KEY = 'sinatra.route'
-        SINATRA_ROUTE_SEPARATOR = ' '
-        GRAPE_ROUTE_KEY = 'grape.routing_args'
-        RAILS_ROUTE_URI_PATTERN_KEY = 'action_dispatch.route_uri_pattern'
-        RAILS_ROUTE_KEY = 'action_dispatch.route' # Rails 8.1.1+
-        RAILS_ROUTES_KEY = 'action_dispatch.routes'
-        RAILS_PATH_PARAMS_KEY = 'action_dispatch.request.path_parameters'
-        RAILS_FORMAT_SUFFIX = '(.:format)'
-        DATADOG_RAILS_ROUTE_KEY = 'datadog.action_dispatch.route'
+        SINATRA_ROUTE_KEY = "sinatra.route"
+        SINATRA_ROUTE_SEPARATOR = " "
+        GRAPE_ROUTE_KEY = "grape.routing_args"
+        RAILS_ROUTE_URI_PATTERN_KEY = "action_dispatch.route_uri_pattern"
+        RAILS_ROUTE_KEY = "action_dispatch.route" # Rails 8.1.1+
+        RAILS_ROUTES_KEY = "action_dispatch.routes"
+        RAILS_PATH_PARAMS_KEY = "action_dispatch.request.path_parameters"
+        RAILS_FORMAT_SUFFIX = "(.:format)"
+        DATADOG_RAILS_ROUTE_KEY = "datadog.action_dispatch.route"
 
         # HACK: We rely on the fact that each contrib will modify `request.env`
         #       and store information sufficient to compute the canonical
@@ -31,16 +31,19 @@ module Datadog
         #         uses `sinatra.route` with a string like "GET /users/:id"
         #       Grape
         #         uses `grape.routing_args` with a hash with a `:route_info` key
-        #         that contains a `Grape::Router::Route` object that contains
-        #         `Grape::Router::Pattern` object with an `origin` method
+        #         that contains a {Grape::Router::Route} object that contains
+        #         {Grape::Router::Pattern} object with an `origin` method
+        #       Rails with `action_pack` tracing contrib (fast path)
+        #         `datadog.action_dispatch.route` stores the {Journey::Route}
+        #         object set by the tracer at routing time
         #       Rails < 7.1 (slow path)
-        #         uses `action_dispatch.routes` to store `ActionDispatch::Routing::RouteSet`
+        #         uses `action_dispatch.routes` to store {ActionDispatch::Routing::RouteSet}
         #         which can recognize requests
         #       Rails > 7.1 (fast path)
         #         uses `action_dispatch.route_uri_pattern` with a string like
         #         "/users/:id(.:format)"
         #       Rails > 8.1.1 (fast path)
-        #         uses `action_dispatch.route` to store the ActionDispatch::Journey::Route
+        #         uses `action_dispatch.route` to store the {ActionDispatch::Journey::Route}
         #         that matched when the request was routed
         #
         # WARNING: This method works only *after* the request has been routed.
@@ -91,7 +94,7 @@ module Datadog
             Tracing::Contrib::Rack::RouteInference.read_or_infer(request.env)
           end
         rescue => e
-          AppSec.telemetry&.report(e, description: 'AppSec: Could not extract route pattern')
+          AppSec.telemetry&.report(e, description: "AppSec: Could not extract route pattern")
 
           nil
         end

data/lib/datadog/appsec/api_security/sampler.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require 'zlib'
-require_relative 'route_extractor'
-require_relative '../../core/utils/time'
-require_relative '../../core/utils/lru_cache'
+require "zlib"
+require_relative "route_extractor"
+require_relative "../../core/utils/time"
+require_relative "../../core/utils/lru_cache"
 
 module Datadog
   module AppSec
@@ -35,7 +35,7 @@ module Datadog
         end
 
         def initialize(sample_delay)
-          raise ArgumentError, 'sample_delay must be an Integer' unless sample_delay.is_a?(Integer)
+          raise ArgumentError, "sample_delay must be an Integer" unless sample_delay.is_a?(Integer)
 
           @cache = Core::Utils::LRUCache.new(MAX_CACHE_SIZE)
           @sample_delay_seconds = sample_delay

data/lib/datadog/appsec/api_security.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'api_security/sampler'
+require_relative "api_security/sampler"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/assets.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'pathname'
+require "pathname"
 
 module Datadog
   module AppSec
@@ -13,11 +13,11 @@ module Datadog
       end
 
       def waf_processors
-        read('waf_rules/processors.json')
+        read("waf_rules/processors.json")
       end
 
       def waf_scanners
-        read('waf_rules/scanners.json')
+        read("waf_rules/scanners.json")
       end
 
       def blocked(format: :html)
@@ -25,21 +25,21 @@ module Datadog
       end
 
       def path
-        Pathname.new(dir).join('assets')
+        Pathname.new(dir).join("assets")
       end
 
       def filepath(filename)
         path.join(filename)
       end
 
-      def read(filename, mode = 'rb')
-        File.open(filepath(filename), mode) { |f| f.read || raise('Unexpected nil IO object') }
+      def read(filename, mode = "rb")
+        File.open(filepath(filename), mode) { |f| f.read || raise("Unexpected nil IO object") }
       end
 
       def dir
         # Happens only if this file is evaluated standalone, which should not happen
         # Necessary to make type-checker happy with a non-nilable return value
-        __dir__ || raise('Unexpected file eval')
+        __dir__ || raise("Unexpected file eval")
       end
     end
   end

data/lib/datadog/appsec/autoload.rb

@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
-if %w[1 true].include?((Datadog::DATADOG_ENV['DD_APPSEC_ENABLED'] || '').downcase)
+if %w[1 true].include?((Datadog::DATADOG_ENV["DD_APPSEC_ENABLED"] || "").downcase)
   begin
-    require_relative 'contrib/auto_instrument'
+    require_relative "contrib/auto_instrument"
     Datadog::AppSec::Contrib::AutoInstrument.patch_all
   rescue => e
     Kernel.warn(
-      '[datadog] AppSec failed to instrument. No security check will be performed. error: ' \
+      "[datadog] AppSec failed to instrument. No security check will be performed. error: " \
       " #{e.class}: #{e.message}"
     )
   end

data/lib/datadog/appsec/component.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require_relative 'security_engine/engine'
-require_relative 'security_engine/runner'
-require_relative 'processor/rule_loader'
-require_relative 'actions_handler'
-require_relative 'thread_safe_ref'
+require_relative "security_engine/engine"
+require_relative "security_engine/runner"
+require_relative "processor/rule_loader"
+require_relative "actions_handler"
+require_relative "thread_safe_ref"
 
 module Datadog
   module AppSec
@@ -14,21 +14,21 @@ module Datadog
         def build_appsec_component(settings, telemetry:)
           return if !settings.respond_to?(:appsec) || !settings.appsec.enabled
 
-          ffi_version = Gem.loaded_specs['ffi']&.version
+          ffi_version = Gem.loaded_specs["ffi"]&.version
           unless ffi_version
-            Datadog.logger.warn('FFI gem is not loaded, AppSec will be disabled.')
-            telemetry.error('AppSec: Component not loaded, due to missing FFI gem')
+            Datadog.logger.warn("FFI gem is not loaded, AppSec will be disabled.")
+            telemetry.error("AppSec: Component not loaded, due to missing FFI gem")
 
             return
           end
 
-          if RubyVersion.is?('>= 3.3') && ffi_version < Gem::Version.new('1.16.0')
+          if RubyVersion.is?(">= 3.3") && ffi_version < Gem::Version.new("1.16.0")
             Datadog.logger.warn(
-              'AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, ' \
-              'and will be forcibly disabled due to a memory leak in `ffi`. ' \
-              'Please upgrade your `ffi` version to 1.16.0 or higher.'
+              "AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, " \
+              "and will be forcibly disabled due to a memory leak in `ffi`. " \
+              "Please upgrade your `ffi` version to 1.16.0 or higher."
             )
-            telemetry.error('AppSec: Component not loaded, ffi version is leaky with ruby > 3.3.0')
+            telemetry.error("AppSec: Component not loaded, ffi version is leaky with ruby > 3.3.0")
 
             return
           end
@@ -63,9 +63,9 @@ module Datadog
         private
 
         def require_libddwaf(telemetry:)
-          require('libddwaf')
+          require("libddwaf")
         rescue LoadError => e
-          libddwaf_platform = Gem.loaded_specs['libddwaf']&.platform || 'unknown'
+          libddwaf_platform = Gem.loaded_specs["libddwaf"]&.platform || "unknown"
           ruby_platforms = Gem.platforms.map(&:to_s)
 
           error_message = "libddwaf failed to load - installed platform: #{libddwaf_platform}, " \

data/lib/datadog/appsec/compressed_json.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require 'json'
-require 'zlib'
-require 'stringio'
+require "json"
+require "zlib"
+require "stringio"
 
-require_relative '../core/utils/base64_codec'
+require_relative "../core/utils/base64_codec"
 
 module Datadog
   module AppSec
@@ -21,7 +21,7 @@ module Datadog
 
         compress_and_encode(value)
       rescue ArgumentError, Encoding::UndefinedConversionError, JSON::JSONError => e
-        AppSec.telemetry.report(e, description: 'AppSec: Failed to convert value into JSON')
+        AppSec.telemetry.report(e, description: "AppSec: Failed to convert value into JSON")
 
         nil
       end
@@ -31,7 +31,7 @@ module Datadog
           Zlib.gzip(payload, level: Zlib::BEST_SPEED, strategy: Zlib::DEFAULT_STRATEGY)
         )
       rescue Zlib::Error, TypeError => e
-        AppSec.telemetry.report(e, description: 'AppSec: Failed to compress and encode value')
+        AppSec.telemetry.report(e, description: "AppSec: Failed to compress and encode value")
 
         nil
       end