datadog 2.38.0 → 2.39.0

data/lib/datadog/appsec/context.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative 'counter_sampler'
-require_relative 'metrics'
-require_relative 'security_event'
+require_relative "counter_sampler"
+require_relative "metrics"
+require_relative "security_event"
 
 module Datadog
   module AppSec
@@ -34,8 +34,8 @@ module Datadog
 
       class << self
         def activate(context)
-          raise ArgumentError, 'not a Datadog::AppSec::Context' unless context.instance_of?(Context)
-          raise ActiveContextError, 'another context is active, nested contexts are not supported' if active
+          raise ArgumentError, "not a Datadog::AppSec::Context" unless context.instance_of?(Context)
+          raise ActiveContextError, "another context is active, nested contexts are not supported" if active
 
           Thread.current[Ext::ACTIVE_CONTEXT_KEY] = context
         end
@@ -103,7 +103,7 @@ module Datadog
       end
 
       def extract_schema!
-        persistent_data = {'waf.context.processor' => {'extract-schema' => true}}
+        persistent_data = {"waf.context.processor" => {"extract-schema" => true}}
         waf_result = run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
         security_event = AppSec::SecurityEvent.new(waf_result, trace: trace, span: span)
 

data/lib/datadog/appsec/contrib/active_record/instrumentation.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative '../../event'
-require_relative '../../trace_keeper'
-require_relative '../../security_event'
+require_relative "../../event"
+require_relative "../../trace_keeper"
+require_relative "../../security_event"
 
 module Datadog
   module AppSec
@@ -21,11 +21,11 @@ module Datadog
             # libddwaf expects db system to be lowercase,
             # in case of sqlite adapter, libddwaf expects 'sqlite' as db system
             db_system = adapter_name.downcase
-            db_system = 'sqlite' if db_system == 'sqlite3'
+            db_system = "sqlite" if db_system == "sqlite3"
 
             ephemeral_data = {
-              'server.db.statement' => sql,
-              'server.db.system' => db_system
+              "server.db.statement" => sql,
+              "server.db.system" => db_system
             }
 
             waf_timeout = Datadog.configuration.appsec.waf_timeout

data/lib/datadog/appsec/contrib/active_record/integration.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
-require_relative 'patcher'
+require_relative "../integration"
+require_relative "patcher"
 
 module Datadog
   module AppSec
@@ -11,12 +11,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('4')
+          MINIMUM_VERSION = Gem::Version.new("4")
 
           register_as :active_record, auto_patch: true
 
           def self.version
-            Gem.loaded_specs['activerecord']&.version
+            Gem.loaded_specs["activerecord"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/active_record/patcher.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'instrumentation'
+require_relative "instrumentation"
 
 module Datadog
   module AppSec
@@ -52,7 +52,7 @@ module Datadog
           end
 
           def patch_sqlite3_adapter
-            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new('7.1')
+            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
               Instrumentation::InternalExecQueryAdapterPatch
             elsif ::ActiveRecord.gem_version.segments.first == 4
               Instrumentation::Rails4ExecQueryAdapterPatch
@@ -65,7 +65,7 @@ module Datadog
           end
 
           def patch_mysql2_adapter
-            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new('7.1')
+            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
               Instrumentation::InternalExecQueryAdapterPatch
             elsif ::ActiveRecord.gem_version.segments.first == 4
               Instrumentation::Rails4ExecQueryAdapterPatch
@@ -85,7 +85,7 @@ module Datadog
             end
 
             if defined?(::ActiveRecord::ConnectionAdapters::JdbcAdapter)
-              instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new('7.1')
+              instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
                 Instrumentation::InternalExecQueryAdapterPatch
               elsif ::ActiveRecord.gem_version.segments.first == 4
                 Instrumentation::Rails4ExecQueryAdapterPatch

data/lib/datadog/appsec/contrib/aws_lambda/gateway/watcher.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require_relative '../waf_addresses'
-require_relative '../../../event'
-require_relative '../../../trace_keeper'
-require_relative '../../../security_event'
-require_relative '../../../instrumentation/gateway'
+require_relative "../waf_addresses"
+require_relative "../../../event"
+require_relative "../../../trace_keeper"
+require_relative "../../../security_event"
+require_relative "../../../instrumentation/gateway"
 
 module Datadog
   module AppSec
@@ -21,7 +21,7 @@ module Datadog
               end
 
               def watch_request(gateway = Instrumentation.gateway)
-                gateway.watch('aws_lambda.request.start') do |stack, payload|
+                gateway.watch("aws_lambda.request.start") do |stack, payload|
                   context = payload.context
                   next stack.call(payload) unless context
 
@@ -45,7 +45,7 @@ module Datadog
               end
 
               def watch_response(gateway = Instrumentation.gateway)
-                gateway.watch('aws_lambda.response.start') do |stack, payload|
+                gateway.watch("aws_lambda.response.start") do |stack, payload|
                   context = payload.context
                   next stack.call(payload) unless context
 

data/lib/datadog/appsec/contrib/aws_lambda/integration.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative 'patcher'
-require_relative '../integration'
+require_relative "patcher"
+require_relative "../integration"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/aws_lambda/patcher.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../monitor'
-require_relative 'gateway/watcher'
+require_relative "../../monitor"
+require_relative "gateway/watcher"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/aws_lambda/waf_addresses.rb

@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
-require 'uri'
+require "uri"
 
-require_relative '../../utils/http/media_type'
-require_relative '../../utils/http/body'
-require_relative '../../../core/utils/base64_codec'
-require_relative '../../../core/header_collection'
-require_relative '../../../tracing/client_ip'
+require_relative "../../utils/http/media_type"
+require_relative "../../utils/http/body"
+require_relative "../../../core/utils/base64_codec"
+require_relative "../../../core/header_collection"
+require_relative "../../../tracing/client_ip"
 
 module Datadog
   module AppSec
@@ -26,16 +26,16 @@ module Datadog
 
             headers = parse_headers(payload)
             data = {
-              'server.request.cookies' => parse_cookies(payload, headers),
-              'server.request.query' => payload['query'],
-              'server.request.uri.raw' => build_fullpath(payload),
-              'server.request.headers' => headers,
-              'server.request.headers.no_cookies' => headers.dup.tap { |h| h.delete('cookie') },
-              'server.request.method' => payload['method'],
-              'server.request.body' => parse_body(payload, headers),
-              'server.request.body.byte_length' => body_byte_length(payload),
-              'server.request.path_params' => payload['path_params'],
-              'http.client_ip' => extract_client_ip(payload['source_ip'], headers)
+              "server.request.cookies" => parse_cookies(payload, headers),
+              "server.request.query" => payload["query"],
+              "server.request.uri.raw" => build_fullpath(payload),
+              "server.request.headers" => headers,
+              "server.request.headers.no_cookies" => headers.dup.tap { |h| h.delete("cookie") },
+              "server.request.method" => payload["method"],
+              "server.request.body" => parse_body(payload, headers),
+              "server.request.body.byte_length" => body_byte_length(payload),
+              "server.request.path_params" => payload["path_params"],
+              "http.client_ip" => extract_client_ip(payload["source_ip"], headers)
             }
 
             data.compact!
@@ -47,11 +47,11 @@ module Datadog
 
             headers = parse_headers(payload)
             data = {
-              'server.response.status' => payload['status_code']&.to_s,
-              'server.response.headers' => headers,
-              'server.response.headers.no_cookies' => headers.dup.tap { |h| h.delete('set-cookie') },
-              'server.response.body' => parse_body(payload, headers),
-              'server.response.body.byte_length' => body_byte_length(payload)
+              "server.response.status" => payload["status_code"]&.to_s,
+              "server.response.headers" => headers,
+              "server.response.headers.no_cookies" => headers.dup.tap { |h| h.delete("set-cookie") },
+              "server.response.body" => parse_body(payload, headers),
+              "server.response.body.byte_length" => body_byte_length(payload)
             }
 
             data.compact!
@@ -59,23 +59,23 @@ module Datadog
           end
 
           def parse_headers(payload)
-            (payload['headers'] || {}).each_with_object({}) do |(key, value), hash|
+            (payload["headers"] || {}).each_with_object({}) do |(key, value), hash|
               hash[key.downcase] = value
             end
           end
 
           def parse_cookies(payload, headers)
-            raw_pairs = payload['cookies'] || headers['cookie']&.split(';')
+            raw_pairs = payload["cookies"] || headers["cookie"]&.split(";")
             return unless raw_pairs
 
             raw_pairs.each_with_object({}) do |pair, hash|
-              name, value = pair.strip.split('=', 2)
+              name, value = pair.strip.split("=", 2)
               hash[name] = value if name
             end
           end
 
           def build_fullpath(payload)
-            path = payload['path']
+            path = payload["path"]
             return unless path
 
             query_string = build_query_string(payload)
@@ -83,10 +83,10 @@ module Datadog
           end
 
           def build_query_string(payload)
-            query_string = payload['query_string']
+            query_string = payload["query_string"]
             return query_string if query_string && !query_string.empty?
 
-            query = payload['query']
+            query = payload["query"]
             return if query.nil? || query.empty?
 
             URI.encode_www_form(query)
@@ -98,32 +98,34 @@ module Datadog
           end
 
           def parse_body(payload, headers)
-            body = payload['body']
+            body = payload["body"]
             return unless body
 
             if (byte_length = body_byte_length(payload))
               return if byte_length > Datadog.configuration.appsec.body_parsing_size_limit
             end
 
-            content_type = headers['content-type']
+            content_type = headers["content-type"]
             return unless content_type
 
             media_type = AppSec::Utils::HTTP::MediaType.parse(content_type)
             return unless media_type
 
-            body = Core::Utils::Base64Codec.strict_decode64(body) if payload['base64_encoded']
-            AppSec::Utils::HTTP::Body.parse(body, media_type: media_type)
+            body = Core::Utils::Base64Codec.strict_decode64(body) if payload["base64_encoded"]
+            AppSec::Utils::HTTP::Body.parse(
+              body, media_type: media_type, limit: Datadog.configuration.appsec.body_parsing_size_limit
+            )
           rescue ArgumentError => e
-            AppSec.telemetry.report(e, description: 'AppSec: Failed to decode base64 body')
+            AppSec.telemetry.report(e, description: "AppSec: Failed to decode base64 body")
 
             nil
           end
 
           def body_byte_length(payload)
-            body = payload['body']
+            body = payload["body"]
 
             return unless body
-            return body.bytesize unless payload['base64_encoded']
+            return body.bytesize unless payload["base64_encoded"]
 
             # NOTE: Base64 packs every 3 bytes into 4 characters and pads the last
             #       group with up to two "=" bytes. The decoded length is therefore

data/lib/datadog/appsec/contrib/devise/data_extractor.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../../anonymizer'
+require_relative "../../anonymizer"
 
 module Datadog
   module AppSec
@@ -9,8 +9,8 @@ module Datadog
         # Extracts user identification data from Devise resources.
         # Supports both regular and anonymized data extraction modes.
         class DataExtractor
-          PRIORITY_ORDERED_ID_KEYS = [:id, 'id', :uuid, 'uuid'].freeze
-          PRIORITY_ORDERED_LOGIN_KEYS = [:email, 'email', :username, 'username', :login, 'login'].freeze
+          PRIORITY_ORDERED_ID_KEYS = [:id, "id", :uuid, "uuid"].freeze
+          PRIORITY_ORDERED_LOGIN_KEYS = [:email, "email", :username, "username", :login, "login"].freeze
 
           def initialize(mode:)
             @mode = mode

data/lib/datadog/appsec/contrib/devise/ext.rb

@@ -6,28 +6,28 @@ module Datadog
       module Devise
         # Devise integration constants
         module Ext
-          EVENT_LOGIN_SUCCESS = 'users.login.success'
-          EVENT_LOGIN_FAILURE = 'users.login.failure'
-          EVENT_SIGNUP = 'users.signup'
+          EVENT_LOGIN_SUCCESS = "users.login.success"
+          EVENT_LOGIN_FAILURE = "users.login.failure"
+          EVENT_SIGNUP = "users.signup"
 
-          TAG_DD_USR_ID = '_dd.appsec.usr.id'
-          TAG_DD_USR_LOGIN = '_dd.appsec.usr.login'
-          TAG_DD_SIGNUP_MODE = '_dd.appsec.events.users.signup.auto.mode'
-          TAG_DD_COLLECTION_MODE = '_dd.appsec.user.collection_mode'
-          TAG_DD_LOGIN_SUCCESS_MODE = '_dd.appsec.events.users.login.success.auto.mode'
-          TAG_DD_LOGIN_FAILURE_MODE = '_dd.appsec.events.users.login.failure.auto.mode'
+          TAG_DD_USR_ID = "_dd.appsec.usr.id"
+          TAG_DD_USR_LOGIN = "_dd.appsec.usr.login"
+          TAG_DD_SIGNUP_MODE = "_dd.appsec.events.users.signup.auto.mode"
+          TAG_DD_COLLECTION_MODE = "_dd.appsec.user.collection_mode"
+          TAG_DD_LOGIN_SUCCESS_MODE = "_dd.appsec.events.users.login.success.auto.mode"
+          TAG_DD_LOGIN_FAILURE_MODE = "_dd.appsec.events.users.login.failure.auto.mode"
 
-          TAG_USR_ID = 'usr.id'
-          TAG_SESSION_ID = 'usr.session_id'
-          TAG_SIGNUP_TRACK = 'appsec.events.users.signup.track'
-          TAG_SIGNUP_USR_ID = 'appsec.events.users.signup.usr.id'
-          TAG_SIGNUP_USR_LOGIN = 'appsec.events.users.signup.usr.login'
-          TAG_LOGIN_FAILURE_TRACK = 'appsec.events.users.login.failure.track'
-          TAG_LOGIN_FAILURE_USR_ID = 'appsec.events.users.login.failure.usr.id'
-          TAG_LOGIN_FAILURE_USR_LOGIN = 'appsec.events.users.login.failure.usr.login'
-          TAG_LOGIN_FAILURE_USR_EXISTS = 'appsec.events.users.login.failure.usr.exists'
-          TAG_LOGIN_SUCCESS_TRACK = 'appsec.events.users.login.success.track'
-          TAG_LOGIN_SUCCESS_USR_LOGIN = 'appsec.events.users.login.success.usr.login'
+          TAG_USR_ID = "usr.id"
+          TAG_SESSION_ID = "usr.session_id"
+          TAG_SIGNUP_TRACK = "appsec.events.users.signup.track"
+          TAG_SIGNUP_USR_ID = "appsec.events.users.signup.usr.id"
+          TAG_SIGNUP_USR_LOGIN = "appsec.events.users.signup.usr.login"
+          TAG_LOGIN_FAILURE_TRACK = "appsec.events.users.login.failure.track"
+          TAG_LOGIN_FAILURE_USR_ID = "appsec.events.users.login.failure.usr.id"
+          TAG_LOGIN_FAILURE_USR_LOGIN = "appsec.events.users.login.failure.usr.login"
+          TAG_LOGIN_FAILURE_USR_EXISTS = "appsec.events.users.login.failure.usr.exists"
+          TAG_LOGIN_SUCCESS_TRACK = "appsec.events.users.login.success.track"
+          TAG_LOGIN_SUCCESS_USR_LOGIN = "appsec.events.users.login.success.usr.login"
         end
       end
     end

data/lib/datadog/appsec/contrib/devise/integration.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
-require_relative 'patcher'
+require_relative "../integration"
+require_relative "patcher"
 
 module Datadog
   module AppSec
@@ -11,12 +11,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('3.2.1')
+          MINIMUM_VERSION = Gem::Version.new("3.2.1")
 
           register_as :devise, auto_patch: true
 
           def self.version
-            Gem.loaded_specs['devise']&.version
+            Gem.loaded_specs["devise"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/devise/patcher.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require_relative '../../../core/utils/only_once'
+require_relative "../../../core/utils/only_once"
 
-require_relative 'tracking_middleware'
-require_relative 'patches/signup_tracking_patch'
-require_relative 'patches/signin_tracking_patch'
-require_relative 'patches/skip_signin_tracking_patch'
+require_relative "tracking_middleware"
+require_relative "patches/signup_tracking_patch"
+require_relative "patches/signin_tracking_patch"
+require_relative "patches/skip_signin_tracking_patch"
 
 module Datadog
   module AppSec
@@ -32,7 +32,7 @@ module Datadog
               GUARD_ONCE_PER_APP[app].run do
                 app.middleware.insert_after(Warden::Manager, TrackingMiddleware)
               rescue RuntimeError
-                AppSec.telemetry.error('AppSec: unable to insert Devise TrackingMiddleware')
+                AppSec.telemetry.error("AppSec: unable to insert Devise TrackingMiddleware")
               end
             end
 
@@ -50,7 +50,7 @@ module Datadog
 
             if ::Devise::STRATEGIES.include?(:rememberable)
               # Rememberable strategy is required in autoloaded Rememberable model
-              require 'devise/models/rememberable'
+              require "devise/models/rememberable"
               ::Devise::Strategies::Rememberable.prepend(Patches::SkipSigninTrackingPatch)
             end
 

data/lib/datadog/appsec/contrib/devise/patches/signin_tracking_patch.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../ext'
-require_relative '../configuration'
-require_relative '../data_extractor'
-require_relative '../../../trace_keeper'
+require_relative "../ext"
+require_relative "../configuration"
+require_relative "../data_extractor"
+require_relative "../../../trace_keeper"
 
 module Datadog
   module AppSec
@@ -23,7 +23,7 @@ module Datadog
               return result unless context
 
               if context.trace.nil? || context.span.nil?
-                Datadog.logger.debug { 'AppSec: unable to track signin events, due to missing trace or span' }
+                Datadog.logger.debug { "AppSec: unable to track signin events, due to missing trace or span" }
                 return result
               end
 
@@ -31,13 +31,13 @@ module Datadog
 
               if result
                 record_successful_signin(context, resource)
-                Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_LOGIN_SUCCESS)
+                Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_LOGIN_SUCCESS)
 
                 return result
               end
 
               record_failed_signin(context, resource)
-              Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_LOGIN_FAILURE)
+              Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_LOGIN_FAILURE)
 
               result
             end
@@ -56,7 +56,7 @@ module Datadog
               end
 
               context.span[Ext::TAG_LOGIN_SUCCESS_USR_LOGIN] ||= login
-              context.span[Ext::TAG_LOGIN_SUCCESS_TRACK] = 'true'
+              context.span[Ext::TAG_LOGIN_SUCCESS_TRACK] = "true"
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_DD_LOGIN_SUCCESS_MODE] = Configuration.auto_user_instrumentation_mode
 
@@ -64,14 +64,14 @@ module Datadog
               #       and because of that we will trigger an additional event even
               #       if it was already done via the SDK
               AppSec::Instrumentation.gateway.push(
-                'identity.set_user', AppSec::Instrumentation::Gateway::User.new(id, login)
+                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login)
               )
             end
 
             def record_failed_signin(context, resource)
               extractor = DataExtractor.new(mode: Configuration.auto_user_instrumentation_mode)
 
-              context.span[Ext::TAG_LOGIN_FAILURE_TRACK] = 'true'
+              context.span[Ext::TAG_LOGIN_FAILURE_TRACK] = "true"
               context.span[Ext::TAG_DD_LOGIN_FAILURE_MODE] = Configuration.auto_user_instrumentation_mode
 
               unless resource
@@ -79,7 +79,7 @@ module Datadog
 
                 context.span[Ext::TAG_DD_USR_LOGIN] = login
                 context.span[Ext::TAG_LOGIN_FAILURE_USR_LOGIN] ||= login
-                context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= 'false'
+                context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= "false"
 
                 return
               end
@@ -94,7 +94,7 @@ module Datadog
 
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_LOGIN_FAILURE_USR_LOGIN] ||= login
-              context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= 'true'
+              context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= "true"
             end
           end
         end

data/lib/datadog/appsec/contrib/devise/patches/signup_tracking_patch.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../ext'
-require_relative '../configuration'
-require_relative '../data_extractor'
-require_relative '../../../trace_keeper'
+require_relative "../ext"
+require_relative "../configuration"
+require_relative "../data_extractor"
+require_relative "../../../trace_keeper"
 
 module Datadog
   module AppSec
@@ -21,7 +21,7 @@ module Datadog
                 context = AppSec.active_context
 
                 if context.trace.nil? || context.span.nil?
-                  Datadog.logger.debug { 'AppSec: unable to track signup events, due to missing trace or span' }
+                  Datadog.logger.debug { "AppSec: unable to track signup events, due to missing trace or span" }
                   next yield(resource) if block_given?
                 end
 
@@ -29,7 +29,7 @@ module Datadog
 
                 TraceKeeper.keep!(context.trace)
                 record_successful_signup(context, resource)
-                Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_SIGNUP)
+                Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_SIGNUP)
 
                 yield(resource) if block_given?
               end
@@ -43,7 +43,7 @@ module Datadog
               id = extractor.extract_id(resource)
               login = extractor.extract_login(resource_params) || extractor.extract_login(resource)
 
-              context.span[Ext::TAG_SIGNUP_TRACK] = 'true'
+              context.span[Ext::TAG_SIGNUP_TRACK] = "true"
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_SIGNUP_USR_LOGIN] ||= login
               context.span[Ext::TAG_DD_SIGNUP_MODE] = Configuration.auto_user_instrumentation_mode
@@ -59,7 +59,7 @@ module Datadog
               #       and because of that we will trigger an additional event even
               #       if it was already done via the SDK
               AppSec::Instrumentation.gateway.push(
-                'identity.set_user', AppSec::Instrumentation::Gateway::User.new(id, login)
+                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login)
               )
             end
           end