datadog 2.38.0 → 2.39.0

data/lib/datadog/appsec/contrib/rack/gateway/request.rb

@@ -1,9 +1,10 @@
 # frozen_string_literal: true
 
-require_relative '../input_peeker'
-require_relative '../../../instrumentation/gateway/argument'
-require_relative '../../../../core/header_collection'
-require_relative '../../../../tracing/client_ip'
+require_relative "../input_peeker"
+require_relative "../../../instrumentation/gateway/argument"
+require_relative "../../../utils/http/url_encoded"
+require_relative "../../../../core/header_collection"
+require_relative "../../../../tracing/client_ip"
 
 module Datadog
   module AppSec
@@ -24,12 +25,7 @@ module Datadog
             end
 
             def query
-              ::Rack::Utils.parse_query(request.query_string)
-            rescue => e
-              Datadog.logger.debug { "AppSec: Failed to parse request query string: #{e.class}: #{e.message}" }
-              AppSec.telemetry.report(e, description: 'AppSec: Failed to parse request query string')
-
-              {}
+              Utils::HTTP::URLEncoded.parse(request.query_string)
             end
 
             def method
@@ -38,12 +34,12 @@ module Datadog
 
             def headers
               result = request.env.each_with_object({}) do |(k, v), h|
-                h[k.delete_prefix('HTTP_').tap(&:downcase!).tap { |s| s.tr!('_', '-') }] = v if k.start_with?('HTTP_')
+                h[k.delete_prefix("HTTP_").tap(&:downcase!).tap { |s| s.tr!("_", "-") }] = v if k.start_with?("HTTP_")
               end
 
-              result['content-type'] = request.content_type if request.content_type
+              result["content-type"] = request.content_type if request.content_type
               # Since Rack 3.1, content-length is nil if the body is empty, but we still want to send it to the WAF.
-              result['content-length'] = request.content_length || '0'
+              result["content-length"] = request.content_length || "0"
               result
             end
 
@@ -72,7 +68,7 @@ module Datadog
             end
 
             def remote_addr
-              env['REMOTE_ADDR']
+              env["REMOTE_ADDR"]
             end
 
             def form_hash
@@ -82,10 +78,10 @@ module Datadog
 
               # usually Hash[String, String] but can be a more complex
               # Hash[String, (String|Array|Hash)] when e.g coming from JSON
-              env['rack.request.form_hash']
+              env["rack.request.form_hash"]
             rescue => e
               Datadog.logger.debug { "AppSec: Failed to parse request body: #{e.class}: #{e.message}" }
-              AppSec.telemetry.report(e, description: 'AppSec: Failed to parse request body')
+              AppSec.telemetry.report(e, description: "AppSec: Failed to parse request body")
 
               nil
             end
@@ -112,7 +108,7 @@ module Datadog
 
               # NOTE: A parsed-body cache without a raw byte count means the input
               #       stream was consumed before measurement, consider it unknown-length
-              return if env.key?('rack.request.form_hash')
+              return if env.key?("rack.request.form_hash")
 
               InputPeeker.peek_bytesize(env, limit: limit)
             end
@@ -123,7 +119,7 @@ module Datadog
             # NOTE: Rack does not parse JSON itself, a body parser middleware such as
             #       {Rack::JSONBodyParser} populates the form hash read by {#form_hash}
             def collectable_body?
-              request.form_data? || request.parseable_data? || env.key?('rack.request.form_hash')
+              request.form_data? || request.parseable_data? || env.key?("rack.request.form_hash")
             end
 
             def client_ip

data/lib/datadog/appsec/contrib/rack/gateway/response.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../../../instrumentation/gateway/argument'
+require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require_relative '../ext'
-require_relative '../../../event'
-require_relative '../../../trace_keeper'
-require_relative '../../../security_event'
-require_relative '../../../instrumentation/gateway'
+require_relative "../ext"
+require_relative "../../../event"
+require_relative "../../../trace_keeper"
+require_relative "../../../security_event"
+require_relative "../../../instrumentation/gateway"
 
 module Datadog
   module AppSec
@@ -24,17 +24,17 @@ module Datadog
               end
 
               def watch_request(gateway = Instrumentation.gateway)
-                gateway.watch('rack.request') do |stack, gateway_request|
+                gateway.watch("rack.request") do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
 
                   persistent_data = {
-                    'server.request.cookies' => gateway_request.cookies,
-                    'server.request.query' => gateway_request.query,
-                    'server.request.uri.raw' => gateway_request.fullpath,
-                    'server.request.headers' => gateway_request.headers,
-                    'server.request.headers.no_cookies' => gateway_request.headers.dup.tap { |h| h.delete('cookie') },
-                    'http.client_ip' => gateway_request.client_ip,
-                    'server.request.method' => gateway_request.method
+                    "server.request.cookies" => gateway_request.cookies,
+                    "server.request.query" => gateway_request.query,
+                    "server.request.uri.raw" => gateway_request.fullpath,
+                    "server.request.headers" => gateway_request.headers,
+                    "server.request.headers.no_cookies" => gateway_request.headers.dup.tap { |h| h.delete("cookie") },
+                    "http.client_ip" => gateway_request.client_ip,
+                    "server.request.method" => gateway_request.method
                   }
 
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
@@ -57,13 +57,13 @@ module Datadog
               end
 
               def watch_response(gateway = Instrumentation.gateway)
-                gateway.watch('rack.response') do |stack, gateway_response|
+                gateway.watch("rack.response") do |stack, gateway_response|
                   context = gateway_response.context
 
                   persistent_data = {
-                    'server.response.status' => gateway_response.status.to_s,
-                    'server.response.headers' => gateway_response.headers,
-                    'server.response.headers.no_cookies' => gateway_response.headers.dup.tap { |h| h.delete('set-cookie') }
+                    "server.response.status" => gateway_response.status.to_s,
+                    "server.response.headers" => gateway_response.headers,
+                    "server.response.headers.no_cookies" => gateway_response.headers.dup.tap { |h| h.delete("set-cookie") }
                   }
 
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
@@ -84,7 +84,7 @@ module Datadog
               end
 
               def watch_request_body(gateway = Instrumentation.gateway)
-                gateway.watch('rack.request.body') do |stack, gateway_request|
+                gateway.watch("rack.request.body") do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
 
                   request = gateway_request.request
@@ -98,16 +98,16 @@ module Datadog
                   byte_length = gateway_request.body_bytesize(limit)
 
                   if byte_length
-                    persistent_data['server.request.body.byte_length'] = byte_length
+                    persistent_data["server.request.body.byte_length"] = byte_length
 
                     if byte_length <= limit
                       body = gateway_request.form_hash
-                      persistent_data['server.request.body'] = body if body
+                      persistent_data["server.request.body"] = body if body
                     end
                   # NOTE: Body was parsed before measurement, keep byte_length unset
-                  elsif gateway_request.env.key?('rack.request.form_hash')
-                    body = gateway_request.env['rack.request.form_hash']
-                    persistent_data['server.request.body'] = body if body
+                  elsif gateway_request.env.key?("rack.request.form_hash")
+                    body = gateway_request.env["rack.request.form_hash"]
+                    persistent_data["server.request.body"] = body if body
                   end
 
                   next stack.call(request) if persistent_data.empty?
@@ -134,7 +134,7 @@ module Datadog
               #       somewhere closer to identity related monitor.
               # WARNING: The Gateway is a subject of refactoring
               def watch_request_finish(gateway = Instrumentation.gateway)
-                gateway.watch('rack.request.finish') do |stack, gateway_request|
+                gateway.watch("rack.request.finish") do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
 
                   next stack.call(gateway_request.request) if context.span.nil?

data/lib/datadog/appsec/contrib/rack/input_peeker.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require 'stringio'
-require_relative 'buffered_input'
-require_relative '../../utils/http/body_reader'
+require "stringio"
+require_relative "buffered_input"
+require_relative "../../utils/http/body_reader"
 
 module Datadog
   module AppSec
@@ -30,7 +30,7 @@ module Datadog
           #   `limit`, including `0`; `nil` when input is missing, over the
           #   limit, or cannot be preserved for downstream reads
           def peek_bytesize(env, limit:)
-            rack_input = env['rack.input']
+            rack_input = env["rack.input"]
             return unless rack_input
 
             rewindable = rewind? && rack_input.respond_to?(:rewind)
@@ -49,7 +49,7 @@ module Datadog
               #       a partially consumed body. Treat it as not safely collectable
               return unless rewind(rack_input)
             else
-              env['rack.input'] = if over_limit
+              env["rack.input"] = if over_limit
                 BufferedInput.new(rack_input, buffer: StringIO.new(buffer))
               else
                 StringIO.new(buffer)
@@ -62,7 +62,7 @@ module Datadog
           private_class_method def rewind?
             return @rewind if defined?(@rewind)
 
-            @rewind = ::Gem::Version.new(::Rack.release) < ::Gem::Version.new('3')
+            @rewind = ::Gem::Version.new(::Rack.release) < ::Gem::Version.new("3")
           end
 
           private_class_method def rewind(io)

data/lib/datadog/appsec/contrib/rack/integration.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
+require_relative "../integration"
 
-require_relative 'patcher'
-require_relative 'request_middleware'
-require_relative 'request_body_middleware'
+require_relative "patcher"
+require_relative "request_middleware"
+require_relative "request_body_middleware"
 
 module Datadog
   module AppSec
@@ -14,12 +14,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('1.1.0')
+          MINIMUM_VERSION = Gem::Version.new("1.1.0")
 
           register_as :rack, auto_patch: false
 
           def self.version
-            Gem.loaded_specs['rack']&.version
+            Gem.loaded_specs["rack"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/rack/patcher.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../monitor'
-require_relative 'gateway/watcher'
+require_relative "../../monitor"
+require_relative "gateway/watcher"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative 'gateway/request'
-require_relative '../../instrumentation/gateway'
-require_relative '../../response'
+require_relative "gateway/request"
+require_relative "../../instrumentation/gateway"
+require_relative "../../response"
 
 module Datadog
   module AppSec
@@ -25,14 +25,14 @@ module Datadog
 
             http_response = nil
             interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
-              http_response, _request = Instrumentation.gateway.push('rack.request.body', Gateway::Request.new(env)) do
+              http_response, _request = Instrumentation.gateway.push("rack.request.body", Gateway::Request.new(env)) do
                 @app.call(env)
               end
 
               nil
             end
 
-            return AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack if interrupt_params
+            return AppSec::Response.from_interrupt_params(interrupt_params, env["HTTP_ACCEPT"]).to_rack if interrupt_params
 
             http_response
           end

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -1,22 +1,22 @@
 # frozen_string_literal: true
 
-require 'json'
+require "json"
 
-require_relative 'response_body'
-require_relative 'gateway/request'
-require_relative 'gateway/response'
+require_relative "response_body"
+require_relative "gateway/request"
+require_relative "gateway/response"
 
-require_relative '../../event'
-require_relative '../../response'
-require_relative '../../api_security'
-require_relative '../../default_header_tags'
-require_relative '../../route_normalizer'
-require_relative '../../security_event'
-require_relative '../../instrumentation/gateway'
+require_relative "../../event"
+require_relative "../../response"
+require_relative "../../api_security"
+require_relative "../../default_header_tags"
+require_relative "../../route_normalizer"
+require_relative "../../security_event"
+require_relative "../../instrumentation/gateway"
 
-require_relative '../../../core/header_collection'
-require_relative '../../../tracing/client_ip'
-require_relative '../../../tracing/contrib/rack/header_collection'
+require_relative "../../../core/header_collection"
+require_relative "../../../tracing/client_ip"
+require_relative "../../../tracing/contrib/rack/header_collection"
 
 module Datadog
   module AppSec
@@ -63,7 +63,7 @@ module Datadog
             interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
               # TODO: This event should be renamed into `rack.request.start` to
               #       reflect that it's the beginning of the request-cycle
-              http_response, _gateway_request = Instrumentation.gateway.push('rack.request', gateway_request) do
+              http_response, _gateway_request = Instrumentation.gateway.push("rack.request", gateway_request) do
                 @app.call(env)
               end
 
@@ -71,8 +71,8 @@ module Datadog
                 http_response[2], http_response[0], http_response[1], context: ctx
               )
 
-              Instrumentation.gateway.push('rack.request.finish', gateway_request)
-              Instrumentation.gateway.push('rack.response', gateway_response)
+              Instrumentation.gateway.push("rack.request.finish", gateway_request)
+              Instrumentation.gateway.push("rack.response", gateway_response)
 
               nil
             end
@@ -81,7 +81,7 @@ module Datadog
 
             if interrupt_params
               ctx.mark_as_interrupted!
-              http_response = AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack
+              http_response = AppSec::Response.from_interrupt_params(interrupt_params, env["HTTP_ACCEPT"]).to_rack
             end
 
             # NOTE: This is not optimal, but in the current implementation
@@ -148,18 +148,18 @@ module Datadog
             return unless trace && span
 
             span.set_metric(Datadog::AppSec::Ext::TAG_APPSEC_ENABLED, 1)
-            span.set_tag('_dd.runtime_family', 'ruby')
-            span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
+            span.set_tag("_dd.runtime_family", "ruby")
+            span.set_tag("_dd.appsec.waf.version", Datadog::AppSec::WAF::VERSION::BASE_STRING)
 
             if context.waf_runner_ruleset_version
-              span.set_tag('_dd.appsec.event_rules.version', context.waf_runner_ruleset_version)
+              span.set_tag("_dd.appsec.event_rules.version", context.waf_runner_ruleset_version)
 
               unless oneshot_tags_sent?
                 # Small race condition, but it's inoccuous: worst case the tags
                 # are sent a couple of times more than expected
                 @oneshot_tags_sent = true
 
-                span.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(context.waf_runner_known_addresses))
+                span.set_tag("_dd.appsec.event_rules.addresses", JSON.dump(context.waf_runner_known_addresses))
 
                 # Ensure these tags reach the backend
                 trace.keep!
@@ -182,7 +182,7 @@ module Datadog
             if span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
               # always collect client ip, as this is part of AppSec provided functionality
               Datadog::Tracing::ClientIp.set_client_ip_tag!(
-                span, headers: headers, remote_ip: env['REMOTE_ADDR']
+                span, headers: headers, remote_ip: env["REMOTE_ADDR"]
               )
             end
           end
@@ -195,9 +195,9 @@ module Datadog
               span, Datadog::Core::HeaderCollection.from_hash(response.headers)
             )
 
-            unless response.headers.key?('content-length')
+            unless response.headers.key?("content-length")
               length = ResponseBody.content_length(response.body)
-              span.set_tag('http.response.headers.content-length', length.to_s) if length
+              span.set_tag("http.response.headers.content-length", length.to_s) if length
             end
           end
 
@@ -212,7 +212,7 @@ module Datadog
 
             # NOTE: To build full path that covers mounted engines we need to add
             #       pre-computed by Tracer route path tag to the normalized route
-            prefix = context.trace&.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH) || env['SCRIPT_NAME']
+            prefix = context.trace&.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE_PATH) || env["SCRIPT_NAME"]
             normalized_route = RouteNormalizer.extract_normalized_route(env, prefix: prefix, pattern: pattern)
             return unless normalized_route
 

data/lib/datadog/appsec/contrib/rack/response_body.rb

@@ -25,7 +25,7 @@ module Datadog
 
             body_ary.sum { |part| part.is_a?(String) ? part.bytesize : 0 }
           rescue => e
-            AppSec.telemetry.report(e, description: 'AppSec: Failed to compute body content length')
+            AppSec.telemetry.report(e, description: "AppSec: Failed to compute body content length")
 
             nil
           end

data/lib/datadog/appsec/contrib/rails/gateway/request.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../rack/input_peeker'
-require_relative '../../../instrumentation/gateway/argument'
+require_relative "../../rack/input_peeker"
+require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
   module AppSec
@@ -44,17 +44,17 @@ module Datadog
               # usually Hash<String,String> but can be a more complex
               # Hash<String,String||Array||Hash> when e.g coming from JSON or
               # with Rails advanced param square bracket parsing
-              body = request.env['action_dispatch.request.request_parameters']
+              body = request.env["action_dispatch.request.request_parameters"]
 
               return if body.nil?
-              return body unless request.env['action_dispatch.request.path_parameters']
+              return body unless request.env["action_dispatch.request.path_parameters"]
 
               body.reject do |k, _v|
-                request.env['action_dispatch.request.path_parameters'].key?(k)
+                request.env["action_dispatch.request.path_parameters"].key?(k)
               end
             rescue => e
               Datadog.logger.debug { "AppSec: Failed to parse request body: #{e.class}: #{e.message}" }
-              AppSec.telemetry.report(e, description: 'AppSec: Failed to parse request body')
+              AppSec.telemetry.report(e, description: "AppSec: Failed to parse request body")
 
               nil
             end
@@ -62,7 +62,7 @@ module Datadog
             def route_params
               excluded = [:controller, :action]
 
-              request.env.fetch('action_dispatch.request.path_parameters', {}).reject do |k, _v|
+              request.env.fetch("action_dispatch.request.path_parameters", {}).reject do |k, _v|
                 excluded.include?(k)
               end
             end
@@ -74,10 +74,10 @@ module Datadog
             #       raw posted data, raw form vars, size if known, raw
             #       Content-Length, then buffering to the limit if unknown-length
             def body_bytesize(limit)
-              raw_body = env['RAW_POST_DATA']
+              raw_body = env["RAW_POST_DATA"]
               return raw_body.bytesize if raw_body
 
-              form_vars = env['rack.request.form_vars']
+              form_vars = env["rack.request.form_vars"]
               return form_vars.bytesize if form_vars
 
               io = request.body
@@ -86,7 +86,7 @@ module Datadog
 
               # NOTE: Read raw `CONTENT_LENGTH` as {ActionDispatch::Request#content_length}
               #       drains `rack.input` into `RAW_POST_DATA` on chunked Transfer-Encoding
-              content_length = env['CONTENT_LENGTH']
+              content_length = env["CONTENT_LENGTH"]
               return content_length.to_i if content_length
 
               # NOTE: An already-read body (e.g. late-parsed multipart on Rack 3+) peeks

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../../../event'
-require_relative '../../../trace_keeper'
-require_relative '../../../security_event'
-require_relative '../../../instrumentation/gateway'
+require_relative "../../../event"
+require_relative "../../../trace_keeper"
+require_relative "../../../security_event"
+require_relative "../../../instrumentation/gateway"
 
 module Datadog
   module AppSec
@@ -21,12 +21,12 @@ module Datadog
               end
 
               def watch_request_action(gateway = Instrumentation.gateway)
-                gateway.watch('rails.request.action') do |stack, gateway_request|
+                gateway.watch("rails.request.action") do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
                   limit = Datadog.configuration.appsec.body_parsing_size_limit
 
                   persistent_data = {
-                    'server.request.path_params' => gateway_request.route_params
+                    "server.request.path_params" => gateway_request.route_params
                   }
 
                   unless limit.zero?
@@ -36,11 +36,11 @@ module Datadog
                       # NOTE: Params may be parsed before this hook, leaving the
                       #       body stream at EOF. Keep byte_length unset for that
                       #       case, but still inspect cached params
-                      persistent_data['server.request.body.byte_length'] = byte_length if byte_length.positive?
+                      persistent_data["server.request.body.byte_length"] = byte_length if byte_length.positive?
 
                       if byte_length <= limit
                         body = gateway_request.parsed_body
-                        persistent_data['server.request.body'] = body unless body.nil? || body.empty?
+                        persistent_data["server.request.body"] = body unless body.nil? || body.empty?
                       end
                     end
                   end
@@ -63,11 +63,11 @@ module Datadog
               end
 
               def watch_response_body_json(gateway = Instrumentation.gateway)
-                gateway.watch('rails.response.body.json') do |stack, container|
+                gateway.watch("rails.response.body.json") do |stack, container|
                   context = container.context
 
                   persistent_data = {
-                    'server.response.body' => container.data
+                    "server.response.body" => container.data
                   }
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 

data/lib/datadog/appsec/contrib/rails/integration.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
+require_relative "../integration"
 
-require_relative 'patcher'
-require_relative 'request_middleware'
+require_relative "patcher"
+require_relative "request_middleware"
 
 module Datadog
   module AppSec
@@ -13,12 +13,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('4')
+          MINIMUM_VERSION = Gem::Version.new("4")
 
           register_as :rails, auto_patch: false
 
           def self.version
-            Gem.loaded_specs['railties']&.version
+            Gem.loaded_specs["railties"]&.version
           end
 
           def self.loaded?