datadog 2.38.0 → 2.39.0

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -1,18 +1,18 @@
 # frozen_string_literal: true
 
-require_relative '../../../core/utils/only_once'
+require_relative "../../../core/utils/only_once"
 
-require_relative 'framework'
-require_relative '../../response'
-require_relative '../rack/request_middleware'
-require_relative '../rack/request_body_middleware'
-require_relative 'gateway/watcher'
-require_relative 'gateway/request'
-require_relative 'patches/render_to_body_patch'
-require_relative 'patches/process_action_patch'
-require_relative '../../api_security/endpoint_collection/rails_collector'
+require_relative "framework"
+require_relative "../../response"
+require_relative "../rack/request_middleware"
+require_relative "../rack/request_body_middleware"
+require_relative "gateway/watcher"
+require_relative "gateway/request"
+require_relative "patches/render_to_body_patch"
+require_relative "patches/process_action_patch"
+require_relative "../../api_security/endpoint_collection/rails_collector"
 
-require_relative '../../../tracing/contrib/rack/middlewares'
+require_relative "../../../tracing/contrib/rack/middlewares"
 
 module Datadog
   module AppSec
@@ -108,7 +108,7 @@ module Datadog
           end
 
           def inspect_middlewares(app)
-            Datadog.logger.debug { +'Rails middlewares: ' << app.middleware.map(&:inspect).inspect }
+            Datadog.logger.debug { +"Rails middlewares: " << app.middleware.map(&:inspect).inspect }
           end
 
           def patch_after_initialize
@@ -133,11 +133,11 @@ module Datadog
               end
 
               # Rails 7.1 adds `after_routes_loaded` hook
-              if Datadog::AppSec::Contrib::Rails::Patcher.target_version < Gem::Version.new('7.1')
+              if Datadog::AppSec::Contrib::Rails::Patcher.target_version < Gem::Version.new("7.1")
                 Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(::Rails.application.routes.routes)
               end
             rescue => e
-              error_message = 'Failed to get application routes'
+              error_message = "Failed to get application routes"
               Datadog.logger.error("#{error_message}, #{e.class}: #{e.message}")
               AppSec.telemetry.report(e, description: error_message)
             end
@@ -147,7 +147,7 @@ module Datadog
             ::ActiveSupport.on_load(:after_routes_loaded) do
               Datadog::AppSec::Contrib::Rails::Patcher.report_routes_via_telemetry(::Rails.application.routes.routes)
             rescue => e
-              error_message = 'Failed to get application routes'
+              error_message = "Failed to get application routes"
               Datadog.logger.error("#{error_message}, #{e.class}: #{e.message}")
               AppSec.telemetry.report(e, description: error_message)
             end
@@ -156,7 +156,7 @@ module Datadog
           def report_routes_via_telemetry(routes)
             # We do not support Rails 4.x for Endpoint Collection,
             # mainly because the Route#verb was a Regexp before Rails 5.0
-            return if target_version < Gem::Version.new('5.0')
+            return if target_version < Gem::Version.new("5.0")
             return unless Datadog.configuration.appsec.api_security.endpoint_collection.enabled
             return unless AppSec.telemetry
 
@@ -166,7 +166,7 @@ module Datadog
               )
             end
           rescue => e
-            AppSec.telemetry&.report(e, description: 'failed to report application endpoints')
+            AppSec.telemetry&.report(e, description: "failed to report application endpoints")
           end
 
           def setup_security

data/lib/datadog/appsec/contrib/rails/patches/process_action_patch.rb

@@ -11,11 +11,11 @@ module Datadog
               context = request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
               return super unless context
 
-              context.state[:web_framework] = 'rails'
+              context.state[:web_framework] = "rails"
 
               # TODO: handle exceptions, except for super
               gateway_request = Gateway::Request.new(request)
-              http_response, _gateway_request = Instrumentation.gateway.push('rails.request.action', gateway_request) do
+              http_response, _gateway_request = Instrumentation.gateway.push("rails.request.action", gateway_request) do
                 super
               end
 

data/lib/datadog/appsec/contrib/rails/patches/render_to_body_patch.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../../utils/hash_coercion'
-require_relative '../../../instrumentation/gateway/argument'
+require_relative "../../../utils/hash_coercion"
+require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
   module AppSec
@@ -21,7 +21,7 @@ module Datadog
               return super unless data
 
               container = Instrumentation::Gateway::DataContainer.new(data, context: context)
-              Instrumentation.gateway.push('rails.response.body.json', container)
+              Instrumentation.gateway.push("rails.response.body.json", container)
 
               super
             end

data/lib/datadog/appsec/contrib/rails/request.rb

@@ -13,19 +13,19 @@ module Datadog
             # usually Hash<String,String> but can be a more complex
             # Hash<String,String||Array||Hash> when e.g coming from JSON or
             # with Rails advanced param square bracket parsing
-            body = request.env['action_dispatch.request.request_parameters']
+            body = request.env["action_dispatch.request.request_parameters"]
 
             return if body.nil?
 
             body.reject do |k, _v|
-              request.env['action_dispatch.request.path_parameters'].key?(k)
+              request.env["action_dispatch.request.path_parameters"].key?(k)
             end
           end
 
           def self.route_params(request)
             excluded = [:controller, :action]
 
-            request.env['action_dispatch.request.path_parameters'].reject do |k, _v|
+            request.env["action_dispatch.request.path_parameters"].reject do |k, _v|
               excluded.include?(k)
             end
           end

data/lib/datadog/appsec/contrib/rest_client/integration.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
-require_relative 'patcher'
+require_relative "../integration"
+require_relative "patcher"
 
 module Datadog
   module AppSec
@@ -11,16 +11,16 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('1.8')
+          MINIMUM_VERSION = Gem::Version.new("1.8")
 
           register_as :rest_client
 
           def self.gem_name
-            'rest-client'
+            "rest-client"
           end
 
           def self.version
-            Gem.loaded_specs['rest-client']&.version
+            Gem.loaded_specs["rest-client"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/rest_client/patcher.rb

@@ -17,7 +17,7 @@ module Datadog
           end
 
           def patch
-            require_relative 'request_ssrf_detection_patch'
+            require_relative "request_ssrf_detection_patch"
 
             ::RestClient::Request.prepend(RequestSSRFDetectionPatch)
 

data/lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require_relative '../../event'
-require_relative '../../trace_keeper'
-require_relative '../../security_event'
-require_relative '../../utils/http/body'
-require_relative '../../utils/http/body_reader'
-require_relative '../../utils/http/media_type'
+require_relative "../../event"
+require_relative "../../trace_keeper"
+require_relative "../../security_event"
+require_relative "../../utils/http/body"
+require_relative "../../utils/http/body_reader"
+require_relative "../../utils/http/media_type"
 
 module Datadog
   module AppSec
@@ -22,9 +22,9 @@ module Datadog
             headers = normalize_request_headers
             # @type var ephemeral_data: ::Datadog::AppSec::Context::input_data
             ephemeral_data = {
-              'server.io.net.url' => url,
-              'server.io.net.request.method' => method.to_s.upcase,
-              'server.io.net.request.headers' => headers
+              "server.io.net.url" => url,
+              "server.io.net.request.method" => method.to_s.upcase,
+              "server.io.net.request.headers" => headers
             }
 
             is_redirect = context.state[:downstream_redirect_url] == url
@@ -36,8 +36,8 @@ module Datadog
             end
 
             if !is_redirect && sample_body
-              body = parse_request_body(payload, content_type: headers['content-type'])
-              ephemeral_data['server.io.net.request.body'] = body if body
+              body = parse_request_body(payload, content_type: headers["content-type"])
+              ephemeral_data["server.io.net.request.body"] = body if body
             end
 
             timeout = Datadog.configuration.appsec.waf_timeout
@@ -67,16 +67,16 @@ module Datadog
             headers = normalize_response_headers(response)
             # @type var ephemeral_data: ::Datadog::AppSec::Context::input_data
             ephemeral_data = {
-              'server.io.net.response.status' => response.code.to_s,
-              'server.io.net.response.headers' => headers
+              "server.io.net.response.status" => response.code.to_s,
+              "server.io.net.response.headers" => headers
             }
 
-            is_redirect = REDIRECT_STATUS_CODES.cover?(response.code.to_i) && headers.key?('location')
-            context.state[:downstream_redirect_url] = URI.join(url, headers['location']).to_s if is_redirect && sample_body
+            is_redirect = REDIRECT_STATUS_CODES.cover?(response.code.to_i) && headers.key?("location")
+            context.state[:downstream_redirect_url] = URI.join(url, headers["location"]).to_s if is_redirect && sample_body
 
             if sample_body && !is_redirect
               body = parse_response_body(response.body, headers: headers, context: context)
-              ephemeral_data['server.io.net.response.body'] = body if body
+              ephemeral_data["server.io.net.response.body"] = body if body
             end
 
             timeout = Datadog.configuration.appsec.waf_timeout
@@ -104,25 +104,25 @@ module Datadog
             content = read_body(body, limit: limit)
             return if content.nil? || content.bytesize > limit
 
-            Utils::HTTP::Body.parse(content, media_type: media_type)
+            Utils::HTTP::Body.parse(content, media_type: media_type, limit: limit)
           end
 
           def parse_response_body(body, headers:, context:)
             return unless readable_body?(body)
 
-            media_type = Utils::HTTP::MediaType.parse(headers['content-type'])
-            if !media_type || media_type.type != 'application'
+            media_type = Utils::HTTP::MediaType.parse(headers["content-type"])
+            if !media_type || media_type.type != "application"
               context.metrics.record_ignored_downstream_response_body(:content_type_invalid)
               return
             end
 
             subtype = media_type.subtype
-            if subtype != 'json' && !subtype.end_with?('+json') && subtype != 'x-www-form-urlencoded'
+            if subtype != "json" && !subtype.end_with?("+json") && subtype != "x-www-form-urlencoded"
               context.metrics.record_ignored_downstream_response_body(:content_type_invalid)
               return
             end
 
-            content_length_value = headers['content-length']
+            content_length_value = headers["content-length"]
             if !content_length_value.is_a?(String) || !content_length_value.match?(/\A[1-9][0-9]*\z/)
               context.metrics.record_ignored_downstream_response_body(:content_length_missing)
               return
@@ -143,7 +143,7 @@ module Datadog
               return
             end
 
-            Utils::HTTP::Body.parse(content, media_type: media_type)
+            Utils::HTTP::Body.parse(content, media_type: media_type, limit: content_length)
           end
 
           def readable_body?(body)
@@ -173,7 +173,7 @@ module Datadog
           #        type and it failed with "Cannot allow block body" error
           def normalize_response_headers(response) # steep:ignore MethodBodyTypeMismatch
             response.net_http_res.to_hash
-              .transform_values! { |value| Array(value).join(', ') } # steep:ignore BlockBodyTypeMismatch
+              .transform_values! { |value| Array(value).join(", ") } # steep:ignore BlockBodyTypeMismatch
           end
 
           def handle(result, context:)

data/lib/datadog/appsec/contrib/sinatra/gateway/request.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../../rack/gateway/request'
+require_relative "../../rack/gateway/request"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/sinatra/gateway/route_params.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../../../instrumentation/gateway/argument'
+require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../../../event'
-require_relative '../../../trace_keeper'
-require_relative '../../../security_event'
-require_relative '../../../instrumentation/gateway'
+require_relative "../../../event"
+require_relative "../../../trace_keeper"
+require_relative "../../../security_event"
+require_relative "../../../instrumentation/gateway"
 
 module Datadog
   module AppSec
@@ -22,10 +22,10 @@ module Datadog
               end
 
               def watch_request_dispatch(gateway = Instrumentation.gateway)
-                gateway.watch('sinatra.request.dispatch') do |stack, gateway_request|
+                gateway.watch("sinatra.request.dispatch") do |stack, gateway_request|
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY] # : Context
 
-                  context.state[:web_framework] = 'sinatra'
+                  context.state[:web_framework] = "sinatra"
 
                   request = gateway_request.request
                   next stack.call(request) unless gateway_request.collectable_body?
@@ -38,16 +38,16 @@ module Datadog
                   byte_length = gateway_request.body_bytesize(limit)
 
                   if byte_length
-                    persistent_data['server.request.body.byte_length'] = byte_length
+                    persistent_data["server.request.body.byte_length"] = byte_length
 
                     if byte_length <= limit
                       body = gateway_request.form_hash
-                      persistent_data['server.request.body'] = body if body
+                      persistent_data["server.request.body"] = body if body
                     end
                   # NOTE: Body was parsed before measurement, keep byte_length unset
-                  elsif gateway_request.env.key?('rack.request.form_hash')
-                    body = gateway_request.env['rack.request.form_hash']
-                    persistent_data['server.request.body'] = body if body
+                  elsif gateway_request.env.key?("rack.request.form_hash")
+                    body = gateway_request.env["rack.request.form_hash"]
+                    persistent_data["server.request.body"] = body if body
                   end
 
                   next stack.call(request) if persistent_data.empty?
@@ -72,12 +72,12 @@ module Datadog
               end
 
               def watch_request_routed(gateway = Instrumentation.gateway)
-                gateway.watch('sinatra.request.routed') do |stack, args|
+                gateway.watch("sinatra.request.routed") do |stack, args|
                   gateway_request, gateway_route_params = args # : [Gateway::Request, Gateway::RouteParams]
                   context = gateway_request.env[AppSec::Ext::CONTEXT_KEY] # : Context
 
                   persistent_data = {
-                    'server.request.path_params' => gateway_route_params.params
+                    "server.request.path_params" => gateway_route_params.params
                   }
 
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
@@ -98,11 +98,11 @@ module Datadog
               end
 
               def watch_response_body_json(gateway = Instrumentation.gateway)
-                gateway.watch('sinatra.response.body.json') do |stack, container|
+                gateway.watch("sinatra.response.body.json") do |stack, container|
                   context = container.context # : Context
 
                   persistent_data = {
-                    'server.response.body' => container.data
+                    "server.response.body" => container.data
                   }
                   result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 

data/lib/datadog/appsec/contrib/sinatra/integration.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
+require_relative "../integration"
 
-require_relative 'patcher'
-require_relative 'request_middleware'
+require_relative "patcher"
+require_relative "request_middleware"
 
 module Datadog
   module AppSec
@@ -13,12 +13,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('1.4.0')
+          MINIMUM_VERSION = Gem::Version.new("1.4.0")
 
           register_as :sinatra
 
           def self.version
-            Gem.loaded_specs['sinatra']&.version
+            Gem.loaded_specs["sinatra"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -1,15 +1,15 @@
 # frozen_string_literal: true
 
-require_relative '../../../tracing/contrib'
+require_relative "../../../tracing/contrib"
 
-require_relative '../../response'
-require_relative '../rack/request_middleware'
-require_relative 'framework'
-require_relative 'gateway/watcher'
-require_relative 'gateway/route_params'
-require_relative 'gateway/request'
-require_relative 'patches/json_patch'
-require_relative '../../../tracing/contrib/sinatra/framework'
+require_relative "../../response"
+require_relative "../rack/request_middleware"
+require_relative "framework"
+require_relative "gateway/watcher"
+require_relative "gateway/route_params"
+require_relative "gateway/request"
+require_relative "patches/json_patch"
+require_relative "../../../tracing/contrib/sinatra/framework"
 
 module Datadog
   module AppSec
@@ -59,7 +59,7 @@ module Datadog
             # TODO: handle exceptions, except for super
 
             gateway_request = Gateway::Request.new(env)
-            request_return, _gateway_request = Instrumentation.gateway.push('sinatra.request.dispatch', gateway_request) do
+            request_return, _gateway_request = Instrumentation.gateway.push("sinatra.request.dispatch", gateway_request) do
               super
             end
 
@@ -91,7 +91,7 @@ module Datadog
               gateway_request = Gateway::Request.new(env)
               gateway_route_params = Gateway::RouteParams.new(route_params)
 
-              Instrumentation.gateway.push('sinatra.request.routed', [gateway_request, gateway_route_params])
+              Instrumentation.gateway.push("sinatra.request.routed", [gateway_request, gateway_route_params])
 
               yield(*super_args)
             end

data/lib/datadog/appsec/contrib/sinatra/patches/json_patch.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../../../utils/hash_coercion'
-require_relative '../../../instrumentation/gateway/argument'
+require_relative "../../../utils/hash_coercion"
+require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
   module AppSec
@@ -19,7 +19,7 @@ module Datadog
               return super unless data
 
               container = Instrumentation::Gateway::DataContainer.new(data, context: context)
-              Instrumentation.gateway.push('sinatra.response.body.json', container)
+              Instrumentation.gateway.push("sinatra.response.body.json", container)
 
               super
             end

data/lib/datadog/appsec/counter_sampler.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../core/knuth_sampler'
+require_relative "../core/knuth_sampler"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/event.rb

@@ -1,15 +1,15 @@
 # frozen_string_literal: true
 
-require 'json'
-require_relative 'rate_limiter'
-require_relative 'trace_keeper'
-require_relative 'compressed_json'
+require "json"
+require_relative "rate_limiter"
+require_relative "trace_keeper"
+require_relative "compressed_json"
 
 module Datadog
   module AppSec
     # AppSec event
     module Event
-      ATTRIBUTES_SCHEMA_KEY_PREFIX = '_dd.appsec.s.'
+      ATTRIBUTES_SCHEMA_KEY_PREFIX = "_dd.appsec.s."
       ATTRIBUTES_SCHEMA_MAX_COMPRESSED_SIZE = 25000
       ALLOWED_REQUEST_HEADERS = %w[
         x-forwarded-for
@@ -36,11 +36,11 @@ module Datadog
         def tag(context, waf_result)
           return if context.span.nil?
 
-          if waf_result.actions.key?('block_request') || waf_result.actions.key?('redirect_request')
-            context.span.set_tag('appsec.blocked', 'true')
+          if waf_result.actions.key?("block_request") || waf_result.actions.key?("redirect_request")
+            context.span.set_tag("appsec.blocked", "true")
           end
 
-          context.span.set_tag('appsec.event', 'true')
+          context.span.set_tag("appsec.event", "true")
         end
 
         def record(context, request: nil)
@@ -57,7 +57,7 @@ module Datadog
               if event_group.any? { |event| event.keep? || event.schema? }
                 TraceKeeper.keep!(trace)
 
-                context.span['_dd.origin'] = 'appsec'
+                context.span["_dd.origin"] = "appsec"
                 context.span.set_tags(request_tags(request)) if request
               end
 
@@ -71,9 +71,9 @@ module Datadog
         def request_tags(request)
           tags = {}
 
-          tags['http.host'] = request.host if request.host
-          tags['http.useragent'] = request.user_agent if request.user_agent
-          tags['network.client.ip'] = request.remote_addr if request.remote_addr
+          tags["http.host"] = request.host if request.host
+          tags["http.useragent"] = request.user_agent if request.user_agent
+          tags["network.client.ip"] = request.remote_addr if request.remote_addr
 
           request.headers.each_with_object(tags) do |(name, value), memo|
             next unless ALLOWED_REQUEST_HEADERS.include?(name)
@@ -103,7 +103,7 @@ module Datadog
             end
           end
 
-          tags['_dd.appsec.json'] = json_parse({triggers: triggers}) unless triggers.empty?
+          tags["_dd.appsec.json"] = json_parse({triggers: triggers}) unless triggers.empty?
           tags
         end
 
@@ -113,7 +113,7 @@ module Datadog
         def json_parse(value)
           JSON.dump(value)
         rescue ArgumentError, Encoding::UndefinedConversionError, JSON::JSONError => e
-          AppSec.telemetry.report(e, description: 'AppSec: Failed to convert value into JSON')
+          AppSec.telemetry.report(e, description: "AppSec: Failed to convert value into JSON")
 
           nil
         end

data/lib/datadog/appsec/ext.rb

@@ -3,24 +3,24 @@
 module Datadog
   module AppSec
     module Ext
-      RASP_SQLI = 'sql_injection'
-      RASP_LFI = 'lfi'
-      RASP_SSRF = 'ssrf'
-      RASP_REQUEST_PHASE = 'request'
-      RASP_RESPONSE_PHASE = 'response'
+      RASP_SQLI = "sql_injection"
+      RASP_LFI = "lfi"
+      RASP_SSRF = "ssrf"
+      RASP_REQUEST_PHASE = "request"
+      RASP_RESPONSE_PHASE = "response"
 
       PRODUCT_BIT = 0b00000010
 
       INTERRUPT = :datadog_appsec_interrupt
-      CONTEXT_KEY = 'datadog.appsec.context'
+      CONTEXT_KEY = "datadog.appsec.context"
       ACTIVE_CONTEXT_KEY = :datadog_appsec_active_context
-      EXPLOIT_PREVENTION_EVENT_CATEGORY = 'exploit'
+      EXPLOIT_PREVENTION_EVENT_CATEGORY = "exploit"
 
-      TAG_APPSEC_ENABLED = '_dd.appsec.enabled'
-      TAG_NORMALIZED_ROUTE = '_dd.appsec.normalized_route'
-      TAG_METASTRUCT_STACK_TRACE = '_dd.stack'
+      TAG_APPSEC_ENABLED = "_dd.appsec.enabled"
+      TAG_NORMALIZED_ROUTE = "_dd.appsec.normalized_route"
+      TAG_METASTRUCT_STACK_TRACE = "_dd.stack"
 
-      TELEMETRY_METRICS_NAMESPACE = 'appsec'
+      TELEMETRY_METRICS_NAMESPACE = "appsec"
     end
   end
 end

data/lib/datadog/appsec/extensions.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative 'configuration'
-require_relative '../core/configuration'
+require_relative "configuration"
+require_relative "../core/configuration"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/instrumentation/gateway.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'gateway/middleware'
+require_relative "gateway/middleware"
 
 module Datadog
   module AppSec