datadog 2.38.0 → 2.39.0

data/lib/datadog/appsec/metrics/exporter.rb

@@ -10,24 +10,24 @@ module Datadog
         def export_waf_metrics(metrics, span)
           return if metrics.evals.zero?
 
-          span.set_tag('_dd.appsec.waf.timeouts', metrics.timeouts)
-          span.set_tag('_dd.appsec.waf.duration', convert_ns_to_us(metrics.duration_ns))
-          span.set_tag('_dd.appsec.waf.duration_ext', convert_ns_to_us(metrics.duration_ext_ns))
+          span.set_tag("_dd.appsec.waf.timeouts", metrics.timeouts)
+          span.set_tag("_dd.appsec.waf.duration", convert_ns_to_us(metrics.duration_ns))
+          span.set_tag("_dd.appsec.waf.duration_ext", convert_ns_to_us(metrics.duration_ext_ns))
         end
 
         def export_rasp_metrics(metrics, span)
           return if metrics.evals.zero?
 
-          span.set_tag('_dd.appsec.rasp.rule.eval', metrics.evals)
-          span.set_tag('_dd.appsec.rasp.timeout', 1) unless metrics.timeouts.zero?
-          span.set_tag('_dd.appsec.rasp.duration', convert_ns_to_us(metrics.duration_ns))
-          span.set_tag('_dd.appsec.rasp.duration_ext', convert_ns_to_us(metrics.duration_ext_ns))
+          span.set_tag("_dd.appsec.rasp.rule.eval", metrics.evals)
+          span.set_tag("_dd.appsec.rasp.timeout", 1) unless metrics.timeouts.zero?
+          span.set_tag("_dd.appsec.rasp.duration", convert_ns_to_us(metrics.duration_ns))
+          span.set_tag("_dd.appsec.rasp.duration_ext", convert_ns_to_us(metrics.duration_ext_ns))
 
           # NOTE: In case of downstream requests being analyzed additionally
           #       with `Context.run_waf` method, we would need to share it
           #       between two exporting methods
           unless metrics.downstream_requests.zero?
-            span.set_tag('_dd.appsec.downstream_request', metrics.downstream_requests)
+            span.set_tag("_dd.appsec.downstream_request", metrics.downstream_requests)
           end
         end
 

data/lib/datadog/appsec/metrics/telemetry.rb

@@ -5,10 +5,10 @@ module Datadog
     module Metrics
       # A class responsible for reporting WAF and RASP telemetry metrics.
       module Telemetry
-        ACTION_BLOCK = 'block_request'
-        ACTION_REDIRECT = 'redirect_request'
-        BLOCK_SUCCESS = 'success'
-        BLOCK_IRRELEVANT = 'irrelevant'
+        ACTION_BLOCK = "block_request"
+        ACTION_REDIRECT = "redirect_request"
+        BLOCK_SUCCESS = "success"
+        BLOCK_IRRELEVANT = "irrelevant"
 
         module_function
 
@@ -23,15 +23,15 @@ module Datadog
 
           namespace = Ext::TELEMETRY_METRICS_NAMESPACE
 
-          AppSec.telemetry.inc(namespace, 'rasp.rule.eval', 1, tags: tags)
-          AppSec.telemetry.inc(namespace, 'rasp.timeout', 1, tags: tags) if result.timeout?
+          AppSec.telemetry.inc(namespace, "rasp.rule.eval", 1, tags: tags)
+          AppSec.telemetry.inc(namespace, "rasp.timeout", 1, tags: tags) if result.timeout?
 
           if result.match?
             blocked = result.actions.key?(ACTION_BLOCK) || result.actions.key?(ACTION_REDIRECT)
             # NOTE: Mutates tags to avoid an extra hash allocation. Keep this the last .inc call.
             tags[:block] = blocked ? BLOCK_SUCCESS : BLOCK_IRRELEVANT
 
-            AppSec.telemetry.inc(namespace, 'rasp.rule.match', 1, tags: tags)
+            AppSec.telemetry.inc(namespace, "rasp.rule.match", 1, tags: tags)
           end
         end
       end

data/lib/datadog/appsec/metrics/telemetry_exporter.rb

@@ -9,7 +9,7 @@ module Datadog
 
         def export_waf_request_metrics(metrics, context)
           AppSec.telemetry.inc(
-            Ext::TELEMETRY_METRICS_NAMESPACE, 'waf.requests', 1,
+            Ext::TELEMETRY_METRICS_NAMESPACE, "waf.requests", 1,
             tags: {
               waf_version: WAF::VERSION::BASE_STRING,
               event_rules_version: context.waf_runner_ruleset_version,
@@ -17,7 +17,7 @@ module Datadog
               waf_error: metrics.errors.positive?.to_s,
               waf_timeout: metrics.timeouts.positive?.to_s,
               request_blocked: context.interrupted?.to_s,
-              block_failure: 'false',
+              block_failure: "false",
               rate_limited: (!context.trace.sampled?).to_s,
               input_truncated: metrics.inputs_truncated.positive?.to_s,
             }
@@ -30,12 +30,12 @@ module Datadog
 
           if context.span&.get_tag(Tracing::Metadata::Ext::HTTP::TAG_ROUTE).nil?
             AppSec.telemetry.inc(
-              AppSec::Ext::TELEMETRY_METRICS_NAMESPACE, 'api_security.missing_route', 1,
+              AppSec::Ext::TELEMETRY_METRICS_NAMESPACE, "api_security.missing_route", 1,
               tags: {framework: web_framework}
             )
           end
 
-          metric_name = context.state[:schema_extracted] ? 'schema' : 'no_schema'
+          metric_name = context.state[:schema_extracted] ? "schema" : "no_schema"
           AppSec.telemetry.inc(
             AppSec::Ext::TELEMETRY_METRICS_NAMESPACE, "api_security.request.#{metric_name}", 1,
             tags: {framework: web_framework}

data/lib/datadog/appsec/metrics.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative 'metrics/collector'
-require_relative 'metrics/exporter'
-require_relative 'metrics/telemetry'
-require_relative 'metrics/telemetry_exporter'
+require_relative "metrics/collector"
+require_relative "metrics/exporter"
+require_relative "metrics/telemetry"
+require_relative "metrics/telemetry_exporter"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/monitor/gateway/watcher.rb

@@ -1,8 +1,8 @@
 # frozen_string_literal: true
 
-require_relative '../../event'
-require_relative '../../security_event'
-require_relative '../../instrumentation/gateway'
+require_relative "../../event"
+require_relative "../../security_event"
+require_relative "../../instrumentation/gateway"
 
 module Datadog
   module AppSec
@@ -10,9 +10,9 @@ module Datadog
       module Gateway
         # Watcher for Apssec internal events
         module Watcher
-          ARBITRARY_VALUE = 'invalid'
-          EVENT_LOGIN_SUCCESS = 'users.login.success'
-          EVENT_LOGIN_FAILURE = 'users.login.failure'
+          ARBITRARY_VALUE = "invalid"
+          EVENT_LOGIN_SUCCESS = "users.login.success"
+          EVENT_LOGIN_FAILURE = "users.login.failure"
           WATCHED_LOGIN_EVENTS = [EVENT_LOGIN_SUCCESS, EVENT_LOGIN_FAILURE].freeze
 
           class << self
@@ -24,19 +24,21 @@ module Datadog
             end
 
             def watch_user_id(gateway = Instrumentation.gateway)
-              gateway.watch('identity.set_user') do |stack, user|
+              gateway.watch("identity.set_user") do |stack, user|
                 context = AppSec.active_context
+                next stack.call(user) unless context
+
                 context.state[:has_identity_event] = true
 
                 if user.id.nil? && user.login.nil? && user.session_id.nil?
-                  Datadog.logger.debug { 'AppSec: skipping WAF check because no user information was provided' }
+                  Datadog.logger.debug { "AppSec: skipping WAF check because no user information was provided" }
                   next stack.call(user)
                 end
 
                 persistent_data = {}
-                persistent_data['usr.id'] = user.id if user.id
-                persistent_data['usr.login'] = user.login if user.login
-                persistent_data['usr.session_id'] = user.session_id if user.session_id
+                persistent_data["usr.id"] = user.id if user.id
+                persistent_data["usr.login"] = user.login if user.login
+                persistent_data["usr.session_id"] = user.session_id if user.session_id
 
                 result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
@@ -56,8 +58,10 @@ module Datadog
             end
 
             def watch_user_login(gateway = Instrumentation.gateway)
-              gateway.watch('appsec.events.user_lifecycle') do |stack, kind|
+              gateway.watch("appsec.events.user_lifecycle") do |stack, kind|
                 context = AppSec.active_context
+                next stack.call(kind) unless context
+
                 context.state[:has_identity_event] = true
 
                 next stack.call(kind) unless WATCHED_LOGIN_EVENTS.include?(kind)

data/lib/datadog/appsec/monitor.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'monitor/gateway/watcher'
+require_relative "monitor/gateway/watcher"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/processor/rule_loader.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../assets'
+require_relative "../assets"
 
 module Datadog
   module AppSec
@@ -15,15 +15,15 @@ module Datadog
               JSON.parse(Datadog::AppSec::Assets.waf_rules(ruleset))
             when :risky
               Datadog.logger.warn(
-                'The :risky Application Security Management ruleset has been deprecated and no longer available.' \
-                'The `:recommended` ruleset will be used instead.' \
-                'Please remove the `appsec.ruleset = :risky` setting from your Datadog.configure block.'
+                "The :risky Application Security Management ruleset has been deprecated and no longer available." \
+                "The `:recommended` ruleset will be used instead." \
+                "Please remove the `appsec.ruleset = :risky` setting from your Datadog.configure block."
               )
               JSON.parse(Datadog::AppSec::Assets.waf_rules(:recommended))
             when String
               JSON.parse(File.read(File.expand_path(ruleset)))
             when File, StringIO
-              JSON.parse(ruleset.read || '').tap { ruleset.rewind }
+              JSON.parse(ruleset.read || "").tap { ruleset.rewind }
             when Hash
               ruleset
             else
@@ -34,15 +34,15 @@ module Datadog
               "libddwaf ruleset failed to load, ruleset: #{ruleset.inspect} error: #{e.inspect}"
             end
 
-            telemetry.report(e, description: 'libddwaf ruleset failed to load')
+            telemetry.report(e, description: "libddwaf ruleset failed to load")
 
             raise e
           end
 
           def load_data(ip_denylist: [], user_id_denylist: [])
             data = []
-            data << denylist_data('blocked_ips', ip_denylist) if ip_denylist.any?
-            data << denylist_data('blocked_users', user_id_denylist) if user_id_denylist.any?
+            data << denylist_data("blocked_ips", ip_denylist) if ip_denylist.any?
+            data << denylist_data("blocked_users", user_id_denylist) if user_id_denylist.any?
 
             data
           end
@@ -57,9 +57,9 @@ module Datadog
 
           def denylist_data(id, denylist)
             {
-              'id' => id,
-              'type' => 'data_with_expiration',
-              'data' => denylist.map { |v| {'value' => v.to_s, 'expiration' => 2**63} }
+              "id" => id,
+              "type" => "data_with_expiration",
+              "data" => denylist.map { |v| {"value" => v.to_s, "expiration" => 2**63} }
             }
           end
 
@@ -76,38 +76,38 @@ module Datadog
             exclusions = []
 
             exclusions << {
-              'conditions' => [
+              "conditions" => [
                 {
-                  'operator' => 'ip_match',
-                  'parameters' => {
-                    'inputs' => [
+                  "operator" => "ip_match",
+                  "parameters" => {
+                    "inputs" => [
                       {
-                        'address' => 'http.client_ip'
+                        "address" => "http.client_ip"
                       }
                     ],
-                    'list' => pass
+                    "list" => pass
                   }
                 }
               ],
-              'id' => SecureRandom.uuid,
+              "id" => SecureRandom.uuid,
             }
 
             exclusions << {
-              'conditions' => [
+              "conditions" => [
                 {
-                  'operator' => 'ip_match',
-                  'parameters' => {
-                    'inputs' => [
+                  "operator" => "ip_match",
+                  "parameters" => {
+                    "inputs" => [
                       {
-                        'address' => 'http.client_ip'
+                        "address" => "http.client_ip"
                       }
                     ],
-                    'list' => monitor
+                    "list" => monitor
                   }
                 }
               ],
-              'id' => SecureRandom.uuid,
-              'on_match' => 'monitor'
+              "id" => SecureRandom.uuid,
+              "on_match" => "monitor"
             }
 
             exclusions

data/lib/datadog/appsec/rate_limiter.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../core/rate_limiter'
+require_relative "../core/rate_limiter"
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/remote.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../core/remote/dispatcher'
-require_relative 'processor/rule_loader'
+require_relative "../core/remote/dispatcher"
+require_relative "processor/rule_loader"
 
 module Datadog
   module AppSec
@@ -56,10 +56,10 @@ module Datadog
         ].freeze
 
         ASM_PRODUCTS = [
-          'ASM_DD',       # Datadog employee issued configuration
-          'ASM',          # customer issued configuration (rulesets, passlist...)
-          'ASM_FEATURES', # capabilities
-          'ASM_DATA',     # config files (IP addresses or users for blocking)
+          "ASM_DD",       # Datadog employee issued configuration
+          "ASM",          # customer issued configuration (rulesets, passlist...)
+          "ASM_FEATURES", # capabilities
+          "ASM_DATA",     # config files (IP addresses or users for blocking)
         ].freeze
 
         def capabilities

data/lib/datadog/appsec/response.rb

@@ -1,13 +1,13 @@
 # frozen_string_literal: true
 
-require_relative 'assets'
-require_relative 'utils/http/media_range'
+require_relative "assets"
+require_relative "utils/http/media_range"
 
 module Datadog
   module AppSec
     # AppSec response
     class Response
-      SECURITY_RESPONSE_ID_PLACEHOLDER = '[security_response_id]'
+      SECURITY_RESPONSE_ID_PLACEHOLDER = "[security_response_id]"
 
       attr_reader :status, :headers, :body
 
@@ -23,7 +23,7 @@ module Datadog
 
       class << self
         def from_interrupt_params(interrupt_params, http_accept_header)
-          return redirect_response(interrupt_params) if interrupt_params['location']
+          return redirect_response(interrupt_params) if interrupt_params["location"]
 
           block_response(interrupt_params, http_accept_header)
         end
@@ -31,17 +31,17 @@ module Datadog
         private
 
         def block_response(interrupt_params, http_accept_header)
-          content_type = case interrupt_params['type']
-          when nil, 'auto' then content_type(http_accept_header)
-          else FORMAT_TO_CONTENT_TYPE.fetch(interrupt_params['type'], DEFAULT_CONTENT_TYPE)
+          content_type = case interrupt_params["type"]
+          when nil, "auto" then content_type(http_accept_header)
+          else FORMAT_TO_CONTENT_TYPE.fetch(interrupt_params["type"], DEFAULT_CONTENT_TYPE)
           end
 
           Response.new(
-            status: interrupt_params['status_code']&.to_i || 403,
-            headers: {'Content-Type' => content_type},
+            status: interrupt_params["status_code"]&.to_i || 403,
+            headers: {"Content-Type" => content_type},
             body: [
               content(
-                security_response_id: interrupt_params['security_response_id'],
+                security_response_id: interrupt_params["security_response_id"],
                 content_type: content_type
               )
             ],
@@ -49,37 +49,37 @@ module Datadog
         end
 
         def redirect_response(interrupt_params)
-          status_code = interrupt_params['status_code'].to_i
-          location = interrupt_params.fetch('location')
+          status_code = interrupt_params["status_code"].to_i
+          location = interrupt_params.fetch("location")
 
-          if (security_response_id = interrupt_params.fetch('security_response_id'))
+          if (security_response_id = interrupt_params.fetch("security_response_id"))
             location.gsub!(SECURITY_RESPONSE_ID_PLACEHOLDER, security_response_id)
           end
 
           Response.new(
             status: ((status_code >= 300 && status_code < 400) ? status_code : 303),
-            headers: {'Location' => location},
+            headers: {"Location" => location},
             body: [],
           )
         end
 
         CONTENT_TYPE_TO_FORMAT = {
-          'application/json' => :json,
-          'text/html' => :html,
-          'text/plain' => :text,
+          "application/json" => :json,
+          "text/html" => :html,
+          "text/plain" => :text,
         }.freeze
 
         FORMAT_TO_CONTENT_TYPE = {
-          'json' => 'application/json',
-          'html' => 'text/html',
+          "json" => "application/json",
+          "html" => "text/html",
         }.freeze
 
-        DEFAULT_CONTENT_TYPE = 'application/json'
+        DEFAULT_CONTENT_TYPE = "application/json"
 
         def content_type(http_accept_header)
           return DEFAULT_CONTENT_TYPE if http_accept_header.nil?
 
-          accept_types = http_accept_header.split(',').map(&:strip)
+          accept_types = http_accept_header.split(",").map(&:strip)
 
           accepted = accept_types.map { |m| Utils::HTTP::MediaRange.new(m) }.sort!.reverse!
 

data/lib/datadog/appsec/route_normalizer/rails_route_pattern.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative 'route_text'
-require_relative 'route_pattern'
+require_relative "route_text"
+require_relative "route_pattern"
 
 module Datadog
   module AppSec
@@ -13,11 +13,11 @@ module Datadog
       #
       # @api private
       class RailsRoutePattern
-        DOT_CHAR = '.'
-        GROUP_OPEN_CHAR = '('
+        DOT_CHAR = "."
+        GROUP_OPEN_CHAR = "("
         OPTIONAL_GROUP_PATTERN = /\(([^()]*)\)/
-        NAMED_PARAM_PREFIX_CHAR = ':'
-        GLOB_PARAM_PREFIX_CHAR = '*'
+        NAMED_PARAM_PREFIX_CHAR = ":"
+        GLOB_PARAM_PREFIX_CHAR = "*"
 
         def initialize(pattern)
           @pattern = pattern
@@ -60,7 +60,7 @@ module Datadog
             substituted = result.gsub(OPTIONAL_GROUP_PATTERN) do
               # NOTE: OPTIONAL_GROUP_PATTERN always captures a string for each gsub match
               group = ::Regexp.last_match(1) # : String
-              optional_group_has_route_params?(group) ? "(#{group})" : ''
+              optional_group_has_route_params?(group) ? "(#{group})" : ""
             end
 
             return result if substituted == result
@@ -125,7 +125,7 @@ module Datadog
         class Buffer
           def initialize
             @segments = []
-            @text = +''
+            @text = +""
             @params = []
             @nameless_param_count = 0
           end
@@ -147,14 +147,14 @@ module Datadog
               render_params(@params)
             end
 
-            @text = +''
+            @text = +""
             @params.clear
           end
 
           def to_path
             flush
 
-            "/#{@segments.join('/')}"
+            "/#{@segments.join("/")}"
           end
 
           private
@@ -167,7 +167,7 @@ module Datadog
               "param#{@nameless_param_count}"
             end
 
-            "{#{names.join('+')}}"
+            "{#{names.join("+")}}"
           end
         end
       end

data/lib/datadog/appsec/route_normalizer/route_pattern.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'route_text'
+require_relative "route_text"
 
 module Datadog
   module AppSec
@@ -24,18 +24,18 @@ module Datadog
       #
       # @api private
       class RoutePattern
-        GROUP_OPEN_CHAR = '('
-        GROUP_CLOSE_CHAR = ')'
+        GROUP_OPEN_CHAR = "("
+        GROUP_CLOSE_CHAR = ")"
 
-        OPTIONAL_GROUP_SUFFIX_CHAR = '?'
+        OPTIONAL_GROUP_SUFFIX_CHAR = "?"
         OPTIONAL_GROUP_SIGILS = [
           GROUP_OPEN_CHAR,
           GROUP_CLOSE_CHAR,
           OPTIONAL_GROUP_SUFFIX_CHAR
         ].join
 
-        NAMED_PARAM_PREFIX_CHAR = ':'
-        GLOB_PARAM_PREFIX_CHAR = '*'
+        NAMED_PARAM_PREFIX_CHAR = ":"
+        GLOB_PARAM_PREFIX_CHAR = "*"
 
         PATTERN_STRUCTURE_CHARS = [
           NAMED_PARAM_PREFIX_CHAR,
@@ -44,7 +44,7 @@ module Datadog
           GROUP_CLOSE_CHAR
         ].join
 
-        PARAM_NAME_CHARS = [*'a'..'z', *'A'..'Z', *'0'..'9', '_'].join
+        PARAM_NAME_CHARS = [*"a".."z", *"A".."Z", *"0".."9", "_"].join
 
         EXCLUDED_PARAM_NAME_TERMINATOR_CHARS = [
           PARAM_NAME_CHARS,
@@ -75,15 +75,15 @@ module Datadog
           @path_index = 0
           @pattern_index = 0
 
-          @path = path || ''
+          @path = path || ""
           @path_length = @path.length
           @pattern_length = @pattern.length
 
           nameless_counter = 0
           pattern = resolve_pattern_optionals(path)
 
-          result = pattern.split('/', -1).each_with_object(+'') do |segment, memo|
-            memo << '/' unless memo.empty? && segment.empty?
+          result = pattern.split("/", -1).each_with_object(+"") do |segment, memo|
+            memo << "/" unless memo.empty? && segment.empty?
             next if segment.empty?
 
             unless segment.match?(PARAM_START_SIGILS)
@@ -106,10 +106,10 @@ module Datadog
               end
             end
 
-            memo << "{#{names.join('+')}}"
+            memo << "{#{names.join("+")}}"
           end
 
-          result.start_with?('/') ? result : "/#{result}"
+          result.start_with?("/") ? result : "/#{result}"
         end
 
         private
@@ -148,7 +148,7 @@ module Datadog
             return @pattern
           end
 
-          resolved = +''
+          resolved = +""
           checkpoints = []
 
           while @pattern_index < @pattern_length
@@ -323,8 +323,8 @@ module Datadog
 
         def find_param_value_end_index(terminator_char:)
           terminator_indexes = []
-          slash_index = @path.index('/', @path_index)
-          dot_index = @path.index('.', @path_index)
+          slash_index = @path.index("/", @path_index)
+          dot_index = @path.index(".", @path_index)
 
           terminator_indexes << slash_index if slash_index
           terminator_indexes << dot_index if dot_index

data/lib/datadog/appsec/route_normalizer/route_text.rb

@@ -21,7 +21,7 @@ module Datadog
         #  169 => %A9   (UTF-8 continuation byte)
         BYTE_ENCODING_TABLE = Array.new(256) do |byte|
           char = byte.chr
-          char.match?(DISALLOWED_CHARS) ? -('%%%02X' % byte) : -char
+          char.match?(DISALLOWED_CHARS) ? -("%%%02X" % byte) : -char
         end.freeze
 
         # Max bytes one input byte expands to as percent-encoded `%XX`
@@ -48,8 +48,8 @@ module Datadog
         # NOTE: Defensive only — this can never happen. {String#each_byte} yields
         #       integers in 0-255 and {BYTE_ENCODING_TABLE} has an entry for every one
         rescue IndexError => e
-          AppSec.telemetry&.report(e, description: 'AppSec: Route text byte outside 0-255 escape table')
-          '~invalid~'
+          AppSec.telemetry&.report(e, description: "AppSec: Route text byte outside 0-255 escape table")
+          "~invalid~"
         end
       end
     end