datadog 2.38.0 → 2.40.0

data/lib/datadog/appsec/contrib/aws_lambda/waf_addresses.rb

@@ -1,12 +1,12 @@
 # frozen_string_literal: true
 
-require 'uri'
+require "uri"
 
-require_relative '../../utils/http/media_type'
-require_relative '../../utils/http/body'
-require_relative '../../../core/utils/base64_codec'
-require_relative '../../../core/header_collection'
-require_relative '../../../tracing/client_ip'
+require_relative "../../utils/http/media_type"
+require_relative "../../utils/http/body"
+require_relative "../../../core/utils/base64_codec"
+require_relative "../../../core/header_collection"
+require_relative "../../../tracing/client_ip"
 
 module Datadog
   module AppSec
@@ -26,16 +26,16 @@ module Datadog
 
             headers = parse_headers(payload)
             data = {
-              'server.request.cookies' => parse_cookies(payload, headers),
-              'server.request.query' => payload['query'],
-              'server.request.uri.raw' => build_fullpath(payload),
-              'server.request.headers' => headers,
-              'server.request.headers.no_cookies' => headers.dup.tap { |h| h.delete('cookie') },
-              'server.request.method' => payload['method'],
-              'server.request.body' => parse_body(payload, headers),
-              'server.request.body.byte_length' => body_byte_length(payload),
-              'server.request.path_params' => payload['path_params'],
-              'http.client_ip' => extract_client_ip(payload['source_ip'], headers)
+              "server.request.cookies" => parse_cookies(payload, headers),
+              "server.request.query" => payload["query"],
+              "server.request.uri.raw" => build_fullpath(payload),
+              "server.request.headers" => headers,
+              "server.request.headers.no_cookies" => headers.dup.tap { |h| h.delete("cookie") },
+              "server.request.method" => payload["method"],
+              "server.request.body" => parse_body(payload, headers),
+              "server.request.body.byte_length" => body_byte_length(payload),
+              "server.request.path_params" => payload["path_params"],
+              "http.client_ip" => extract_client_ip(payload["source_ip"], headers)
             }
 
             data.compact!
@@ -47,11 +47,11 @@ module Datadog
 
             headers = parse_headers(payload)
             data = {
-              'server.response.status' => payload['status_code']&.to_s,
-              'server.response.headers' => headers,
-              'server.response.headers.no_cookies' => headers.dup.tap { |h| h.delete('set-cookie') },
-              'server.response.body' => parse_body(payload, headers),
-              'server.response.body.byte_length' => body_byte_length(payload)
+              "server.response.status" => payload["status_code"]&.to_s,
+              "server.response.headers" => headers,
+              "server.response.headers.no_cookies" => headers.dup.tap { |h| h.delete("set-cookie") },
+              "server.response.body" => parse_body(payload, headers),
+              "server.response.body.byte_length" => body_byte_length(payload)
             }
 
             data.compact!
@@ -59,23 +59,23 @@ module Datadog
           end
 
           def parse_headers(payload)
-            (payload['headers'] || {}).each_with_object({}) do |(key, value), hash|
+            (payload["headers"] || {}).each_with_object({}) do |(key, value), hash|
               hash[key.downcase] = value
             end
           end
 
           def parse_cookies(payload, headers)
-            raw_pairs = payload['cookies'] || headers['cookie']&.split(';')
+            raw_pairs = payload["cookies"] || headers["cookie"]&.split(";")
             return unless raw_pairs
 
             raw_pairs.each_with_object({}) do |pair, hash|
-              name, value = pair.strip.split('=', 2)
+              name, value = pair.strip.split("=", 2)
               hash[name] = value if name
             end
           end
 
           def build_fullpath(payload)
-            path = payload['path']
+            path = payload["path"]
             return unless path
 
             query_string = build_query_string(payload)
@@ -83,10 +83,10 @@ module Datadog
           end
 
           def build_query_string(payload)
-            query_string = payload['query_string']
+            query_string = payload["query_string"]
             return query_string if query_string && !query_string.empty?
 
-            query = payload['query']
+            query = payload["query"]
             return if query.nil? || query.empty?
 
             URI.encode_www_form(query)
@@ -98,32 +98,34 @@ module Datadog
           end
 
           def parse_body(payload, headers)
-            body = payload['body']
+            body = payload["body"]
             return unless body
 
             if (byte_length = body_byte_length(payload))
               return if byte_length > Datadog.configuration.appsec.body_parsing_size_limit
             end
 
-            content_type = headers['content-type']
+            content_type = headers["content-type"]
             return unless content_type
 
             media_type = AppSec::Utils::HTTP::MediaType.parse(content_type)
             return unless media_type
 
-            body = Core::Utils::Base64Codec.strict_decode64(body) if payload['base64_encoded']
-            AppSec::Utils::HTTP::Body.parse(body, media_type: media_type)
+            body = Core::Utils::Base64Codec.strict_decode64(body) if payload["base64_encoded"]
+            AppSec::Utils::HTTP::Body.parse(
+              body, media_type: media_type, limit: Datadog.configuration.appsec.body_parsing_size_limit
+            )
           rescue ArgumentError => e
-            AppSec.telemetry.report(e, description: 'AppSec: Failed to decode base64 body')
+            AppSec.telemetry.report(e, description: "AppSec: Failed to decode base64 body")
 
             nil
           end
 
           def body_byte_length(payload)
-            body = payload['body']
+            body = payload["body"]
 
             return unless body
-            return body.bytesize unless payload['base64_encoded']
+            return body.bytesize unless payload["base64_encoded"]
 
             # NOTE: Base64 packs every 3 bytes into 4 characters and pads the last
             #       group with up to two "=" bytes. The decoded length is therefore

data/lib/datadog/appsec/contrib/devise/data_extractor.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative '../../anonymizer'
+require_relative "../../anonymizer"
 
 module Datadog
   module AppSec
@@ -9,8 +9,8 @@ module Datadog
         # Extracts user identification data from Devise resources.
         # Supports both regular and anonymized data extraction modes.
         class DataExtractor
-          PRIORITY_ORDERED_ID_KEYS = [:id, 'id', :uuid, 'uuid'].freeze
-          PRIORITY_ORDERED_LOGIN_KEYS = [:email, 'email', :username, 'username', :login, 'login'].freeze
+          PRIORITY_ORDERED_ID_KEYS = [:id, "id", :uuid, "uuid"].freeze
+          PRIORITY_ORDERED_LOGIN_KEYS = [:email, "email", :username, "username", :login, "login"].freeze
 
           def initialize(mode:)
             @mode = mode

data/lib/datadog/appsec/contrib/devise/ext.rb

@@ -6,28 +6,28 @@ module Datadog
       module Devise
         # Devise integration constants
         module Ext
-          EVENT_LOGIN_SUCCESS = 'users.login.success'
-          EVENT_LOGIN_FAILURE = 'users.login.failure'
-          EVENT_SIGNUP = 'users.signup'
+          EVENT_LOGIN_SUCCESS = "users.login.success"
+          EVENT_LOGIN_FAILURE = "users.login.failure"
+          EVENT_SIGNUP = "users.signup"
 
-          TAG_DD_USR_ID = '_dd.appsec.usr.id'
-          TAG_DD_USR_LOGIN = '_dd.appsec.usr.login'
-          TAG_DD_SIGNUP_MODE = '_dd.appsec.events.users.signup.auto.mode'
-          TAG_DD_COLLECTION_MODE = '_dd.appsec.user.collection_mode'
-          TAG_DD_LOGIN_SUCCESS_MODE = '_dd.appsec.events.users.login.success.auto.mode'
-          TAG_DD_LOGIN_FAILURE_MODE = '_dd.appsec.events.users.login.failure.auto.mode'
+          TAG_DD_USR_ID = "_dd.appsec.usr.id"
+          TAG_DD_USR_LOGIN = "_dd.appsec.usr.login"
+          TAG_DD_SIGNUP_MODE = "_dd.appsec.events.users.signup.auto.mode"
+          TAG_DD_COLLECTION_MODE = "_dd.appsec.user.collection_mode"
+          TAG_DD_LOGIN_SUCCESS_MODE = "_dd.appsec.events.users.login.success.auto.mode"
+          TAG_DD_LOGIN_FAILURE_MODE = "_dd.appsec.events.users.login.failure.auto.mode"
 
-          TAG_USR_ID = 'usr.id'
-          TAG_SESSION_ID = 'usr.session_id'
-          TAG_SIGNUP_TRACK = 'appsec.events.users.signup.track'
-          TAG_SIGNUP_USR_ID = 'appsec.events.users.signup.usr.id'
-          TAG_SIGNUP_USR_LOGIN = 'appsec.events.users.signup.usr.login'
-          TAG_LOGIN_FAILURE_TRACK = 'appsec.events.users.login.failure.track'
-          TAG_LOGIN_FAILURE_USR_ID = 'appsec.events.users.login.failure.usr.id'
-          TAG_LOGIN_FAILURE_USR_LOGIN = 'appsec.events.users.login.failure.usr.login'
-          TAG_LOGIN_FAILURE_USR_EXISTS = 'appsec.events.users.login.failure.usr.exists'
-          TAG_LOGIN_SUCCESS_TRACK = 'appsec.events.users.login.success.track'
-          TAG_LOGIN_SUCCESS_USR_LOGIN = 'appsec.events.users.login.success.usr.login'
+          TAG_USR_ID = "usr.id"
+          TAG_SESSION_ID = "usr.session_id"
+          TAG_SIGNUP_TRACK = "appsec.events.users.signup.track"
+          TAG_SIGNUP_USR_ID = "appsec.events.users.signup.usr.id"
+          TAG_SIGNUP_USR_LOGIN = "appsec.events.users.signup.usr.login"
+          TAG_LOGIN_FAILURE_TRACK = "appsec.events.users.login.failure.track"
+          TAG_LOGIN_FAILURE_USR_ID = "appsec.events.users.login.failure.usr.id"
+          TAG_LOGIN_FAILURE_USR_LOGIN = "appsec.events.users.login.failure.usr.login"
+          TAG_LOGIN_FAILURE_USR_EXISTS = "appsec.events.users.login.failure.usr.exists"
+          TAG_LOGIN_SUCCESS_TRACK = "appsec.events.users.login.success.track"
+          TAG_LOGIN_SUCCESS_USR_LOGIN = "appsec.events.users.login.success.usr.login"
         end
       end
     end

data/lib/datadog/appsec/contrib/devise/integration.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
-require_relative 'patcher'
+require_relative "../integration"
+require_relative "patcher"
 
 module Datadog
   module AppSec
@@ -11,12 +11,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('3.2.1')
+          MINIMUM_VERSION = Gem::Version.new("3.2.1")
 
           register_as :devise, auto_patch: true
 
           def self.version
-            Gem.loaded_specs['devise']&.version
+            Gem.loaded_specs["devise"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/devise/patcher.rb

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-require_relative '../../../core/utils/only_once'
+require_relative "../../../core/utils/only_once"
 
-require_relative 'tracking_middleware'
-require_relative 'patches/signup_tracking_patch'
-require_relative 'patches/signin_tracking_patch'
-require_relative 'patches/skip_signin_tracking_patch'
+require_relative "tracking_middleware"
+require_relative "patches/signup_tracking_patch"
+require_relative "patches/signin_tracking_patch"
+require_relative "patches/skip_signin_tracking_patch"
 
 module Datadog
   module AppSec
@@ -20,7 +20,7 @@ module Datadog
           module_function
 
           def patched?
-            Patcher.instance_variable_get(:@patched)
+            !!Patcher.instance_variable_get(:@patched)
           end
 
           def target_version
@@ -32,7 +32,7 @@ module Datadog
               GUARD_ONCE_PER_APP[app].run do
                 app.middleware.insert_after(Warden::Manager, TrackingMiddleware)
               rescue RuntimeError
-                AppSec.telemetry.error('AppSec: unable to insert Devise TrackingMiddleware')
+                AppSec.telemetry.error("AppSec: unable to insert Devise TrackingMiddleware")
               end
             end
 
@@ -50,7 +50,7 @@ module Datadog
 
             if ::Devise::STRATEGIES.include?(:rememberable)
               # Rememberable strategy is required in autoloaded Rememberable model
-              require 'devise/models/rememberable'
+              require "devise/models/rememberable"
               ::Devise::Strategies::Rememberable.prepend(Patches::SkipSigninTrackingPatch)
             end
 

data/lib/datadog/appsec/contrib/devise/patches/signin_tracking_patch.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../ext'
-require_relative '../configuration'
-require_relative '../data_extractor'
-require_relative '../../../trace_keeper'
+require_relative "../ext"
+require_relative "../configuration"
+require_relative "../data_extractor"
+require_relative "../../../trace_keeper"
 
 module Datadog
   module AppSec
@@ -23,7 +23,7 @@ module Datadog
               return result unless context
 
               if context.trace.nil? || context.span.nil?
-                Datadog.logger.debug { 'AppSec: unable to track signin events, due to missing trace or span' }
+                Datadog.logger.debug { "AppSec: unable to track signin events, due to missing trace or span" }
                 return result
               end
 
@@ -31,13 +31,13 @@ module Datadog
 
               if result
                 record_successful_signin(context, resource)
-                Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_LOGIN_SUCCESS)
+                Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_LOGIN_SUCCESS)
 
                 return result
               end
 
               record_failed_signin(context, resource)
-              Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_LOGIN_FAILURE)
+              Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_LOGIN_FAILURE)
 
               result
             end
@@ -56,7 +56,7 @@ module Datadog
               end
 
               context.span[Ext::TAG_LOGIN_SUCCESS_USR_LOGIN] ||= login
-              context.span[Ext::TAG_LOGIN_SUCCESS_TRACK] = 'true'
+              context.span[Ext::TAG_LOGIN_SUCCESS_TRACK] = "true"
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_DD_LOGIN_SUCCESS_MODE] = Configuration.auto_user_instrumentation_mode
 
@@ -64,14 +64,14 @@ module Datadog
               #       and because of that we will trigger an additional event even
               #       if it was already done via the SDK
               AppSec::Instrumentation.gateway.push(
-                'identity.set_user', AppSec::Instrumentation::Gateway::User.new(id, login)
+                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login)
               )
             end
 
             def record_failed_signin(context, resource)
               extractor = DataExtractor.new(mode: Configuration.auto_user_instrumentation_mode)
 
-              context.span[Ext::TAG_LOGIN_FAILURE_TRACK] = 'true'
+              context.span[Ext::TAG_LOGIN_FAILURE_TRACK] = "true"
               context.span[Ext::TAG_DD_LOGIN_FAILURE_MODE] = Configuration.auto_user_instrumentation_mode
 
               unless resource
@@ -79,7 +79,7 @@ module Datadog
 
                 context.span[Ext::TAG_DD_USR_LOGIN] = login
                 context.span[Ext::TAG_LOGIN_FAILURE_USR_LOGIN] ||= login
-                context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= 'false'
+                context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= "false"
 
                 return
               end
@@ -94,7 +94,7 @@ module Datadog
 
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_LOGIN_FAILURE_USR_LOGIN] ||= login
-              context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= 'true'
+              context.span[Ext::TAG_LOGIN_FAILURE_USR_EXISTS] ||= "true"
             end
           end
         end

data/lib/datadog/appsec/contrib/devise/patches/signup_tracking_patch.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../ext'
-require_relative '../configuration'
-require_relative '../data_extractor'
-require_relative '../../../trace_keeper'
+require_relative "../ext"
+require_relative "../configuration"
+require_relative "../data_extractor"
+require_relative "../../../trace_keeper"
 
 module Datadog
   module AppSec
@@ -21,7 +21,7 @@ module Datadog
                 context = AppSec.active_context
 
                 if context.trace.nil? || context.span.nil?
-                  Datadog.logger.debug { 'AppSec: unable to track signup events, due to missing trace or span' }
+                  Datadog.logger.debug { "AppSec: unable to track signup events, due to missing trace or span" }
                   next yield(resource) if block_given?
                 end
 
@@ -29,7 +29,7 @@ module Datadog
 
                 TraceKeeper.keep!(context.trace)
                 record_successful_signup(context, resource)
-                Instrumentation.gateway.push('appsec.events.user_lifecycle', Ext::EVENT_SIGNUP)
+                Instrumentation.gateway.push("appsec.events.user_lifecycle", Ext::EVENT_SIGNUP)
 
                 yield(resource) if block_given?
               end
@@ -43,7 +43,7 @@ module Datadog
               id = extractor.extract_id(resource)
               login = extractor.extract_login(resource_params) || extractor.extract_login(resource)
 
-              context.span[Ext::TAG_SIGNUP_TRACK] = 'true'
+              context.span[Ext::TAG_SIGNUP_TRACK] = "true"
               context.span[Ext::TAG_DD_USR_LOGIN] = login
               context.span[Ext::TAG_SIGNUP_USR_LOGIN] ||= login
               context.span[Ext::TAG_DD_SIGNUP_MODE] = Configuration.auto_user_instrumentation_mode
@@ -59,7 +59,7 @@ module Datadog
               #       and because of that we will trigger an additional event even
               #       if it was already done via the SDK
               AppSec::Instrumentation.gateway.push(
-                'identity.set_user', AppSec::Instrumentation::Gateway::User.new(id, login)
+                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login)
               )
             end
           end

data/lib/datadog/appsec/contrib/devise/tracking_middleware.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative 'ext'
-require_relative '../../anonymizer'
+require_relative "ext"
+require_relative "../../anonymizer"
 
 module Datadog
   module AppSec
@@ -9,8 +9,8 @@ module Datadog
       module Devise
         # A Rack middleware capable of tracking currently signed user
         class TrackingMiddleware
-          WARDEN_KEY = 'warden'
-          SESSION_ID_KEY = 'session_id'
+          WARDEN_KEY = "warden"
+          SESSION_ID_KEY = "session_id"
 
           def initialize(app)
             @app = app
@@ -23,13 +23,13 @@ module Datadog
             return @app.call(env) unless AppSec.active_context
 
             unless env.key?(WARDEN_KEY)
-              Datadog.logger.debug { 'AppSec: unable to track requests, due to missing warden manager' }
+              Datadog.logger.debug { "AppSec: unable to track requests, due to missing warden manager" }
               return @app.call(env)
             end
 
             context = AppSec.active_context
             if context.trace.nil? || context.span.nil?
-              Datadog.logger.debug { 'AppSec: unable to track requests, due to missing trace or span' }
+              Datadog.logger.debug { "AppSec: unable to track requests, due to missing trace or span" }
               return @app.call(env)
             end
 
@@ -49,7 +49,7 @@ module Datadog
                 #        passing them at first place.
                 #        This is a temporary situation until we refactor events model.
                 AppSec::Instrumentation.gateway.push(
-                  'identity.set_user', AppSec::Instrumentation::Gateway::User.new(user_id, nil, user_session_id)
+                  "identity.set_user", AppSec::Instrumentation::Gateway::User.new(user_id, nil, user_session_id)
                 )
               end
 
@@ -67,7 +67,7 @@ module Datadog
             session_serializer = warden.session_serializer
 
             key = session_key_for(session_serializer, ::Devise.default_scope)
-            id = session_serializer.session[key]&.dig(0, 0)
+            id = extract_record_id(session_serializer.session[key])
 
             return id if ::Devise.mappings.size == 1
             return "#{::Devise.default_scope}:#{id}" if id
@@ -76,7 +76,7 @@ module Datadog
               next if scope == ::Devise.default_scope
 
               key = session_key_for(session_serializer, scope)
-              id = session_serializer.session[key]&.dig(0, 0)
+              id = extract_record_id(session_serializer.session[key])
 
               return "#{scope}:#{id}" if id
             end
@@ -84,6 +84,21 @@ module Datadog
             nil
           end
 
+          # NOTE: This supports Devise's default session serialization:
+          #       `[record.to_key, record.authenticatable_salt]`,
+          #       e.g. `[[1], "0abc..."]`
+          #
+          # WARNING: Applications can redefine Warden serialization, replacing
+          #          this default format
+          def extract_record_id(serialized_record)
+            return unless serialized_record.is_a?(Array)
+
+            record_key = serialized_record[0]
+            return unless record_key.is_a?(Array)
+
+            record_key[0]
+          end
+
           def session_key_for(session_serializer, scope)
             @devise_session_scope_keys[scope] ||= session_serializer.key_for(scope)
           end

data/lib/datadog/appsec/contrib/excon/integration.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
-require_relative 'patcher'
+require_relative "../integration"
+require_relative "patcher"
 
 module Datadog
   module AppSec
@@ -11,12 +11,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('0.50.0')
+          MINIMUM_VERSION = Gem::Version.new("0.50.0")
 
           register_as :excon
 
           def self.version
-            Gem.loaded_specs['excon']&.version
+            Gem.loaded_specs["excon"]&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/excon/patcher.rb

@@ -17,7 +17,7 @@ module Datadog
           end
 
           def patch
-            require_relative 'ssrf_detection_middleware'
+            require_relative "ssrf_detection_middleware"
 
             ::Excon.defaults[:middlewares].insert(0, SSRFDetectionMiddleware)