datadog 2.39.0 → 2.47.0

data/lib/datadog/tracing/contrib/racecar/events.rb

@@ -13,7 +13,7 @@ module Datadog
           ALL = [
             Events::Consume,
             Events::Batch,
-            Events::Message
+            Events::Message,
           ].freeze
 
           module_function

data/lib/datadog/tracing/contrib/rack/configuration/settings.rb

@@ -15,7 +15,7 @@ module Datadog
               response: %w[
                 Content-Type
                 X-Request-ID
-              ]
+              ],
             }.freeze
 
             option :enabled do |o|

data/lib/datadog/tracing/contrib/rack/header_tagging.rb

@@ -10,7 +10,7 @@ module Datadog
         module HeaderTagging
           DATADOG_REQUEST_ATTRIBUTION_HEADERS = [
             "x-datadog-endpoint-scan",
-            "x-datadog-security-test"
+            "x-datadog-security-test",
           ].freeze
 
           def self.tag_request_headers(span, env, configuration)

data/lib/datadog/tracing/contrib/rack/patcher.rb

@@ -70,7 +70,7 @@ module Datadog
         module Patcher
           PATCHERS = [
             MiddlewarePatcher,
-            MiddlewareNamePatcher
+            MiddlewareNamePatcher,
           ].freeze
 
           module_function

data/lib/datadog/tracing/contrib/rack/trace_proxy_middleware.rb

@@ -27,7 +27,7 @@ module Datadog
             options = {
               service: configuration[:web_service_name],
               start_time: start_time,
-              type: Tracing::Metadata::Ext::HTTP::TYPE_PROXY
+              type: Tracing::Metadata::Ext::HTTP::TYPE_PROXY,
             }
 
             request_span = Tracing.trace(Ext::SPAN_HTTP_PROXY_REQUEST, **options)

data/lib/datadog/tracing/contrib/redis/configuration/resolver.rb

@@ -34,7 +34,7 @@ module Datadog
                 host: hash[:host],
                 port: hash[:port],
                 db: hash[:db],
-                scheme: hash[:scheme]
+                scheme: hash[:scheme],
               }
             end
 

data/lib/datadog/tracing/contrib/redis/quantize.rb

@@ -15,6 +15,9 @@ module Datadog
 
           AUTH_COMMANDS = %w[AUTH auth].freeze
 
+          CONNECTION_SETUP_COMMANDS = Set.new(%w[HELLO]).freeze
+          CLIENT_CONNECTION_SETUP_SUBCOMMANDS = Set.new(%w[SETINFO SETNAME]).freeze
+
           MULTI_VERB_COMMANDS = Set.new(
             %w[
               ACL
@@ -40,7 +43,7 @@ module Datadog
 
           def format_command_args(command_args)
             command_args = resolve_command_args(command_args)
-            return "AUTH ?" if auth_command?(command_args)
+            return "AUTH ?" if auth_command?(command_args) || hello_auth_command?(command_args)
 
             verb, *args = command_args.map { |x| format_arg(x) }
             Core::Utils.truncate("#{verb.upcase} #{args.join(" ")}", CMD_MAX_LEN, TOO_LONG_MARK)
@@ -51,6 +54,8 @@ module Datadog
 
             return get_verb(command_args.first) if command_args.first.is_a?(Array)
 
+            return "AUTH" if hello_auth_command?(command_args)
+
             verb = command_args.first.to_s.upcase
             return verb unless MULTI_VERB_COMMANDS.include?(verb) && command_args[1]
 
@@ -64,6 +69,35 @@ module Datadog
             AUTH_COMMANDS.include?(verb)
           end
 
+          # Identifies a RESP3 `HELLO ... AUTH user pass` handshake command, which embeds
+          # credentials the same way a standalone `AUTH` command does and must be redacted
+          # (and kept visible as its own span) rather than treated as a silent connection
+          # bootstrap command.
+          def hello_auth_command?(command_args)
+            return false unless command_args.is_a?(Array) && !command_args.empty?
+
+            # `redis-client` always emits this as `["HELLO", "3", "AUTH", username, password]` — check
+            # the fixed "AUTH" keyword position only, never the username/password values themselves,
+            # since those are untrusted, possibly-binary bulk strings that `#upcase` can raise on.
+            return false if command_args.length < 3
+            command_args[0].to_s.upcase == "HELLO" && command_args[2].to_s.upcase == "AUTH"
+          end
+
+          # Identifies protocol-level connection bootstrap commands (`HELLO`, `CLIENT SETINFO`,
+          # `CLIENT SETNAME`) that `redis-client` sends as part of its per-connection handshake,
+          # so they can be excluded from pipeline resource naming. A `HELLO` carrying `AUTH`
+          # credentials is excluded from this so authentication remains visible as its own span.
+          def connection_setup_command?(command_args)
+            command_args = resolve_command_args(command_args)
+            return false unless command_args.is_a?(Array) && !command_args.empty?
+            return false if hello_auth_command?(command_args)
+
+            verb = command_args.first.to_s.upcase
+            return true if CONNECTION_SETUP_COMMANDS.include?(verb)
+
+            verb == "CLIENT" && CLIENT_CONNECTION_SETUP_SUBCOMMANDS.include?(command_args[1].to_s.upcase)
+          end
+
           # Unwraps command array when Redis is called with the following syntax:
           #   redis.call([:cmd, 'arg1', ...])
           def resolve_command_args(command_args)
@@ -72,7 +106,7 @@ module Datadog
             command_args
           end
 
-          private_class_method :auth_command?, :resolve_command_args
+          private_class_method :auth_command?, :hello_auth_command?, :resolve_command_args
         end
       end
     end

data/lib/datadog/tracing/contrib/redis/trace_middleware.rb

@@ -37,12 +37,18 @@ module Datadog
             end
 
             def call_pipelined(client, commands, service_name, command_args)
+              # `redis-client` sends its per-connection handshake (`HELLO`, `CLIENT SETINFO`/`SETNAME`)
+              # as a pipeline through this same code path. Excluding those from resource naming keeps
+              # the resource focused on application-issued commands (e.g. a lone `SELECT` prelude).
+              traced_commands = commands.reject { |c| Contrib::Redis::Quantize.connection_setup_command?(c) }
+              return yield if traced_commands.empty? && !commands.empty?
+
               Tracing.trace(Redis::Ext::SPAN_COMMAND, type: Redis::Ext::TYPE, service: service_name) do |span|
                 span.set_tag(Tracing::Metadata::Ext::TAG_SVC_SRC, Redis::Ext::TAG_COMPONENT)
-                raw_command = get_pipeline_commands(commands, true)
-                span.resource = command_args ? raw_command : get_pipeline_commands(commands, false)
+                raw_command = get_pipeline_commands(traced_commands, true)
+                span.resource = command_args ? raw_command : get_pipeline_commands(traced_commands, false)
 
-                span.set_metric Contrib::Redis::Ext::METRIC_PIPELINE_LEN, commands.length
+                span.set_metric Contrib::Redis::Ext::METRIC_PIPELINE_LEN, traced_commands.length
 
                 Contrib::Redis::Tags.set_common_tags(client, span, raw_command)
 

data/lib/datadog/tracing/contrib/rest_client/request_patch.rb

@@ -6,6 +6,7 @@ require_relative "../../metadata/ext"
 require_relative "../http"
 require_relative "../analytics"
 require_relative "ext"
+require_relative "../utils/quantization/http"
 
 module Datadog
   module Tracing
@@ -38,7 +39,13 @@ module Datadog
 
             def datadog_tag_request(uri, span)
               span.set_tag(Tracing::Metadata::Ext::TAG_SVC_SRC, Ext::TAG_COMPONENT)
-              span.resource = method.to_s.upcase
+              http_method = method.to_s.upcase
+              path = uri.path
+              span.resource = Contrib::Utils::Quantization::HTTP.client_resource(
+                http_method,
+                path,
+                enabled: Datadog.configuration.tracing.http_client_resource_name_quantize
+              )
 
               if datadog_configuration[:peer_service]
                 span.set_tag(
@@ -57,8 +64,8 @@ module Datadog
               # Set analytics sample rate
               Contrib::Analytics.set_sample_rate(span, analytics_sample_rate) if analytics_enabled?
 
-              span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_URL, uri.path)
-              span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_METHOD, method.to_s.upcase)
+              span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_URL, path)
+              span.set_tag(Tracing::Metadata::Ext::HTTP::TAG_METHOD, http_method)
               span.set_tag(Tracing::Metadata::Ext::NET::TAG_TARGET_HOST, uri.host)
               span.set_tag(Tracing::Metadata::Ext::NET::TAG_TARGET_PORT, uri.port)
               span.set_tags(

data/lib/datadog/tracing/contrib/sequel/database.rb

@@ -46,11 +46,7 @@ module Datadog
             end
 
             def parse_opts(sql, opts)
-              db_opts = if ::Sequel::VERSION < "3.41.0" && self.class.to_s !~ /Dataset$/
-                @opts
-              elsif instance_variable_defined?(:@pool) && @pool
-                @pool.db.opts
-              end
+              db_opts = @pool.db.opts if instance_variable_defined?(:@pool) && @pool
               sql = sql.is_a?(::Sequel::SQL::Expression) ? literal(sql) : sql.to_s
 
               Utils.parse_opts(sql, opts, db_opts)

data/lib/datadog/tracing/contrib/sequel/jdbc_connection_string.rb

@@ -0,0 +1,140 @@
+# frozen_string_literal: true
+
+module Datadog
+  module Tracing
+    module Contrib
+      module Sequel
+        # Extracts connection metadata from JDBC connection strings.
+        module JDBCConnectionString
+          MAX_BYTES = 8_192
+
+          # Matches JDBC connection strings whose subname uses `[transport:]//host...`.
+          CONNECTION_STRING_PATTERN =
+            %r{\Ajdbc:[a-z][a-z0-9+.-]*:(?:[a-z][a-z0-9+.-]*:)?//(?<subname>.+)\z}im
+
+          # Extracts the host and port from a string.
+          # The host can be a multi-host value, a bracketed IPv6 host, or an ordinary host.
+          HOST_AND_PORT_PATTERN =
+            /\A(?:\[(?<ipv6_host>[^\[\]]+)\]|(?<host>[^,]+(?:,[^,]+)+|[^:]+))(?::(?<port>\d+))?\z/
+
+          DATABASE_PROPERTY_PATTERN =
+            /(?:\A|[&;])(?:databaseName|database)=(?<value>[^&;]+)/i
+          LIBRARIES_PROPERTY_PATTERN =
+            /(?:\A|[&;])libraries=,*(?<value>[^,&;]+)/i
+          DATABASE_PATH_DELIMITER_PATTERN = %r{[:@\[\]?&=#]}
+
+          private_constant :MAX_BYTES, :CONNECTION_STRING_PATTERN,
+            :DATABASE_PROPERTY_PATTERN, :LIBRARIES_PROPERTY_PATTERN,
+            :DATABASE_PATH_DELIMITER_PATTERN, :HOST_AND_PORT_PATTERN
+
+          class << self
+            # The returned Hash guarantees the existence of all keys,
+            # but Hash values can be `nil` when not parseable from the connection string.
+            #
+            # @param connection_string [String, nil] the JDBC connection string to parse
+            # @return [Hash{Symbol => String, nil}]
+            #   - `:host` — host value when the subname uses authority syntax: `//host[:port]`
+            #   - `:port` — port when the subname uses authority syntax: `//host[:port]`
+            #   - `:database` — best-effort database name
+            def parse(connection_string)
+              # @type var result: metadata
+              result = {host: nil, port: nil, database: nil}
+              return result unless connection_string.is_a?(String) && connection_string.valid_encoding?
+
+              if connection_string.bytesize > MAX_BYTES
+                # Strip userinfo before truncation. Otherwise, an `@` beyond the limit could be
+                # discarded and leave a credential prefix looking like a valid authority/host.
+                authority_marker = connection_string.index("//")
+                if authority_marker
+                  authority_start = authority_marker + 2
+                  authority_end = [
+                    connection_string.index("/", authority_start),
+                    connection_string.index(";", authority_start),
+                    connection_string.index("?", authority_start),
+                  ].compact.min || connection_string.length
+                  userinfo_end = connection_string.rindex("@", authority_end - 1)
+
+                  if userinfo_end && userinfo_end >= authority_start
+                    connection_string =
+                      # Steep: https://github.com/soutaro/steep/issues/1219
+                      connection_string[0...authority_start] + # steep:ignore NoMethod
+                      connection_string[(userinfo_end + 1)..-1].to_s
+                  end
+                end
+
+                # Keep one extra byte, then let `chop` safely remove multi-byte unicode characters.
+                if connection_string.bytesize > MAX_BYTES
+                  connection_string = connection_string.byteslice(0, MAX_BYTES + 1).chop
+                end
+              end
+
+              match = CONNECTION_STRING_PATTERN.match(connection_string)
+              return result unless match
+
+              # We start with: `host[:port][/database][;properties][?query]`.
+              subname = match[:subname]
+
+              # Extract `query` from the end, leaving `host[:port][/database][;properties]`.
+              subname, query_separator, query = subname.partition("?")
+              query = nil if query_separator.empty?
+
+              # Extract `properties` next, leaving `host[:port][/database]`.
+              subname, properties_separator, properties = subname.partition(";")
+              properties = nil if properties_separator.empty?
+
+              # Separate the authority (`host[:port]`) from the optional database path.
+              authority, path = subname.split("/", 2)
+              return result if authority.nil? || authority.empty?
+
+              host, port = host_and_port_from_authority(authority)
+              return result unless host
+
+              database = database_from_path(path) ||
+                database_from_properties(properties) || database_from_properties(query)
+
+              {host: host, port: port, database: database}
+            rescue Encoding::CompatibilityError, ArgumentError
+              result
+            end
+
+            private
+
+            def database_from_path(path)
+              return if path.nil? || path.empty?
+
+              database = path.split(DATABASE_PATH_DELIMITER_PATTERN, 2).first
+              return if database.nil? || database.empty?
+
+              database
+            end
+
+            def host_and_port_from_authority(authority)
+              # Discard optional `userinfo@`, retaining only `host[:port]`.
+              authority = authority.rpartition("@").last
+              return if authority.empty?
+
+              match = HOST_AND_PORT_PATTERN.match(authority)
+              return unless match
+
+              # Only one of `ipv6_host` or `host` will be populated.
+              host = match[:ipv6_host] || match[:host]
+              port = match[:port]
+
+              [host, port]
+            end
+
+            def database_from_properties(properties)
+              return unless properties
+
+              database = DATABASE_PROPERTY_PATTERN.match(properties)
+              return database[:value] if database
+
+              libraries = LIBRARIES_PROPERTY_PATTERN.match(properties)
+              libraries && libraries[:value]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/tracing/contrib/sequel/utils.rb

@@ -1,10 +1,9 @@
 # frozen_string_literal: true
 
-require "uri"
-
 require_relative "../../metadata/ext"
 require_relative "../utils/database"
 require_relative "ext"
+require_relative "jdbc_connection_string"
 require_relative "../ext"
 require_relative "../span_attribute_schema"
 
@@ -14,11 +13,6 @@ module Datadog
       module Sequel
         # General purpose functions for Sequel
         module Utils
-          JDBC_URI_PATTERN = %r{\Ajdbc:(?<vendor>[a-z][a-z0-9+.-]*):(?<location>//[^\r\n]*)\z}i
-          DATABASE_PROPERTY_PATTERN =
-            /(?:\A|[&;])(?<key>databaseName|database|libraries)=(?<value>[^&;]+)/i
-          private_constant :JDBC_URI_PATTERN, :DATABASE_PROPERTY_PATTERN
-
           class << self
             # Ruby database connector library
             #
@@ -42,34 +36,6 @@ module Datadog
               Contrib::Utils::Database.normalize_vendor(database.database_type.to_s)
             end
 
-            # Parses URI-style JDBC connection strings, extracting host, port, and
-            # (best-effort) database name. Unsupported or ambiguous forms return empty
-            # metadata rather than potentially incorrect tags.
-            def parse_jdbc_uri(uri)
-              result = {host: nil, port: nil, database: nil}
-              return result unless uri.is_a?(String) && uri.valid_encoding?
-
-              match = JDBC_URI_PATTERN.match(uri)
-              return result unless match
-
-              vendor = match[:vendor].downcase
-              location, properties = match[:location].split(";", 2)
-
-              # Several JDBC vendors append properties with semicolons, outside the URI
-              # grammar. Parse the URI-compatible location separately from those properties.
-              parsed = URI.parse("#{vendor}:#{location}")
-
-              host = parsed.hostname
-              port = parsed.port
-
-              database = database_from_path(parsed.path) ||
-                database_from_properties(properties) || database_from_properties(parsed.query)
-
-              {host: host, port: port&.to_s, database: database}
-            rescue URI::InvalidURIError, Encoding::CompatibilityError, ArgumentError
-              result
-            end
-
             def parse_opts(sql, opts, db_opts, dataset = nil)
               # Prepared statements don't provide their sql query in the +sql+ parameter.
               if !sql.is_a?(String) && dataset&.respond_to?(:prepared_sql) &&
@@ -84,7 +50,7 @@ module Datadog
                 query: sql,
                 prepared_name: prepared_name,
                 database: db_opts[:database],
-                host: db_opts[:host]
+                host: db_opts[:host],
               }
             end
 
@@ -121,25 +87,38 @@ module Datadog
               Contrib::Analytics.set_sample_rate(span, analytics_sample_rate) if analytics_enabled?
             end
 
-            # Resolves the connection host/port/database for a Sequel::Database. When the
-            # connection string is a JDBC URL (Sequel's JDBC adapter, used on JRuby), the
-            # host/port/database are parsed from it regardless of whether opts[:host] is set.
+            # Resolves the connection host/port/database for a Sequel::Database. For Sequel's
+            # JDBC adapter (used on JRuby), metadata is parsed from the JDBC connection string
+            # regardless of whether opts[:host] is set.
             def connection_metadata(db)
               opts = db.opts || {}
               host = opts[:host]
               port = opts[:port]
               database = opts[:database]
 
-              # A JDBC URL (in :uri, :url, or :database) can carry credentials, so always parse
-              # it and emit only the parsed database name -- never the raw connection string.
-              conn = opts[:uri] || opts[:url] || opts[:database]
-              is_jdbc = conn.is_a?(String) && conn.byteslice(0, 5)&.casecmp("jdbc:") == 0
+              # A JDBC connection string (in :uri, :url, or :database) can carry credentials, so
+              # always emit only parsed metadata -- never the raw connection string.
+              connection_string = opts[:uri] || opts[:url] || opts[:database]
+              is_jdbc = connection_string.is_a?(String) &&
+                connection_string.byteslice(0, 5)&.casecmp("jdbc:") == 0
               if is_jdbc
-                parsed = parse_jdbc_uri(conn)
+                parsed = JDBCConnectionString.parse(connection_string)
+
+                # JNDI/DataSource-managed connections keep only a lookup name in opts (e.g.
+                # "jdbc:jndi:..."), so nothing can be parsed from it. Recover the endpoint from the
+                # live connection's JDBC metadata, the same way Sequel resolves JNDI. This stays a
+                # fallback rather than the primary source: it requires a connection checkout and
+                # some drivers report no connection string, whereas the opts value is free and
+                # already present for direct connections (and non-JDBC adapters have no such
+                # metadata at all).
+                if parsed[:host].nil? && parsed[:port].nil? && parsed[:database].nil?
+                  fallback_metadata = jdbc_metadata_from_connection(db)
+                  parsed = fallback_metadata if fallback_metadata
+                end
 
-                # Sequel's JDBC adapter connects with the URL and ignores separate
+                # Sequel's JDBC adapter connects with the connection string and ignores separate
                 # :host/:port options, unlike native adapters where those options take precedence.
-                if !parsed[:host].nil? || !parsed[:port].nil? || !parsed[:database].nil?
+                if parsed[:host] || parsed[:port] || parsed[:database]
                   host = parsed[:host]
                   port = parsed[:port]
                 end
@@ -151,24 +130,32 @@ module Datadog
 
             private
 
-            def database_from_path(path)
-              return unless path&.start_with?("/")
-
-              database = path[1..-1]
-              return if database.empty? || database.include?("/")
-
-              database
-            end
-
-            def database_from_properties(properties)
-              return unless properties
-
-              match = DATABASE_PROPERTY_PATTERN.match(properties)
-              return unless match
+            # Resolves host/port/database from the live connection's JDBC metadata
+            # (java.sql.DatabaseMetaData#getURL), for JNDI/DataSource connections whose opts hold
+            # only a lookup name. Returns the parsed metadata, or nil when it can't be resolved.
+            #
+            # Only *parsed, credential-free* metadata is memoized -- the raw connection string is
+            # used transiently and never stored or logged. A completed lookup that yields no usable
+            # connection string is a permanent property of the connection, so it is cached to avoid
+            # re-checking out a connection on every query. A raised error is treated as transient
+            # (pool checkout timeout, dropped connection, ...) and left uncached, so a later query
+            # can retry once connectivity recovers.
+            def jdbc_metadata_from_connection(db)
+              return db.instance_variable_get(:@datadog_jdbc_metadata) if db.instance_variable_defined?(:@datadog_jdbc_metadata)
+
+              connection_string =
+                begin
+                  db.synchronize do |conn|
+                    conn.get_meta_data.get_url if conn.respond_to?(:get_meta_data)
+                  end
+                rescue => e
+                  Datadog.logger.debug { "Sequel: unable to resolve JDBC connection metadata (#{e.class})" }
+                  return nil
+                end
 
-              database = match[:value]
-              database = database.split(",", 2).first if match[:key].casecmp("libraries").zero?
-              database
+              metadata = connection_string && JDBCConnectionString.parse(connection_string)
+              db.instance_variable_set(:@datadog_jdbc_metadata, metadata)
+              metadata
             end
 
             def datadog_configuration

data/lib/datadog/tracing/contrib/sidekiq/distributed/propagation.rb

@@ -35,7 +35,7 @@ module Datadog
                     Tracing::Distributed::TraceContext.new(fetcher: Tracing::Distributed::Fetcher),
                   Tracing::Configuration::Ext::Distributed::PROPAGATION_STYLE_BAGGAGE =>
                     Tracing::Distributed::Baggage.new(fetcher: Tracing::Distributed::Fetcher),
-                  Tracing::Configuration::Ext::Distributed::PROPAGATION_STYLE_NONE => Tracing::Distributed::None.new
+                  Tracing::Configuration::Ext::Distributed::PROPAGATION_STYLE_NONE => Tracing::Distributed::None.new,
                 },
                 propagation_style_inject: propagation_style_inject,
                 propagation_style_extract: propagation_style_extract,

data/lib/datadog/tracing/contrib/sinatra/configuration/settings.rb

@@ -12,7 +12,7 @@ module Datadog
           # @public_api
           class Settings < Contrib::Configuration::Settings
             DEFAULT_HEADERS = {
-              response: %w[Content-Type X-Request-ID]
+              response: %w[Content-Type X-Request-ID],
             }.freeze
 
             option :enabled do |o|

data/lib/datadog/tracing/contrib/sneakers/tracer.rb

@@ -18,7 +18,7 @@ module Datadog
             trace_options = {
               service: configuration[:service_name],
               type: Tracing::Metadata::Ext::AppTypes::TYPE_WORKER,
-              on_error: configuration[:on_error]
+              on_error: configuration[:on_error],
             }
 
             Tracing.trace(Ext::SPAN_JOB, **trace_options) do |request_span|

data/lib/datadog/tracing/contrib/utils/quantization/hash_formatter.rb

@@ -15,7 +15,7 @@ module Datadog
             DEFAULT_OPTIONS = { # steep:ignore IncompatibleAssignment
               exclude: EXCLUDE_KEYS,
               show: SHOW_KEYS,
-              placeholder: PLACEHOLDER
+              placeholder: PLACEHOLDER,
             }.freeze
 
             module_function