datadog 2.46.0 → 2.48.0

data/lib/datadog/appsec/assets/waf_rules/strict.json

@@ -1,7 +1,7 @@
 {
   "version": "2.2",
   "metadata": {
-    "rules_version": "1.15.1"
+    "rules_version": "1.17.0"
   },
   "rules": [
     {
@@ -3063,4 +3063,4 @@
       }
     }
   ]
-}
+}

data/lib/datadog/appsec/autoload.rb

@@ -7,7 +7,7 @@ if %w[1 true].include?((Datadog::DATADOG_ENV["DD_APPSEC_ENABLED"] || "").downcas
   rescue => e
     Kernel.warn(
       "[datadog] AppSec failed to instrument. No security check will be performed. error: " \
-      " #{e.class}: #{e.message}"
+      " #{e.class}: #{e.message}",
     )
   end
 end

data/lib/datadog/appsec/component.rb

@@ -26,7 +26,7 @@ module Datadog
             Datadog.logger.warn(
               "AppSec is not supported in Ruby versions above 3.3.0 when using `ffi` versions older than 1.16.0, " \
               "and will be forcibly disabled due to a memory leak in `ffi`. " \
-              "Please upgrade your `ffi` version to 1.16.0 or higher."
+              "Please upgrade your `ffi` version to 1.16.0 or higher.",
             )
             telemetry.error("AppSec: Component not loaded, ffi version is leaky with ruby > 3.3.0")
 

data/lib/datadog/appsec/compressed_json.rb

@@ -28,7 +28,7 @@ module Datadog
 
       private_class_method def self.compress_and_encode(payload)
         Core::Utils::Base64Codec.strict_encode64(
-          Zlib.gzip(payload, level: Zlib::BEST_SPEED, strategy: Zlib::DEFAULT_STRATEGY)
+          Zlib.gzip(payload, level: Zlib::BEST_SPEED, strategy: Zlib::DEFAULT_STRATEGY),
         )
       rescue Zlib::Error, TypeError => e
         AppSec.telemetry.report(e, description: "AppSec: Failed to compress and encode value")

data/lib/datadog/appsec/configuration.rb

@@ -34,7 +34,7 @@ module Datadog
           SAFE_TRACK_USER_EVENTS_MODE, EXTENDED_TRACK_USER_EVENTS_MODE,
         ].freeze
         APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES = ["1", "true"].concat(
-          APPSEC_VALID_TRACK_USER_EVENTS_MODE
+          APPSEC_VALID_TRACK_USER_EVENTS_MODE,
         ).freeze
 
         def self.extended(base)
@@ -297,7 +297,7 @@ module Datadog
                     Datadog.logger.warn(
                       "The appsec.auto_user_instrumentation.mode value provided is not supported. " \
                       "Supported values are: #{AUTO_USER_INSTRUMENTATION_MODES.join(" | ")}. " \
-                      "Using value: #{DISABLED_AUTO_USER_INSTRUMENTATION_MODE}."
+                      "Using value: #{DISABLED_AUTO_USER_INSTRUMENTATION_MODE}.",
                     )
 
                     DISABLED_AUTO_USER_INSTRUMENTATION_MODE
@@ -342,7 +342,7 @@ module Datadog
                       Datadog.logger.warn(
                         "The appsec.track_user_events.mode value provided is not supported." \
                         "Supported values are: #{APPSEC_VALID_TRACK_USER_EVENTS_MODE.join(" | ")}." \
-                        "Using default value: #{SAFE_TRACK_USER_EVENTS_MODE}."
+                        "Using default value: #{SAFE_TRACK_USER_EVENTS_MODE}.",
                       )
 
                       SAFE_TRACK_USER_EVENTS_MODE

data/lib/datadog/appsec/context.rb

@@ -57,7 +57,7 @@ module Datadog
         @waf_runner = waf_runner
         @metrics = Metrics::Collector.new
         @downstream_body_sampler = CounterSampler.new(
-          Datadog.configuration.appsec.api_security.downstream_body_analysis.sample_rate
+          Datadog.configuration.appsec.api_security.downstream_body_analysis.sample_rate,
         )
         @state = {
           events: [],

data/lib/datadog/appsec/contrib/active_record/instrumentation.rb

@@ -36,13 +36,23 @@ module Datadog
               TraceKeeper.keep!(context.trace) if result.keep?
 
               context.events.push(
-                AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
               )
 
               AppSec::ActionsHandler.handle(result.actions)
             end
           end
 
+          module PreprocessQueryAdapterPatch
+            private
+
+            def preprocess_query(sql)
+              Instrumentation.detect_sql_injection(sql, adapter_name)
+
+              super
+            end
+          end
+
           # patch for mysql2, sqlite3, and postgres+jdbc adapters in ActiveRecord >= 7.1
           module InternalExecQueryAdapterPatch
             def internal_exec_query(sql, *args, **rest)

data/lib/datadog/appsec/contrib/active_record/patcher.rb

@@ -52,7 +52,9 @@ module Datadog
           end
 
           def patch_sqlite3_adapter
-            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
+            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("8.0")
+              Instrumentation::PreprocessQueryAdapterPatch
+            elsif ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
               Instrumentation::InternalExecQueryAdapterPatch
             elsif ::ActiveRecord.gem_version.segments.first == 4
               Instrumentation::Rails4ExecQueryAdapterPatch
@@ -65,7 +67,9 @@ module Datadog
           end
 
           def patch_mysql2_adapter
-            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
+            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("8.0")
+              Instrumentation::PreprocessQueryAdapterPatch
+            elsif ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
               Instrumentation::InternalExecQueryAdapterPatch
             elsif ::ActiveRecord.gem_version.segments.first == 4
               Instrumentation::Rails4ExecQueryAdapterPatch
@@ -78,14 +82,18 @@ module Datadog
           end
 
           def patch_postgresql_adapter
-            instrumentation_module = if ::ActiveRecord.gem_version.segments.first == 4
+            instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("8.0")
+              Instrumentation::PreprocessQueryAdapterPatch
+            elsif ::ActiveRecord.gem_version.segments.first == 4
               Instrumentation::Rails4ExecuteAndClearAdapterPatch
             else
               Instrumentation::ExecuteAndClearAdapterPatch
             end
 
             if defined?(::ActiveRecord::ConnectionAdapters::JdbcAdapter)
-              instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
+              instrumentation_module = if ::ActiveRecord.gem_version >= Gem::Version.new("8.0")
+                Instrumentation::PreprocessQueryAdapterPatch
+              elsif ::ActiveRecord.gem_version >= Gem::Version.new("7.1")
                 Instrumentation::InternalExecQueryAdapterPatch
               elsif ::ActiveRecord.gem_version.segments.first == 4
                 Instrumentation::Rails4ExecQueryAdapterPatch

data/lib/datadog/appsec/contrib/aws_lambda/gateway/watcher.rb

@@ -30,7 +30,7 @@ module Datadog
 
                   if result.match? || !result.attributes.empty?
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
                   end
 
@@ -57,7 +57,7 @@ module Datadog
                     TraceKeeper.keep!(context.trace) if result.keep?
 
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
 
                     AppSec::ActionsHandler.handle(result.actions)

data/lib/datadog/appsec/contrib/aws_lambda/waf_addresses.rb

@@ -113,7 +113,7 @@ module Datadog
 
             body = Core::Utils::Base64Codec.strict_decode64(body) if payload["base64_encoded"]
             AppSec::Utils::HTTP::Body.parse(
-              body, media_type: media_type, limit: Datadog.configuration.appsec.body_parsing_size_limit
+              body, media_type: media_type, limit: Datadog.configuration.appsec.body_parsing_size_limit,
             )
           rescue ArgumentError => e
             AppSec.telemetry.report(e, description: "AppSec: Failed to decode base64 body")

data/lib/datadog/appsec/contrib/devise/configuration.rb

@@ -39,7 +39,7 @@ module Datadog
             if !appsec.track_user_events.options[:mode].default_precedence? &&
                 appsec.auto_user_instrumentation.options[:mode].default_precedence?
               return TRACK_USER_EVENTS_CONVERSION_RULES.fetch(
-                appsec.track_user_events.mode, appsec.auto_user_instrumentation.mode
+                appsec.track_user_events.mode, appsec.auto_user_instrumentation.mode,
               )
             end
 

data/lib/datadog/appsec/contrib/devise/patches/signin_tracking_patch.rb

@@ -64,7 +64,7 @@ module Datadog
               #       and because of that we will trigger an additional event even
               #       if it was already done via the SDK
               AppSec::Instrumentation.gateway.push(
-                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login)
+                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login),
               )
             end
 

data/lib/datadog/appsec/contrib/devise/patches/signup_tracking_patch.rb

@@ -59,7 +59,7 @@ module Datadog
               #       and because of that we will trigger an additional event even
               #       if it was already done via the SDK
               AppSec::Instrumentation.gateway.push(
-                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login)
+                "identity.set_user", AppSec::Instrumentation::Gateway::User.new(id, login),
               )
             end
           end

data/lib/datadog/appsec/contrib/devise/tracking_middleware.rb

@@ -49,7 +49,7 @@ module Datadog
                 #        passing them at first place.
                 #        This is a temporary situation until we refactor events model.
                 AppSec::Instrumentation.gateway.push(
-                  "identity.set_user", AppSec::Instrumentation::Gateway::User.new(user_id, nil, user_session_id)
+                  "identity.set_user", AppSec::Instrumentation::Gateway::User.new(user_id, nil, user_session_id),
                 )
               end
 

data/lib/datadog/appsec/contrib/excon/ssrf_detection_middleware.rb

@@ -169,7 +169,7 @@ module Datadog
             TraceKeeper.keep!(context.trace) if result.keep?
 
             context.events.push(
-              AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+              AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
             )
 
             AppSec::ActionsHandler.handle(result.actions)

data/lib/datadog/appsec/contrib/faraday/ssrf_detection_middleware.rb

@@ -154,7 +154,7 @@ module Datadog
             TraceKeeper.keep!(context.trace) if result.keep?
 
             context.events.push(
-              AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+              AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
             )
 
             AppSec::ActionsHandler.handle(result.actions)

data/lib/datadog/appsec/contrib/graphql/gateway/multiplex.rb

@@ -60,7 +60,7 @@ module Datadog
                 when ::GraphQL::Language::Nodes::FragmentSpread
                   fragment_name = selection.name
                   append_arguments(
-                    args_hash, fragment_name, nil, arguments_from_directives(selection.directives, query_variables)
+                    args_hash, fragment_name, nil, arguments_from_directives(selection.directives, query_variables),
                   )
 
                   next if visited_fragments[fragment_name]
@@ -69,13 +69,13 @@ module Datadog
                   next unless fragment
 
                   append_arguments(
-                    args_hash, fragment_name, nil, arguments_from_directives(fragment.directives, query_variables)
+                    args_hash, fragment_name, nil, arguments_from_directives(fragment.directives, query_variables),
                   )
 
                   # re-used fragments are not expanded
                   visited_fragments[fragment_name] = true
                   arguments_from_selections(
-                    fragment.selections, query_variables, args_hash, fragments, visited_fragments
+                    fragment.selections, query_variables, args_hash, fragments, visited_fragments,
                   )
                 when ::GraphQL::Language::Nodes::Field
                   selection_name = selection.alias || selection.name
@@ -84,19 +84,19 @@ module Datadog
                     args_hash,
                     selection_name,
                     field_arguments,
-                    arguments_from_directives(selection.directives, query_variables)
+                    arguments_from_directives(selection.directives, query_variables),
                   )
 
                   arguments_from_selections(
-                    selection.selections, query_variables, args_hash, fragments, visited_fragments
+                    selection.selections, query_variables, args_hash, fragments, visited_fragments,
                   )
                 when ::GraphQL::Language::Nodes::InlineFragment
                   append_arguments(
-                    args_hash, selection.type.name, nil, arguments_from_directives(selection.directives, query_variables)
+                    args_hash, selection.type.name, nil, arguments_from_directives(selection.directives, query_variables),
                   )
 
                   arguments_from_selections(
-                    selection.selections, query_variables, args_hash, fragments, visited_fragments
+                    selection.selections, query_variables, args_hash, fragments, visited_fragments,
                   )
                 end
               end

data/lib/datadog/appsec/contrib/graphql/gateway/watcher.rb

@@ -37,7 +37,7 @@ module Datadog
                       TraceKeeper.keep!(context.trace) if result.keep?
 
                       context.events.push(
-                        AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                        AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                       )
 
                       AppSec::ActionsHandler.handle(result.actions)

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -41,7 +41,7 @@ module Datadog
 
                   if result.match? || !result.attributes.empty?
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
                   end
 
@@ -73,7 +73,7 @@ module Datadog
                     TraceKeeper.keep!(context.trace) if result.keep?
 
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
 
                     AppSec::ActionsHandler.handle(result.actions)
@@ -119,7 +119,7 @@ module Datadog
                     TraceKeeper.keep!(context.trace) if result.keep?
 
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
 
                     AppSec::ActionsHandler.handle(result.actions)

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -49,7 +49,7 @@ module Datadog
             return @app.call(env) unless security_engine
 
             ctx = Datadog::AppSec::Context.activate(
-              Datadog::AppSec::Context.new(active_trace, active_span, security_engine.new_runner)
+              Datadog::AppSec::Context.new(active_trace, active_span, security_engine.new_runner),
             )
             env[Datadog::AppSec::Ext::CONTEXT_KEY] = ctx
 
@@ -68,7 +68,7 @@ module Datadog
               end
 
               gateway_response = Gateway::Response.new(
-                http_response[2], http_response[0], http_response[1], context: ctx
+                http_response[2], http_response[0], http_response[1], context: ctx,
               )
 
               Instrumentation.gateway.push("rack.request.finish", gateway_request)
@@ -165,7 +165,7 @@ module Datadog
                 trace.keep!
                 trace.set_tag(
                   Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
-                  Datadog::Tracing::Sampling::Ext::Decision::ASM
+                  Datadog::Tracing::Sampling::Ext::Decision::ASM,
                 )
               end
             end
@@ -182,7 +182,7 @@ module Datadog
             if span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
               # always collect client ip, as this is part of AppSec provided functionality
               Datadog::Tracing::ClientIp.set_client_ip_tag!(
-                span, headers: headers, remote_ip: env["REMOTE_ADDR"]
+                span, headers: headers, remote_ip: env["REMOTE_ADDR"],
               )
             end
           end
@@ -192,7 +192,7 @@ module Datadog
             return unless span
 
             AppSec::DefaultHeaderTags.tag_response(
-              span, Datadog::Core::HeaderCollection.from_hash(response.headers)
+              span, Datadog::Core::HeaderCollection.from_hash(response.headers),
             )
 
             unless response.headers.key?("content-length")

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -49,7 +49,7 @@ module Datadog
 
                   if result.match?
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
 
                     AppSec::Event.tag(context, result)
@@ -66,14 +66,27 @@ module Datadog
                 gateway.watch("rails.response.body.json") do |stack, container|
                   context = container.context
 
+                  body_bytesize = container.data.bytesize
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
+
                   persistent_data = {
-                    "server.response.body" => container.data,
+                    "server.response.body.byte_length" => body_bytesize,
                   }
-                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if limit > 0 && body_bytesize <= limit
+                    json = extract_json(container.data)
+                    persistent_data["server.response.body"] = WAF::JSONString.new(json) if json
+                  end
+
+                  result = begin
+                    context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+                  rescue WAF::ConversionError
+                    next stack.call(container)
+                  end
 
                   if result.match?
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
 
                     AppSec::Event.tag(context, result)
@@ -85,6 +98,20 @@ module Datadog
                   stack.call(container)
                 end
               end
+
+              private
+
+              def extract_json(body)
+                return body unless body.start_with?("/**/")
+                return unless body.end_with?(")")
+
+                # NOTE: Best-effort support for standard Rails JSONP callbacks.
+                #       Callback expressions with parentheses may prevent extraction
+                opening_parenthesis_index = body.b.index("(")
+                return unless opening_parenthesis_index
+
+                body.byteslice(opening_parenthesis_index + 1, body.bytesize - opening_parenthesis_index - 2) #: String
+              end
             end
           end
         end

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -66,7 +66,7 @@ module Datadog
             if include_middleware?(Datadog::Tracing::Contrib::Rack::TraceMiddleware, app)
               app.middleware.insert_after(
                 Datadog::Tracing::Contrib::Rack::TraceMiddleware,
-                Datadog::AppSec::Contrib::Rack::RequestMiddleware
+                Datadog::AppSec::Contrib::Rack::RequestMiddleware,
               )
             else
               app.middleware.insert_before(0, Datadog::AppSec::Contrib::Rack::RequestMiddleware)
@@ -162,7 +162,7 @@ module Datadog
 
             GUARD_ROUTES_REPORTING_ONCE_PER_APP[::Rails.application].run do
               AppSec.telemetry.app_endpoints_loaded(
-                APISecurity::EndpointCollection::RailsCollector.new(routes).to_enum
+                APISecurity::EndpointCollection::RailsCollector.new(routes).to_enum,
               )
             end
           rescue => e

data/lib/datadog/appsec/contrib/rails/patches/render_to_body_patch.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "../../../utils/hash_coercion"
 require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
@@ -8,8 +7,8 @@ module Datadog
     module Contrib
       module Rails
         module Patches
-          # A patch targeting `AbstractController::Rendering#render_to_body`
-          # method to capture JSON response body right before it is serialized.
+          # A patch for `AbstractController::Rendering#render_to_body` that captures
+          # the serialized JSON response body for AppSec inspection
           module RenderToBodyPatch
             def render_to_body(options = {})
               return super unless options.key?(:json)
@@ -17,13 +16,15 @@ module Datadog
               context = request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
               return super unless context
 
-              data = Utils::HashCoercion.coerce(options[:json])
-              return super unless data
+              # NOTE: Custom renderers can return streaming bodies, which we
+              #       currently do not inspect
+              body = super
+              return body unless body.is_a?(String)
 
-              container = Instrumentation::Gateway::DataContainer.new(data, context: context)
+              container = Instrumentation::Gateway::DataContainer.new(body, context: context)
               Instrumentation.gateway.push("rails.response.body.json", container)
 
-              super
+              body
             end
           end
         end

data/lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb

@@ -181,7 +181,7 @@ module Datadog
             TraceKeeper.keep!(context.trace) if result.keep?
 
             context.events.push(
-              AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+              AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
             )
 
             AppSec::ActionsHandler.handle(result.actions)

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -56,7 +56,7 @@ module Datadog
 
                   if result.match? || !result.attributes.empty?
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
                   end
 
@@ -87,7 +87,7 @@ module Datadog
                     TraceKeeper.keep!(context.trace) if result.keep?
 
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
 
                     AppSec::ActionsHandler.handle(result.actions)
@@ -101,14 +101,26 @@ module Datadog
                 gateway.watch("sinatra.response.body.json") do |stack, container|
                   context = container.context # : Context
 
+                  body_bytesize = container.data.bytesize
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
+
                   persistent_data = {
-                    "server.response.body" => container.data,
+                    "server.response.body.byte_length" => body_bytesize,
                   }
-                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if limit > 0 && body_bytesize <= limit
+                    persistent_data["server.response.body"] = WAF::JSONString.new(container.data)
+                  end
+
+                  result = begin
+                    context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+                  rescue WAF::ConversionError
+                    next stack.call(container)
+                  end
 
                   if result.match?
                     context.events.push(
-                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span),
                     )
 
                     AppSec::Event.tag(context, result)

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -37,7 +37,7 @@ module Datadog
                 tracing_sinatra_framework.add_middleware_after(
                   tracing_middleware,
                   Datadog::AppSec::Contrib::Rack::RequestMiddleware,
-                  builder
+                  builder,
                 )
               else
                 tracing_sinatra_framework.add_middleware(Datadog::AppSec::Contrib::Rack::RequestMiddleware, builder)

data/lib/datadog/appsec/contrib/sinatra/patches/json_patch.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require_relative "../../../utils/hash_coercion"
 require_relative "../../../instrumentation/gateway/argument"
 
 module Datadog
@@ -8,20 +7,22 @@ module Datadog
     module Contrib
       module Sinatra
         module Patches
-          # A patch targeting `Sinatra::JSON#json` method to capture JSON response
-          # body right before it is serialized.
+          # A patch for `Sinatra::JSON#json` that captures the serialized
+          # response body for AppSec inspection
           module JsonPatch
             def json(object, options = {})
               context = @request.env[Datadog::AppSec::Ext::CONTEXT_KEY] # : Context?
               return super unless context
 
-              data = Utils::HashCoercion.coerce(object)
-              return super unless data
+              # NOTE: Custom renderers can return streaming bodies, which we
+              #       currently do not inspect
+              body = super
+              return body unless body.is_a?(String)
 
-              container = Instrumentation::Gateway::DataContainer.new(data, context: context)
+              container = Instrumentation::Gateway::DataContainer.new(body, context: context)
               Instrumentation.gateway.push("sinatra.response.body.json", container)
 
-              super
+              body
             end
           end
         end

data/lib/datadog/appsec/metrics/collector.rb

@@ -14,7 +14,7 @@ module Datadog
           :duration_ext_ns,
           :inputs_truncated,
           :downstream_requests,
-          keyword_init: true
+          keyword_init: true,
         )
 
         DownstreamResponseStore = Struct.new(
@@ -22,7 +22,7 @@ module Datadog
           :content_length_missing,
           :content_length_too_big,
           :content_exceed_content_length,
-          keyword_init: true
+          keyword_init: true,
         )
 
         attr_reader :waf, :rasp, :downstream_responses
@@ -32,17 +32,17 @@ module Datadog
 
           @waf = Store.new(
             evals: 0, matches: 0, errors: 0, timeouts: 0, duration_ns: 0,
-            duration_ext_ns: 0, inputs_truncated: 0, downstream_requests: 0
+            duration_ext_ns: 0, inputs_truncated: 0, downstream_requests: 0,
           )
 
           @rasp = Store.new(
             evals: 0, matches: 0, errors: 0, timeouts: 0, duration_ns: 0,
-            duration_ext_ns: 0, inputs_truncated: 0, downstream_requests: 0
+            duration_ext_ns: 0, inputs_truncated: 0, downstream_requests: 0,
           )
 
           @downstream_responses = DownstreamResponseStore.new(
             content_type_invalid: 0, content_length_missing: 0,
-            content_length_too_big: 0, content_exceed_content_length: 0
+            content_length_too_big: 0, content_exceed_content_length: 0,
           )
         end