datadog 2.7.1 → 2.17.0

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -4,9 +4,12 @@ require 'json'
 
 require_relative 'gateway/request'
 require_relative 'gateway/response'
-require_relative '../../instrumentation/gateway'
-require_relative '../../processor'
+
+require_relative '../../event'
 require_relative '../../response'
+require_relative '../../processor'
+require_relative '../../security_event'
+require_relative '../../instrumentation/gateway'
 
 require_relative '../../../tracing/client_ip'
 require_relative '../../../tracing/contrib/rack/header_collection'
@@ -36,7 +39,7 @@ module Datadog
             @rack_headers = {}
           end
 
-          # rubocop:disable Metrics/AbcSize,Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity,Metrics/MethodLength
+          # rubocop:disable Metrics/MethodLength
           def call(env)
             return @app.call(env) unless Datadog::AppSec.enabled?
 
@@ -45,19 +48,22 @@ module Datadog
 
             processor = nil
             ready = false
-            scope = nil
+            ctx = nil
 
             # For a given request, keep using the first Rack stack scope for
             # nested apps. Don't set `context` local variable so that on popping
             # out of this nested stack we don't finalize the parent's context
-            return @app.call(env) if active_scope(env)
+            return @app.call(env) if active_context(env)
 
             Datadog::AppSec.reconfigure_lock do
               processor = Datadog::AppSec.processor
 
               if !processor.nil? && processor.ready?
-                scope = Datadog::AppSec::Scope.activate_scope(active_trace, active_span, processor)
-                env[Datadog::AppSec::Ext::SCOPE_KEY] = scope
+                ctx = Datadog::AppSec::Context.activate(
+                  Datadog::AppSec::Context.new(active_trace, active_span, processor)
+                )
+
+                env[Datadog::AppSec::Ext::CONTEXT_KEY] = ctx
                 ready = true
               end
             end
@@ -66,66 +72,55 @@ module Datadog
 
             return @app.call(env) unless ready
 
-            gateway_request = Gateway::Request.new(env)
+            add_appsec_tags(processor, ctx)
+            add_request_tags(ctx, env)
 
-            add_appsec_tags(processor, scope)
-            add_request_tags(scope, env)
+            http_response = nil
+            gateway_request = Gateway::Request.new(env)
+            gateway_response = nil
 
-            request_return, request_response = catch(::Datadog::AppSec::Ext::INTERRUPT) do
-              Instrumentation.gateway.push('rack.request', gateway_request) do
+            interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
+              # TODO: This event should be renamed into `rack.request.start` to
+              #       reflect that it's the beginning of the request-cycle
+              http_response, _gateway_request = Instrumentation.gateway.push('rack.request', gateway_request) do
                 @app.call(env)
               end
-            end
-
-            if request_response
-              blocked_event = request_response.find { |action, _options| action == :block }
-              request_return = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_rack if blocked_event
-            end
-
-            gateway_response = Gateway::Response.new(
-              request_return[2],
-              request_return[0],
-              request_return[1],
-              scope: scope,
-            )
 
-            _response_return, response_response = Instrumentation.gateway.push('rack.response', gateway_response)
+              gateway_response = Gateway::Response.new(
+                http_response[2], http_response[0], http_response[1], context: ctx
+              )
 
-            result = scope.processor_context.extract_schema
+              Instrumentation.gateway.push('rack.request.finish', gateway_request)
+              Instrumentation.gateway.push('rack.response', gateway_response)
 
-            if result
-              scope.processor_context.events << {
-                trace: scope.trace,
-                span: scope.service_entry_span,
-                waf_result: result,
-              }
+              nil
             end
 
-            scope.processor_context.events.each do |e|
-              e[:response] ||= gateway_response
-              e[:request]  ||= gateway_request
+            if interrupt_params
+              http_response = AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack
             end
 
-            AppSec::Event.record(scope.service_entry_span, *scope.processor_context.events)
-
-            if response_response
-              blocked_event = response_response.find { |action, _options| action == :block }
-              request_return = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_rack if blocked_event
+            if AppSec.perform_api_security_check?
+              ctx.events.push(
+                AppSec::SecurityEvent.new(ctx.extract_schema, trace: ctx.trace, span: ctx.span)
+              )
             end
 
-            request_return
+            AppSec::Event.record(ctx, request: gateway_request, response: gateway_response)
+
+            http_response
           ensure
-            if scope
-              add_waf_runtime_tags(scope)
-              Datadog::AppSec::Scope.deactivate_scope
+            if ctx
+              ctx.export_metrics
+              Datadog::AppSec::Context.deactivate
             end
           end
-          # rubocop:enable Metrics/AbcSize,Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity,Metrics/MethodLength
+          # rubocop:enable Metrics/MethodLength
 
           private
 
-          def active_scope(env)
-            env[Datadog::AppSec::Ext::SCOPE_KEY]
+          def active_context(env)
+            env[Datadog::AppSec::Ext::CONTEXT_KEY]
           end
 
           def active_trace
@@ -144,15 +139,14 @@ module Datadog
             Datadog::Tracing.active_span
           end
 
-          def add_appsec_tags(processor, scope)
-            span = scope.service_entry_span
-            trace = scope.trace
+          # standard:disable Metrics/MethodLength
+          def add_appsec_tags(processor, context)
+            span = context.span
+            trace = context.trace
 
             return unless trace && span
 
             span.set_metric(Datadog::AppSec::Ext::TAG_APPSEC_ENABLED, 1)
-            # We add this tag when ASM standalone is enabled to make sure we don't bill APM
-            span.set_metric(Datadog::AppSec::Ext::TAG_APM_ENABLED, 0) if Datadog.configuration.appsec.standalone.enabled
             span.set_tag('_dd.runtime_family', 'ruby')
             span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
 
@@ -180,9 +174,11 @@ module Datadog
               end
             end
           end
+          # standard:enable Metrics/MethodLength
 
-          def add_request_tags(scope, env)
-            span = scope.service_entry_span
+          # standard:disable Metrics/MethodLength
+          def add_request_tags(context, env)
+            span = context.span
 
             return unless span
 
@@ -203,19 +199,7 @@ module Datadog
               )
             end
           end
-
-          def add_waf_runtime_tags(scope)
-            span = scope.service_entry_span
-            context = scope.processor_context
-
-            return unless span && context
-
-            span.set_tag('_dd.appsec.waf.timeouts', context.timeouts)
-
-            # these tags expect time in us
-            span.set_tag('_dd.appsec.waf.duration', context.time_ns / 1000.0)
-            span.set_tag('_dd.appsec.waf.duration_ext', context.time_ext_ns / 1000.0)
-          end
+          # standard:enable Metrics/MethodLength
 
           def to_rack_header(header)
             @rack_headers[header] ||= Datadog::Tracing::Contrib::Rack::Header.to_rack_header(header)

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -1,9 +1,8 @@
 # frozen_string_literal: true
 
-require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/operation'
-require_relative '../reactive/action'
 require_relative '../../../event'
+require_relative '../../../security_event'
+require_relative '../../../instrumentation/gateway'
 
 module Datadog
   module AppSec
@@ -21,43 +20,27 @@ module Datadog
 
               def watch_request_action(gateway = Instrumentation.gateway)
                 gateway.watch('rails.request.action', :appsec) do |stack, gateway_request|
-                  block = false
-
-                  event = nil
-                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
 
-                  AppSec::Reactive::Operation.new('rails.request.action') do |op|
-                    Rails::Reactive::Action.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          request: gateway_request,
-                          actions: result.actions
-                        }
+                  persistent_data = {
+                    'server.request.body' => gateway_request.parsed_body,
+                    'server.request.path_params' => gateway_request.route_params
+                  }
 
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
-                    end
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
-                    block = Rails::Reactive::Action.publish(op, gateway_request)
+                  if result.match? || !result.derivatives.empty?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
                   end
 
-                  next [nil, [[:block, event]]] if block
-
-                  ret, res = stack.call(gateway_request.request)
-
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
+                  if result.match?
+                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::ActionsHandler.handle(result.actions)
                   end
 
-                  [ret, res]
+                  stack.call(gateway_request.request)
                 end
               end
             end

data/lib/datadog/appsec/contrib/rails/integration.rb

@@ -18,7 +18,7 @@ module Datadog
           register_as :rails, auto_patch: false
 
           def self.version
-            Gem.loaded_specs['railties'] && Gem.loaded_specs['railties'].version
+            Gem.loaded_specs['railties']&.version
           end
 
           def self.loaded?

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -2,7 +2,6 @@
 
 require_relative '../../../core/utils/only_once'
 
-require_relative '../patcher'
 require_relative 'framework'
 require_relative '../../response'
 require_relative '../rack/request_middleware'
@@ -18,8 +17,6 @@ module Datadog
       module Rails
         # Patcher for AppSec on Rails
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
           AFTER_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
 
@@ -73,29 +70,19 @@ module Datadog
             def process_action(*args)
               env = request.env
 
-              context = env[Datadog::AppSec::Ext::SCOPE_KEY]
+              context = env[Datadog::AppSec::Ext::CONTEXT_KEY]
 
               return super unless context
 
               # TODO: handle exceptions, except for super
 
               gateway_request = Gateway::Request.new(request)
-              request_return, request_response = Instrumentation.gateway.push('rails.request.action', gateway_request) do
-                super
-              end
 
-              if request_response
-                blocked_event = request_response.find { |action, _options| action == :block }
-                if blocked_event
-                  @_response = AppSec::Response.negotiate(
-                    env,
-                    blocked_event.last[:actions]
-                  ).to_action_dispatch_response
-                  request_return = @_response.body
-                end
+              http_response, _gateway_request = Instrumentation.gateway.push('rails.request.action', gateway_request) do
+                super
               end
 
-              request_return
+              http_response
             end
           end
 
@@ -109,27 +96,27 @@ module Datadog
             # find tracer middleware reference in Rails::Configuration::MiddlewareStackProxy
             app.middleware.instance_variable_get(:@operations).each do |operation|
               args = case operation
-                     when Array
-                       # rails 5.2
-                       _op, args = operation
-                       args
-                     when Proc
-                       if operation.binding.local_variables.include?(:args)
-                         # rails 6.0, 6.1
-                         operation.binding.local_variable_get(:args)
-                       else
-                         # rails 7.0 uses ... to pass args
-                         args_getter = Class.new do
-                           def method_missing(_op, *args) # rubocop:disable Style/MissingRespondToMissing
-                             args
-                           end
-                         end.new
-                         operation.call(args_getter)
-                       end
-                     else
-                       # unknown, pass through
-                       []
-                     end
+              when Array
+                # rails 5.2
+                _op, args = operation
+                args
+              when Proc
+                if operation.binding.local_variables.include?(:args)
+                  # rails 6.0, 6.1
+                  operation.binding.local_variable_get(:args)
+                else
+                  # rails 7.0 uses ... to pass args
+                  args_getter = Class.new do
+                    def method_missing(_op, *args) # standard:disable Style/MissingRespondToMissing
+                      args
+                    end
+                  end.new
+                  operation.call(args_getter)
+                end
+              else
+                # unknown, pass through
+                []
+              end
 
               found = true if args.include?(middleware)
             end

data/lib/datadog/appsec/contrib/rest_client/integration.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative '../integration'
+require_relative 'patcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # This class defines properties of rest-client AppSec integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('1.8')
+
+          register_as :rest_client
+
+          def self.gem_name
+            'rest-client'
+          end
+
+          def self.version
+            Gem.loaded_specs['rest-client']&.version
+          end
+
+          def self.loaded?
+            !defined?(::RestClient::Request).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rest_client/patcher.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # Patcher for RestClient gem
+        module Patcher
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            require_relative 'request_ssrf_detection_patch'
+
+            ::RestClient::Request.prepend(RequestSSRFDetectionPatch)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rest_client/request_ssrf_detection_patch.rb

@@ -0,0 +1,38 @@
+# rubocop:disable Naming/FileName
+# frozen_string_literal: true
+
+require_relative '../../event'
+require_relative '../../security_event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module RestClient
+        # Module that adds SSRF detection to RestClient::Request#execute
+        module RequestSSRFDetectionPatch
+          def execute(&block)
+            return super unless AppSec.rasp_enabled? && AppSec.active_context
+
+            context = AppSec.active_context
+
+            ephemeral_data = {'server.io.net.url' => url}
+            result = context.run_rasp(Ext::RASP_SSRF, {}, ephemeral_data, Datadog.configuration.appsec.waf_timeout)
+
+            if result.match?
+              AppSec::Event.tag_and_keep!(context, result)
+
+              context.events.push(
+                AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+              )
+
+              AppSec::ActionsHandler.handle(result.actions)
+            end
+
+            super
+          end
+        end
+      end
+    end
+  end
+end
+# rubocop:enable Naming/FileName

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -1,10 +1,8 @@
 # frozen_string_literal: true
 
-require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/operation'
-require_relative '../../rack/reactive/request_body'
-require_relative '../reactive/routed'
 require_relative '../../../event'
+require_relative '../../../security_event'
+require_relative '../../../instrumentation/gateway'
 
 module Datadog
   module AppSec
@@ -23,85 +21,50 @@ module Datadog
 
               def watch_request_dispatch(gateway = Instrumentation.gateway)
                 gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
-                  block = false
-
-                  event = nil
-                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
-
-                  AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
-                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          request: gateway_request,
-                          actions: result.actions
-                        }
-
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
-                    end
-
-                    block = Rack::Reactive::RequestBody.publish(op, gateway_request)
-                  end
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
+
+                  persistent_data = {
+                    'server.request.body' => gateway_request.form_hash
+                  }
 
-                  next [nil, [[:block, event]]] if block
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
-                  ret, res = stack.call(gateway_request.request)
+                  if result.match? || !result.derivatives.empty?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+                  end
 
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
+                  if result.match?
+                    AppSec::Event.tag_and_keep!(context, result)
+                    AppSec::ActionsHandler.handle(result.actions)
                   end
 
-                  [ret, res]
+                  stack.call(gateway_request.request)
                 end
               end
 
               def watch_request_routed(gateway = Instrumentation.gateway)
                 gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
-                  block = false
-
-                  event = nil
-                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
-
-                  AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
-                    Sinatra::Reactive::Routed.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          request: gateway_request,
-                          actions: result.actions
-                        }
-
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
-                    end
-
-                    block = Sinatra::Reactive::Routed.publish(op, [gateway_request, gateway_route_params])
-                  end
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY]
+
+                  persistent_data = {
+                    'server.request.path_params' => gateway_route_params.params
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
 
-                  next [nil, [[:block, event]]] if block
+                  if result.match?
+                    AppSec::Event.tag_and_keep!(context, result)
 
-                  ret, res = stack.call(gateway_request.request)
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
 
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
+                    AppSec::ActionsHandler.handle(result.actions)
                   end
 
-                  [ret, res]
+                  stack.call(gateway_request.request)
                 end
               end
             end

data/lib/datadog/appsec/contrib/sinatra/integration.rb

@@ -18,7 +18,7 @@ module Datadog
           register_as :sinatra
 
           def self.version
-            Gem.loaded_specs['sinatra'] && Gem.loaded_specs['sinatra'].version
+            Gem.loaded_specs['sinatra']&.version
           end
 
           def self.loaded?