datadog 2.7.1 → 2.17.0

data/lib/datadog/appsec/monitor/reactive/set_user.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Monitor
-      module Reactive
-        # Dispatch data from Datadog::Kit::Identity.set_user to the WAF context
-        module SetUser
-          ADDRESSES = [
-            'usr.id',
-          ].freeze
-          private_constant :ADDRESSES
-
-          def self.publish(op, user)
-            catch(:block) do
-              op.publish('usr.id', user.id)
-
-              nil
-            end
-          end
-
-          def self.subscribe(op, waf_context)
-            op.subscribe(*ADDRESSES) do |*values|
-              Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
-
-              user_id = values[0]
-
-              persistent_data = {
-                'usr.id' => user_id,
-              }
-
-              waf_timeout = Datadog.configuration.appsec.waf_timeout
-              result = waf_context.run(persistent_data, {}, waf_timeout)
-
-              next if result.status != :match
-
-              yield result
-              throw(:block, true) unless result.actions.empty?
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/processor/actions.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    class Processor
-      # Actions store the actions information in memory
-      # Also, takes care of merging when RC send new information
-      module Actions
-        class << self
-          def actions
-            @actions ||= []
-          end
-
-          def fetch_configuration(action)
-            actions.find { |action_configuration| action_configuration['id'] == action }
-          end
-
-          def merge(actions_to_merge)
-            return if actions_to_merge.empty?
-
-            if actions.empty?
-              @actions = actions_to_merge
-            else
-              merged_actions = []
-              actions_dup = actions.dup
-
-              actions_to_merge.each do |new_action|
-                existing_action = actions_dup.find { |action| new_action['id'] == action['id'] }
-
-                # the old action is discard and the new kept
-                actions_dup.delete(existing_action) if existing_action
-                merged_actions << new_action
-              end
-
-              @actions = merged_actions.concat(actions_dup)
-            end
-          end
-
-          private
-
-          # Used in tests
-          def reset
-            @actions = []
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/processor/context.rb

@@ -1,107 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    class Processor
-      # Context manages a sequence of runs
-      class Context
-        LIBDDWAF_SUCCESSFUL_EXECUTION_CODES = [:ok, :match].freeze
-
-        attr_reader :time_ns, :time_ext_ns, :timeouts, :events
-
-        def initialize(handle, telemetry:)
-          @context = WAF::Context.new(handle)
-          @telemetry = telemetry
-
-          @time_ns = 0.0
-          @time_ext_ns = 0.0
-          @timeouts = 0
-          @events = []
-          @run_mutex = Mutex.new
-
-          @libddwaf_debug_tag = "libddwaf:#{WAF::VERSION::STRING}"
-        end
-
-        def run(persistent_data, ephemeral_data, timeout = WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
-          @run_mutex.lock
-
-          start_ns = Core::Utils::Time.get_time(:nanosecond)
-
-          persistent_data.reject! do |_, v|
-            next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)
-
-            v.nil? ? true : v.empty?
-          end
-
-          ephemeral_data.reject! do |_, v|
-            next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)
-
-            v.nil? ? true : v.empty?
-          end
-
-          _code, result = try_run(persistent_data, ephemeral_data, timeout)
-
-          stop_ns = Core::Utils::Time.get_time(:nanosecond)
-
-          # these updates are not thread safe and should be protected
-          @time_ns += result.total_runtime
-          @time_ext_ns += (stop_ns - start_ns)
-          @timeouts += 1 if result.timeout
-
-          report_execution(result)
-          result
-        ensure
-          @run_mutex.unlock
-        end
-
-        def extract_schema
-          return unless extract_schema?
-
-          input = {
-            'waf.context.processor' => {
-              'extract-schema' => true
-            }
-          }
-
-          _code, result = try_run(input, {}, WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
-
-          report_execution(result)
-          result
-        end
-
-        def finalize
-          @context.finalize
-        end
-
-        private
-
-        def try_run(persistent_data, ephemeral_data, timeout)
-          @context.run(persistent_data, ephemeral_data, timeout)
-        rescue WAF::LibDDWAF::Error => e
-          Datadog.logger.debug { "#{@libddwaf_debug_tag} execution error: #{e} backtrace: #{e.backtrace&.first(3)}" }
-          @telemetry.report(e, description: 'libddwaf internal low-level error')
-
-          [:err_internal, WAF::Result.new(:err_internal, [], 0.0, false, [], [])]
-        end
-
-        def report_execution(result)
-          Datadog.logger.debug { "#{@libddwaf_debug_tag} execution timed out: #{result.inspect}" } if result.timeout
-
-          if LIBDDWAF_SUCCESSFUL_EXECUTION_CODES.include?(result.status)
-            Datadog.logger.debug { "#{@libddwaf_debug_tag} execution result: #{result.inspect}" }
-          else
-            message = "#{@libddwaf_debug_tag} execution error: #{result.status.inspect}"
-
-            Datadog.logger.debug { message }
-            @telemetry.error(message)
-          end
-        end
-
-        def extract_schema?
-          Datadog.configuration.appsec.api_security.enabled &&
-            Datadog.configuration.appsec.api_security.sample_rate.sample?
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/reactive/address_hash.rb

@@ -1,22 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Reactive
-      # AddressHash for Reactive Engine
-      class AddressHash < Hash
-        def self.new(*arguments, &block)
-          super { |h, k| h[k] = [] }
-        end
-
-        def addresses
-          keys.flatten
-        end
-
-        def with(address)
-          keys.select { |k| k.include?(address) }
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/reactive/engine.rb

@@ -1,47 +0,0 @@
-# frozen_string_literal: true
-
-require_relative 'address_hash'
-require_relative 'subscriber'
-
-module Datadog
-  module AppSec
-    module Reactive
-      # Reactive Engine
-      class Engine
-        def initialize
-          @data = {}
-          @subscribers = AddressHash.new
-        end
-
-        def subscribe(*addresses, &block)
-          @subscribers[addresses.freeze] << Subscriber.new(&block)
-        end
-
-        def publish(address, value)
-          # check if someone has address subscribed
-          if @subscribers.addresses.include?(address)
-
-            # someone will be interested, set value
-            @data[address] = value
-
-            # find candidates i.e address groups that contain the just posted address
-            @subscribers.with(address).each do |addresses|
-              # find targets to the address group containing the posted address
-              subscribers = @subscribers[addresses]
-
-              # is all data for the targets available?
-              if (addresses - @data.keys).empty?
-                hash = addresses.each_with_object({}) { |a, h| h[a] = @data[a] }
-                subscribers.each { |s| s.call(*hash.values) }
-              end
-            end
-          end
-        end
-
-        private
-
-        attr_reader :subscribers, :data
-      end
-    end
-  end
-end

data/lib/datadog/appsec/reactive/operation.rb

@@ -1,68 +0,0 @@
-# frozen_string_literal: true
-
-require_relative 'engine'
-
-module Datadog
-  module AppSec
-    module Reactive
-      # Reactive Engine nested operation tracking
-      class Operation
-        attr_reader :reactive,
-          :parent,
-          :name
-
-        def initialize(name, parent = nil, reactive_engine = nil)
-          Datadog.logger.debug { "operation: #{name} initialize" }
-          @name = name
-          @parent = parent
-          @reactive = select_reactive_engine(reactive_engine, parent)
-
-          # TODO: concurrent store
-          # TODO: constant
-          Thread.current[:datadog_security_active_operation] = self
-
-          yield self if block_given?
-        ensure
-          finalize
-        end
-
-        # TODO: use structs instead of an arg splat
-        def subscribe(*addresses, &block)
-          reactive.subscribe(*addresses, &block)
-        end
-
-        def publish(address, data)
-          reactive.publish(address, data)
-        end
-
-        def finalize
-          Datadog.logger.debug { "operation: #{name} finalize" }
-          Thread.current[:datadog_security_active_operation] = parent
-        end
-
-        private
-
-        def select_reactive_engine(reactive, parent)
-          return reactive if reactive
-
-          return parent.reactive unless parent.nil?
-
-          Reactive::Engine.new
-        end
-
-        class << self
-          def active
-            Thread.current[:datadog_security_active_operation]
-          end
-
-          private
-
-          # For testing only.
-          def reset!
-            Thread.current[:datadog_security_active_operation] = nil
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/reactive/subscriber.rb

@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Reactive
-      # Reactive Engine subscriber
-      class Subscriber
-        def initialize(&block)
-          @block = block
-          freeze
-        end
-
-        def call(*args)
-          @block.call(*args)
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/scope.rb

@@ -1,58 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    # Capture context essential to consistently call processor and report via traces
-    class Scope
-      attr_reader :trace, :service_entry_span, :processor_context
-
-      def initialize(trace, service_entry_span, processor_context)
-        @trace = trace
-        @service_entry_span = service_entry_span
-        @processor_context = processor_context
-      end
-
-      def finalize
-        @processor_context.finalize
-      end
-
-      class << self
-        def activate_scope(trace, service_entry_span, processor)
-          raise ActiveScopeError, 'another scope is active, nested scopes are not supported' if active_scope
-
-          context = processor.new_context
-          self.active_scope = new(trace, service_entry_span, context)
-        end
-
-        def deactivate_scope
-          raise InactiveScopeError, 'no scope is active, nested scopes are not supported' unless active_scope
-
-          scope = active_scope
-
-          reset_active_scope
-
-          scope.finalize
-        end
-
-        def active_scope
-          Thread.current[:datadog_appsec_active_scope]
-        end
-
-        private
-
-        def active_scope=(scope)
-          raise ArgumentError, 'not a Datadog::AppSec::Scope' unless scope.instance_of?(Scope)
-
-          Thread.current[:datadog_appsec_active_scope] = scope
-        end
-
-        def reset_active_scope
-          Thread.current[:datadog_appsec_active_scope] = nil
-        end
-      end
-
-      class InactiveScopeError < StandardError; end
-      class ActiveScopeError < StandardError; end
-    end
-  end
-end

data/lib/datadog/appsec/utils/trace_operation.rb

@@ -1,15 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Utils
-      # Utility class to to AppSec-specific trace operations
-      class TraceOperation
-        def self.appsec_standalone_reject?(trace)
-          Datadog.configuration.appsec.standalone.enabled &&
-            (trace.nil? || trace.get_tag(Datadog::AppSec::Ext::TAG_DISTRIBUTED_APPSEC_EVENT) != '1')
-        end
-      end
-    end
-  end
-end

data/lib/datadog/core/crashtracking/agent_base_url.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../configuration/ext'
-
-module Datadog
-  module Core
-    module Crashtracking
-      # This module provides a method to resolve the base URL of the agent
-      module AgentBaseUrl
-        def self.resolve(agent_settings)
-          case agent_settings.adapter
-          when Datadog::Core::Configuration::Ext::Agent::HTTP::ADAPTER
-            "#{agent_settings.ssl ? 'https' : 'http'}://#{agent_settings.hostname}:#{agent_settings.port}/"
-          when Datadog::Core::Configuration::Ext::Agent::UnixSocket::ADAPTER
-            "unix://#{agent_settings.uds_path}"
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/core/remote/transport/http/api/instance.rb

@@ -1,39 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module Core
-    module Remote
-      module Transport
-        module HTTP
-          module API
-            # An API configured with adapter and routes
-            class Instance
-              attr_reader \
-                :adapter,
-                :headers,
-                :spec
-
-              def initialize(spec, adapter, options = {})
-                @spec = spec
-                @adapter = adapter
-                @headers = options.fetch(:headers, {})
-              end
-
-              def encoder
-                spec.encoder
-              end
-
-              def call(env)
-                # Add headers to request env, unless empty.
-                env.headers.merge!(headers) unless headers.empty?
-
-                # Send request env to the adapter.
-                adapter.call(env)
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/core/remote/transport/http/api/spec.rb

@@ -1,21 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module Core
-    module Remote
-      module Transport
-        module HTTP
-          module API
-            # Specification for an HTTP API
-            # Defines behaviors without specific configuration details.
-            class Spec
-              def initialize
-                yield(self) if block_given?
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end