datadog 2.7.1 → 2.18.0

data/lib/datadog/appsec/actions_handler/serializable_backtrace.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module ActionsHandler
+      # This module serves encapsulates MessagePack serialization for caller locations.
+      #
+      # It serializes part of the stack:
+      # up to 32 frames (configurable)
+      # keeping frames from top and bottom of the stack (75% to 25%, configurable).
+      #
+      # It represents the stack trace that is added to span metastruct field.
+      class SerializableBacktrace
+        CLASS_AND_FUNCTION_NAME_REGEX = /\b((?:\w+::)*\w+)?[#.]?\b(\w+)\z/.freeze
+
+        def initialize(locations:, stack_id:)
+          @stack_id = stack_id
+          @locations = locations
+        end
+
+        def to_msgpack(packer = nil)
+          # JRuby doesn't pass the packer
+          packer ||= MessagePack::Packer.new
+
+          packer.write_map_header(3)
+
+          packer.write('id')
+          packer.write(@stack_id.encode('UTF-8'))
+
+          packer.write('language')
+          packer.write('ruby'.encode('UTF-8'))
+
+          serializable_locations_map = build_serializable_locations_map
+
+          packer.write('frames')
+          packer.write_array_header(serializable_locations_map.size)
+
+          serializable_locations_map.each do |frame_id, location|
+            packer.write_map_header(6)
+
+            packer.write('id')
+            packer.write(frame_id)
+
+            packer.write('text')
+            packer.write(location.to_s.encode('UTF-8'))
+
+            packer.write('file')
+            packer.write(location.path&.encode('UTF-8'))
+
+            packer.write('line')
+            packer.write(location.lineno)
+
+            class_name, function_name = location.label&.match(CLASS_AND_FUNCTION_NAME_REGEX)&.captures
+
+            packer.write('class_name')
+            packer.write(class_name&.encode('UTF-8'))
+
+            packer.write('function')
+            packer.write(function_name&.encode('UTF-8'))
+          end
+
+          packer
+        end
+
+        private
+
+        def build_serializable_locations_map
+          max_depth = Datadog.configuration.appsec.stack_trace.max_depth
+          top_percent = Datadog.configuration.appsec.stack_trace.top_percentage
+
+          drop_from_idx = max_depth * top_percent / 100
+          drop_until_idx = @locations.size - (max_depth - drop_from_idx)
+
+          frame_idx = -1
+          @locations.each_with_object({}) do |location, map|
+            # we are dropping frames from library code without increasing frame index
+            next if location.path&.include?('lib/datadog')
+
+            frame_idx += 1
+
+            next if max_depth != 0 && frame_idx >= drop_from_idx && frame_idx < drop_until_idx
+
+            map[frame_idx] = location
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/actions_handler.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require_relative 'actions_handler/serializable_backtrace'
+
+module Datadog
+  module AppSec
+    # this module encapsulates functions for handling actions that libddawf returns
+    module ActionsHandler
+      module_function
+
+      def handle(actions_hash)
+        # handle actions according their precedence
+        # stack and schema generation should be done before we throw an interrupt signal
+        generate_stack(actions_hash['generate_stack']) if actions_hash.key?('generate_stack')
+        generate_schema(actions_hash['generate_schema']) if actions_hash.key?('generate_schema')
+        interrupt_execution(actions_hash['redirect_request']) if actions_hash.key?('redirect_request')
+        interrupt_execution(actions_hash['block_request']) if actions_hash.key?('block_request')
+      end
+
+      def interrupt_execution(action_params)
+        throw(Datadog::AppSec::Ext::INTERRUPT, action_params)
+      end
+
+      def generate_stack(action_params)
+        return unless Datadog.configuration.appsec.stack_trace.enabled
+
+        stack_id = action_params['stack_id']
+        return unless stack_id
+
+        active_span = AppSec.active_context&.span
+        return unless active_span
+
+        event_category = Ext::EXPLOIT_PREVENTION_EVENT_CATEGORY
+        tag_key = Ext::TAG_METASTRUCT_STACK_TRACE
+
+        existing_stack_data = active_span.get_metastruct_tag(tag_key).dup || {event_category => []}
+        max_stack_traces = Datadog.configuration.appsec.stack_trace.max_stack_traces
+        return if max_stack_traces != 0 && existing_stack_data[event_category].count >= max_stack_traces
+
+        backtrace = SerializableBacktrace.new(locations: Array(caller_locations), stack_id: stack_id)
+        existing_stack_data[event_category] << backtrace
+        active_span.set_metastruct_tag(tag_key, existing_stack_data)
+      end
+
+      def generate_schema(_action_params)
+      end
+    end
+  end
+end

data/lib/datadog/appsec/anonymizer.rb

@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+require 'digest/sha2'
+
+module Datadog
+  module AppSec
+    # Manual anonymization of the potential PII data
+    module Anonymizer
+      def self.anonymize(payload)
+        raise ArgumentError, "expected String, received #{payload.class}" unless payload.is_a?(String)
+
+        "anon_#{Digest::SHA256.hexdigest(payload)[0, 32]}"
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/lru_cache.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require 'forwardable'
+
+module Datadog
+  module AppSec
+    module APISecurity
+      # An LRU (Least Recently Used) cache implementation that relies on the
+      # Ruby 1.9+ `Hash` implementation that guarantees insertion order.
+      #
+      # WARNING: This implementation is NOT thread-safe and should be used
+      #          in a single-threaded context.
+      class LRUCache
+        extend Forwardable
+
+        def_delegators :@store, :clear, :empty?
+
+        def initialize(max_size)
+          raise ArgumentError, 'max_size must be an Integer' unless max_size.is_a?(Integer)
+          raise ArgumentError, 'max_size must be greater than 0' if max_size <= 0
+
+          @max_size = max_size
+          @store = {}
+        end
+
+        # NOTE: Accessing a key moves it to the end of the list.
+        def [](key)
+          if (entry = @store.delete(key))
+            @store[key] = entry
+          end
+        end
+
+        def store(key, value)
+          return @store[key] = value if @store.delete(key)
+
+          # NOTE: evict the oldest entry if store reached the maximum allowed size
+          @store.shift if @store.size >= @max_size
+          @store[key] = value
+        end
+
+        # NOTE: If the key exists, it's moved to the end of the list and
+        #       if does not, the given block will be executed and the result
+        #       will be stored (which will add it to the end of the list).
+        def fetch_or_store(key)
+          if (entry = @store.delete(key))
+            return @store[key] = entry
+          end
+
+          # NOTE: evict the oldest entry if store reached the maximum allowed size
+          @store.shift if @store.size >= @max_size
+          @store[key] = yield
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/route_extractor.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module APISecurity
+      # This is a helper module to extract the route pattern from the Rack::Request.
+      module RouteExtractor
+        SINATRA_ROUTE_KEY = 'sinatra.route'
+        SINATRA_ROUTE_SEPARATOR = ' '
+        GRAPE_ROUTE_KEY = 'grape.routing_args'
+        RAILS_ROUTE_KEY = 'action_dispatch.route_uri_pattern'
+        RAILS_ROUTES_KEY = 'action_dispatch.routes'
+        RAILS_FORMAT_SUFFIX = '(.:format)'
+
+        # HACK: We rely on the fact that each contrib will modify `request.env`
+        #       and store information sufficient to compute the canonical
+        #       route (ex: `/users/:id`).
+        #
+        #       When contribs like Sinatra or Grape are used, they could be mounted
+        #       into the Rails app, hence you can see the use of the `script_name`
+        #       that will contain the path prefix of the mounted app.
+        #
+        #       Rack
+        #         does not support named arguments, so we have to use `path`
+        #       Sinatra
+        #         uses `sinatra.route` with a string like "GET /users/:id"
+        #       Grape
+        #         uses `grape.routing_args` with a hash with a `:route_info` key
+        #         that contains a `Grape::Router::Route` object that contains
+        #         `Grape::Router::Pattern` object with an `origin` method
+        #       Rails < 7.1 (slow path)
+        #         uses `action_dispatch.routes` to store `ActionDispatch::Routing::RouteSet`
+        #         which can recognize requests
+        #       Rails > 7.1 (fast path)
+        #         uses `action_dispatch.route_uri_pattern` with a string like
+        #         "/users/:id(.:format)"
+        #
+        # WARNING: This method works only *after* the request has been routed.
+        def self.route_pattern(request)
+          if request.env.key?(GRAPE_ROUTE_KEY)
+            pattern = request.env[GRAPE_ROUTE_KEY][:route_info]&.pattern&.origin
+            "#{request.script_name}#{pattern}"
+          elsif request.env.key?(SINATRA_ROUTE_KEY)
+            pattern = request.env[SINATRA_ROUTE_KEY].split(SINATRA_ROUTE_SEPARATOR, 2)[1]
+            "#{request.script_name}#{pattern}"
+          elsif request.env.key?(RAILS_ROUTE_KEY)
+            request.env[RAILS_ROUTE_KEY].delete_suffix(RAILS_FORMAT_SUFFIX)
+          elsif request.env.key?(RAILS_ROUTES_KEY)
+            pattern = request.env[RAILS_ROUTES_KEY].router
+              .recognize(request) { |route, _| break route.path.spec.to_s }
+
+            # NOTE: If rails is unable to recognize request it returns empty Array
+            pattern = nil if pattern&.empty?
+
+            # NOTE: If rails can't recognize the request, we are going to fallback
+            #       to generic request path
+            (pattern || request.path).delete_suffix(RAILS_FORMAT_SUFFIX)
+          else
+            request.path
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/sampler.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require 'zlib'
+require_relative 'lru_cache'
+require_relative 'route_extractor'
+require_relative '../../core/utils/time'
+
+module Datadog
+  module AppSec
+    module APISecurity
+      # A thread-local sampler for API security based on defined delay between
+      # samples with caching capability.
+      class Sampler
+        THREAD_KEY = :datadog_appsec_api_security_sampler
+        MAX_CACHE_SIZE = 4096
+
+        class << self
+          def thread_local
+            sampler = Thread.current.thread_variable_get(THREAD_KEY)
+            return sampler unless sampler.nil?
+
+            Thread.current.thread_variable_set(THREAD_KEY, new(sample_delay))
+          end
+
+          # @api private
+          def reset!
+            Thread.current.thread_variable_set(THREAD_KEY, nil)
+          end
+
+          private
+
+          def sample_delay
+            Datadog.configuration.appsec.api_security.sample_delay
+          end
+        end
+
+        def initialize(sample_delay)
+          raise ArgumentError, 'sample_delay must be an Integer' unless sample_delay.is_a?(Integer)
+
+          @cache = LRUCache.new(MAX_CACHE_SIZE)
+          @sample_delay_seconds = sample_delay
+        end
+
+        def sample?(request, response)
+          return true if @sample_delay_seconds.zero?
+
+          key = Zlib.crc32("#{request.request_method}#{RouteExtractor.route_pattern(request)}#{response.status}")
+          current_timestamp = Core::Utils::Time.now.to_i
+          cached_timestamp = @cache[key] || 0
+
+          return false if current_timestamp - cached_timestamp <= @sample_delay_seconds
+
+          @cache.store(key, current_timestamp)
+          true
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative 'api_security/sampler'
+
+module Datadog
+  module AppSec
+    # A namespace for API Security features.
+    module APISecurity
+      def self.enabled?
+        Datadog.configuration.appsec.api_security.enabled?
+      end
+
+      def self.sample?(request, response)
+        Sampler.thread_local.sample?(request, response)
+      end
+
+      def self.sample_trace?(trace)
+        # NOTE: Reads as "if trace is priority sampled or if in standalone mode"
+        trace&.priority_sampled? || !Datadog.configuration.apm.tracing.enabled
+      end
+    end
+  end
+end

data/lib/datadog/appsec/assets/waf_rules/README.md

@@ -1,7 +1,52 @@
-Vendored WAF rules originate from https://github.com/datadog/appsec-event-rules
+AppSec WAF rules based on [appsec-event-rules](https://github.com/datadog/appsec-event-rules) builds
 
-One should check rule compatibility with libddwaf, which is the end consumer of
-these rules.
+## How to update
 
-There might be rules that look to be irrelevant to Ruby as they may still help
-identify bad actors.
+> [!WARNING]
+> This process is a temporary workaround to maintain compatibility with the existing code structure and will be changed.
+
+1. Download `recommended.json` and `strict.json` of the desired version from [appsec-event-rules](https://github.com/datadog/appsec-event-rules) (example: [v1.13.3](https://github.com/DataDog/appsec-event-rules/tree/1.13.3/build))
+2. Run the script below inside `waf_rules` folder to extract scanners and processors into separate files
+
+    ```ruby
+    require 'json'
+
+    recommended_rules = JSON.parse(File.read(File.expand_path('recommended.json', __dir__)))
+    strict_rules = JSON.parse(File.read(File.expand_path('strict.json', __dir__)))
+
+    recommended_processors = recommended_rules.delete('processors')
+    strict_processors = strict_rules.delete('processors')
+
+    if recommended_processors.sort_by { |processor| processor['id'] } !=
+        strict_processors.sort_by { |processor| processor['id'] }
+      raise 'Processors are not the same, unable to extract them'
+    end
+
+    puts 'Extracting processors...'
+    File.open(File.expand_path('processors.json', __dir__), 'wb') do |file|
+      file.write(JSON.pretty_generate(recommended_processors))
+    end
+
+    recommended_scanners = recommended_rules.delete('scanners')
+    strict_scanners = strict_rules.delete('scanners')
+
+    if recommended_scanners.sort_by { |processor| processor['id'] } !=
+        strict_scanners.sort_by { |processor| processor['id'] }
+      raise 'Scanners are not the same, unable to extract them'
+    end
+
+    puts 'Extracting scanners...'
+    File.open(File.expand_path('scanners.json', __dir__), 'wb') do |file|
+      file.write(JSON.pretty_generate(recommended_scanners))
+    end
+
+    puts 'Updating rules...'
+
+    File.open(File.expand_path('recommended.json', __dir__), 'wb') do |file|
+      file.write(JSON.pretty_generate(recommended_rules))
+    end
+
+    File.open(File.expand_path('strict.json', __dir__), 'wb') do |file|
+      file.write(JSON.pretty_generate(strict_rules))
+    end
+    ```