datadog 2.7.1 → 2.18.0

data/ext/datadog_profiling_loader/extconf.rb

@@ -1,60 +0,0 @@
-# rubocop:disable Style/StderrPuts
-
-if RUBY_ENGINE != "ruby" || Gem.win_platform?
-  $stderr.puts(
-    "WARN: Skipping build of Datadog profiling loader. See Datadog profiling native extension note for details."
-  )
-
-  File.write("Makefile", "all install clean: # dummy makefile that does nothing")
-  exit
-end
-
-require "mkmf"
-
-# Because we can't control what compiler versions our customers use, shipping with -Werror by default is a no-go.
-# But we can enable it in CI, so that we quickly spot any new warnings that just got introduced.
-append_cflags "-Werror" if ENV["DATADOG_GEM_CI"] == "true"
-
-# Older gcc releases may not default to C99 and we need to ask for this. This is also used:
-# * by upstream Ruby -- search for gnu99 in the codebase
-# * by msgpack, another datadog gem dependency
-#   (https://github.com/msgpack/msgpack-ruby/blob/18ce08f6d612fe973843c366ac9a0b74c4e50599/ext/msgpack/extconf.rb#L8)
-append_cflags "-std=gnu99"
-
-# Gets really noisy when we include the MJIT header, let's omit it (TODO: Use #pragma GCC diagnostic instead?)
-append_cflags "-Wno-unused-function"
-
-# Allow defining variables at any point in a function
-append_cflags "-Wno-declaration-after-statement"
-
-# If we forget to include a Ruby header, the function call may still appear to work, but then
-# cause a segfault later. Let's ensure that never happens.
-append_cflags "-Werror-implicit-function-declaration"
-
-# Warn on unused parameters to functions. Use `DDTRACE_UNUSED` to mark things as known-to-not-be-used.
-append_cflags "-Wunused-parameter"
-
-# The native extension is not intended to expose any symbols/functions for other native libraries to use;
-# the sole exception being `Init_datadog_profiling_loader` which needs to be visible for Ruby to call it when
-# it `dlopen`s the library.
-#
-# By setting this compiler flag, we tell it to assume that everything is private unless explicitly stated.
-# For more details see https://gcc.gnu.org/wiki/Visibility
-append_cflags "-fvisibility=hidden"
-
-# Avoid legacy C definitions
-append_cflags "-Wold-style-definition"
-
-# Enable all other compiler warnings
-append_cflags "-Wall"
-append_cflags "-Wextra"
-
-# Tag the native extension library with the Ruby version and Ruby platform.
-# This makes it easier for development (avoids "oops I forgot to rebuild when I switched my Ruby") and ensures that
-# the wrong library is never loaded.
-# When requiring, we need to use the exact same string, including the version and the platform.
-EXTENSION_NAME = "datadog_profiling_loader.#{RUBY_VERSION}_#{RUBY_PLATFORM}".freeze
-
-create_makefile(EXTENSION_NAME)
-
-# rubocop:enable Style/StderrPuts

data/lib/datadog/appsec/assets/waf_rules/processors.json

@@ -1,92 +0,0 @@
-[
-  {
-    "id": "processor-001",
-    "generator": "extract_schema",
-    "conditions": [
-      {
-        "operator": "equals",
-        "parameters": {
-          "inputs": [
-            {
-              "address": "waf.context.processor",
-              "key_path": [
-                "extract-schema"
-              ]
-            }
-          ],
-          "type": "boolean",
-          "value": true
-        }
-      }
-    ],
-    "parameters": {
-      "mappings": [
-        {
-          "inputs": [
-            {
-              "address": "server.request.body"
-            }
-          ],
-          "output": "_dd.appsec.s.req.body"
-        },
-        {
-          "inputs": [
-            {
-              "address": "server.request.headers.no_cookies"
-            }
-          ],
-          "output": "_dd.appsec.s.req.headers"
-        },
-        {
-          "inputs": [
-            {
-              "address": "server.request.query"
-            }
-          ],
-          "output": "_dd.appsec.s.req.query"
-        },
-        {
-          "inputs": [
-            {
-              "address": "server.request.path_params"
-            }
-          ],
-          "output": "_dd.appsec.s.req.params"
-        },
-        {
-          "inputs": [
-            {
-              "address": "server.request.cookies"
-            }
-          ],
-          "output": "_dd.appsec.s.req.cookies"
-        },
-        {
-          "inputs": [
-            {
-              "address": "server.response.headers.no_cookies"
-            }
-          ],
-          "output": "_dd.appsec.s.res.headers"
-        },
-        {
-          "inputs": [
-            {
-              "address": "server.response.body"
-            }
-          ],
-          "output": "_dd.appsec.s.res.body"
-        }
-      ],
-      "scanners": [
-        {
-          "tags": {
-            "category": "pii"
-          }
-        }
-      ]
-    },
-    "evaluate": false,
-    "output": true
-  }
-]

data/lib/datadog/appsec/assets/waf_rules/scanners.json

@@ -1,114 +0,0 @@
-[
-  {
-    "id": "d962f7ddb3f55041e39195a60ff79d4814a7c331",
-    "name": "US Passport Scanner",
-    "key": {
-      "operator": "match_regex",
-      "parameters": {
-        "regex": "passport",
-        "options": {
-          "case_sensitive": false,
-          "min_length": 8
-        }
-      }
-    },
-    "value": {
-      "operator": "match_regex",
-      "parameters": {
-        "regex": "\\b[0-9A-Z]{9}\\b|\\b[0-9]{6}[A-Z][0-9]{2}\\b",
-        "options": {
-          "case_sensitive": false,
-          "min_length": 8
-        }
-      }
-    },
-    "tags": {
-      "type": "passport_number",
-      "category": "pii"
-    }
-  },
-  {
-    "id": "ac6d683cbac77f6e399a14990793dd8fd0fca333",
-    "name": "US Vehicle Identification Number Scanner",
-    "key": {
-      "operator": "match_regex",
-      "parameters": {
-        "regex": "vehicle[_\\s-]*identification[_\\s-]*number|vin",
-        "options": {
-          "case_sensitive": false,
-          "min_length": 3
-        }
-      }
-    },
-    "value": {
-      "operator": "match_regex",
-      "parameters": {
-        "regex": "\\b[A-HJ-NPR-Z0-9]{17}\\b",
-        "options": {
-          "case_sensitive": false,
-          "min_length": 17
-        }
-      }
-    },
-    "tags": {
-      "type": "vin",
-      "category": "pii"
-    }
-  },
-  {
-    "id": "de0899e0cbaaa812bb624cf04c912071012f616d",
-    "name": "UK National Insurance Number Scanner",
-    "key": {
-      "operator": "match_regex",
-      "parameters": {
-        "regex": "national[\\s_]?(?:insurance(?:\\s+number)?)?|NIN|NI[\\s_]?number|insurance[\\s_]?number",
-        "options": {
-          "case_sensitive": false,
-          "min_length": 3
-        }
-      }
-    },
-    "value": {
-      "operator": "match_regex",
-      "parameters": {
-        "regex": "\\b[A-Z]{2}\\d{6}[A-Z]?\\b",
-        "options": {
-          "case_sensitive": false,
-          "min_length": 8
-        }
-      }
-    },
-    "tags": {
-      "type": "uk_nin",
-      "category": "pii"
-    }
-  },
-  {
-    "id": "450239afc250a19799b6c03dc0e16fd6a4b2a1af",
-    "name": "Canadian Social Insurance Number Scanner",
-    "key": {
-      "operator": "match_regex",
-      "parameters": {
-        "regex": "social[\\s_]?(?:insurance(?:\\s+number)?)?|SIN|Canadian[\\s_]?(?:social[\\s_]?(?:insurance)?|insurance[\\s_]?number)?",
-        "options": {
-          "case_sensitive": false,
-          "min_length": 3
-        }
-      }
-    },
-    "value": {
-      "operator": "match_regex",
-      "parameters": {
-        "regex": "\\b\\d{3}-\\d{3}-\\d{3}\\b",
-        "options": {
-          "case_sensitive": false,
-          "min_length": 11
-        }
-      }
-    },
-    "tags": {
-      "type": "canadian_sin",
-      "category": "pii"
-    }
-  }
-]

data/lib/datadog/appsec/contrib/devise/event.rb

@@ -1,57 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Devise
-        # Class to extract event information from the resource
-        class Event
-          UUID_REGEX = /^\h{8}-\h{4}-\h{4}-\h{4}-\h{12}$/.freeze
-
-          SAFE_MODE = 'safe'
-          EXTENDED_MODE = 'extended'
-
-          attr_reader :user_id
-
-          def initialize(resource, mode)
-            @resource = resource
-            @mode = mode
-            @user_id = nil
-            @email = nil
-            @username = nil
-
-            extract if @resource
-          end
-
-          def to_h
-            return @event if defined?(@event)
-
-            @event = {}
-            @event[:email] = @email if @email
-            @event[:username] = @username if @username
-            @event
-          end
-
-          private
-
-          def extract
-            @user_id = @resource.id
-
-            case @mode
-            when EXTENDED_MODE
-              @email = @resource.email
-              @username = @resource.username
-            when SAFE_MODE
-              @user_id = nil unless @user_id && @user_id.to_s =~ UUID_REGEX
-            else
-              Datadog.logger.warn(
-                "Invalid automated user evenst mode: `#{@mode}`. "\
-                              'Supported modes are: `safe` and `extended`.'
-              )
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/devise/patcher/authenticatable_patch.rb

@@ -1,77 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../tracking'
-require_relative '../resource'
-require_relative '../event'
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Devise
-        module Patcher
-          # Hook in devise validate method
-          module AuthenticatablePatch
-            # rubocop:disable Metrics/MethodLength
-            def validate(resource, &block)
-              result = super
-              return result unless AppSec.enabled?
-              return result if @_datadog_skip_track_login_event
-
-              track_user_events_configuration = Datadog.configuration.appsec.track_user_events
-
-              return result unless track_user_events_configuration.enabled
-
-              automated_track_user_events_mode = track_user_events_configuration.mode
-
-              appsec_scope = Datadog::AppSec.active_scope
-
-              return result unless appsec_scope
-
-              devise_resource = resource ? Resource.new(resource) : nil
-
-              event_information = Event.new(devise_resource, automated_track_user_events_mode)
-
-              if result
-                if event_information.user_id
-                  Datadog.logger.debug { 'User Login Event success' }
-                else
-                  Datadog.logger.debug { 'User Login Event success, but can\'t extract user ID. Tracking empty event' }
-                end
-
-                Tracking.track_login_success(
-                  appsec_scope.trace,
-                  appsec_scope.service_entry_span,
-                  user_id: event_information.user_id,
-                  **event_information.to_h
-                )
-
-                return result
-              end
-
-              user_exists = nil
-
-              if resource
-                user_exists = true
-                Datadog.logger.debug { 'User Login Event failure users exists' }
-              else
-                user_exists = false
-                Datadog.logger.debug { 'User Login Event failure user do not exists' }
-              end
-
-              Tracking.track_login_failure(
-                appsec_scope.trace,
-                appsec_scope.service_entry_span,
-                user_id: event_information.user_id,
-                user_exists: user_exists,
-                **event_information.to_h
-              )
-
-              result
-            end
-            # rubocop:enable Metrics/MethodLength
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/devise/patcher/registration_controller_patch.rb

@@ -1,54 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../tracking'
-require_relative '../resource'
-require_relative '../event'
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Devise
-        module Patcher
-          # Hook in devise registration controller
-          module RegistrationControllerPatch
-            def create
-              return super unless AppSec.enabled?
-
-              track_user_events_configuration = Datadog.configuration.appsec.track_user_events
-
-              return super unless track_user_events_configuration.enabled
-
-              automated_track_user_events_mode = track_user_events_configuration.mode
-
-              appsec_scope = Datadog::AppSec.active_scope
-              return super unless appsec_scope
-
-              super do |resource|
-                if resource.persisted?
-                  devise_resource = Resource.new(resource)
-
-                  event_information = Event.new(devise_resource, automated_track_user_events_mode)
-
-                  if event_information.user_id
-                    Datadog.logger.debug { 'User Signup Event' }
-                  else
-                    Datadog.logger.warn { 'User Signup Event, but can\'t extract user ID. Tracking empty event' }
-                  end
-
-                  Tracking.track_signup(
-                    appsec_scope.trace,
-                    appsec_scope.service_entry_span,
-                    user_id: event_information.user_id,
-                    **event_information.to_h
-                  )
-                end
-
-                yield resource if block_given?
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/devise/resource.rb

@@ -1,35 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Devise
-        # Class to encpasulate extracting information from a Devise resource
-        # Normally a devise resource would be an Active::Record instance
-        class Resource
-          def initialize(resource)
-            @resource = resource
-          end
-
-          def id
-            extract(:id) || extract(:uuid)
-          end
-
-          def email
-            extract(:email)
-          end
-
-          def username
-            extract(:username)
-          end
-
-          private
-
-          def extract(method)
-            @resource.send(method) if @resource.respond_to?(method)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/devise/tracking.rb

@@ -1,57 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../../../kit/identity'
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Devise
-        # Internal module to track user events
-        module Tracking
-          LOGIN_SUCCESS_EVENT = 'users.login.success'
-          LOGIN_FAILURE_EVENT = 'users.login.failure'
-          SIGNUP_EVENT = 'users.signup'
-
-          def self.track_login_success(trace, span, user_id:, **others)
-            return if trace.nil? || span.nil?
-
-            track(LOGIN_SUCCESS_EVENT, trace, span, **others)
-
-            Kit::Identity.set_user(trace, span, id: user_id.to_s, **others) if user_id
-          end
-
-          def self.track_login_failure(trace, span, user_id:, user_exists:, **others)
-            return if trace.nil? || span.nil?
-
-            track(LOGIN_FAILURE_EVENT, trace, span, **others)
-
-            span.set_tag('appsec.events.users.login.failure.usr.id', user_id) if user_id
-            span.set_tag('appsec.events.users.login.failure.usr.exists', user_exists)
-          end
-
-          def self.track_signup(trace, span, user_id:, **others)
-            return if trace.nil? || span.nil?
-
-            track(SIGNUP_EVENT, trace, span, **others)
-            Kit::Identity.set_user(trace, id: user_id.to_s, **others) if user_id
-          end
-
-          def self.track(event, trace, span, **others)
-            return if trace.nil? || span.nil?
-
-            span.set_tag("appsec.events.#{event}.track", 'true')
-            span.set_tag("_dd.appsec.events.#{event}.auto.mode", Datadog.configuration.appsec.track_user_events.mode)
-
-            others.each do |k, v|
-              raise ArgumentError, 'key cannot be :track' if k.to_sym == :track
-
-              span.set_tag("appsec.events.#{event}.#{k}", v) unless v.nil?
-            end
-
-            trace.keep!
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/graphql/reactive/multiplex.rb

@@ -1,46 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module GraphQL
-        module Reactive
-          # Dispatch data from a GraphQL resolve query to the WAF context
-          module Multiplex
-            ADDRESSES = [
-              'graphql.server.all_resolvers'
-            ].freeze
-            private_constant :ADDRESSES
-
-            def self.publish(op, gateway_multiplex)
-              catch(:block) do
-                op.publish('graphql.server.all_resolvers', gateway_multiplex.arguments)
-
-                nil
-              end
-            end
-
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
-                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
-                arguments = values[0]
-
-                persistent_data = {
-                  'graphql.server.all_resolvers' => arguments
-                }
-
-                waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
-
-                next if result.status != :match
-
-                yield result
-                throw(:block, true) unless result.actions.empty?
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/patcher.rb

@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      # Common patcher code for AppSec integrations
-      # TODO: empty implementation, check with tracer shareable code
-      module Patcher
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/rack/reactive/request.rb

@@ -1,69 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Rack
-        module Reactive
-          # Dispatch data from a Rack request to the WAF context
-          module Request
-            ADDRESSES = [
-              'request.headers',
-              'request.uri.raw',
-              'request.query',
-              'request.cookies',
-              'request.client_ip',
-              'server.request.method'
-            ].freeze
-            private_constant :ADDRESSES
-
-            def self.publish(op, gateway_request)
-              catch(:block) do
-                op.publish('request.query', gateway_request.query)
-                op.publish('request.headers', gateway_request.headers)
-                op.publish('request.uri.raw', gateway_request.fullpath)
-                op.publish('request.cookies', gateway_request.cookies)
-                op.publish('request.client_ip', gateway_request.client_ip)
-                op.publish('server.request.method', gateway_request.method)
-
-                nil
-              end
-            end
-
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
-                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
-
-                headers = values[0]
-                headers_no_cookies = headers.dup.tap { |h| h.delete('cookie') }
-                uri_raw = values[1]
-                query = values[2]
-                cookies = values[3]
-                client_ip = values[4]
-                request_method = values[5]
-
-                persistent_data = {
-                  'server.request.cookies' => cookies,
-                  'server.request.query' => query,
-                  'server.request.uri.raw' => uri_raw,
-                  'server.request.headers' => headers,
-                  'server.request.headers.no_cookies' => headers_no_cookies,
-                  'http.client_ip' => client_ip,
-                  'server.request.method' => request_method,
-                }
-
-                waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
-
-                next if result.status != :match
-
-                yield result
-                throw(:block, true) unless result.actions.empty?
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end