datadog 2.7.1 → 2.18.0

data/lib/datadog/appsec/contrib/rack/reactive/request_body.rb

@@ -1,47 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Rack
-        module Reactive
-          # Dispatch data from a Rack request to the WAF context
-          module RequestBody
-            ADDRESSES = [
-              'request.body',
-            ].freeze
-            private_constant :ADDRESSES
-
-            def self.publish(op, gateway_request)
-              catch(:block) do
-                # params have been parsed from the request body
-                op.publish('request.body', gateway_request.form_hash)
-
-                nil
-              end
-            end
-
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
-                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
-                body = values[0]
-
-                persistent_data = {
-                  'server.request.body' => body,
-                }
-
-                waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
-
-                next if result.status != :match
-
-                yield result
-                throw(:block, true) unless result.actions.empty?
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/rack/reactive/response.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Rack
-        module Reactive
-          # Dispatch data from a Rack response to the WAF context
-          module Response
-            ADDRESSES = [
-              'response.status',
-              'response.headers',
-            ].freeze
-            private_constant :ADDRESSES
-
-            def self.publish(op, gateway_response)
-              catch(:block) do
-                op.publish('response.status', gateway_response.status)
-                op.publish('response.headers', gateway_response.headers)
-
-                nil
-              end
-            end
-
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
-                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
-
-                response_status = values[0]
-                response_headers = values[1]
-                response_headers_no_cookies = response_headers.dup.tap { |h| h.delete('set-cookie') }
-
-                persistent_data = {
-                  'server.response.status' => response_status.to_s,
-                  'server.response.headers' => response_headers,
-                  'server.response.headers.no_cookies' => response_headers_no_cookies,
-                }
-
-                waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
-
-                next if result.status != :match
-
-                yield result
-                throw(:block, true) unless result.actions.empty?
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/rails/reactive/action.rb

@@ -1,53 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../request'
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Rails
-        module Reactive
-          # Dispatch data from a Rails request to the WAF context
-          module Action
-            ADDRESSES = [
-              'rails.request.body',
-              'rails.request.route_params',
-            ].freeze
-            private_constant :ADDRESSES
-
-            def self.publish(op, gateway_request)
-              catch(:block) do
-                # params have been parsed from the request body
-                op.publish('rails.request.body', gateway_request.parsed_body)
-                op.publish('rails.request.route_params', gateway_request.route_params)
-
-                nil
-              end
-            end
-
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
-                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
-                body = values[0]
-                path_params = values[1]
-
-                persistent_data = {
-                  'server.request.body' => body,
-                  'server.request.path_params' => path_params,
-                }
-
-                waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
-
-                next if result.status != :match
-
-                yield result
-                throw(:block, true) unless result.actions.empty?
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/sinatra/ext.rb

@@ -1,14 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Sinatra
-        # Sinatra integration constants
-        module Ext
-          ROUTE_INTERRUPT = :datadog_appsec_contrib_sinatra_route_interrupt
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb

@@ -1,48 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Contrib
-      module Sinatra
-        module Reactive
-          # Dispatch data from a Sinatra request to the WAF context
-          module Routed
-            ADDRESSES = [
-              'sinatra.request.route_params',
-            ].freeze
-            private_constant :ADDRESSES
-
-            def self.publish(op, data)
-              _request, route_params = data
-
-              catch(:block) do
-                op.publish('sinatra.request.route_params', route_params.params)
-
-                nil
-              end
-            end
-
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
-                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
-                path_params = values[0]
-
-                persistent_data = {
-                  'server.request.path_params' => path_params,
-                }
-
-                waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
-
-                next if result.status != :match
-
-                yield result
-                throw(:block, true) unless result.actions.empty?
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/monitor/reactive/set_user.rb

@@ -1,45 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    module Monitor
-      module Reactive
-        # Dispatch data from Datadog::Kit::Identity.set_user to the WAF context
-        module SetUser
-          ADDRESSES = [
-            'usr.id',
-          ].freeze
-          private_constant :ADDRESSES
-
-          def self.publish(op, user)
-            catch(:block) do
-              op.publish('usr.id', user.id)
-
-              nil
-            end
-          end
-
-          def self.subscribe(op, waf_context)
-            op.subscribe(*ADDRESSES) do |*values|
-              Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
-
-              user_id = values[0]
-
-              persistent_data = {
-                'usr.id' => user_id,
-              }
-
-              waf_timeout = Datadog.configuration.appsec.waf_timeout
-              result = waf_context.run(persistent_data, {}, waf_timeout)
-
-              next if result.status != :match
-
-              yield result
-              throw(:block, true) unless result.actions.empty?
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/processor/actions.rb

@@ -1,49 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    class Processor
-      # Actions store the actions information in memory
-      # Also, takes care of merging when RC send new information
-      module Actions
-        class << self
-          def actions
-            @actions ||= []
-          end
-
-          def fetch_configuration(action)
-            actions.find { |action_configuration| action_configuration['id'] == action }
-          end
-
-          def merge(actions_to_merge)
-            return if actions_to_merge.empty?
-
-            if actions.empty?
-              @actions = actions_to_merge
-            else
-              merged_actions = []
-              actions_dup = actions.dup
-
-              actions_to_merge.each do |new_action|
-                existing_action = actions_dup.find { |action| new_action['id'] == action['id'] }
-
-                # the old action is discard and the new kept
-                actions_dup.delete(existing_action) if existing_action
-                merged_actions << new_action
-              end
-
-              @actions = merged_actions.concat(actions_dup)
-            end
-          end
-
-          private
-
-          # Used in tests
-          def reset
-            @actions = []
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/processor/context.rb

@@ -1,107 +0,0 @@
-# frozen_string_literal: true
-
-module Datadog
-  module AppSec
-    class Processor
-      # Context manages a sequence of runs
-      class Context
-        LIBDDWAF_SUCCESSFUL_EXECUTION_CODES = [:ok, :match].freeze
-
-        attr_reader :time_ns, :time_ext_ns, :timeouts, :events
-
-        def initialize(handle, telemetry:)
-          @context = WAF::Context.new(handle)
-          @telemetry = telemetry
-
-          @time_ns = 0.0
-          @time_ext_ns = 0.0
-          @timeouts = 0
-          @events = []
-          @run_mutex = Mutex.new
-
-          @libddwaf_debug_tag = "libddwaf:#{WAF::VERSION::STRING}"
-        end
-
-        def run(persistent_data, ephemeral_data, timeout = WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
-          @run_mutex.lock
-
-          start_ns = Core::Utils::Time.get_time(:nanosecond)
-
-          persistent_data.reject! do |_, v|
-            next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)
-
-            v.nil? ? true : v.empty?
-          end
-
-          ephemeral_data.reject! do |_, v|
-            next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)
-
-            v.nil? ? true : v.empty?
-          end
-
-          _code, result = try_run(persistent_data, ephemeral_data, timeout)
-
-          stop_ns = Core::Utils::Time.get_time(:nanosecond)
-
-          # these updates are not thread safe and should be protected
-          @time_ns += result.total_runtime
-          @time_ext_ns += (stop_ns - start_ns)
-          @timeouts += 1 if result.timeout
-
-          report_execution(result)
-          result
-        ensure
-          @run_mutex.unlock
-        end
-
-        def extract_schema
-          return unless extract_schema?
-
-          input = {
-            'waf.context.processor' => {
-              'extract-schema' => true
-            }
-          }
-
-          _code, result = try_run(input, {}, WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
-
-          report_execution(result)
-          result
-        end
-
-        def finalize
-          @context.finalize
-        end
-
-        private
-
-        def try_run(persistent_data, ephemeral_data, timeout)
-          @context.run(persistent_data, ephemeral_data, timeout)
-        rescue WAF::LibDDWAF::Error => e
-          Datadog.logger.debug { "#{@libddwaf_debug_tag} execution error: #{e} backtrace: #{e.backtrace&.first(3)}" }
-          @telemetry.report(e, description: 'libddwaf internal low-level error')
-
-          [:err_internal, WAF::Result.new(:err_internal, [], 0.0, false, [], [])]
-        end
-
-        def report_execution(result)
-          Datadog.logger.debug { "#{@libddwaf_debug_tag} execution timed out: #{result.inspect}" } if result.timeout
-
-          if LIBDDWAF_SUCCESSFUL_EXECUTION_CODES.include?(result.status)
-            Datadog.logger.debug { "#{@libddwaf_debug_tag} execution result: #{result.inspect}" }
-          else
-            message = "#{@libddwaf_debug_tag} execution error: #{result.status.inspect}"
-
-            Datadog.logger.debug { message }
-            @telemetry.error(message)
-          end
-        end
-
-        def extract_schema?
-          Datadog.configuration.appsec.api_security.enabled &&
-            Datadog.configuration.appsec.api_security.sample_rate.sample?
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/processor/rule_merger.rb

@@ -1,170 +0,0 @@
-# frozen_string_literal: true
-
-require_relative '../assets'
-
-module Datadog
-  module AppSec
-    class Processor
-      # RuleMerger merge different sources of information
-      # into the rules payload
-      module RuleMerger
-        # RuleVersionMismatchError
-        class RuleVersionMismatchError < StandardError
-          def initialize(version1, version2)
-            msg = 'Merging rule files with different version could lead to unkown behaviour. '\
-              "We have receieve two rule files with versions: #{version1}, #{version2}. "\
-              'Please validate the configuration is correct and try again.'
-            super(msg)
-          end
-        end
-
-        class << self
-          # TODO: `processors` and `scanners` are not provided by the caller, consider removing them
-          def merge(
-            telemetry:,
-            rules:, data: [], overrides: [], exclusions: [], custom_rules: [],
-            processors: nil, scanners: nil
-          )
-            processors ||= begin
-              default_waf_processors
-            rescue StandardError => e
-              Datadog.logger.error("libddwaf rulemerger failed to parse default waf processors. Error: #{e.inspect}")
-              telemetry.report(
-                e,
-                description: 'libddwaf rulemerger failed to parse default waf processors'
-              )
-              []
-            end
-
-            scanners ||= begin
-              default_waf_scanners
-            rescue StandardError => e
-              Datadog.logger.error("libddwaf rulemerger failed to parse default waf scanners. Error: #{e.inspect}")
-              telemetry.report(
-                e,
-                description: 'libddwaf rulemerger failed to parse default waf scanners'
-              )
-              []
-            end
-
-            combined_rules = combine_rules(rules)
-
-            combined_data = combine_data(data) if data.any?
-            combined_overrides = combine_overrides(overrides) if overrides.any?
-            combined_exclusions = combine_exclusions(exclusions) if exclusions.any?
-            combined_custom_rules = combine_custom_rules(custom_rules) if custom_rules.any?
-
-            combined_rules['rules_data'] = combined_data if combined_data
-            combined_rules['rules_override'] = combined_overrides if combined_overrides
-            combined_rules['exclusions'] = combined_exclusions if combined_exclusions
-            combined_rules['custom_rules'] = combined_custom_rules if combined_custom_rules
-            combined_rules['processors'] = processors
-            combined_rules['scanners'] = scanners
-            combined_rules
-          end
-
-          def default_waf_processors
-            @default_waf_processors ||= JSON.parse(Datadog::AppSec::Assets.waf_processors)
-          end
-
-          def default_waf_scanners
-            @default_waf_scanners ||= JSON.parse(Datadog::AppSec::Assets.waf_scanners)
-          end
-
-          private
-
-          def combine_rules(rules)
-            return rules[0].dup if rules.size == 1
-
-            final_rules = []
-            # @type var final_version: ::String
-            final_version = (_ = nil)
-
-            rules.each do |rule_file|
-              version = rule_file['version']
-
-              if version && !final_version
-                final_version = version
-              elsif final_version != version
-                raise RuleVersionMismatchError.new(final_version, version)
-              end
-
-              final_rules.concat(rule_file['rules'])
-            end
-
-            {
-              'version' => final_version,
-              'rules' => final_rules
-            }
-          end
-
-          def combine_data(data)
-            result = []
-
-            data.each do |data_entry|
-              data_entry.each do |value|
-                existing_data = result.find { |x| x['id'] == value['id'] }
-
-                if existing_data && existing_data['type'] == value['type']
-                  # Duplicate entry base on type and id
-                  # We need to merge the existing data with the new one
-                  # and make sure to remove duplicates
-                  merged_data = merge_data_base_on_expiration(existing_data['data'], value['data'])
-                  existing_data['data'] = merged_data
-                else
-                  result << value
-                end
-              end
-            end
-
-            return unless result.any?
-
-            result
-          end
-
-          def merge_data_base_on_expiration(data1, data2)
-            result = data1.each_with_object({}) do |value, acc|
-              acc[value['value']] = value['expiration']
-            end
-
-            data2.each do |data|
-              if result.key?(data['value'])
-                # The value is duplicated so we need to keep
-                # the one with the highest expiration value
-                # We replace it if the expiration is higher than the current one
-                # or if no experiration
-                current_expiration = result[data['value']]
-                new_expiration = data['expiration']
-
-                if new_expiration.nil? || current_expiration && new_expiration > current_expiration
-                  result[data['value']] = new_expiration
-                end
-              else
-                result[data['value']] = data['expiration']
-              end
-            end
-
-            result.each_with_object([]) do |entry, acc|
-              value = { 'value' => entry[0] }
-              value['expiration'] = entry[1] if entry[1]
-
-              acc << value
-            end
-          end
-
-          def combine_overrides(overrides)
-            overrides.flatten
-          end
-
-          def combine_exclusions(exclusions)
-            exclusions.flatten
-          end
-
-          def combine_custom_rules(custom_rules)
-            custom_rules.flatten
-          end
-        end
-      end
-    end
-  end
-end

data/lib/datadog/appsec/processor.rb

@@ -1,106 +0,0 @@
-# frozen_string_literal: true
-
-require_relative 'processor/context'
-
-module Datadog
-  module AppSec
-    # Processor integrates libddwaf into datadog/appsec
-    class Processor
-      attr_reader :diagnostics, :addresses
-
-      def initialize(ruleset:, telemetry:)
-        @telemetry = telemetry
-        @diagnostics = nil
-        @addresses = []
-
-        settings = Datadog.configuration.appsec
-
-        # TODO: Refactor to make it easier to test
-        unless require_libddwaf && libddwaf_provides_waf? && create_waf_handle(settings, ruleset)
-          Datadog.logger.warn('AppSec is disabled, see logged errors above')
-        end
-      end
-
-      def ready?
-        !@handle.nil?
-      end
-
-      def finalize
-        @handle.finalize
-      end
-
-      def new_context
-        Context.new(@handle, telemetry: @telemetry)
-      end
-
-      private
-
-      # libddwaf raises a LoadError on unsupported platforms; it may at some
-      # point succeed in being required yet not provide a specific needed feature.
-      def require_libddwaf
-        Datadog.logger.debug { "libddwaf platform: #{libddwaf_platform}" }
-
-        require 'libddwaf'
-
-        true
-      rescue LoadError => e
-        Datadog.logger.error do
-          'libddwaf failed to load,' \
-            "installed platform: #{libddwaf_platform} ruby platforms: #{ruby_platforms} error: #{e.inspect}"
-        end
-        @telemetry.report(e, description: 'libddwaf failed to load')
-
-        false
-      end
-
-      # check whether libddwaf is required *and* able to provide the needed feature
-      def libddwaf_provides_waf?
-        defined?(Datadog::AppSec::WAF) ? true : false
-      end
-
-      def create_waf_handle(settings, ruleset)
-        # TODO: this may need to be reset if the main Datadog logging level changes after initialization
-        Datadog::AppSec::WAF.logger = Datadog.logger if Datadog.logger.debug? && settings.waf_debug
-
-        obfuscator_config = {
-          key_regex: settings.obfuscator_key_regex,
-          value_regex: settings.obfuscator_value_regex,
-        }
-
-        @handle = Datadog::AppSec::WAF::Handle.new(ruleset, obfuscator: obfuscator_config)
-        @diagnostics = @handle.diagnostics
-        @addresses = @handle.required_addresses
-
-        true
-      rescue WAF::LibDDWAF::Error => e
-        Datadog.logger.error do
-          "libddwaf failed to initialize, error: #{e.inspect}"
-        end
-        @telemetry.report(e, description: 'libddwaf failed to initialize')
-
-        @diagnostics = e.diagnostics if e.diagnostics
-
-        false
-      rescue StandardError => e
-        Datadog.logger.error do
-          "libddwaf failed to initialize, error: #{e.inspect}"
-        end
-        @telemetry.report(e, description: 'libddwaf failed to initialize')
-
-        false
-      end
-
-      def libddwaf_platform
-        if Gem.loaded_specs['libddwaf']
-          Gem.loaded_specs['libddwaf'].platform.to_s
-        else
-          'unknown'
-        end
-      end
-
-      def ruby_platforms
-        Gem.platforms.map(&:to_s)
-      end
-    end
-  end
-end