datadog 2.8.0 → 2.10.0

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/operation'
+require_relative '../../../reactive/engine'
 require_relative '../reactive/request'
 require_relative '../reactive/request_body'
 require_relative '../reactive/response'
@@ -25,126 +25,97 @@ module Datadog
 
               def watch_request(gateway = Instrumentation.gateway)
                 gateway.watch('rack.request', :appsec) do |stack, gateway_request|
-                  block = false
                   event = nil
-                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
-
-                  AppSec::Reactive::Operation.new('rack.request') do |op|
-                    Rack::Reactive::Request.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          request: gateway_request,
-                          actions: result.actions
-                        }
-
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
+                  context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
+                  engine = AppSec::Reactive::Engine.new
+
+                  Rack::Reactive::Request.subscribe(engine, context) do |result|
+                    if result.match?
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: context.trace,
+                        span: context.span,
+                        request: gateway_request,
+                        actions: result.actions
+                      }
+
+                      # We want to keep the trace in case of security event
+                      context.trace.keep! if context.trace
+                      Datadog::AppSec::Event.tag_and_keep!(context, result)
+                      context.events << event
+
+                      Datadog::AppSec::ActionsHandler.handle(result.actions)
                     end
-
-                    block = Rack::Reactive::Request.publish(op, gateway_request)
                   end
 
-                  next [nil, [[:block, event]]] if block
-
-                  ret, res = stack.call(gateway_request.request)
-
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
-                  end
+                  Rack::Reactive::Request.publish(engine, gateway_request)
 
-                  [ret, res]
+                  stack.call(gateway_request.request)
                 end
               end
 
               def watch_response(gateway = Instrumentation.gateway)
                 gateway.watch('rack.response', :appsec) do |stack, gateway_response|
-                  block = false
-
                   event = nil
-                  scope = gateway_response.scope
-
-                  AppSec::Reactive::Operation.new('rack.response') do |op|
-                    Rack::Reactive::Response.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          response: gateway_response,
-                          actions: result.actions
-                        }
-
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
+                  context = gateway_response.context
+                  engine = AppSec::Reactive::Engine.new
+
+                  Rack::Reactive::Response.subscribe(engine, context) do |result|
+                    if result.match?
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: context.trace,
+                        span: context.span,
+                        response: gateway_response,
+                        actions: result.actions
+                      }
+
+                      # We want to keep the trace in case of security event
+                      context.trace.keep! if context.trace
+                      Datadog::AppSec::Event.tag_and_keep!(context, result)
+                      context.events << event
+
+                      Datadog::AppSec::ActionsHandler.handle(result.actions)
                     end
-
-                    block = Rack::Reactive::Response.publish(op, gateway_response)
                   end
 
-                  next [nil, [[:block, event]]] if block
-
-                  ret, res = stack.call(gateway_response.response)
+                  Rack::Reactive::Response.publish(engine, gateway_response)
 
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
-                  end
-
-                  [ret, res]
+                  stack.call(gateway_response.response)
                 end
               end
 
               def watch_request_body(gateway = Instrumentation.gateway)
                 gateway.watch('rack.request.body', :appsec) do |stack, gateway_request|
-                  block = false
-
                   event = nil
-                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
-
-                  AppSec::Reactive::Operation.new('rack.request.body') do |op|
-                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          request: gateway_request,
-                          actions: result.actions
-                        }
-
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
+                  context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
+                  engine = AppSec::Reactive::Engine.new
+
+                  Rack::Reactive::RequestBody.subscribe(engine, context) do |result|
+                    if result.match?
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: context.trace,
+                        span: context.span,
+                        request: gateway_request,
+                        actions: result.actions
+                      }
+
+                      # We want to keep the trace in case of security event
+                      context.trace.keep! if context.trace
+                      Datadog::AppSec::Event.tag_and_keep!(context, result)
+                      context.events << event
+
+                      Datadog::AppSec::ActionsHandler.handle(result.actions)
                     end
-
-                    block = Rack::Reactive::RequestBody.publish(op, gateway_request)
                   end
 
-                  next [nil, [[:block, event]]] if block
-
-                  ret, res = stack.call(gateway_request.request)
-
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
-                  end
+                  Rack::Reactive::RequestBody.publish(engine, gateway_request)
 
-                  [ret, res]
+                  stack.call(gateway_request.request)
                 end
               end
             end

data/lib/datadog/appsec/contrib/rack/reactive/request.rb

@@ -17,21 +17,21 @@ module Datadog
             ].freeze
             private_constant :ADDRESSES
 
-            def self.publish(op, gateway_request)
+            def self.publish(engine, gateway_request)
               catch(:block) do
-                op.publish('request.query', gateway_request.query)
-                op.publish('request.headers', gateway_request.headers)
-                op.publish('request.uri.raw', gateway_request.fullpath)
-                op.publish('request.cookies', gateway_request.cookies)
-                op.publish('request.client_ip', gateway_request.client_ip)
-                op.publish('server.request.method', gateway_request.method)
+                engine.publish('request.query', gateway_request.query)
+                engine.publish('request.headers', gateway_request.headers)
+                engine.publish('request.uri.raw', gateway_request.fullpath)
+                engine.publish('request.cookies', gateway_request.cookies)
+                engine.publish('request.client_ip', gateway_request.client_ip)
+                engine.publish('server.request.method', gateway_request.method)
 
                 nil
               end
             end
 
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
+            def self.subscribe(engine, context)
+              engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
 
                 headers = values[0]
@@ -53,9 +53,9 @@ module Datadog
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
-                next if result.status != :match
+                next unless result.match?
 
                 yield result
                 throw(:block, true) unless result.actions.empty?

data/lib/datadog/appsec/contrib/rack/reactive/request_body.rb

@@ -12,17 +12,17 @@ module Datadog
             ].freeze
             private_constant :ADDRESSES
 
-            def self.publish(op, gateway_request)
+            def self.publish(engine, gateway_request)
               catch(:block) do
                 # params have been parsed from the request body
-                op.publish('request.body', gateway_request.form_hash)
+                engine.publish('request.body', gateway_request.form_hash)
 
                 nil
               end
             end
 
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
+            def self.subscribe(engine, context)
+              engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 body = values[0]
 
@@ -31,9 +31,9 @@ module Datadog
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
-                next if result.status != :match
+                next unless result.match?
 
                 yield result
                 throw(:block, true) unless result.actions.empty?

data/lib/datadog/appsec/contrib/rack/reactive/response.rb

@@ -13,17 +13,17 @@ module Datadog
             ].freeze
             private_constant :ADDRESSES
 
-            def self.publish(op, gateway_response)
+            def self.publish(engine, gateway_response)
               catch(:block) do
-                op.publish('response.status', gateway_response.status)
-                op.publish('response.headers', gateway_response.headers)
+                engine.publish('response.status', gateway_response.status)
+                engine.publish('response.headers', gateway_response.headers)
 
                 nil
               end
             end
 
-            def self.subscribe(op, waf_context)
-              op.subscribe(*ADDRESSES) do |*values|
+            def self.subscribe(engine, context)
+              engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
 
                 response_status = values[0]
@@ -37,9 +37,9 @@ module Datadog
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
-                next if result.status != :match
+                next unless result.match?
 
                 yield result
                 throw(:block, true) unless result.actions.empty?

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -17,25 +17,24 @@ module Datadog
           end
 
           def call(env)
-            context = env[Datadog::AppSec::Ext::SCOPE_KEY]
+            context = env[Datadog::AppSec::Ext::CONTEXT_KEY]
 
             return @app.call(env) unless context
 
             # TODO: handle exceptions, except for @app.call
 
-            request_return, request_response = Instrumentation.gateway.push(
-              'rack.request.body',
-              Gateway::Request.new(env)
-            ) do
-              @app.call(env)
-            end
+            http_response = nil
+            interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
+              http_response, _request = Instrumentation.gateway.push('rack.request.body', Gateway::Request.new(env)) do
+                @app.call(env)
+              end
 
-            if request_response
-              blocked_event = request_response.find { |action, _event| action == :block }
-              request_return = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_rack if blocked_event
+              nil
             end
 
-            request_return
+            return AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack if interrupt_params
+
+            http_response
           end
         end
       end

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -36,7 +36,7 @@ module Datadog
             @rack_headers = {}
           end
 
-          # rubocop:disable Metrics/AbcSize,Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity,Metrics/MethodLength
+          # rubocop:disable Metrics/AbcSize,Metrics/MethodLength
           def call(env)
             return @app.call(env) unless Datadog::AppSec.enabled?
 
@@ -45,19 +45,22 @@ module Datadog
 
             processor = nil
             ready = false
-            scope = nil
+            ctx = nil
 
             # For a given request, keep using the first Rack stack scope for
             # nested apps. Don't set `context` local variable so that on popping
             # out of this nested stack we don't finalize the parent's context
-            return @app.call(env) if active_scope(env)
+            return @app.call(env) if active_context(env)
 
             Datadog::AppSec.reconfigure_lock do
               processor = Datadog::AppSec.processor
 
               if !processor.nil? && processor.ready?
-                scope = Datadog::AppSec::Scope.activate_scope(active_trace, active_span, processor)
-                env[Datadog::AppSec::Ext::SCOPE_KEY] = scope
+                ctx = Datadog::AppSec::Context.activate(
+                  Datadog::AppSec::Context.new(active_trace, active_span, processor)
+                )
+
+                env[Datadog::AppSec::Ext::CONTEXT_KEY] = ctx
                 ready = true
               end
             end
@@ -66,66 +69,59 @@ module Datadog
 
             return @app.call(env) unless ready
 
-            gateway_request = Gateway::Request.new(env)
+            add_appsec_tags(processor, ctx)
+            add_request_tags(ctx, env)
 
-            add_appsec_tags(processor, scope)
-            add_request_tags(scope, env)
+            http_response = nil
+            gateway_request = Gateway::Request.new(env)
+            gateway_response = nil
 
-            request_return, request_response = catch(::Datadog::AppSec::Ext::INTERRUPT) do
-              Instrumentation.gateway.push('rack.request', gateway_request) do
+            interrupt_params = catch(::Datadog::AppSec::Ext::INTERRUPT) do
+              http_response, _gateway_request = Instrumentation.gateway.push('rack.request', gateway_request) do
                 @app.call(env)
               end
-            end
 
-            if request_response
-              blocked_event = request_response.find { |action, _options| action == :block }
-              request_return = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_rack if blocked_event
-            end
+              gateway_response = Gateway::Response.new(
+                http_response[2], http_response[0], http_response[1], context: ctx
+              )
 
-            gateway_response = Gateway::Response.new(
-              request_return[2],
-              request_return[0],
-              request_return[1],
-              scope: scope,
-            )
+              Instrumentation.gateway.push('rack.response', gateway_response)
 
-            _response_return, response_response = Instrumentation.gateway.push('rack.response', gateway_response)
+              nil
+            end
 
-            result = scope.processor_context.extract_schema
+            if interrupt_params
+              http_response = AppSec::Response.from_interrupt_params(interrupt_params, env['HTTP_ACCEPT']).to_rack
+            end
 
-            if result
-              scope.processor_context.events << {
-                trace: scope.trace,
-                span: scope.service_entry_span,
-                waf_result: result,
+            if AppSec.api_security_enabled?
+              ctx.events << {
+                trace: ctx.trace,
+                span: ctx.span,
+                waf_result: ctx.extract_schema,
               }
             end
 
-            scope.processor_context.events.each do |e|
+            ctx.events.each do |e|
               e[:response] ||= gateway_response
               e[:request]  ||= gateway_request
             end
 
-            AppSec::Event.record(scope.service_entry_span, *scope.processor_context.events)
-
-            if response_response
-              blocked_event = response_response.find { |action, _options| action == :block }
-              request_return = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_rack if blocked_event
-            end
+            AppSec::Event.record(ctx.span, *ctx.events)
 
-            request_return
+            http_response
           ensure
-            if scope
-              add_waf_runtime_tags(scope)
-              Datadog::AppSec::Scope.deactivate_scope
+            if ctx
+              ctx.export_metrics
+              Datadog::AppSec::Context.deactivate
             end
           end
-          # rubocop:enable Metrics/AbcSize,Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity,Metrics/MethodLength
+          # rubocop:enable Metrics/AbcSize,Metrics/MethodLength
 
           private
 
-          def active_scope(env)
-            env[Datadog::AppSec::Ext::SCOPE_KEY]
+          def active_context(env)
+            env[Datadog::AppSec::Ext::CONTEXT_KEY]
           end
 
           def active_trace
@@ -144,9 +140,9 @@ module Datadog
             Datadog::Tracing.active_span
           end
 
-          def add_appsec_tags(processor, scope)
-            span = scope.service_entry_span
-            trace = scope.trace
+          def add_appsec_tags(processor, context)
+            span = context.span
+            trace = context.trace
 
             return unless trace && span
 
@@ -181,8 +177,8 @@ module Datadog
             end
           end
 
-          def add_request_tags(scope, env)
-            span = scope.service_entry_span
+          def add_request_tags(context, env)
+            span = context.span
 
             return unless span
 
@@ -204,19 +200,6 @@ module Datadog
             end
           end
 
-          def add_waf_runtime_tags(scope)
-            span = scope.service_entry_span
-            context = scope.processor_context
-
-            return unless span && context
-
-            span.set_tag('_dd.appsec.waf.timeouts', context.timeouts)
-
-            # these tags expect time in us
-            span.set_tag('_dd.appsec.waf.duration', context.time_ns / 1000.0)
-            span.set_tag('_dd.appsec.waf.duration_ext', context.time_ext_ns / 1000.0)
-          end
-
           def to_rack_header(header)
             @rack_headers[header] ||= Datadog::Tracing::Contrib::Rack::Header.to_rack_header(header)
           end

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/operation'
+require_relative '../../../reactive/engine'
 require_relative '../reactive/action'
 require_relative '../../../event'
 
@@ -21,43 +21,33 @@ module Datadog
 
               def watch_request_action(gateway = Instrumentation.gateway)
                 gateway.watch('rails.request.action', :appsec) do |stack, gateway_request|
-                  block = false
-
                   event = nil
-                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
-
-                  AppSec::Reactive::Operation.new('rails.request.action') do |op|
-                    Rails::Reactive::Action.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          request: gateway_request,
-                          actions: result.actions
-                        }
-
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
+                  context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
+                  engine = AppSec::Reactive::Engine.new
+
+                  Rails::Reactive::Action.subscribe(engine, context) do |result|
+                    if result.match?
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: context.trace,
+                        span: context.span,
+                        request: gateway_request,
+                        actions: result.actions
+                      }
+
+                      # We want to keep the trace in case of security event
+                      context.trace.keep! if context.trace
+                      Datadog::AppSec::Event.tag_and_keep!(context, result)
+                      context.events << event
+
+                      Datadog::AppSec::ActionsHandler.handle(result.actions)
                     end
-
-                    block = Rails::Reactive::Action.publish(op, gateway_request)
                   end
 
-                  next [nil, [[:block, event]]] if block
-
-                  ret, res = stack.call(gateway_request.request)
-
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
-                  end
+                  Rails::Reactive::Action.publish(engine, gateway_request)
 
-                  [ret, res]
+                  stack.call(gateway_request.request)
                 end
               end
             end

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -73,29 +73,19 @@ module Datadog
             def process_action(*args)
               env = request.env
 
-              context = env[Datadog::AppSec::Ext::SCOPE_KEY]
+              context = env[Datadog::AppSec::Ext::CONTEXT_KEY]
 
               return super unless context
 
               # TODO: handle exceptions, except for super
 
               gateway_request = Gateway::Request.new(request)
-              request_return, request_response = Instrumentation.gateway.push('rails.request.action', gateway_request) do
-                super
-              end
 
-              if request_response
-                blocked_event = request_response.find { |action, _options| action == :block }
-                if blocked_event
-                  @_response = AppSec::Response.negotiate(
-                    env,
-                    blocked_event.last[:actions]
-                  ).to_action_dispatch_response
-                  request_return = @_response.body
-                end
+              http_response, _gateway_request = Instrumentation.gateway.push('rails.request.action', gateway_request) do
+                super
               end
 
-              request_return
+              http_response
             end
           end