datadog 2.8.0 → 2.39.0

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -1,10 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../../../instrumentation/gateway'
-require_relative '../../../reactive/operation'
-require_relative '../../rack/reactive/request_body'
-require_relative '../reactive/routed'
-require_relative '../../../event'
+require_relative "../../../event"
+require_relative "../../../trace_keeper"
+require_relative "../../../security_event"
+require_relative "../../../instrumentation/gateway"
 
 module Datadog
   module AppSec
@@ -19,89 +18,106 @@ module Datadog
 
                 watch_request_dispatch(gateway)
                 watch_request_routed(gateway)
+                watch_response_body_json(gateway)
               end
 
               def watch_request_dispatch(gateway = Instrumentation.gateway)
-                gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
-                  block = false
-
-                  event = nil
-                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
-
-                  AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
-                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          request: gateway_request,
-                          actions: result.actions
-                        }
-
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
-                    end
+                gateway.watch("sinatra.request.dispatch") do |stack, gateway_request|
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY] # : Context
+
+                  context.state[:web_framework] = "sinatra"
+
+                  request = gateway_request.request
+                  next stack.call(request) unless gateway_request.collectable_body?
+
+                  # NOTE: A limit of 0 disables request body collection entirely.
+                  limit = Datadog.configuration.appsec.body_parsing_size_limit
+                  next stack.call(request) if limit.zero?
+
+                  persistent_data = {}
+                  byte_length = gateway_request.body_bytesize(limit)
 
-                    block = Rack::Reactive::RequestBody.publish(op, gateway_request)
+                  if byte_length
+                    persistent_data["server.request.body.byte_length"] = byte_length
+
+                    if byte_length <= limit
+                      body = gateway_request.form_hash
+                      persistent_data["server.request.body"] = body if body
+                    end
+                  # NOTE: Body was parsed before measurement, keep byte_length unset
+                  elsif gateway_request.env.key?("rack.request.form_hash")
+                    body = gateway_request.env["rack.request.form_hash"]
+                    persistent_data["server.request.body"] = body if body
                   end
 
-                  next [nil, [[:block, event]]] if block
+                  next stack.call(request) if persistent_data.empty?
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match? || !result.attributes.empty?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
+                  end
 
-                  ret, res = stack.call(gateway_request.request)
+                  if result.match?
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
 
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
+                    AppSec::ActionsHandler.handle(result.actions)
                   end
 
-                  [ret, res]
+                  stack.call(gateway_request.request)
                 end
               end
 
               def watch_request_routed(gateway = Instrumentation.gateway)
-                gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
-                  block = false
-
-                  event = nil
-                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
-
-                  AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
-                    Sinatra::Reactive::Routed.subscribe(op, scope.processor_context) do |result|
-                      if result.status == :match
-                        # TODO: should this hash be an Event instance instead?
-                        event = {
-                          waf_result: result,
-                          trace: scope.trace,
-                          span: scope.service_entry_span,
-                          request: gateway_request,
-                          actions: result.actions
-                        }
-
-                        # We want to keep the trace in case of security event
-                        scope.trace.keep! if scope.trace
-                        Datadog::AppSec::Event.tag_and_keep!(scope, result)
-                        scope.processor_context.events << event
-                      end
-                    end
+                gateway.watch("sinatra.request.routed") do |stack, args|
+                  gateway_request, gateway_route_params = args # : [Gateway::Request, Gateway::RouteParams]
+                  context = gateway_request.env[AppSec::Ext::CONTEXT_KEY] # : Context
+
+                  persistent_data = {
+                    "server.request.path_params" => gateway_route_params.params
+                  }
+
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
+
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
 
-                    block = Sinatra::Reactive::Routed.publish(op, [gateway_request, gateway_route_params])
+                    AppSec::ActionsHandler.handle(result.actions)
                   end
 
-                  next [nil, [[:block, event]]] if block
+                  stack.call(gateway_request.request)
+                end
+              end
+
+              def watch_response_body_json(gateway = Instrumentation.gateway)
+                gateway.watch("sinatra.response.body.json") do |stack, container|
+                  context = container.context # : Context
+
+                  persistent_data = {
+                    "server.response.body" => container.data
+                  }
+                  result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)
+
+                  if result.match?
+                    context.events.push(
+                      AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
+                    )
 
-                  ret, res = stack.call(gateway_request.request)
+                    AppSec::Event.tag(context, result)
+                    TraceKeeper.keep!(context.trace) if result.keep?
 
-                  if event
-                    res ||= []
-                    res << [:monitor, event]
+                    AppSec::ActionsHandler.handle(result.actions)
                   end
 
-                  [ret, res]
+                  stack.call(container)
                 end
               end
             end

data/lib/datadog/appsec/contrib/sinatra/integration.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
-require_relative '../integration'
+require_relative "../integration"
 
-require_relative 'patcher'
-require_relative 'request_middleware'
+require_relative "patcher"
+require_relative "request_middleware"
 
 module Datadog
   module AppSec
@@ -13,12 +13,12 @@ module Datadog
         class Integration
           include Datadog::AppSec::Contrib::Integration
 
-          MINIMUM_VERSION = Gem::Version.new('1.4.0')
+          MINIMUM_VERSION = Gem::Version.new("1.4.0")
 
           register_as :sinatra
 
           def self.version
-            Gem.loaded_specs['sinatra'] && Gem.loaded_specs['sinatra'].version
+            Gem.loaded_specs["sinatra"]&.version
           end
 
           def self.loaded?
@@ -26,7 +26,7 @@ module Datadog
           end
 
           def self.compatible?
-            super && version >= MINIMUM_VERSION
+            !!(super && (version&.>= MINIMUM_VERSION))
           end
 
           def self.auto_instrument?

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -1,16 +1,15 @@
 # frozen_string_literal: true
 
-require_relative '../../../tracing/contrib'
-
-require_relative '../patcher'
-require_relative '../../response'
-require_relative '../rack/request_middleware'
-require_relative 'framework'
-require_relative 'ext'
-require_relative 'gateway/watcher'
-require_relative 'gateway/route_params'
-require_relative 'gateway/request'
-require_relative '../../../tracing/contrib/sinatra/framework'
+require_relative "../../../tracing/contrib"
+
+require_relative "../../response"
+require_relative "../rack/request_middleware"
+require_relative "framework"
+require_relative "gateway/watcher"
+require_relative "gateway/route_params"
+require_relative "gateway/request"
+require_relative "patches/json_patch"
+require_relative "../../../tracing/contrib/sinatra/framework"
 
 module Datadog
   module AppSec
@@ -53,26 +52,15 @@ module Datadog
         module DispatchPatch
           def dispatch!
             env = @request.env
-
-            context = env[Datadog::AppSec::Ext::SCOPE_KEY]
+            context = env[Datadog::AppSec::Ext::CONTEXT_KEY]
 
             return super unless context
 
             # TODO: handle exceptions, except for super
 
             gateway_request = Gateway::Request.new(env)
-
-            request_return, request_response = Instrumentation.gateway.push('sinatra.request.dispatch', gateway_request) do
-              # handle process_route interruption
-              catch(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT) { super }
-            end
-
-            if request_response
-              blocked_event = request_response.find { |action, _options| action == :block }
-              if blocked_event
-                self.response = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_sinatra_response
-                request_return = nil
-              end
+            request_return, _gateway_request = Instrumentation.gateway.push("sinatra.request.dispatch", gateway_request) do
+              super
             end
 
             request_return
@@ -83,10 +71,10 @@ module Datadog
         # path params are returned by pattern.params in process_route, then
         # merged with normal params, so we get both
         module RoutePatch
-          def process_route(*)
+          def process_route(*args)
             env = @request.env
 
-            context = env[Datadog::AppSec::Ext::SCOPE_KEY]
+            context = env[Datadog::AppSec::Ext::CONTEXT_KEY]
 
             return super unless context
 
@@ -95,7 +83,7 @@ module Datadog
             # Capture normal params.
             base_params = params
 
-            super do |*args|
+            super do |*super_args|
               # This block is called only once the route is found.
               # At this point params has both route params and normal params.
               route_params = params.each.with_object({}) { |(k, v), h| h[k] = v unless base_params.key?(k) }
@@ -103,30 +91,15 @@ module Datadog
               gateway_request = Gateway::Request.new(env)
               gateway_route_params = Gateway::RouteParams.new(route_params)
 
-              _, request_response = Instrumentation.gateway.push(
-                'sinatra.request.routed',
-                [gateway_request, gateway_route_params]
-              )
+              Instrumentation.gateway.push("sinatra.request.routed", [gateway_request, gateway_route_params])
 
-              if request_response
-                blocked_event = request_response.find { |action, _options| action == :block }
-                if blocked_event
-                  self.response = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_sinatra_response
-
-                  # interrupt request and return response to dispatch! for consistency
-                  throw(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT, response)
-                end
-              end
-
-              yield(*args)
+              yield(*super_args)
             end
           end
         end
 
         # Patcher for AppSec on Sinatra
         module Patcher
-          include Datadog::AppSec::Contrib::Patcher
-
           module_function
 
           def patched?
@@ -139,27 +112,18 @@ module Datadog
 
           def patch
             Gateway::Watcher.watch
-            patch_default_middlewares
-            patch_dispatch
-            patch_route
-            setup_security
-            Patcher.instance_variable_set(:@patched, true)
-          end
-
-          def setup_security
-            ::Sinatra::Base.singleton_class.prepend(AppSecSetupPatch)
-          end
 
-          def patch_default_middlewares
             ::Sinatra::Base.singleton_class.prepend(DefaultMiddlewarePatch)
-          end
-
-          def patch_dispatch
             ::Sinatra::Base.prepend(DispatchPatch)
+            ::Sinatra::Base.prepend(RoutePatch)
+            ::Sinatra::Base.prepend(Patches::JsonPatch) if patch_json?
+            ::Sinatra::Base.singleton_class.prepend(AppSecSetupPatch)
+
+            Patcher.instance_variable_set(:@patched, true)
           end
 
-          def patch_route
-            ::Sinatra::Base.prepend(RoutePatch)
+          def patch_json?
+            !!(defined?(::Sinatra::JSON) && ::Sinatra::Base < ::Sinatra::JSON)
           end
         end
       end

data/lib/datadog/appsec/contrib/sinatra/patches/json_patch.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require_relative "../../../utils/hash_coercion"
+require_relative "../../../instrumentation/gateway/argument"
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Patches
+          # A patch targeting `Sinatra::JSON#json` method to capture JSON response
+          # body right before it is serialized.
+          module JsonPatch
+            def json(object, options = {})
+              context = @request.env[Datadog::AppSec::Ext::CONTEXT_KEY] # : Context?
+              return super unless context
+
+              data = Utils::HashCoercion.coerce(object)
+              return super unless data
+
+              container = Instrumentation::Gateway::DataContainer.new(data, context: context)
+              Instrumentation.gateway.push("sinatra.response.body.json", container)
+
+              super
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/counter_sampler.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+require_relative "../core/knuth_sampler"
+
+module Datadog
+  module AppSec
+    # Sampler that uses an internal counter to make deterministic sampling decisions.
+    #
+    # Each call to {#sample?} increments the counter and uses it as input to
+    # the underlying Knuth multiplicative hash algorithm.
+    #
+    # @api private
+    class CounterSampler
+      def initialize(rate = 1.0)
+        @sampler = Core::KnuthSampler.new(rate)
+        @counter = 0
+      end
+
+      def sample?
+        @counter += 1
+        @sampler.sample?(@counter)
+      end
+    end
+  end
+end

data/lib/datadog/appsec/default_header_tags.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # Sets the always-on span tags built from a fixed allowlist of request and
+    # response headers.
+    #
+    # NOTE: Unlike {Event#record}, which reports request headers only when
+    #       a security event fires, these are tagged on every request/response
+    #
+    # @api private
+    module DefaultHeaderTags
+      # NOTE: Contains additional WAF vendor headers
+      REQUEST_HEADERS_TAGS = %w[
+        accept
+        content-type
+        user-agent
+        akamai-user-risk
+        x-amzn-trace-id
+        x-cloud-trace-context
+        x-appgw-trace-id
+        x-sigsci-requestid
+        x-sigsci-tags
+        cf-ray
+        cloudfront-viewer-ja3-fingerprint
+      ].freeze
+
+      RESPONSE_HEADERS_TAGS = %w[
+        content-type
+        content-length
+        content-encoding
+        content-language
+      ].freeze
+
+      module_function
+
+      def tag_request(span, headers)
+        REQUEST_HEADERS_TAGS.each do |name|
+          value = headers.get(name)
+          span.set_tag("http.request.headers.#{name}", value) if value
+        end
+      end
+
+      def tag_response(span, headers)
+        RESPONSE_HEADERS_TAGS.each do |name|
+          value = headers.get(name)
+          span.set_tag("http.response.headers.#{name}", value.to_s) if value
+        end
+      end
+    end
+  end
+end