datadog 2.8.0 → 2.39.0

data/lib/datadog/appsec/utils/http/media_range.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'media_type'
+require_relative "media_type"
 
 module Datadog
   module AppSec
@@ -11,7 +11,7 @@ module Datadog
           class ParseError < ::StandardError
           end
 
-          WILDCARD = '*'
+          WILDCARD = "*"
           WILDCARD_RE = ::Regexp.escape(WILDCARD)
 
           # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
@@ -96,40 +96,40 @@ module Datadog
 
             raise ParseError, media_range.inspect if media_range_match.nil?
 
-            @type = (media_range_match['type'] || WILDCARD).downcase
-            @subtype = (media_range_match['subtype'] || WILDCARD).downcase
-            @quality = (media_range_match['quality'] || 1.0).to_f
+            @type = (media_range_match["type"] || WILDCARD).downcase
+            @subtype = (media_range_match["subtype"] || WILDCARD).downcase
+            @quality = (media_range_match["quality"] || 1.0).to_f
             @parameters = {}
             @accept_ext = {}
 
-            parameters = media_range_match['parameters']
+            parameters = media_range_match["parameters"]
 
             return if parameters.nil?
 
-            parameters.split(';').map(&:strip).each do |parameter|
+            parameters.split(";").map(&:strip).each do |parameter|
               parameter_match = PARAMETER_RE.match(parameter)
 
               next if parameter_match.nil?
 
-              parameter_name = parameter_match['parameter_name']
-              parameter_value = parameter_match['parameter_value']
+              parameter_name = parameter_match["parameter_name"]
+              parameter_value = parameter_match["parameter_value"]
 
               next if parameter_name.nil? || parameter_value.nil?
 
               @parameters[parameter_name.downcase] = parameter_value.downcase
             end
 
-            accept_exts = media_range_match['accept_exts']
+            accept_exts = media_range_match["accept_exts"]
 
             return if accept_exts.nil?
 
-            accept_exts.split(';').map(&:strip).each do |ext|
+            accept_exts.split(";").map(&:strip).each do |ext|
               ext_match = ACCEPT_EXT_RE.match(ext)
 
               next if ext_match.nil?
 
-              ext_name = ext_match['ext_name']
-              ext_value = ext_match['ext_value']
+              ext_name = ext_match["ext_name"]
+              ext_value = ext_match["ext_value"]
 
               next if ext_name.nil? || ext_value.nil?
 
@@ -168,7 +168,8 @@ module Datadog
           #
           # returns true if the MediaType is accepted by this MediaRange
           def ===(other)
-            return self === MediaType.new(other) if other.is_a?(::String)
+            return false if other.nil?
+            return self === MediaType.parse(other) if other.is_a?(::String)
 
             type == other.type && subtype == other.subtype && other.parameters.all? { |k, v| parameters[k] == v } ||
               type == other.type && wildcard?(:subtype) ||
@@ -188,9 +189,9 @@ module Datadog
           def to_s
             s = +"#{@type}/#{@subtype}"
 
-            s << ';' << @parameters.map { |k, v| "#{k}=#{v}" }.join(';') if @parameters.count > 0
+            s << ";" << @parameters.map { |k, v| "#{k}=#{v}" }.join(";") if @parameters.count > 0
             s << ";q=#{@quality}" if @quality < 1.0
-            s << ';' << @accept_ext.map { |k, v| "#{k}=#{v}" }.join(';') if @accept_ext.count > 0
+            s << ";" << @accept_ext.map { |k, v| "#{k}=#{v}" }.join(";") if @accept_ext.count > 0
 
             s
           end

data/lib/datadog/appsec/utils/http/media_type.rb

@@ -4,22 +4,19 @@ module Datadog
   module AppSec
     module Utils
       module HTTP
-        # Implementation of media type for content negotiation
+        # Implementation of media type for HTTP headers
         #
         # See:
         # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.1
         # - https://www.rfc-editor.org/rfc/rfc7231#section-5.3.2
         class MediaType
-          class ParseError < ::StandardError
-          end
-
-          WILDCARD = '*'
+          WILDCARD = "*"
 
           # See: https://www.rfc-editor.org/rfc/rfc7230#section-3.2.6
           TOKEN_RE = /[-#$%&'*+.^_`|~A-Za-z0-9]+/.freeze
 
           # See: https://www.rfc-editor.org/rfc/rfc7231#section-3.1.1.1
-          PARAMETER_RE = %r{ # rubocop:disable Style/RegexpLiteral
+          PARAMETER_RE = %r{
             (?:
               (?<parameter_name>#{TOKEN_RE})
               =
@@ -46,39 +43,48 @@ module Datadog
 
           attr_reader :type, :subtype, :parameters
 
-          def initialize(media_type)
-            media_type_match = MEDIA_TYPE_RE.match(media_type)
+          def self.parse(media)
+            match = MEDIA_TYPE_RE.match(media)
+            return if match.nil?
 
-            raise ParseError, media_type.inspect if media_type_match.nil?
+            type = match["type"] || WILDCARD
+            type.downcase!
 
-            @type = (media_type_match['type'] || WILDCARD).downcase
-            @subtype = (media_type_match['subtype'] || WILDCARD).downcase
-            @parameters = {}
+            subtype = match["subtype"] || WILDCARD
+            subtype.downcase!
 
-            parameters = media_type_match['parameters']
+            parameters = {}
+            params = match["parameters"]
 
-            return if parameters.nil?
+            unless params.nil? || params.empty?
+              params.scan(PARAMETER_RE) do |name, unquoted_value, quoted_value|
+                # NOTE: Order of unquoted_value and quoted_value does not matter,
+                #       as they are mutually exclusive by the regex.
+                # @type var value: ::String?
+                value = unquoted_value || quoted_value
+                next if name.nil? || value.nil?
 
-            parameters.split(';').map(&:strip).each do |parameter|
-              parameter_match = PARAMETER_RE.match(parameter)
+                # See https://github.com/soutaro/steep/issues/2051
+                name.downcase! # steep:ignore NoMethod
+                value.downcase!
 
-              next if parameter_match.nil?
-
-              parameter_name = parameter_match['parameter_name']
-              parameter_value = parameter_match['parameter_value']
+                parameters[name] = value
+              end
+            end
 
-              next if parameter_name.nil? || parameter_value.nil?
+            new(type: type, subtype: subtype, parameters: parameters)
+          end
 
-              @parameters[parameter_name.downcase] = parameter_value.downcase
-            end
+          def initialize(type:, subtype:, parameters: {})
+            @type = type
+            @subtype = subtype
+            @parameters = parameters
           end
 
           def to_s
-            s = +"#{@type}/#{@subtype}"
-
-            s << ';' << @parameters.map { |k, v| "#{k}=#{v}" }.join(';') if @parameters.count > 0
+            return "#{@type}/#{@subtype}" if @parameters.empty?
 
-            s
+            "#{@type}/#{@subtype};#{@parameters.map { |k, v| "#{k}=#{v}" }.join(";")}"
           end
         end
       end

data/lib/datadog/appsec/utils/http/url_encoded.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "cgi"
+
+module Datadog
+  module AppSec
+    module Utils
+      module HTTP
+        # Module for parsing URL encoded payloads
+        module URLEncoded
+          module_function
+
+          # Matches Rack's default query bytesize limit, so parsing our own
+          # payloads keeps the same guard against CPU/memory exhaustion.
+          DEFAULT_BYTESIZE_LIMIT = 4 * 1024 * 1024
+
+          AMPERSAND_BYTE = 0x26
+          EQUALS_BYTE = 0x3D
+
+          # Parses a URL encoded payload (query string or form data) into a hash
+          # of keys and values, merging duplicate keys.
+          #
+          # Example:
+          #
+          #   URLEncoded.parse("foo=bar&foo=baz&qux=quux") # => {"foo" => ["bar", "baz"], "qux" => "quux"}
+          #
+          # Parsing stops once +limit+ bytes have been read, and the pair being
+          # read at that point is discarded. This returns the pairs decoded so
+          # far rather than raising or discarding the whole payload.
+          def parse(payload, limit: DEFAULT_BYTESIZE_LIMIT)
+            raise ArgumentError, "limit must not be negative" if limit < 0
+
+            return {} if payload.nil? || payload.empty? || limit.zero?
+
+            # @type var result: URLEncoded::params
+            result = {}
+            payload_bytesize = payload.bytesize
+            bytes_to_parse = (payload_bytesize < limit) ? payload_bytesize : limit
+
+            index = 0
+            param_start = 0
+            equals_index = nil # : Integer?
+
+            payload.each_byte do |byte|
+              break if index >= bytes_to_parse
+
+              if byte == AMPERSAND_BYTE
+                param_end = index
+
+                if equals_index
+                  key = payload.byteslice(param_start, equals_index - param_start) # : String
+                  value = payload.byteslice(equals_index + 1, param_end - equals_index - 1) # : String?
+                else
+                  key = payload.byteslice(param_start, param_end - param_start) # : String
+                  value = nil
+                end
+
+                if !key.empty? || value
+                  key = CGI.unescape(key)
+                  value = CGI.unescape(value) if value
+
+                  add_param(result, key, value)
+                end
+
+                param_start = index + 1
+                equals_index = nil
+              elsif byte == EQUALS_BYTE
+                equals_index ||= index
+              end
+
+              index += 1
+            end
+
+            if bytes_to_parse == payload_bytesize && param_start < index
+              param_end = index
+
+              if equals_index
+                key = payload.byteslice(param_start, equals_index - param_start) # : String
+                value = payload.byteslice(equals_index + 1, param_end - equals_index - 1) # : String?
+              else
+                key = payload.byteslice(param_start, param_end - param_start) # : String
+                value = nil
+              end
+
+              if !key.empty? || value
+                key = CGI.unescape(key)
+                value = CGI.unescape(value) if value
+
+                add_param(result, key, value)
+              end
+            end
+
+            result
+          end
+
+          private_class_method def add_param(params, key, value)
+            case existing = params[key]
+            when ::Array then existing.push(value)
+            when nil then params[key] = value
+            else params[key] = [existing, value]
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/utils.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-require_relative 'utils/trace_operation'
-
 module Datadog
   module AppSec
     # Utilities for AppSec

data/lib/datadog/appsec.rb

@@ -1,43 +1,44 @@
 # frozen_string_literal: true
 
-require_relative 'appsec/configuration'
-require_relative 'appsec/extensions'
-require_relative 'appsec/scope'
-require_relative 'appsec/ext'
-require_relative 'appsec/utils'
+require_relative "appsec/configuration"
+require_relative "appsec/extensions"
+require_relative "appsec/context"
+require_relative "appsec/ext"
+require_relative "appsec/utils"
 
 module Datadog
   # Namespace for Datadog AppSec instrumentation
   module AppSec
     class << self
       def enabled?
-        Datadog.configuration.appsec.enabled
+        !!components.appsec
       end
 
-      def active_scope
-        Datadog::AppSec::Scope.active_scope
+      def rasp_enabled?
+        # TODO this should take rasp_enabled flag from the settings in
+        # the appsec component rather than reading global configuration.
+        enabled? && Datadog.configuration.appsec.rasp_enabled
       end
 
-      def processor
-        appsec_component = components.appsec
-
-        appsec_component.processor if appsec_component
+      def active_context
+        Datadog::AppSec::Context.active
       end
 
-      def reconfigure(ruleset:, telemetry:)
-        appsec_component = components.appsec
-
-        return unless appsec_component
-
-        appsec_component.reconfigure(ruleset: ruleset, telemetry: telemetry)
+      def telemetry
+        components.telemetry
       end
 
-      def reconfigure_lock(&block)
-        appsec_component = components.appsec
+      def security_engine
+        components.appsec&.security_engine
+      end
 
-        return unless appsec_component
+      def reconfigure!
+        components.appsec&.reconfigure!
+      end
 
-        appsec_component.reconfigure_lock(&block)
+      def perform_api_security_check?
+        Datadog.configuration.appsec.api_security.enabled &&
+          Datadog.configuration.appsec.api_security.sample_rate.sample?
       end
 
       private
@@ -53,11 +54,15 @@ module Datadog
 end
 
 # Integrations
-require_relative 'appsec/contrib/rack/integration'
-require_relative 'appsec/contrib/sinatra/integration'
-require_relative 'appsec/contrib/rails/integration'
-require_relative 'appsec/contrib/active_record/integration'
-require_relative 'appsec/contrib/devise/integration'
-require_relative 'appsec/contrib/graphql/integration'
-
-require_relative 'appsec/autoload'
+require_relative "appsec/contrib/rack/integration"
+require_relative "appsec/contrib/sinatra/integration"
+require_relative "appsec/contrib/rails/integration"
+require_relative "appsec/contrib/active_record/integration"
+require_relative "appsec/contrib/devise/integration"
+require_relative "appsec/contrib/graphql/integration"
+require_relative "appsec/contrib/faraday/integration"
+require_relative "appsec/contrib/excon/integration"
+require_relative "appsec/contrib/rest_client/integration"
+require_relative "appsec/contrib/aws_lambda/integration"
+
+require_relative "appsec/autoload"

data/lib/datadog/auto_instrument.rb

@@ -3,8 +3,11 @@
 # Entrypoint file for auto instrumentation.
 #
 # This file's path is part of the @public_api.
-require_relative '../datadog'
-require_relative 'tracing/contrib/auto_instrument'
+require_relative "../datadog"
+require_relative "tracing/contrib/auto_instrument"
+
+# DI is not loaded on Ruby 2.5 and JRuby
+Datadog::DI::Contrib.load_now_or_later if defined?(Datadog::DI::Contrib)
 
 Datadog::Profiling.start_if_enabled
 

data/lib/datadog/auto_instrument_base.rb

@@ -3,6 +3,7 @@
 module Datadog
   # base methods stubbed for adding auto instrument extensions
   module AutoInstrumentBase
-    def add_auto_instrument; end
+    def add_auto_instrument
+    end
   end
 end

data/lib/datadog/core/buffer/cruby.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'random'
+require_relative "random"
 
 module Datadog
   module Core

data/lib/datadog/core/buffer/random.rb

@@ -40,7 +40,23 @@ module Datadog
           add_all!(underflow) unless underflow.nil?
 
           # Iteratively replace items, to ensure pseudo-random replacement.
-          overflow.each { |item| replace!(item) } unless overflow.nil?
+          overflow&.each { |item| replace!(item) }
+        end
+
+        def unshift(*items)
+          # TODO The existing concat implementation does not always append
+          # to the end of the buffer - if the buffer is full, a random
+          # item is deleted and the new item is added in the position of
+          # removed item.
+          # Therefore, if we want to preserve the item order, concat
+          # would also need to be changed to maintain order.
+          # With the existing implementation, the idea is to not move
+          # existing items around, which is what sets unshift apart from
+          # concat to begin with.
+          #
+          # Since this method currently delegates to +concat+, it does not
+          # have a matching definition in the thread-safe worker.
+          concat(items)
         end
 
         # Stored items are returned and the local buffer is reset.
@@ -78,7 +94,7 @@ module Datadog
           underflow = nil
           overflow = nil
 
-          overflow_size = @max_size > 0 ? (@items.length + items.length) - @max_size : 0
+          overflow_size = (@max_size > 0) ? (@items.length + items.length) - @max_size : 0
 
           if overflow_size > 0
             # Items will overflow

data/lib/datadog/core/buffer/thread_safe.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require_relative 'random'
+require_relative "random"
 
 module Datadog
   module Core

data/lib/datadog/core/configuration/agent_settings.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require_relative "ext"
+
+module Datadog
+  module Core
+    module Configuration
+      # Immutable container for the resulting settings
+      class AgentSettings
+        # IPv6 regular expression from
+        # https://stackoverflow.com/questions/53497/regular-expression-that-matches-valid-ipv6-addresses
+        # Does not match IPv4 addresses.
+        IPV6_REGEXP = /\A(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\z)/.freeze # rubocop:disable Layout/LineLength
+
+        attr_reader :adapter, :ssl, :hostname, :port, :uds_path, :timeout_seconds
+
+        def initialize(adapter: nil, ssl: nil, hostname: nil, port: nil, uds_path: nil, timeout_seconds: nil)
+          @adapter = adapter
+          @ssl = ssl
+          @hostname = hostname
+          @port = port
+          @uds_path = uds_path
+          @timeout_seconds = timeout_seconds
+          freeze
+        end
+
+        def url
+          case adapter
+          when Datadog::Core::Configuration::Ext::Agent::HTTP::ADAPTER
+            hostname = self.hostname
+            hostname = "[#{hostname}]" if IPV6_REGEXP.match?(hostname)
+            "#{ssl ? "https" : "http"}://#{hostname}:#{port}/"
+          when Datadog::Core::Configuration::Ext::Agent::UnixSocket::ADAPTER
+            "unix://#{uds_path}"
+          else
+            raise ArgumentError, "Unexpected adapter: #{adapter}"
+          end
+        end
+
+        def ==(other)
+          self.class == other.class &&
+            adapter == other.adapter &&
+            ssl == other.ssl &&
+            hostname == other.hostname &&
+            port == other.port &&
+            uds_path == other.uds_path &&
+            timeout_seconds == other.timeout_seconds
+        end
+      end
+    end
+  end
+end

data/lib/datadog/core/configuration/agent_settings_resolver.rb

@@ -1,10 +1,11 @@
 # frozen_string_literal: true
 
-require 'uri'
+require "uri"
 
-require_relative 'settings'
-require_relative 'ext'
-require_relative '../transport/ext'
+require_relative "settings"
+require_relative "ext"
+require_relative "agent_settings"
+require_relative "../transport/ext"
 
 module Datadog
   module Core
@@ -19,21 +20,6 @@ module Datadog
       # Whenever there is a conflict (different configurations are provided in different orders), it MUST warn the users
       # about it and pick a value based on the following priority: code > environment variable > defaults.
       class AgentSettingsResolver
-        AgentSettings = Struct.new(
-          :adapter,
-          :ssl,
-          :hostname,
-          :port,
-          :uds_path,
-          :timeout_seconds,
-          keyword_init: true
-        ) do
-          def initialize(*)
-            super
-            freeze
-          end
-        end
-
         def self.call(settings, logger: Datadog.logger)
           new(settings, logger: logger).send(:call)
         end
@@ -82,7 +68,7 @@ module Datadog
             ),
             DetectedConfiguration.new(
               friendly_name: "#{Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_HOST} environment variable",
-              value: ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_HOST]
+              value: DATADOG_ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_HOST]
             )
           )
         end
@@ -101,7 +87,7 @@ module Datadog
             ),
             try_parsing_as_integer(
               friendly_name: "#{Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_PORT} environment variable",
-              value: ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_PORT],
+              value: DATADOG_ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_PORT],
             )
           )
         end
@@ -130,9 +116,9 @@ module Datadog
               value: settings.agent.timeout_seconds,
             ),
             try_parsing_as_integer(
-              friendly_name: "#{Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_TIMEOUT_SECONDS} "\
-                'environment variable',
-              value: ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_TIMEOUT_SECONDS],
+              friendly_name: "#{Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_TIMEOUT_SECONDS} " \
+                "environment variable",
+              value: DATADOG_ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_TIMEOUT_SECONDS],
             )
           )
         end
@@ -155,7 +141,7 @@ module Datadog
         def parsed_url_ssl?
           return nil if parsed_url.nil?
 
-          parsed_url.scheme == 'https'
+          parsed_url.scheme == "https"
         end
 
         def try_parsing_as_integer(value:, friendly_name:)
@@ -203,10 +189,10 @@ module Datadog
           path = parsed_url.to_s
           # Some versions of the built-in uri gem leave the original url untouched, and others remove the //, so this
           # supports both
-          if path.start_with?('unix://')
-            path.sub('unix://', '')
+          if path.start_with?("unix://")
+            path.sub("unix://", "")
           else
-            path.sub('unix:', '')
+            path.sub("unix:", "")
           end
         end
 
@@ -246,11 +232,11 @@ module Datadog
             warn_if_configuration_mismatch(
               [
                 DetectedConfiguration.new(
-                  friendly_name: 'configuration for unix domain socket',
+                  friendly_name: "configuration for unix domain socket",
                   value: parsed_url.to_s,
                 ),
                 DetectedConfiguration.new(
-                  friendly_name: 'configuration of hostname/port for http/https use',
+                  friendly_name: "configuration of hostname/port for http/https use",
                   value: "hostname: '#{hostname}', port: '#{port}'",
                 ),
               ]
@@ -270,7 +256,7 @@ module Datadog
         def parsed_url
           return @parsed_url if defined?(@parsed_url)
 
-          unparsed_url_from_env = ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_URL]
+          unparsed_url_from_env = DATADOG_ENV[Datadog::Core::Configuration::Ext::Agent::ENV_DEFAULT_URL]
 
           @parsed_url =
             if unparsed_url_from_env
@@ -308,19 +294,19 @@ module Datadog
           return unless detected_configurations_in_priority_order.map(&:value).uniq.size > 1
 
           log_warning(
-            'Configuration mismatch: values differ between ' \
+            "Configuration mismatch: values differ between " \
             "#{detected_configurations_in_priority_order
-              .map { |config| "#{config.friendly_name} (#{config.value.inspect})" }.join(' and ')}" \
+              .map { |config| "#{config.friendly_name} (#{config.value.inspect})" }.join(" and ")}" \
             ". Using #{detected_configurations_in_priority_order.first.value.inspect} and ignoring other configuration."
           )
         end
 
         def log_warning(message)
-          logger.warn(message) if logger
+          logger&.warn(message)
         end
 
         def http_scheme?(uri)
-          ['http', 'https'].include?(uri.scheme)
+          ["http", "https"].include?(uri.scheme)
         end
 
         # Expected to return nil (not false!) when it's not http
@@ -329,7 +315,7 @@ module Datadog
         end
 
         def unix_scheme?(uri)
-          uri.scheme == 'unix'
+          uri.scheme == "unix"
         end
 
         # Represents a given configuration value and where we got it from