ddtrace 0.53.0 → 1.9.0

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -0,0 +1,151 @@
+# typed: ignore
+
+require_relative '../../../tracing/contrib/rack/middlewares'
+
+require_relative '../patcher'
+require_relative '../../response'
+require_relative '../rack/request_middleware'
+require_relative 'framework'
+require_relative 'gateway/watcher'
+require_relative '../../../tracing/contrib/sinatra/framework'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        # Set tracer configuration at a late enough time
+        module AppSecSetupPatch
+          def setup_middleware(*args, &block)
+            super.tap do
+              Datadog::AppSec::Contrib::Sinatra::Framework.setup
+            end
+          end
+        end
+
+        # Hook into builder before the middleware list gets frozen
+        module DefaultMiddlewarePatch
+          def setup_middleware(*args, &block)
+            builder = args.first
+
+            super.tap do
+              tracing_sinatra_framework = Datadog::Tracing::Contrib::Sinatra::Framework
+              tracing_middleware = Datadog::Tracing::Contrib::Rack::TraceMiddleware
+
+              if tracing_sinatra_framework.include_middleware?(tracing_middleware, builder)
+                tracing_sinatra_framework.add_middleware_after(
+                  tracing_middleware,
+                  Datadog::AppSec::Contrib::Rack::RequestMiddleware,
+                  builder
+                )
+              else
+                tracing_sinatra_framework.add_middleware(Datadog::AppSec::Contrib::Rack::RequestMiddleware, builder)
+              end
+
+              tracing_sinatra_framework.inspect_middlewares(builder)
+            end
+          end
+        end
+
+        # Hook into Base#dispatch!, which encompasses route filters
+        module DispatchPatch
+          def dispatch!
+            env = @request.env
+
+            context = env['datadog.waf.context']
+
+            return super unless context
+
+            # TODO: handle exceptions, except for super
+
+            request_return, request_response = Instrumentation.gateway.push('sinatra.request.dispatch', request) do
+              # handle process_route interruption
+              catch(Ext::ROUTE_INTERRUPT) { super }
+            end
+
+            if request_response && request_response.any? { |action, _event| action == :block }
+              self.response = AppSec::Response.negotiate(env).to_sinatra_response
+              request_return = nil
+            end
+
+            request_return
+          end
+        end
+
+        # Hook into Base#route_eval, which
+        # path params are returned by pattern.params in process_route, then
+        # merged with normal params, so we get both
+        module RoutePatch
+          def process_route(*)
+            env = @request.env
+
+            context = env['datadog.waf.context']
+
+            return super unless context
+
+            # process_route is called repeatedly until a route is found.
+            # Until then, params has no route params.
+            # Capture normal params.
+            base_params = params
+
+            super do |*args|
+              # This block is called only once the route is found.
+              # At this point params has both route params and normal params.
+              route_params = params.each.with_object({}) { |(k, v), h| h[k] = v unless base_params.key?(k) }
+
+              _, request_response = Instrumentation.gateway.push('sinatra.request.routed', [request, route_params])
+
+              if request_response && request_response.any? { |action, _event| action == :block }
+                self.response = AppSec::Response.negotiate(env).to_sinatra_response
+
+                # interrupt request and return response to dispatch! for consistency
+                throw(Ext::ROUTE_INTERRUPT, response)
+              end
+
+              yield(*args)
+            end
+          end
+        end
+
+        # Patcher for AppSec on Sinatra
+        module Patcher
+          include Datadog::AppSec::Contrib::Patcher
+
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Gateway::Watcher.watch
+            patch_default_middlewares
+            patch_dispatch
+            patch_route
+            setup_security
+            Patcher.instance_variable_set(:@patched, true)
+          end
+
+          def setup_security
+            ::Sinatra::Base.singleton_class.prepend(AppSecSetupPatch)
+          end
+
+          def patch_default_middlewares
+            ::Sinatra::Base.singleton_class.prepend(DefaultMiddlewarePatch)
+          end
+
+          def patch_dispatch
+            ::Sinatra::Base.prepend(DispatchPatch)
+          end
+
+          def patch_route
+            ::Sinatra::Base.prepend(RoutePatch)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb

@@ -0,0 +1,63 @@
+# typed: ignore
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Reactive
+          # Dispatch data from a Rack request to the WAF context
+          module Routed
+            def self.publish(op, data)
+              _request, route_params = data
+
+              catch(:block) do
+                op.publish('sinatra.request.route_params', route_params)
+
+                nil
+              end
+            end
+
+            def self.subscribe(op, waf_context)
+              addresses = [
+                'sinatra.request.route_params',
+              ]
+
+              op.subscribe(*addresses) do |*values|
+                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+                path_params = values[0]
+
+                waf_args = {
+                  'server.request.path_params' => path_params,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                case result.status
+                when :match
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/request_middleware.rb

@@ -0,0 +1,20 @@
+# typed: ignore
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        # Rack middleware for AppSec on Sinatra
+        class RequestMiddleware
+          def initialize(app, opt = {})
+            @app = app
+          end
+
+          def call(env)
+            @app.call(env)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/event.rb

@@ -0,0 +1,117 @@
+# typed: ignore
+
+require 'json'
+
+require_relative 'contrib/rack/request'
+require_relative 'contrib/rack/response'
+require_relative 'rate_limiter'
+
+module Datadog
+  module AppSec
+    # AppSec event
+    module Event
+      ALLOWED_REQUEST_HEADERS = %w[
+        X-Forwarded-For
+        X-Client-IP
+        X-Real-IP
+        X-Forwarded
+        X-Cluster-Client-IP
+        Forwarded-For
+        Forwarded
+        Via
+        True-Client-IP
+        Content-Length
+        Content-Type
+        Content-Encoding
+        Content-Language
+        Host
+        User-Agent
+        Accept
+        Accept-Encoding
+        Accept-Language
+      ].map!(&:downcase).freeze
+
+      ALLOWED_RESPONSE_HEADERS = %w[
+        Content-Length
+        Content-Type
+        Content-Encoding
+        Content-Language
+      ].map!(&:downcase).freeze
+
+      # Record events for a trace
+      #
+      # This is expected to be called only once per trace for the rate limiter
+      # to properly apply
+      def self.record(*events)
+        # ensure rate limiter is called only when there are events to record
+        return if events.empty?
+
+        Datadog::AppSec::RateLimiter.limit(:traces) do
+          record_via_span(*events)
+        end
+      end
+
+      # rubocop:disable Metrics/MethodLength
+      def self.record_via_span(*events) # rubocop:disable Metrics/AbcSize
+        events.group_by { |e| e[:trace] }.each do |trace, event_group|
+          unless trace
+            Datadog.logger.debug { "{ error: 'no trace: cannot record', event_group: #{event_group.inspect}}" }
+            next
+          end
+
+          trace.keep!
+          trace.set_tag(
+            Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+            Datadog::Tracing::Sampling::Ext::Decision::ASM
+          )
+
+          # prepare and gather tags to apply
+          trace_tags = event_group.each_with_object({}) do |event, tags|
+            # TODO: assume HTTP request context for now
+
+            if (request = event[:request])
+              request_headers = AppSec::Contrib::Rack::Request.headers(request).select do |k, _|
+                ALLOWED_REQUEST_HEADERS.include?(k.downcase)
+              end
+
+              request_headers.each do |header, value|
+                tags["http.request.headers.#{header}"] = value
+              end
+
+              tags['http.host'] = request.host
+              tags['http.useragent'] = request.user_agent
+              tags['network.client.ip'] = request.env['REMOTE_ADDR'] if request.env['REMOTE_ADDR']
+            end
+
+            if (response = event[:response])
+              response_headers = AppSec::Contrib::Rack::Response.headers(response).select do |k, _|
+                ALLOWED_RESPONSE_HEADERS.include?(k.downcase)
+              end
+
+              response_headers.each do |header, value|
+                tags["http.response.headers.#{header}"] = value
+              end
+            end
+
+            tags['_dd.origin'] = 'appsec'
+
+            # accumulate triggers
+            tags['_dd.appsec.triggers'] ||= []
+            tags['_dd.appsec.triggers'] += event[:waf_result].data
+          end
+
+          # apply tags to root span
+
+          # complex types are unsupported, we need to serialize to a string
+          triggers = trace_tags.delete('_dd.appsec.triggers')
+          trace.set_tag('_dd.appsec.json', JSON.dump({ triggers: triggers }))
+
+          trace_tags.each do |key, value|
+            trace.set_tag(key, value)
+          end
+        end
+      end
+      # rubocop:enable Metrics/MethodLength
+    end
+  end
+end

data/lib/datadog/appsec/extensions.rb

@@ -0,0 +1,138 @@
+# typed: ignore
+
+require_relative 'configuration'
+
+module Datadog
+  module AppSec
+    # Extends Datadog tracing with AppSec features
+    module Extensions
+      # Inject AppSec into global objects.
+      def self.activate!
+        Core::Configuration::Settings.include(Settings)
+      end
+
+      # Global Datadog configuration mixin
+      module Settings
+        # Exposes AppSec settings through the
+        # `Datadog.configure {|c| c.appsec._option_ }`
+        # configuration path.
+        def appsec
+          @appsec ||= AppSecAdapter.new(AppSec.settings)
+        end
+      end
+
+      # Merges {Datadog::AppSec::Configuration::Settings} and {Datadog::AppSec::Configuration::DSL}
+      # into a single read/write object.
+      class AppSecAdapter
+        def initialize(settings)
+          @settings = settings
+        end
+
+        # Writer methods
+
+        def instrument(name, options = {})
+          dsl = AppSec::Configuration::DSL.new
+          dsl.instrument(name, options)
+          @settings.merge(dsl)
+        end
+
+        def enabled=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.enabled = arg
+          @settings.merge(dsl)
+        end
+
+        def ruleset=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.ruleset = arg
+          @settings.merge(dsl)
+        end
+
+        def ip_denylist=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.ip_denylist = arg
+          @settings.merge(dsl)
+        end
+
+        def waf_timeout=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.waf_timeout = arg
+          @settings.merge(dsl)
+        end
+
+        def waf_debug=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.waf_debug = arg
+          @settings.merge(dsl)
+        end
+
+        def trace_rate_limit=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.trace_rate_limit = arg
+          @settings.merge(dsl)
+        end
+
+        def obfuscator_key_regex=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.obfuscator_key_regex = arg
+          @settings.merge(dsl)
+        end
+
+        def obfuscator_value_regex=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.obfuscator_value_regex = arg
+          @settings.merge(dsl)
+        end
+
+        # Reader methods
+
+        def [](key)
+          @settings[key]
+        end
+
+        def enabled
+          @settings.enabled
+        end
+
+        def ruleset
+          @settings.ruleset
+        end
+
+        def ip_denylist
+          @settings.ip_denylist
+        end
+
+        def waf_timeout
+          @settings.waf_timeout
+        end
+
+        def waf_debug
+          @settings.waf_debug
+        end
+
+        def trace_rate_limit
+          @settings.trace_rate_limit
+        end
+
+        def obfuscator_key_regex
+          @settings.obfuscator_key_regex
+        end
+
+        def obfuscator_value_regex
+          @settings.obfuscator_key_regex
+        end
+
+        def merge(arg)
+          @settings.merge(arg)
+        end
+
+        private
+
+        # Restore to original state, for testing only.
+        def reset!
+          @settings.send(:reset!)
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/instrumentation/gateway.rb

@@ -0,0 +1,58 @@
+# typed: ignore
+
+module Datadog
+  module AppSec
+    # Instrumentation for AppSec
+    module Instrumentation
+      # Instrumentation gateway implementation
+      class Gateway
+        # Instrumentation gateway middleware
+        class Middleware
+          attr_reader :key, :block
+
+          def initialize(key, &block)
+            @key = key
+            @block = block
+          end
+
+          def call(stack, env)
+            @block.call(stack, env)
+          end
+        end
+
+        def initialize
+          @middlewares = Hash.new { |h, k| h[k] = [] }
+        end
+
+        def push(name, env, &block)
+          block ||= -> {}
+
+          middlewares = @middlewares[name]
+
+          return [block.call, nil] if middlewares.empty?
+
+          wrapped = lambda do |_env|
+            [block.call, nil]
+          end
+
+          # TODO: handle exceptions, except for wrapped
+          stack = middlewares.reverse.reduce(wrapped) do |next_, middleware|
+            lambda do |env_|
+              middleware.call(next_, env_)
+            end
+          end
+
+          stack.call(env)
+        end
+
+        def watch(name, key, &block)
+          @middlewares[name] << Middleware.new(key, &block) unless @middlewares[name].any? { |m| m.key == key }
+        end
+      end
+
+      def self.gateway
+        @gateway ||= Gateway.new # TODO: not thread safe
+      end
+    end
+  end
+end