ddtrace 0.54.0 → 1.1.0

data/lib/datadog/appsec/contrib/rack/patcher.rb

@@ -0,0 +1,32 @@
+# typed: ignore
+
+require 'datadog/appsec/contrib/patcher'
+require 'datadog/appsec/contrib/rack/gateway/watcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Patcher for Rack integration
+        module Patcher
+          include Datadog::AppSec::Contrib::Patcher
+
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched) # TODO: Patcher.flag_patched
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Gateway::Watcher.watch
+            Patcher.instance_variable_set(:@patched, true)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/reactive/request.rb

@@ -0,0 +1,87 @@
+# typed: true
+
+require 'datadog/appsec/contrib/rack/request'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Reactive
+          # Dispatch data from a Rack request to the WAF context
+          module Request
+            def self.publish(op, request)
+              catch(:block) do
+                op.publish('request.query', Rack::Request.query(request))
+                op.publish('request.headers', Rack::Request.headers(request))
+                op.publish('request.uri.raw', Rack::Request.url(request))
+                op.publish('request.cookies', Rack::Request.cookies(request))
+                # op.publish('request.body.raw', Rack::Request.body(request))
+                # TODO: op.publish('request.path_params', { k: v }) # route params only?
+                # TODO: op.publish('request.path', request.script_name + request.path) # unused for now
+
+                nil
+              end
+            end
+
+            # rubocop:disable Metrics/MethodLength
+            def self.subscribe(op, waf_context)
+              addresses = [
+                'request.headers',
+                'request.uri.raw',
+                'request.query',
+                'request.cookies',
+                # 'request.body.raw',
+                # TODO: 'request.path_params',
+              ]
+
+              op.subscribe(*addresses) do |*values|
+                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+                headers = values[0]
+                headers_no_cookies = headers.dup.tap { |h| h.delete('cookie') }
+                uri_raw = values[1]
+                query = values[2]
+                cookies = values[3]
+                # body = values[4]
+
+                waf_args = {
+                  'server.request.cookies' => cookies,
+                  # 'server.request.body.raw' => body,
+                  'server.request.query' => query,
+                  'server.request.uri.raw' => uri_raw,
+                  'server.request.headers' => headers,
+                  'server.request.headers.no_cookies' => headers_no_cookies,
+                  # TODO: 'server.request.path_params' => path_params,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                action, result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                # TODO: encapsulate return array in a type
+                case action
+                when :monitor
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+                  yield [action, result, false]
+                when :block
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+                  yield [action, result, true]
+                  throw(:block, [action, result, true])
+                when :good
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{action.inspect} #{result.inspect}" }
+                end
+              end
+            end
+            # rubocop:enable Metrics/MethodLength
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/reactive/request_body.rb

@@ -0,0 +1,64 @@
+# typed: true
+
+require 'datadog/appsec/contrib/rack/request'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Reactive
+          # Dispatch data from a Rack request to the WAF context
+          module RequestBody
+            def self.publish(op, request)
+              catch(:block) do
+                # params have been parsed from the request body
+                op.publish('request.body', Rack::Request.form_hash(request))
+
+                nil
+              end
+            end
+
+            def self.subscribe(op, waf_context)
+              addresses = [
+                'request.body',
+              ]
+
+              op.subscribe(*addresses) do |*values|
+                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+                body = values[0]
+
+                waf_args = {
+                  'server.request.body' => body,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                action, result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                # TODO: encapsulate return array in a type
+                case action
+                when :monitor
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+                  yield [action, result, false]
+                when :block
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+                  yield [action, result, true]
+                  throw(:block, [action, result, true])
+                when :good
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{action.inspect} #{result.inspect}" }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/reactive/response.rb

@@ -0,0 +1,64 @@
+# typed: true
+
+require 'datadog/appsec/contrib/rack/response'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Reactive
+          # Dispatch data from a Rack response to the WAF context
+          module Response
+            def self.publish(op, response)
+              catch(:block) do
+                op.publish('response.status', Rack::Response.status(response))
+
+                nil
+              end
+            end
+
+            def self.subscribe(op, waf_context)
+              addresses = [
+                'response.status',
+              ]
+
+              op.subscribe(*addresses) do |*values|
+                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+
+                response_status = values[0]
+
+                waf_args = {
+                  'server.response.status' => response_status.to_s,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                action, result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                # TODO: encapsulate return array in a type
+                case action
+                when :monitor
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+                  yield [action, result, false]
+                when :block
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+                  yield [action, result, true]
+                  throw(:block, [action, result, true])
+                when :good
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{action.inspect} #{result.inspect}" }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/request.rb

@@ -0,0 +1,58 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Normalized extration of data from Rack::Request
+        module Request
+          def self.query(request)
+            # Downstream libddwaf expects keys and values to be extractable
+            # separately so we can't use [[k, v], ...]. We also want to allow
+            # duplicate keys, so we use [{k, v}, ...] instead.
+            request.query_string.split('&').map do |e|
+              k, v = e.split('=').map { |s| CGI.unescape(s) }
+
+              { k => v }
+            end
+          end
+
+          # Rack < 2.0 does not have :each_header
+          # TODO: We need access to Rack here. We must make sure we are able to load AppSec without Rack,
+          # TODO: while still ensure correctness in ths code path.
+          if defined?(::Rack) && ::Rack::Request.instance_methods.include?(:each_header)
+            def self.headers(request)
+              request.each_header.each_with_object({}) do |(k, v), h|
+                h[k.gsub(/^HTTP_/, '').downcase.tr('_', '-')] = v if k =~ /^HTTP_/
+              end
+            end
+          else
+            def self.headers(request)
+              request.env.each_with_object({}) do |(k, v), h|
+                h[k.gsub(/^HTTP_/, '').downcase.tr('_', '-')] = v if k =~ /^HTTP_/
+              end
+            end
+          end
+
+          def self.body(request)
+            request.body.read.tap { request.body.rewind }
+          end
+
+          def self.url(request)
+            request.url
+          end
+
+          def self.cookies(request)
+            request.cookies
+          end
+
+          def self.form_hash(request)
+            # usually Hash<String,String> but can be a more complex
+            # Hash<String,String||Array||Hash> when e.g coming from JSON
+            request.env['rack.request.form_hash']
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -0,0 +1,41 @@
+# typed: ignore
+
+require 'datadog/appsec/instrumentation/gateway'
+require 'datadog/appsec/assets'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Rack request body middleware for AppSec
+        # This should be inserted just below Rack::JSONBodyParser or
+        # legacy Rack::PostBodyContentTypeParser from rack-contrib
+        class RequestBodyMiddleware
+          def initialize(app, opt = {})
+            @app = app
+          end
+
+          def call(env)
+            context = env['datadog.waf.context']
+
+            return @app.call(env) unless context
+
+            # TODO: handle exceptions, except for @app.call
+
+            request = ::Rack::Request.new(env)
+
+            request_return, request_response = Instrumentation.gateway.push('rack.request.body', request) do
+              @app.call(env)
+            end
+
+            if request_response && request_response.any? { |action, _event| action == :block }
+              request_return = [403, { 'Content-Type' => 'text/html' }, [Datadog::AppSec::Assets.blocked]]
+            end
+
+            request_return
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -0,0 +1,112 @@
+# typed: ignore
+
+require 'json'
+
+require 'datadog/appsec/instrumentation/gateway'
+require 'datadog/appsec/processor'
+require 'datadog/appsec/assets'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Topmost Rack middleware for AppSec
+        # This should be inserted just below Datadog::Tracing::Contrib::Rack::TraceMiddleware
+        class RequestMiddleware
+          def initialize(app, opt = {})
+            @app = app
+
+            @oneshot_tags_sent = false
+            @processor = Datadog::AppSec::Processor.new
+          end
+
+          def call(env)
+            return @app.call(env) unless @processor.ready?
+
+            # TODO: handle exceptions, except for @app.call
+
+            context = @processor.new_context
+
+            env['datadog.waf.context'] = context
+            request = ::Rack::Request.new(env)
+
+            add_appsec_tags
+
+            request_return, request_response = Instrumentation.gateway.push('rack.request', request) do
+              @app.call(env)
+            end
+
+            if request_response && request_response.any? { |action, _event| action == :block }
+              request_return = [403, { 'Content-Type' => 'text/html' }, [Datadog::AppSec::Assets.blocked]]
+            end
+
+            response = ::Rack::Response.new(request_return[2], request_return[0], request_return[1])
+            response.instance_eval do
+              @waf_context = context
+            end
+
+            _response_return, _response_response = Instrumentation.gateway.push('rack.response', response)
+
+            context.events.each do |e|
+              e[:response] ||= response
+              e[:request]  ||= request
+            end
+
+            AppSec::Event.record(*context.events)
+
+            request_return
+          ensure
+            add_waf_runtime_tags(context) if context
+          end
+
+          private
+
+          def active_trace
+            # TODO: factor out tracing availability detection
+
+            return unless defined?(Datadog::Tracing)
+
+            Datadog::Tracing.active_trace
+          end
+
+          def add_appsec_tags
+            return unless active_trace
+
+            active_trace.set_tag('_dd.appsec.enabled', 1)
+            active_trace.set_tag('_dd.runtime_family', 'ruby')
+            active_trace.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
+
+            if @processor.ruleset_info
+              active_trace.set_tag('_dd.appsec.event_rules.version', @processor.ruleset_info[:version])
+
+              unless @oneshot_tags_sent
+                # Small race condition, but it's inoccuous: worst case the tags
+                # are sent a couple of times more than expected
+                @oneshot_tags_sent = true
+
+                active_trace.set_tag('_dd.appsec.event_rules.loaded', @processor.ruleset_info[:loaded].to_f)
+                active_trace.set_tag('_dd.appsec.event_rules.error_count', @processor.ruleset_info[:failed].to_f)
+                active_trace.set_tag('_dd.appsec.event_rules.errors', JSON.dump(@processor.ruleset_info[:errors]))
+                active_trace.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(@processor.addresses))
+
+                # Ensure these tags reach the backend
+                active_trace.keep!
+              end
+            end
+          end
+
+          def add_waf_runtime_tags(context)
+            return unless active_trace
+            return unless context
+
+            active_trace.set_tag('_dd.appsec.waf.timeouts', context.timeouts)
+
+            # these tags expect time in us
+            active_trace.set_tag('_dd.appsec.waf.duration', context.time_ns / 1000.0)
+            active_trace.set_tag('_dd.appsec.waf.duration_ext', context.time_ext_ns / 1000.0)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/response.rb

@@ -0,0 +1,24 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Normalized extration of data from Rack::Response
+        module Response
+          def self.headers(response)
+            response.headers.each_with_object({}) { |(k, v), h| h[k.downcase] = v }
+          end
+
+          def self.cookies(response)
+            response.cookies
+          end
+
+          def self.status(response)
+            response.status
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/configuration/settings.rb

@@ -0,0 +1,22 @@
+# typed: false
+
+require 'datadog/appsec/contrib/configuration/settings'
+require 'datadog/appsec/contrib/rails/ext'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Configuration
+          # Custom settings for the Rack integration
+          class Settings < Datadog::AppSec::Contrib::Configuration::Settings
+            option :enabled do |o|
+              o.default { env_to_bool(Ext::ENV_ENABLED, true) }
+              o.lazy
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/ext.rb

@@ -0,0 +1,15 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Rack integration constants
+        module Ext
+          APP = 'rails'.freeze
+          ENV_ENABLED = 'DD_TRACE_RAILS_ENABLED'.freeze
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/framework.rb

@@ -0,0 +1,30 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Rails specific framework tie
+        module Framework
+          def self.setup
+            Datadog::AppSec.configure do |datadog_config|
+              rails_config = config_with_defaults(datadog_config)
+              activate_rack!(datadog_config, rails_config)
+            end
+          end
+
+          def self.config_with_defaults(datadog_config)
+            datadog_config[:rails]
+          end
+
+          # Apply relevant configuration from Sinatra to Rack
+          def self.activate_rack!(datadog_config, sinatra_config)
+            datadog_config.instrument(
+              :rack,
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -0,0 +1,81 @@
+# typed: false
+
+require 'datadog/appsec/instrumentation/gateway'
+require 'datadog/appsec/reactive/operation'
+require 'datadog/appsec/contrib/rails/reactive/action'
+require 'datadog/appsec/event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Gateway
+          # Watcher for Rails gateway events
+          module Watcher
+            def self.watch
+              Instrumentation.gateway.watch('rails.request.action') do |stack, request|
+                block = false
+                event = nil
+                waf_context = request.env['datadog.waf.context']
+
+                AppSec::Reactive::Operation.new('rails.request.action') do |op|
+                  trace = active_trace
+                  span = active_span
+
+                  Rails::Reactive::Action.subscribe(op, waf_context) do |action, result, _block|
+                    record = [:block, :monitor].include?(action)
+                    if record
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: trace,
+                        span: span,
+                        request: request,
+                        action: action
+                      }
+
+                      waf_context.events << event
+                    end
+                  end
+
+                  _action, _result, block = Rails::Reactive::Action.publish(op, request)
+                end
+
+                next [nil, [[:block, event]]] if block
+
+                ret, res = stack.call(request)
+
+                if event
+                  res ||= []
+                  res << [:monitor, event]
+                end
+
+                [ret, res]
+              end
+            end
+
+            class << self
+              private
+
+              def active_trace
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_trace
+              end
+
+              def active_span
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_span
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/integration.rb

@@ -0,0 +1,48 @@
+# typed: ignore
+
+require 'datadog/appsec/contrib/integration'
+
+require 'datadog/appsec/contrib/rails/configuration/settings'
+require 'datadog/appsec/contrib/rails/patcher'
+require 'datadog/appsec/contrib/rails/request_middleware'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Description of Rails integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('3.2.0')
+
+          register_as :rails, auto_patch: false
+
+          def self.version
+            Gem.loaded_specs['rails'] && Gem.loaded_specs['rails'].version
+          end
+
+          def self.loaded?
+            !defined?(::Rails).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            true
+          end
+
+          def default_configuration
+            Configuration::Settings.new
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end