ddtrace 0.54.0 → 1.1.0

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -0,0 +1,158 @@
+# typed: ignore
+
+require 'datadog/core/utils/only_once'
+
+require 'datadog/appsec/contrib/patcher'
+require 'datadog/appsec/contrib/rails/framework'
+require 'datadog/appsec/contrib/rack/request_middleware'
+require 'datadog/appsec/contrib/rack/request_body_middleware'
+require 'datadog/appsec/contrib/rails/gateway/watcher'
+
+require 'datadog/tracing/contrib/rack/middlewares'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Patcher for AppSec on Rails
+        module Patcher
+          include Datadog::AppSec::Contrib::Patcher
+
+          BEFORE_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+          AFTER_INITIALIZE_ONLY_ONCE_PER_APP = Hash.new { |h, key| h[key] = Datadog::Core::Utils::OnlyOnce.new }
+
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Gateway::Watcher.watch
+            patch_before_intialize
+            patch_after_intialize
+
+            Patcher.instance_variable_set(:@patched, true)
+          end
+
+          def patch_before_intialize
+            ::ActiveSupport.on_load(:before_initialize) do
+              Datadog::AppSec::Contrib::Rails::Patcher.before_intialize(self)
+            end
+          end
+
+          def before_intialize(app)
+            BEFORE_INITIALIZE_ONLY_ONCE_PER_APP[app].run do
+              # Middleware must be added before the application is initialized.
+              # Otherwise the middleware stack will be frozen.
+              # Sometimes we don't want to activate middleware e.g. OpenTracing, etc.
+              add_middleware(app) if Datadog.configuration.tracing[:rails][:middleware]
+              patch_process_action
+            end
+          end
+
+          def add_middleware(app)
+            # Add trace middleware
+            if include_middleware?(Datadog::Tracing::Contrib::Rack::TraceMiddleware, app)
+              app.middleware.insert_after(Datadog::Tracing::Contrib::Rack::TraceMiddleware,
+                                          Datadog::AppSec::Contrib::Rack::RequestMiddleware)
+            else
+              app.middleware.insert_before(0, Datadog::AppSec::Contrib::Rack::RequestMiddleware)
+            end
+          end
+
+          # Hook into ActionController::Instrumentation#process_action, which encompasses action filters
+          module ProcessActionPatch
+            def process_action(*args)
+              env = request.env
+
+              context = env['datadog.waf.context']
+
+              return super unless context
+
+              # TODO: handle exceptions, except for super
+
+              request_return, request_response = Instrumentation.gateway.push('rails.request.action', request) do
+                super
+              end
+
+              if request_response && request_response.any? { |action, _event| action == :block }
+                @_response = ::ActionDispatch::Response.new(403,
+                                                            { 'Content-Type' => 'text/html' },
+                                                            [Datadog::AppSec::Assets.blocked])
+                request_return = @_response.body
+              end
+
+              request_return
+            end
+          end
+
+          def patch_process_action
+            ActionController::Instrumentation.prepend(ProcessActionPatch)
+          end
+
+          def include_middleware?(middleware, app)
+            found = false
+
+            # find tracer middleware reference in Rails::Configuration::MiddlewareStackProxy
+            app.middleware.instance_variable_get(:@operations).each do |operation|
+              args = case operation
+                     when Array
+                       # rails 5.2
+                       _op, args = operation
+                       args
+                     when Proc
+                       if operation.binding.local_variables.include?(:args)
+                         # rails 6.0, 6.1
+                         operation.binding.local_variable_get(:args)
+                       else
+                         # rails 7.0 uses ... to pass args
+                         args_getter = Class.new do
+                           def method_missing(_op, *args) # rubocop:disable Style/MissingRespondToMissing
+                             args
+                           end
+                         end.new
+                         operation.call(args_getter)
+                       end
+                     else
+                       # unknown, pass through
+                       []
+                     end
+
+              found = true if args.include?(middleware)
+            end
+
+            found
+          end
+
+          def inspect_middlewares(app)
+            Datadog.logger.debug { 'Rails middlewares: ' << app.middleware.map(&:inspect).inspect }
+          end
+
+          def patch_after_intialize
+            ::ActiveSupport.on_load(:after_initialize) do
+              Datadog::AppSec::Contrib::Rails::Patcher.after_intialize(self)
+            end
+          end
+
+          def after_intialize(app)
+            AFTER_INITIALIZE_ONLY_ONCE_PER_APP[app].run do
+              # Finish configuring the tracer after the application is initialized.
+              # We need to wait for some things, like application name, middleware stack, etc.
+              setup_security
+              inspect_middlewares(app)
+            end
+          end
+
+          def setup_security
+            Datadog::AppSec::Contrib::Rails::Framework.setup
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/reactive/action.rb

@@ -0,0 +1,68 @@
+# typed: true
+
+require 'datadog/appsec/contrib/rails/request'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Reactive
+          # Dispatch data from a Rails request to the WAF context
+          module Action
+            def self.publish(op, request)
+              catch(:block) do
+                # params have been parsed from the request body
+                op.publish('rails.request.body', Rails::Request.parsed_body(request))
+                op.publish('rails.request.route_params', Rails::Request.route_params(request))
+
+                nil
+              end
+            end
+
+            def self.subscribe(op, waf_context)
+              addresses = [
+                'rails.request.body',
+                'rails.request.route_params',
+              ]
+
+              op.subscribe(*addresses) do |*values|
+                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+                body = values[0]
+                path_params = values[1]
+
+                waf_args = {
+                  'server.request.body' => body,
+                  'server.request.path_params' => path_params,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                action, result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                # TODO: encapsulate return array in a type
+                case action
+                when :monitor
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+                  yield [action, result, false]
+                when :block
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+                  yield [action, result, true]
+                  throw(:block, [action, result, true])
+                when :good
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{action.inspect} #{result.inspect}" }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/request.rb

@@ -0,0 +1,33 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Normalized extration of data from ActionDispatch::Request
+        module Request
+          def self.parsed_body(request)
+            # usually Hash<String,String> but can be a more complex
+            # Hash<String,String||Array||Hash> when e.g coming from JSON or
+            # with Rails advanced param square bracket parsing
+            body = request.env['action_dispatch.request.request_parameters']
+
+            return if body.nil?
+
+            body.reject do |k, _v|
+              request.env['action_dispatch.request.path_parameters'].key?(k)
+            end
+          end
+
+          def self.route_params(request)
+            excluded = [:controller, :action]
+
+            request.env['action_dispatch.request.path_parameters'].reject do |k, _v|
+              excluded.include?(k)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/request_middleware.rb

@@ -0,0 +1,20 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        # Rack middleware for AppSec on Rails
+        class RequestMiddleware
+          def initialize(app, opt = {})
+            @app = app
+          end
+
+          def call(env)
+            @app.call(env)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/configuration/settings.rb

@@ -0,0 +1,22 @@
+# typed: false
+
+require 'datadog/appsec/contrib/configuration/settings'
+require 'datadog/appsec/contrib/sinatra/ext'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Configuration
+          # Custom settings for the Rack integration
+          class Settings < Datadog::AppSec::Contrib::Configuration::Settings
+            option :enabled do |o|
+              o.default { env_to_bool(Ext::ENV_ENABLED, true) }
+              o.lazy
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/ext.rb

@@ -0,0 +1,15 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        # Sinatra integration constants
+        module Ext
+          APP = 'sinatra'.freeze
+          ENV_ENABLED = 'DD_TRACE_SINATRA_ENABLED'.freeze
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/framework.rb

@@ -0,0 +1,34 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      # Instrument Sinatra.
+      module Sinatra
+        # Sinatra framework code, used to essentially:
+        # - handle configuration entries which are specific to Datadog tracing
+        # - instrument parts of the framework when needed
+        module Framework
+          # Configure Rack from Sinatra, but only if Rack has not been configured manually beforehand
+          def self.setup
+            Datadog::AppSec.configure do |datadog_config|
+              sinatra_config = config_with_defaults(datadog_config)
+              activate_rack!(datadog_config, sinatra_config)
+            end
+          end
+
+          def self.config_with_defaults(datadog_config)
+            datadog_config[:sinatra]
+          end
+
+          # Apply relevant configuration from Sinatra to Rack
+          def self.activate_rack!(datadog_config, sinatra_config)
+            datadog_config.instrument(
+              :rack,
+            )
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -0,0 +1,124 @@
+# typed: false
+
+require 'datadog/appsec/instrumentation/gateway'
+require 'datadog/appsec/reactive/operation'
+require 'datadog/appsec/contrib/rack/reactive/request_body'
+require 'datadog/appsec/contrib/sinatra/reactive/routed'
+require 'datadog/appsec/event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Gateway
+          # Watcher for Rails gateway events
+          module Watcher
+            # rubocop:disable Metrics/MethodLength
+            def self.watch
+              Instrumentation.gateway.watch('sinatra.request.dispatch') do |stack, request|
+                block = false
+                event = nil
+                waf_context = request.env['datadog.waf.context']
+
+                AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
+                  trace = active_trace
+                  span = active_span
+
+                  Rack::Reactive::RequestBody.subscribe(op, waf_context) do |action, result, _block|
+                    record = [:block, :monitor].include?(action)
+                    if record
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: trace,
+                        span: span,
+                        request: request,
+                        action: action
+                      }
+
+                      waf_context.events << event
+                    end
+                  end
+
+                  _action, _result, block = Rack::Reactive::RequestBody.publish(op, request)
+                end
+
+                next [nil, [[:block, event]]] if block
+
+                ret, res = stack.call(request)
+
+                if event
+                  res ||= []
+                  res << [:monitor, event]
+                end
+
+                [ret, res]
+              end
+
+              Instrumentation.gateway.watch('sinatra.request.routed') do |stack, (request, route_params)|
+                block = false
+                event = nil
+                waf_context = request.env['datadog.waf.context']
+
+                AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
+                  trace = active_trace
+                  span = active_span
+
+                  Sinatra::Reactive::Routed.subscribe(op, waf_context) do |action, result, _block|
+                    record = [:block, :monitor].include?(action)
+                    if record
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: trace,
+                        span: span,
+                        request: request,
+                        action: action
+                      }
+
+                      waf_context.events << event
+                    end
+                  end
+
+                  _action, _result, block = Sinatra::Reactive::Routed.publish(op, [request, route_params])
+                end
+
+                next [nil, [[:block, event]]] if block
+
+                ret, res = stack.call(request)
+
+                if event
+                  res ||= []
+                  res << [:monitor, event]
+                end
+
+                [ret, res]
+              end
+            end
+            # rubocop:enable Metrics/MethodLength
+
+            class << self
+              private
+
+              def active_trace
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_trace
+              end
+
+              def active_span
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_span
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/integration.rb

@@ -0,0 +1,48 @@
+# typed: ignore
+
+require 'datadog/appsec/contrib/integration'
+
+require 'datadog/appsec/contrib/sinatra/configuration/settings'
+require 'datadog/appsec/contrib/sinatra/patcher'
+require 'datadog/appsec/contrib/sinatra/request_middleware'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        # Description of Sinatra integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('1.4.0')
+
+          register_as :sinatra
+
+          def self.version
+            Gem.loaded_specs['sinatra'] && Gem.loaded_specs['sinatra'].version
+          end
+
+          def self.loaded?
+            !defined?(::Sinatra).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            true
+          end
+
+          def default_configuration
+            Configuration::Settings.new
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -0,0 +1,144 @@
+# typed: ignore
+
+require 'datadog/tracing/contrib/rack/middlewares'
+
+require 'datadog/appsec/contrib/patcher'
+require 'datadog/appsec/contrib/rack/request_middleware'
+require 'datadog/appsec/contrib/sinatra/framework'
+require 'datadog/appsec/contrib/sinatra/gateway/watcher'
+require 'datadog/tracing/contrib/sinatra/framework'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        # Set tracer configuration at a late enough time
+        module AppSecSetupPatch
+          def setup_middleware(*args, &block)
+            super.tap do
+              Datadog::AppSec::Contrib::Sinatra::Framework.setup
+            end
+          end
+        end
+
+        # Hook into builder before the middleware list gets frozen
+        module DefaultMiddlewarePatch
+          def setup_middleware(*args, &block)
+            builder = args.first
+
+            super.tap do
+              tracing_sinatra_framework = Datadog::Tracing::Contrib::Sinatra::Framework
+              tracing_middleware = Datadog::Tracing::Contrib::Rack::TraceMiddleware
+
+              if tracing_sinatra_framework.include_middleware?(tracing_middleware, builder)
+                tracing_sinatra_framework.add_middleware_after(tracing_middleware,
+                                                               Datadog::AppSec::Contrib::Rack::RequestMiddleware,
+                                                               builder)
+              else
+                tracing_sinatra_framework.add_middleware(Datadog::AppSec::Contrib::Rack::RequestMiddleware, builder)
+              end
+
+              tracing_sinatra_framework.inspect_middlewares(builder)
+            end
+          end
+        end
+
+        # Hook into Base#dispatch!, which encompasses route filters
+        module DispatchPatch
+          def dispatch!
+            env = @request.env
+
+            context = env['datadog.waf.context']
+
+            return super unless context
+
+            # TODO: handle exceptions, except for super
+
+            request_return, request_response = Instrumentation.gateway.push('sinatra.request.dispatch', request) do
+              super
+            end
+
+            if request_response && request_response.any? { |action, _event| action == :block }
+              self.response = ::Sinatra::Response.new([Datadog::AppSec::Assets.blocked],
+                                                      403,
+                                                      { 'Content-Type' => 'text/html' })
+              request_return = nil
+            end
+
+            request_return
+          end
+        end
+
+        # Hook into Base#route_eval, which
+        # path params are returned by pattern.params in process_route, then
+        # merged with normal params, so we get both
+        module RoutePatch
+          def process_route(*)
+            env = @request.env
+
+            context = env['datadog.waf.context']
+
+            return super unless context
+
+            # process_route is called repeatedly until a route is found.
+            # Until then, params has no route params.
+            # Capture normal params.
+            base_params = params
+
+            super do |*args|
+              # This block is called only once the route is found.
+              # At this point params has both route params and normal params.
+              route_params = params.each.with_object({}) { |(k, v), h| h[k] = v unless base_params.key?(k) }
+
+              Instrumentation.gateway.push('sinatra.request.routed', [request, route_params])
+
+              # TODO: handle block
+
+              yield(*args)
+            end
+          end
+        end
+
+        # Patcher for AppSec on Sinatra
+        module Patcher
+          include Datadog::AppSec::Contrib::Patcher
+
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            Gateway::Watcher.watch
+            patch_default_middlewares
+            patch_dispatch
+            patch_route
+            setup_security
+            Patcher.instance_variable_set(:@patched, true)
+          end
+
+          def setup_security
+            ::Sinatra::Base.singleton_class.prepend(AppSecSetupPatch)
+          end
+
+          def patch_default_middlewares
+            ::Sinatra::Base.singleton_class.prepend(DefaultMiddlewarePatch)
+          end
+
+          def patch_dispatch
+            ::Sinatra::Base.prepend(DispatchPatch)
+          end
+
+          def patch_route
+            ::Sinatra::Base.prepend(RoutePatch)
+          end
+        end
+      end
+    end
+  end
+end