ddtrace 0.54.2 → 1.8.0

data/lib/datadog/appsec/assets.rb

@@ -0,0 +1,38 @@
+# typed: false
+
+require 'pathname'
+
+module Datadog
+  module AppSec
+    # Helper methods to get vendored assets
+    module Assets
+      module_function
+
+      def waf_rules(kind = :recommended)
+        read("waf_rules/#{kind}.json")
+      end
+
+      def blocked(format: :html)
+        (@blocked ||= {})[format] ||= read("blocked.#{format}")
+      end
+
+      def path
+        Pathname.new(dir).join('assets')
+      end
+
+      def filepath(filename)
+        path.join(filename)
+      end
+
+      def read(filename, mode = 'rb')
+        File.open(filepath(filename), mode) { |f| f.read || raise('Unexpected nil IO object') }
+      end
+
+      def dir
+        # Happens only if this file is evaluated standalone, which should not happen
+        # Necessary to make type-checker happy with a non-nilable return value
+        __dir__ || raise('Unexpected file eval')
+      end
+    end
+  end
+end

data/lib/datadog/appsec/autoload.rb

@@ -0,0 +1,18 @@
+# typed: ignore
+
+if %w[1 true].include?((ENV['DD_APPSEC_ENABLED'] || '').downcase)
+  require_relative '../../ddtrace'
+
+  begin
+    require_relative '../appsec'
+  rescue StandardError => e
+    puts "AppSec failed to load. No security check will be performed. error: #{e.class.name} #{e.message}"
+  end
+
+  begin
+    require_relative 'contrib/auto_instrument'
+    Datadog::AppSec::Contrib::AutoInstrument.patch_all
+  rescue StandardError => e
+    puts "AppSec failed to instrument. No security check will be performed. error: #{e.class.name} #{e.message}"
+  end
+end

data/lib/datadog/appsec/configuration/settings.rb

@@ -0,0 +1,198 @@
+# typed: false
+
+module Datadog
+  module AppSec
+    module Configuration
+      # Configuration settings, acting as an integration registry
+      # TODO: as with Configuration, this is a trivial implementation
+      class Settings
+        class << self
+          def boolean
+            lambda do |v|
+              case v
+              when /(1|true)/i
+                true
+              when /(0|false)/i, nil
+                false
+              else
+                raise ArgumentError, "invalid boolean: #{v.inspect}"
+              end
+            end
+          end
+
+          # TODO: allow symbols
+          def string
+            ->(v) { v.to_s }
+          end
+
+          def integer
+            lambda do |v|
+              case v
+              when /(\d+)/
+                Integer(Regexp.last_match[1])
+              else
+                raise ArgumentError, "invalid integer: #{v.inspect}"
+              end
+            end
+          end
+
+          # rubocop:disable Metrics/MethodLength
+          def duration(base = :ns, type = :integer)
+            lambda do |v|
+              cast = case type
+                     when :integer, Integer
+                       method(:Integer)
+                     when :float, Float
+                       method(:Float)
+                     else
+                       raise ArgumentError, "invalid type: #{v.inspect}"
+                     end
+
+              scale = case base
+                      when :s
+                        1_000_000_000
+                      when :ms
+                        1_000_000
+                      when :us
+                        1000
+                      when :ns
+                        1
+                      else
+                        raise ArgumentError, "invalid base: #{v.inspect}"
+                      end
+
+              case v
+              when /^(\d+)h$/
+                cast.call(Regexp.last_match[1]) * 1_000_000_000 * 60 * 60 / scale
+              when /^(\d+)m$/
+                cast.call(Regexp.last_match[1]) * 1_000_000_000 * 60 / scale
+              when /^(\d+)s$/
+                cast.call(Regexp.last_match[1]) * 1_000_000_000 / scale
+              when /^(\d+)ms$/
+                cast.call(Regexp.last_match[1]) * 1_000_000 / scale
+              when /^(\d+)us$/
+                cast.call(Regexp.last_match[1]) * 1_000 / scale
+              when /^(\d+)ns$/
+                cast.call(Regexp.last_match[1]) / scale
+              when /^(\d+)$/
+                cast.call(Regexp.last_match[1])
+              else
+                raise ArgumentError, "invalid duration: #{v.inspect}"
+              end
+            end
+          end
+          # rubocop:enable Metrics/MethodLength
+        end
+
+        # rubocop:disable Layout/LineLength
+        DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'.freeze
+        DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'.freeze
+        # rubocop:enable Layout/LineLength
+
+        DEFAULTS = {
+          enabled: false,
+          ruleset: :recommended,
+          waf_timeout: 5_000, # us
+          waf_debug: false,
+          trace_rate_limit: 100, # traces/s
+          obfuscator_key_regex: DEFAULT_OBFUSCATOR_KEY_REGEX,
+          obfuscator_value_regex: DEFAULT_OBFUSCATOR_VALUE_REGEX,
+        }.freeze
+
+        ENVS = {
+          'DD_APPSEC_ENABLED' => [:enabled, Settings.boolean],
+          'DD_APPSEC_RULES' => [:ruleset, Settings.string],
+          'DD_APPSEC_WAF_TIMEOUT' => [:waf_timeout, Settings.duration(:us)],
+          'DD_APPSEC_WAF_DEBUG' => [:waf_debug, Settings.boolean],
+          'DD_APPSEC_TRACE_RATE_LIMIT' => [:trace_rate_limit, Settings.integer],
+          'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP' => [:obfuscator_key_regex, Settings.string],
+          'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP' => [:obfuscator_value_regex, Settings.string],
+        }.freeze
+
+        Integration = Struct.new(:integration, :options)
+
+        def initialize
+          @integrations = []
+          @options = DEFAULTS.dup.tap do |options|
+            ENVS.each do |env, (key, conv)|
+              options[key] = conv.call(ENV[env]) if ENV[env]
+            end
+          end
+        end
+
+        def enabled
+          @options[:enabled]
+        end
+
+        def ruleset
+          @options[:ruleset]
+        end
+
+        # EXPERIMENTAL: This configurable is not meant to be publicly used, but
+        #               is very useful for testing. It may change at any point in time.
+        def ip_denylist
+          @options[:ip_denylist]
+        end
+
+        def waf_timeout
+          @options[:waf_timeout]
+        end
+
+        def waf_debug
+          @options[:waf_debug]
+        end
+
+        def trace_rate_limit
+          @options[:trace_rate_limit]
+        end
+
+        def obfuscator_key_regex
+          @options[:obfuscator_key_regex]
+        end
+
+        def obfuscator_value_regex
+          @options[:obfuscator_value_regex]
+        end
+
+        def [](integration_name)
+          integration = Datadog::AppSec::Contrib::Integration.registry[integration_name]
+
+          raise ArgumentError, "'#{integration_name}' is not a valid integration." unless integration
+
+          integration.options if integration
+        end
+
+        def merge(dsl)
+          dsl.options.each do |k, v|
+            @options[k] = v unless v.nil?
+          end
+
+          return self unless @options[:enabled]
+
+          # patcher.patch may call configure again, hence merge might be called again so it needs to be reentrant
+          dsl.instruments.each do |instrument|
+            # TODO: error handling
+            registered_integration = Datadog::AppSec::Contrib::Integration.registry[instrument.name]
+            @integrations << Integration.new(registered_integration, instrument.options)
+
+            # TODO: move to a separate apply step
+            klass = registered_integration.klass
+            if klass.loaded? && klass.compatible?
+              instance = klass.new
+              instance.patcher.patch
+            end
+          end
+
+          self
+        end
+
+        private
+
+        # Restore to original state, for testing only.
+        def reset!
+          initialize
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/configuration.rb

@@ -0,0 +1,84 @@
+# typed: true
+
+require_relative 'configuration/settings'
+
+module Datadog
+  module AppSec
+    # Configuration for AppSec
+    # TODO: this is a trivial implementation, check with shareable code with
+    # tracer and other products
+    module Configuration
+      def self.included(base)
+        base.extend(ClassMethods)
+      end
+
+      # Configuration DSL implementation
+      class DSL
+        Instrument = Struct.new(:name, :options)
+        def initialize
+          @instruments = []
+          @options = {}
+        end
+
+        attr_reader :instruments, :options
+
+        def instrument(name, options = {})
+          @instruments << Instrument.new(name, options)
+        end
+
+        def enabled=(value)
+          options[:enabled] = value
+        end
+
+        def ruleset=(value)
+          options[:ruleset] = value
+        end
+
+        def ip_denylist=(value)
+          options[:ip_denylist] = value
+        end
+
+        # in microseconds
+        def waf_timeout=(value)
+          options[:waf_timeout] = value
+        end
+
+        def waf_debug=(value)
+          options[:waf_debug] = value
+        end
+
+        def trace_rate_limit=(value)
+          options[:trace_rate_limit] = value
+        end
+
+        def obfuscator_key_regex=(value)
+          options[:obfuscator_key_regex] = value
+        end
+
+        def obfuscator_value_regex=(value)
+          options[:obfuscator_value_regex] = value
+        end
+
+        def [](key)
+          found = @instruments.find { |e| e.name == key }
+
+          found.options if found
+        end
+      end
+
+      # class-level methods for Configuration
+      module ClassMethods
+        def configure
+          dsl = DSL.new
+          yield dsl
+          settings.merge(dsl)
+          settings
+        end
+
+        def settings
+          @settings ||= Settings.new
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/auto_instrument.rb

@@ -0,0 +1,27 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      # Auto-instrumentation for security integrations
+      # TODO: this implementation is trivial, check for shareable code with tracer
+      module AutoInstrument
+        def self.patch_all
+          integrations = []
+
+          Datadog::AppSec::Contrib::Integration.registry.each do |_name, integration|
+            next unless integration.klass.auto_instrument?
+
+            integrations << integration.name
+          end
+
+          Datadog::AppSec.configure do |c|
+            integrations.each do |integration_name|
+              c.instrument integration_name
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/configuration/settings.rb

@@ -0,0 +1,20 @@
+# typed: false
+
+require_relative '../../../core/configuration/base'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Configuration
+        # Common settings for all integrations
+        # TODO: move to datadog/appsec/configuration or remove?
+        class Settings
+          include Datadog::Core::Configuration::Base
+
+          option :enabled, default: true
+          option :service_name
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/integration.rb

@@ -0,0 +1,37 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      # Base provides features that are shared across all integrations
+      module Integration
+        @registry = {}
+
+        RegisteredIntegration = Struct.new(:name, :klass, :options)
+
+        def self.included(base)
+          base.extend(ClassMethods)
+        end
+
+        # Class-level methods for Integration
+        module ClassMethods
+          def register_as(name, options = {})
+            Integration.register(self, name, options)
+          end
+
+          def compatible?
+            true
+          end
+        end
+
+        def self.register(integration, name, options)
+          registry[name] = RegisteredIntegration.new(name, integration, options)
+        end
+
+        def self.registry
+          @registry
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/patcher.rb

@@ -0,0 +1,12 @@
+# typed: strict
+
+module Datadog
+  module AppSec
+    module Contrib
+      # Common patcher code for AppSec integrations
+      # TODO: empty implementation, check with tracer shareable code
+      module Patcher
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/configuration/settings.rb

@@ -0,0 +1,22 @@
+# typed: false
+
+require_relative '../../configuration/settings'
+require_relative '../ext'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Configuration
+          # Custom settings for the Rack integration
+          class Settings < Datadog::AppSec::Contrib::Configuration::Settings
+            option :enabled do |o|
+              o.default { env_to_bool(Ext::ENV_ENABLED, true) }
+              o.lazy
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/ext.rb

@@ -0,0 +1,15 @@
+# typed: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Rack integration constants
+        module Ext
+          APP = 'rack'.freeze
+          ENV_ENABLED = 'DD_TRACE_RACK_ENABLED'.freeze # TODO: DD_APPSEC?
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -0,0 +1,174 @@
+# typed: false
+
+require_relative '../../../instrumentation/gateway'
+require_relative '../../../reactive/operation'
+require_relative '../reactive/request'
+require_relative '../reactive/request_body'
+require_relative '../reactive/response'
+require_relative '../../../event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Gateway
+          # Watcher for Rack gateway events
+          module Watcher
+            # rubocop:disable Metrics/AbcSize
+            # rubocop:disable Metrics/MethodLength
+            # rubocop:disable Metrics/CyclomaticComplexity
+            # rubocop:disable Metrics/PerceivedComplexity
+            def self.watch
+              Instrumentation.gateway.watch('rack.request', :appsec) do |stack, request|
+                block = false
+                event = nil
+                waf_context = request.env['datadog.waf.context']
+
+                AppSec::Reactive::Operation.new('rack.request') do |op|
+                  trace = active_trace
+                  span = active_span
+
+                  Rack::Reactive::Request.subscribe(op, waf_context) do |result, _block|
+                    if result.status == :match
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: trace,
+                        span: span,
+                        request: request,
+                        actions: result.actions
+                      }
+
+                      span.set_tag('appsec.event', 'true') if span
+
+                      waf_context.events << event
+                    end
+                  end
+
+                  _result, block = Rack::Reactive::Request.publish(op, request)
+                end
+
+                next [nil, [[:block, event]]] if block
+
+                ret, res = stack.call(request)
+
+                if event
+                  res ||= []
+                  res << [:monitor, event]
+                end
+
+                [ret, res]
+              end
+
+              Instrumentation.gateway.watch('rack.response', :appsec) do |stack, response|
+                block = false
+                event = nil
+                waf_context = response.instance_eval { @waf_context }
+
+                AppSec::Reactive::Operation.new('rack.response') do |op|
+                  trace = active_trace
+                  span = active_span
+
+                  Rack::Reactive::Response.subscribe(op, waf_context) do |result, _block|
+                    if result.status == :match
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: trace,
+                        span: span,
+                        response: response,
+                        actions: result.actions
+                      }
+
+                      span.set_tag('appsec.event', 'true') if span
+
+                      waf_context.events << event
+                    end
+                  end
+
+                  _result, block = Rack::Reactive::Response.publish(op, response)
+                end
+
+                next [nil, [[:block, event]]] if block
+
+                ret, res = stack.call(response)
+
+                if event
+                  res ||= []
+                  res << [:monitor, event]
+                end
+
+                [ret, res]
+              end
+
+              Instrumentation.gateway.watch('rack.request.body', :appsec) do |stack, request|
+                block = false
+                event = nil
+                waf_context = request.env['datadog.waf.context']
+
+                AppSec::Reactive::Operation.new('rack.request.body') do |op|
+                  trace = active_trace
+                  span = active_span
+
+                  Rack::Reactive::RequestBody.subscribe(op, waf_context) do |result, _block|
+                    if result.status == :match
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: trace,
+                        span: span,
+                        request: request,
+                        actions: result.actions
+                      }
+
+                      span.set_tag('appsec.event', 'true') if span
+
+                      waf_context.events << event
+                    end
+                  end
+
+                  _result, block = Rack::Reactive::RequestBody.publish(op, request)
+                end
+
+                next [nil, [[:block, event]]] if block
+
+                ret, res = stack.call(request)
+
+                if event
+                  res ||= []
+                  res << [:monitor, event]
+                end
+
+                [ret, res]
+              end
+            end
+            # rubocop:enable Metrics/CyclomaticComplexity
+            # rubocop:enable Metrics/PerceivedComplexity
+            # rubocop:enable Metrics/MethodLength
+            # rubocop:enable Metrics/AbcSize
+
+            class << self
+              private
+
+              def active_trace
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_trace
+              end
+
+              def active_span
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_span
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/integration.rb

@@ -0,0 +1,49 @@
+# typed: ignore
+
+require_relative '../integration'
+
+require_relative 'configuration/settings'
+require_relative 'patcher'
+require_relative 'request_middleware'
+require_relative 'request_body_middleware'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        # Description of Rack integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('1.1.0')
+
+          register_as :rack, auto_patch: false
+
+          def self.version
+            Gem.loaded_specs['rack'] && Gem.loaded_specs['rack'].version
+          end
+
+          def self.loaded?
+            !defined?(::Rack).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            false
+          end
+
+          def default_configuration
+            Configuration::Settings.new
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end