ddtrace 1.0.0.beta1 → 1.0.0.beta2

data/lib/datadog/appsec/assets/waf_rules/risky.json

@@ -1,5 +1,8 @@
 {
-  "version": "2.1",
+  "version": "2.2",
+  "metadata": {
+    "rules_version": "1.3.1"
+  },
   "rules": [
     {
       "id": "crs-921-130",
@@ -13,9 +16,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -52,7 +52,7 @@
           "parameters": {
             "inputs": [
               {
-                "address": "server.request.cookies"
+                "address": "server.request.query"
               }
             ],
             "list": [
@@ -1254,7 +1254,8 @@
         }
       ],
       "transformers": [
-        "lowercase"
+        "lowercase",
+        "normalizePath"
       ]
     },
     {
@@ -1302,9 +1303,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1338,9 +1336,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1373,9 +1368,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1409,9 +1401,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1434,6 +1423,77 @@
       "transformers": [
         "lowercase"
       ]
+    },
+    {
+      "id": "crs-942-140",
+      "name": "SQL Injection Attack: Common DB Names Detected",
+      "tags": {
+        "type": "sql_injection",
+        "crs_id": "942140",
+        "category": "attack_attempt"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.query"
+              },
+              {
+                "address": "server.request.body"
+              },
+              {
+                "address": "server.request.path_params"
+              },
+              {
+                "address": "grpc.server.request.message"
+              }
+            ],
+            "regex": "\\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)|db)|aster\\.\\.sysdatabases|ysql\\.db)|pg_(?:catalog|toast)|information_schema|northwind|tempdb)\\b|s(?:(?:ys(?:\\.database_name|aux)|qlite(?:_temp)?_master)\\b|chema(?:_name\\b|\\W*\\())|d(?:atabas|b_nam)e\\W*\\()",
+            "options": {
+              "min_length": 4
+            }
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
+    {
+      "id": "crs-942-220",
+      "name": "Looking for integer overflow attacks",
+      "tags": {
+        "type": "sql_injection",
+        "crs_id": "942220",
+        "category": "attack_attempt"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.query"
+              },
+              {
+                "address": "server.request.body"
+              },
+              {
+                "address": "server.request.path_params"
+              },
+              {
+                "address": "grpc.server.request.message"
+              }
+            ],
+            "regex": "^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$",
+            "options": {
+              "case_sensitive": true,
+              "min_length": 5
+            }
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
     }
   ]
 }

data/lib/datadog/appsec/assets/waf_rules/strict.json

@@ -1,5 +1,8 @@
 {
-  "version": "2.1",
+  "version": "2.2",
+  "metadata": {
+    "rules_version": "1.3.1"
+  },
   "rules": [
     {
       "id": "crs-913-100",
@@ -132,9 +135,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -170,9 +170,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -206,9 +203,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -241,9 +235,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -526,9 +517,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -562,9 +550,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -648,9 +633,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -684,9 +666,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -720,9 +699,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -763,9 +739,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -807,9 +780,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -856,9 +826,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -905,9 +872,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -943,9 +907,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -981,9 +942,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1019,9 +977,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1055,9 +1010,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1091,9 +1043,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1126,9 +1075,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1162,9 +1108,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1197,9 +1140,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1241,9 +1181,6 @@
               {
                 "address": "server.request.path_params"
               },
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies"
               }

data/lib/datadog/appsec/assets.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'pathname'
 
 module Datadog

data/lib/datadog/appsec/configuration/settings.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 module Datadog
   module AppSec
     module Configuration
@@ -92,7 +94,7 @@ module Datadog
 
         ENVS = {
           'DD_APPSEC_ENABLED' => [:enabled, Settings.boolean],
-          'DD_APPSEC_RULESET' => [:ruleset, Settings.string],
+          'DD_APPSEC_RULES' => [:ruleset, Settings.string],
           'DD_APPSEC_WAF_TIMEOUT' => [:waf_timeout, Settings.duration(:us)],
           'DD_APPSEC_WAF_DEBUG' => [:waf_debug, Settings.boolean],
           'DD_APPSEC_TRACE_RATE_LIMIT' => [:trace_rate_limit, Settings.integer],

data/lib/datadog/appsec/configuration.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 require 'datadog/appsec/configuration/settings'
 
 module Datadog

data/lib/datadog/appsec/contrib/auto_instrument.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 require 'ddtrace'
 
 module Datadog

data/lib/datadog/appsec/contrib/configuration/settings.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'datadog/core/configuration/base'
 
 module Datadog

data/lib/datadog/appsec/contrib/integration.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/patcher.rb

@@ -1,3 +1,5 @@
+# typed: strict
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rack/configuration/settings.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'datadog/appsec/contrib/configuration/settings'
 require 'datadog/appsec/contrib/rack/ext'
 

data/lib/datadog/appsec/contrib/rack/ext.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'datadog/appsec/instrumentation/gateway'
 require 'datadog/appsec/reactive/operation'
 require 'datadog/appsec/contrib/rack/reactive/request'
@@ -25,7 +27,6 @@ module Datadog
                   # TODO: factor out
                   if defined?(Datadog::Tracing) && Datadog::Tracing.respond_to?(:active_span)
                     active_trace = Datadog::Tracing.active_trace
-                    root_span = active_trace.send(:root_span) if active_trace
                     active_span = Datadog::Tracing.active_span
 
                     Datadog.logger.debug { "active span: #{active_span.span_id}" } if active_span
@@ -43,7 +44,6 @@ module Datadog
                       event = {
                         waf_result: result,
                         trace: active_trace,
-                        root_span: root_span,
                         span: active_span,
                         request: request,
                         action: action
@@ -75,7 +75,6 @@ module Datadog
                   # TODO: factor out
                   if defined?(Datadog::Tracing) && Datadog::Tracing.respond_to?(:active_span)
                     active_trace = Datadog::Tracing.active_trace
-                    root_span = active_trace.send(:root_span) if active_trace
                     active_span = Datadog::Tracing.active_span
 
                     Datadog.logger.debug { "active span: #{active_span.span_id}" } if active_span
@@ -93,7 +92,6 @@ module Datadog
                       event = {
                         waf_result: result,
                         trace: active_trace,
-                        root_span: root_span,
                         span: active_span,
                         response: response,
                         action: action

data/lib/datadog/appsec/contrib/rack/reactive/request.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 require 'datadog/appsec/contrib/rack/request'
 
 module Datadog
@@ -54,6 +56,8 @@ module Datadog
                 waf_timeout = Datadog::AppSec.settings.waf_timeout
                 action, result = waf_context.run(waf_args, waf_timeout)
 
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
                 # TODO: encapsulate return array in a type
                 case action
                 when :monitor
@@ -65,8 +69,6 @@ module Datadog
                   throw(:block, [action, result, true])
                 when :good
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
-                when :timeout
-                  Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" }
                 when :invalid_call
                   Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
                 when :invalid_rule, :invalid_flow, :no_rule

data/lib/datadog/appsec/contrib/rack/reactive/response.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 require 'datadog/appsec/contrib/rack/response'
 
 module Datadog
@@ -32,6 +34,8 @@ module Datadog
                 waf_timeout = Datadog::AppSec.settings.waf_timeout
                 action, result = waf_context.run(waf_args, waf_timeout)
 
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
                 # TODO: encapsulate return array in a type
                 case action
                 when :monitor
@@ -43,8 +47,6 @@ module Datadog
                   throw(:block, [action, result, true])
                 when :good
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
-                when :timeout
-                  Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" }
                 when :invalid_call
                   Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
                 when :invalid_rule, :invalid_flow, :no_rule

data/lib/datadog/appsec/contrib/rack/request.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -1,6 +1,7 @@
 # typed: ignore
 
 require 'datadog/appsec/instrumentation/gateway'
+require 'datadog/appsec/processor'
 require 'datadog/appsec/assets'
 
 module Datadog
@@ -13,47 +14,15 @@ module Datadog
           def initialize(app, opt = {})
             @app = app
 
-            # TODO: move to integration? (may be too early)
-            require_libddwaf
-
-            libddwaf_spec = Gem.loaded_specs['libddwaf']
-            libddwaf_platform = libddwaf_spec ? libddwaf_spec.platform.to_s : 'unknown'
-            ruby_platforms = Gem.platforms.map(&:to_s)
-
-            if libddwaf_required?
-              Datadog.logger.debug { "libddwaf platform: #{libddwaf_platform}" }
-              Datadog::AppSec::WAF.logger = Datadog.logger if Datadog.logger.debug? && Datadog::AppSec.settings.waf_debug
-              @waf = Datadog::AppSec::WAF::Handle.new(waf_rules)
-            else
-              Datadog.logger.warn do
-                "libddwaf failed to load, installed platform: #{libddwaf_platform} ruby platforms: #{ruby_platforms}"
-              end
-              Datadog.logger.warn { 'AppSec is disabled' }
-            end
-          end
-
-          def waf_rules
-            ruleset_setting = Datadog::AppSec.settings.ruleset
-            case ruleset_setting
-            when :recommended, :risky, :strict
-              @waf_rules ||= JSON.parse(Datadog::AppSec::Assets.waf_rules(ruleset_setting))
-            when String
-              # TODO: handle file missing
-              filename = ruleset_setting
-              ruleset = File.read(filename)
-              @waf_rules ||= JSON.parse(ruleset)
-            else
-              # TODO: use a proper exception class
-              raise "unsupported value for :ruleset: #{ruleset_setting.inspect}"
-            end
+            @processor = Datadog::AppSec::Processor.new
           end
 
           def call(env)
-            return @app.call(env) unless libddwaf_required?
+            return @app.call(env) unless @processor.ready?
 
             # TODO: handle exceptions, except for @app.call
 
-            context = Datadog::AppSec::WAF::Context.new(@waf)
+            context = @processor.new_context
 
             env['datadog.waf.context'] = context
             request = ::Rack::Request.new(env)
@@ -81,16 +50,6 @@ module Datadog
 
             request_return
           end
-
-          def libddwaf_required?
-            defined?(Datadog::AppSec::WAF)
-          end
-
-          def require_libddwaf
-            require 'libddwaf'
-          rescue LoadError => e
-            Datadog.logger.warn { "LoadError: libddwaf failed to load: #{e.message}" }
-          end
         end
       end
     end

data/lib/datadog/appsec/contrib/rack/response.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rails/configuration/settings.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'datadog/appsec/contrib/configuration/settings'
 require 'datadog/appsec/contrib/rails/ext'
 

data/lib/datadog/appsec/contrib/rails/ext.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rails/framework.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -48,7 +48,7 @@ module Datadog
               # Middleware must be added before the application is initialized.
               # Otherwise the middleware stack will be frozen.
               # Sometimes we don't want to activate middleware e.g. OpenTracing, etc.
-              add_middleware(app) if Datadog.configuration[:rails][:middleware]
+              add_middleware(app) if Datadog.configuration.tracing[:rails][:middleware]
             end
           end
 

data/lib/datadog/appsec/contrib/rails/request_middleware.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/sinatra/configuration/settings.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'datadog/appsec/contrib/configuration/settings'
 require 'datadog/appsec/contrib/sinatra/ext'
 

data/lib/datadog/appsec/contrib/sinatra/ext.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/sinatra/framework.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib