ddtrace 1.0.0.beta1 → 1.1.0

data/lib/datadog/appsec/assets/waf_rules/risky.json

@@ -1,5 +1,8 @@
 {
-  "version": "2.1",
+  "version": "2.2",
+  "metadata": {
+    "rules_version": "1.3.1"
+  },
   "rules": [
     {
       "id": "crs-921-130",
@@ -13,9 +16,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -52,7 +52,7 @@
           "parameters": {
             "inputs": [
               {
-                "address": "server.request.cookies"
+                "address": "server.request.query"
               }
             ],
             "list": [
@@ -1254,7 +1254,8 @@
         }
       ],
       "transformers": [
-        "lowercase"
+        "lowercase",
+        "normalizePath"
       ]
     },
     {
@@ -1302,9 +1303,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1338,9 +1336,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1373,9 +1368,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1409,9 +1401,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1434,6 +1423,77 @@
       "transformers": [
         "lowercase"
       ]
+    },
+    {
+      "id": "crs-942-140",
+      "name": "SQL Injection Attack: Common DB Names Detected",
+      "tags": {
+        "type": "sql_injection",
+        "crs_id": "942140",
+        "category": "attack_attempt"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.query"
+              },
+              {
+                "address": "server.request.body"
+              },
+              {
+                "address": "server.request.path_params"
+              },
+              {
+                "address": "grpc.server.request.message"
+              }
+            ],
+            "regex": "\\b(?:(?:m(?:s(?:ys(?:ac(?:cess(?:objects|storage|xml)|es)|(?:relationship|object|querie)s|modules2?)|db)|aster\\.\\.sysdatabases|ysql\\.db)|pg_(?:catalog|toast)|information_schema|northwind|tempdb)\\b|s(?:(?:ys(?:\\.database_name|aux)|qlite(?:_temp)?_master)\\b|chema(?:_name\\b|\\W*\\())|d(?:atabas|b_nam)e\\W*\\()",
+            "options": {
+              "min_length": 4
+            }
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
+    },
+    {
+      "id": "crs-942-220",
+      "name": "Looking for integer overflow attacks",
+      "tags": {
+        "type": "sql_injection",
+        "crs_id": "942220",
+        "category": "attack_attempt"
+      },
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.query"
+              },
+              {
+                "address": "server.request.body"
+              },
+              {
+                "address": "server.request.path_params"
+              },
+              {
+                "address": "grpc.server.request.message"
+              }
+            ],
+            "regex": "^(?i:-0000023456|4294967295|4294967296|2147483648|2147483647|0000012345|-2147483648|-2147483649|0000023456|2.2250738585072007e-308|2.2250738585072011e-308|1e309)$",
+            "options": {
+              "case_sensitive": true,
+              "min_length": 5
+            }
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": []
     }
   ]
 }

data/lib/datadog/appsec/assets/waf_rules/strict.json

@@ -1,5 +1,8 @@
 {
-  "version": "2.1",
+  "version": "2.2",
+  "metadata": {
+    "rules_version": "1.3.1"
+  },
   "rules": [
     {
       "id": "crs-913-100",
@@ -132,9 +135,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -170,9 +170,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -206,9 +203,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -241,9 +235,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -526,9 +517,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -562,9 +550,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -648,9 +633,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -684,9 +666,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -720,9 +699,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -763,9 +739,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -807,9 +780,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -856,9 +826,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies",
                 "key_path": [
@@ -905,9 +872,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -943,9 +907,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -981,9 +942,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1019,9 +977,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1055,9 +1010,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1091,9 +1043,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1126,9 +1075,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1162,9 +1108,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1197,9 +1140,6 @@
         {
           "parameters": {
             "inputs": [
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.query"
               },
@@ -1241,9 +1181,6 @@
               {
                 "address": "server.request.path_params"
               },
-              {
-                "address": "server.request.cookies"
-              },
               {
                 "address": "server.request.headers.no_cookies"
               }

data/lib/datadog/appsec/assets.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'pathname'
 
 module Datadog

data/lib/datadog/appsec/autoload.rb

@@ -4,13 +4,13 @@ if %w[1 true].include?((ENV['DD_APPSEC_ENABLED'] || '').downcase)
   begin
     require 'datadog/appsec'
   rescue StandardError => e
-    puts "AppSec failed to load. No security check will be performed. error: #{e.message}"
+    puts "AppSec failed to load. No security check will be performed. error: #{e.class.name} #{e.message}"
   end
 
   begin
     require 'datadog/appsec/contrib/auto_instrument'
     Datadog::AppSec::Contrib::AutoInstrument.patch_all
   rescue StandardError => e
-    puts "AppSec failed to instrument. No security check will be performed. error: #{e.message}"
+    puts "AppSec failed to instrument. No security check will be performed. error: #{e.class.name} #{e.message}"
   end
 end

data/lib/datadog/appsec/configuration/settings.rb

@@ -1,8 +1,11 @@
+# typed: false
+
 module Datadog
   module AppSec
     module Configuration
       # Configuration settings, acting as an integration registry
       # TODO: as with Configuration, this is a trivial implementation
+      # rubocop:disable Metrics/ClassLength
       class Settings
         class << self
           def boolean
@@ -82,20 +85,29 @@ module Datadog
           # rubocop:enable Metrics/MethodLength
         end
 
+        # rubocop:disable Layout/LineLength
+        DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'.freeze
+        DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'.freeze
+        # rubocop:enable Layout/LineLength
+
         DEFAULTS = {
           enabled: false,
           ruleset: :recommended,
           waf_timeout: 5_000, # us
           waf_debug: false,
           trace_rate_limit: 100, # traces/s
+          obfuscator_key_regex: DEFAULT_OBFUSCATOR_KEY_REGEX,
+          obfuscator_value_regex: DEFAULT_OBFUSCATOR_VALUE_REGEX,
         }.freeze
 
         ENVS = {
           'DD_APPSEC_ENABLED' => [:enabled, Settings.boolean],
-          'DD_APPSEC_RULESET' => [:ruleset, Settings.string],
+          'DD_APPSEC_RULES' => [:ruleset, Settings.string],
           'DD_APPSEC_WAF_TIMEOUT' => [:waf_timeout, Settings.duration(:us)],
           'DD_APPSEC_WAF_DEBUG' => [:waf_debug, Settings.boolean],
           'DD_APPSEC_TRACE_RATE_LIMIT' => [:trace_rate_limit, Settings.integer],
+          'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP' => [:obfuscator_key_regex, Settings.string],
+          'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP' => [:obfuscator_value_regex, Settings.string],
         }.freeze
 
         Integration = Struct.new(:integration, :options)
@@ -129,6 +141,14 @@ module Datadog
           @options[:trace_rate_limit]
         end
 
+        def obfuscator_key_regex
+          @options[:obfuscator_key_regex]
+        end
+
+        def obfuscator_value_regex
+          @options[:obfuscator_value_regex]
+        end
+
         def [](integration_name)
           integration = Datadog::AppSec::Contrib::Integration.registry[integration_name]
 
@@ -168,6 +188,7 @@ module Datadog
           initialize
         end
       end
+      # rubocop:enable Metrics/ClassLength
     end
   end
 end

data/lib/datadog/appsec/configuration.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 require 'datadog/appsec/configuration/settings'
 
 module Datadog
@@ -45,6 +47,14 @@ module Datadog
           options[:trace_rate_limit] = value
         end
 
+        def obfuscator_key_regex=(value)
+          options[:obfuscator_key_regex] = value
+        end
+
+        def obfuscator_value_regex=(value)
+          options[:obfuscator_value_regex] = value
+        end
+
         def [](key)
           found = @instruments.find { |e| e.name == key }
 

data/lib/datadog/appsec/contrib/auto_instrument.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 require 'ddtrace'
 
 module Datadog

data/lib/datadog/appsec/contrib/configuration/settings.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'datadog/core/configuration/base'
 
 module Datadog

data/lib/datadog/appsec/contrib/integration.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/patcher.rb

@@ -1,3 +1,5 @@
+# typed: strict
+
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rack/configuration/settings.rb

@@ -1,3 +1,5 @@
+# typed: false
+
 require 'datadog/appsec/contrib/configuration/settings'
 require 'datadog/appsec/contrib/rack/ext'
 

data/lib/datadog/appsec/contrib/rack/ext.rb

@@ -1,3 +1,5 @@
+# typed: true
+
 module Datadog
   module AppSec
     module Contrib