ddtrace 1.0.0 → 1.10.1

data/lib/datadog/appsec/assets.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 require 'pathname'
 
 module Datadog
@@ -12,8 +10,8 @@ module Datadog
         read("waf_rules/#{kind}.json")
       end
 
-      def blocked
-        @blocked ||= read('blocked.html')
+      def blocked(format: :html)
+        (@blocked ||= {})[format] ||= read("blocked.#{format}")
       end
 
       def path

data/lib/datadog/appsec/autoload.rb

@@ -1,16 +1,11 @@
-# typed: ignore
-
 if %w[1 true].include?((ENV['DD_APPSEC_ENABLED'] || '').downcase)
   begin
-    require 'datadog/appsec'
-  rescue StandardError => e
-    puts "AppSec failed to load. No security check will be performed. error: #{e.message}"
-  end
-
-  begin
-    require 'datadog/appsec/contrib/auto_instrument'
+    require_relative 'contrib/auto_instrument'
     Datadog::AppSec::Contrib::AutoInstrument.patch_all
   rescue StandardError => e
-    puts "AppSec failed to instrument. No security check will be performed. error: #{e.message}"
+    Kernel.warn(
+      '[ddtrace] AppSec failed to instrument. No security check will be performed. error: ' \
+      " #{e.class.name} #{e.message}"
+    )
   end
 end

data/lib/datadog/appsec/component.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require_relative 'processor'
+
+module Datadog
+  module AppSec
+    # Core-pluggable component for AppSec
+    class Component
+      class << self
+        def build_appsec_component(settings)
+          return unless settings.respond_to?(:appsec) && settings.appsec.enabled
+
+          processor = create_processor
+          new(processor: processor)
+        end
+
+        private
+
+        def create_processor
+          processor = Processor.new
+          return nil unless processor.ready?
+
+          processor
+        end
+      end
+
+      attr_reader :processor
+
+      def initialize(processor:)
+        @processor = processor
+      end
+
+      def shutdown!
+        if processor && processor.ready?
+          processor.finalize
+          @processor = nil
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/configuration/settings.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 module Datadog
   module AppSec
     module Configuration
@@ -8,7 +6,8 @@ module Datadog
       class Settings
         class << self
           def boolean
-            lambda do |v|
+            # @type ^(::String) -> bool
+            ->(v) do # rubocop:disable Style/Lambda
               case v
               when /(1|true)/i
                 true
@@ -22,14 +21,16 @@ module Datadog
 
           # TODO: allow symbols
           def string
+            # @type ^(::String) -> ::String
             ->(v) { v.to_s }
           end
 
           def integer
-            lambda do |v|
+            # @type ^(::String) -> ::Integer
+            ->(v) do # rubocop:disable Style/Lambda
               case v
               when /(\d+)/
-                Integer(Regexp.last_match[1])
+                Regexp.last_match(1).to_i
               else
                 raise ArgumentError, "invalid integer: #{v.inspect}"
               end
@@ -38,7 +39,8 @@ module Datadog
 
           # rubocop:disable Metrics/MethodLength
           def duration(base = :ns, type = :integer)
-            lambda do |v|
+            # @type ^(::String) -> ::Integer | ::Float
+            ->(v) do # rubocop:disable Style/Lambda
               cast = case type
                      when :integer, Integer
                        method(:Integer)
@@ -63,19 +65,19 @@ module Datadog
 
               case v
               when /^(\d+)h$/
-                cast.call(Regexp.last_match[1]) * 1_000_000_000 * 60 * 60 / scale
+                cast.call(Regexp.last_match(1)) * 1_000_000_000 * 60 * 60 / scale
               when /^(\d+)m$/
-                cast.call(Regexp.last_match[1]) * 1_000_000_000 * 60 / scale
+                cast.call(Regexp.last_match(1)) * 1_000_000_000 * 60 / scale
               when /^(\d+)s$/
-                cast.call(Regexp.last_match[1]) * 1_000_000_000 / scale
+                cast.call(Regexp.last_match(1)) * 1_000_000_000 / scale
               when /^(\d+)ms$/
-                cast.call(Regexp.last_match[1]) * 1_000_000 / scale
+                cast.call(Regexp.last_match(1)) * 1_000_000 / scale
               when /^(\d+)us$/
-                cast.call(Regexp.last_match[1]) * 1_000 / scale
+                cast.call(Regexp.last_match(1)) * 1_000 / scale
               when /^(\d+)ns$/
-                cast.call(Regexp.last_match[1]) / scale
+                cast.call(Regexp.last_match(1)) / scale
               when /^(\d+)$/
-                cast.call(Regexp.last_match[1])
+                cast.call(Regexp.last_match(1))
               else
                 raise ArgumentError, "invalid duration: #{v.inspect}"
               end
@@ -84,12 +86,19 @@ module Datadog
           # rubocop:enable Metrics/MethodLength
         end
 
+        # rubocop:disable Layout/LineLength
+        DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'.freeze
+        DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'.freeze
+        # rubocop:enable Layout/LineLength
+
         DEFAULTS = {
           enabled: false,
           ruleset: :recommended,
           waf_timeout: 5_000, # us
           waf_debug: false,
           trace_rate_limit: 100, # traces/s
+          obfuscator_key_regex: DEFAULT_OBFUSCATOR_KEY_REGEX,
+          obfuscator_value_regex: DEFAULT_OBFUSCATOR_VALUE_REGEX,
         }.freeze
 
         ENVS = {
@@ -98,9 +107,12 @@ module Datadog
           'DD_APPSEC_WAF_TIMEOUT' => [:waf_timeout, Settings.duration(:us)],
           'DD_APPSEC_WAF_DEBUG' => [:waf_debug, Settings.boolean],
           'DD_APPSEC_TRACE_RATE_LIMIT' => [:trace_rate_limit, Settings.integer],
+          'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP' => [:obfuscator_key_regex, Settings.string],
+          'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP' => [:obfuscator_value_regex, Settings.string],
         }.freeze
 
-        Integration = Struct.new(:integration, :options)
+        # Struct constant whisker cast for Steep
+        Integration = _ = Struct.new(:integration, :options) # rubocop:disable Naming/ConstantName
 
         def initialize
           @integrations = []
@@ -112,23 +124,52 @@ module Datadog
         end
 
         def enabled
-          @options[:enabled]
+          # Cast for Steep
+          _ = @options[:enabled]
         end
 
         def ruleset
-          @options[:ruleset]
+          # Cast for Steep
+          _ = @options[:ruleset]
+        end
+
+        # EXPERIMENTAL: This configurable is not meant to be publicly used, but
+        #               is very useful for testing. It may change at any point in time.
+        def ip_denylist
+          # Cast for Steep
+          _ = @options[:ip_denylist] || []
+        end
+
+        # EXPERIMENTAL: This configurable is not meant to be publicly used, but
+        #               is very useful for testing. It may change at any point in time.
+        def user_id_denylist
+          # Cast for Steep
+          _ = @options[:user_id_denylist] || []
         end
 
         def waf_timeout
-          @options[:waf_timeout]
+          # Cast for Steep
+          _ = @options[:waf_timeout]
         end
 
         def waf_debug
-          @options[:waf_debug]
+          # Cast for Steep
+          _ = @options[:waf_debug]
         end
 
         def trace_rate_limit
-          @options[:trace_rate_limit]
+          # Cast for Steep
+          _ = @options[:trace_rate_limit]
+        end
+
+        def obfuscator_key_regex
+          # Cast for Steep
+          _ = @options[:obfuscator_key_regex]
+        end
+
+        def obfuscator_value_regex
+          # Cast for Steep
+          _ = @options[:obfuscator_value_regex]
         end
 
         def [](integration_name)
@@ -136,7 +177,7 @@ module Datadog
 
           raise ArgumentError, "'#{integration_name}' is not a valid integration." unless integration
 
-          integration.options if integration
+          integration.options
         end
 
         def merge(dsl)

data/lib/datadog/appsec/configuration.rb

@@ -1,6 +1,4 @@
-# typed: true
-
-require 'datadog/appsec/configuration/settings'
+require_relative 'configuration/settings'
 
 module Datadog
   module AppSec
@@ -14,7 +12,9 @@ module Datadog
 
       # Configuration DSL implementation
       class DSL
-        Instrument = Struct.new(:name, :options)
+        # Struct constant whisker cast for Steep
+        Instrument = _ = Struct.new(:name, :options) # rubocop:disable Naming/ConstantName
+
         def initialize
           @instruments = []
           @options = {}
@@ -34,6 +34,14 @@ module Datadog
           options[:ruleset] = value
         end
 
+        def ip_denylist=(value)
+          options[:ip_denylist] = value
+        end
+
+        def user_id_denylist=(value)
+          options[:user_id_denylist] = value
+        end
+
         # in microseconds
         def waf_timeout=(value)
           options[:waf_timeout] = value
@@ -47,6 +55,14 @@ module Datadog
           options[:trace_rate_limit] = value
         end
 
+        def obfuscator_key_regex=(value)
+          options[:obfuscator_key_regex] = value
+        end
+
+        def obfuscator_value_regex=(value)
+          options[:obfuscator_value_regex] = value
+        end
+
         def [](key)
           found = @instruments.find { |e| e.name == key }
 

data/lib/datadog/appsec/contrib/auto_instrument.rb

@@ -1,7 +1,3 @@
-# typed: true
-
-require 'ddtrace'
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/configuration/settings.rb

@@ -1,6 +1,4 @@
-# typed: false
-
-require 'datadog/core/configuration/base'
+require_relative '../../../core/configuration/base'
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/integration.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/patcher.rb

@@ -1,5 +1,3 @@
-# typed: strict
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rack/configuration/settings.rb

@@ -1,7 +1,5 @@
-# typed: false
-
-require 'datadog/appsec/contrib/configuration/settings'
-require 'datadog/appsec/contrib/rack/ext'
+require_relative '../../configuration/settings'
+require_relative '../ext'
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/rack/ext.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rack/gateway/request.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+require_relative '../../../instrumentation/gateway/argument'
+require_relative '../../../../core/header_collection'
+require_relative '../../../../tracing/client_ip'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Gateway
+          # Gateway Request argument. Normalized extration of data from Rack::Request
+          class Request < Instrumentation::Gateway::Argument
+            attr_reader :env
+
+            def initialize(env)
+              super
+              @env = env
+            end
+
+            def request
+              @request ||= ::Rack::Request.new(env)
+            end
+
+            def query
+              # Downstream libddwaf expects keys and values to be extractable
+              # separately so we can't use [[k, v], ...]. We also want to allow
+              # duplicate keys, so we use [{k, v}, ...] instead.
+              request.query_string.split('&').map do |e|
+                k, v = e.split('=').map { |s| CGI.unescape(s) }
+
+                { k => v }
+              end
+            end
+
+            # Rack < 2.0 does not have :each_header
+            # TODO: We need access to Rack here. We must make sure we are able to load AppSec without Rack,
+            # TODO: while still ensure correctness in ths code path.
+            if defined?(::Rack) && ::Rack::Request.instance_methods.include?(:each_header)
+              def headers
+                request.each_header.each_with_object({}) do |(k, v), h|
+                  h[k.gsub(/^HTTP_/, '').downcase.tr('_', '-')] = v if k =~ /^HTTP_/
+                end
+              end
+            else
+              def headers
+                request.env.each_with_object({}) do |(k, v), h|
+                  h[k.gsub(/^HTTP_/, '').downcase.tr('_', '-')] = v if k =~ /^HTTP_/
+                end
+              end
+            end
+
+            def body
+              request.body.read.tap { request.body.rewind }
+            end
+
+            def url
+              request.url
+            end
+
+            def cookies
+              request.cookies
+            end
+
+            def host
+              request.host
+            end
+
+            def user_agent
+              request.user_agent
+            end
+
+            def remote_addr
+              env['REMOTE_ADDR']
+            end
+
+            def form_hash
+              # force form data processing
+              request.POST if request.form_data?
+
+              # usually Hash<String,String> but can be a more complex
+              # Hash<String,String||Array||Hash> when e.g coming from JSON
+              env['rack.request.form_hash']
+            end
+
+            def client_ip
+              remote_ip = remote_addr
+              header_collection = Datadog::Core::HeaderCollection.from_hash(headers)
+
+              Datadog::Tracing::ClientIp.extract_client_ip(header_collection, remote_ip)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/gateway/response.rb

@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+require_relative '../../../instrumentation/gateway/argument'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rack
+        module Gateway
+          # Gateway Response argument.
+          class Response < Instrumentation::Gateway::Argument
+            attr_reader :body, :status, :headers, :active_context
+
+            def initialize(body, status, headers, active_context:)
+              super
+              @body = body
+              @status = status
+              @headers = headers.each_with_object({}) { |(k, v), h| h[k.downcase] = v }
+              @active_context = active_context
+            end
+
+            def response
+              @response ||= ::Rack::Response.new(body, status, headers)
+            end
+          end
+        end
+      end
+    end
+  end
+end