ddtrace 1.0.0 → 1.10.1

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -0,0 +1,131 @@
+require_relative '../../../instrumentation/gateway'
+require_relative '../../../reactive/operation'
+require_relative '../../rack/reactive/request_body'
+require_relative '../reactive/routed'
+require_relative '../../../event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Gateway
+          # Watcher for Sinatra gateway events
+          module Watcher
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
+
+                watch_request_dispatch(gateway)
+                watch_request_routed(gateway)
+              end
+
+              def watch_request_dispatch(gateway = Instrumentation.gateway)
+                gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
+                  block = false
+                  event = nil
+                  waf_context = gateway_request.env['datadog.waf.context']
+
+                  AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
+                    trace = active_trace
+                    span = active_span
+
+                    Rack::Reactive::RequestBody.subscribe(op, waf_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: trace,
+                          span: span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        span.set_tag('appsec.event', 'true') if span
+
+                        waf_context.events << event
+                      end
+                    end
+
+                    _result, block = Rack::Reactive::RequestBody.publish(op, gateway_request)
+                  end
+
+                  next [nil, [[:block, event]]] if block
+
+                  ret, res = stack.call(gateway_request.request)
+
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
+
+                  [ret, res]
+                end
+              end
+
+              def watch_request_routed(gateway = Instrumentation.gateway)
+                gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
+                  block = false
+                  event = nil
+                  waf_context = gateway_request.env['datadog.waf.context']
+
+                  AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
+                    trace = active_trace
+                    span = active_span
+
+                    Sinatra::Reactive::Routed.subscribe(op, waf_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: trace,
+                          span: span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        span.set_tag('appsec.event', 'true') if span
+
+                        waf_context.events << event
+                      end
+                    end
+
+                    _result, block = Sinatra::Reactive::Routed.publish(op, [gateway_request, gateway_route_params])
+                  end
+
+                  next [nil, [[:block, event]]] if block
+
+                  ret, res = stack.call(gateway_request.request)
+
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
+
+                  [ret, res]
+                end
+              end
+
+              private
+
+              def active_trace
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_trace
+              end
+
+              def active_span
+                # TODO: factor out tracing availability detection
+
+                return unless defined?(Datadog::Tracing)
+
+                Datadog::Tracing.active_span
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/integration.rb

@@ -1,10 +1,8 @@
-# typed: ignore
+require_relative '../integration'
 
-require 'datadog/appsec/contrib/integration'
-
-require 'datadog/appsec/contrib/sinatra/configuration/settings'
-require 'datadog/appsec/contrib/sinatra/patcher'
-require 'datadog/appsec/contrib/sinatra/request_middleware'
+require_relative 'configuration/settings'
+require_relative 'patcher'
+require_relative 'request_middleware'
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -1,12 +1,13 @@
-# typed: ignore
+require_relative '../../../tracing/contrib/rack/middlewares'
 
-require 'datadog/tracing/contrib/rack/middlewares'
-
-require 'datadog/appsec/contrib/patcher'
-require 'datadog/appsec/contrib/sinatra/integration'
-require 'datadog/appsec/contrib/rack/request_middleware'
-require 'datadog/appsec/contrib/sinatra/framework'
-require 'datadog/tracing/contrib/sinatra/framework'
+require_relative '../patcher'
+require_relative '../../response'
+require_relative '../rack/request_middleware'
+require_relative 'framework'
+require_relative 'gateway/watcher'
+require_relative 'gateway/route_params'
+require_relative 'gateway/request'
+require_relative '../../../tracing/contrib/sinatra/framework'
 
 module Datadog
   module AppSec
@@ -31,17 +32,88 @@ module Datadog
               tracing_middleware = Datadog::Tracing::Contrib::Rack::TraceMiddleware
 
               if tracing_sinatra_framework.include_middleware?(tracing_middleware, builder)
-                tracing_sinatra_framework.add_middleware_after(tracing_middleware,
-                                                               Datadog::AppSec::Contrib::Rack::RequestMiddleware,
-                                                               builder)
+                tracing_sinatra_framework.add_middleware_after(
+                  tracing_middleware,
+                  Datadog::AppSec::Contrib::Rack::RequestMiddleware,
+                  builder
+                )
               else
                 tracing_sinatra_framework.add_middleware(Datadog::AppSec::Contrib::Rack::RequestMiddleware, builder)
               end
+
               tracing_sinatra_framework.inspect_middlewares(builder)
             end
           end
         end
 
+        # Hook into Base#dispatch!, which encompasses route filters
+        module DispatchPatch
+          def dispatch!
+            env = @request.env
+
+            context = env['datadog.waf.context']
+
+            return super unless context
+
+            # TODO: handle exceptions, except for super
+
+            gateway_request = Gateway::Request.new(env)
+
+            request_return, request_response = Instrumentation.gateway.push('sinatra.request.dispatch', gateway_request) do
+              # handle process_route interruption
+              catch(Ext::ROUTE_INTERRUPT) { super }
+            end
+
+            if request_response && request_response.any? { |action, _event| action == :block }
+              self.response = AppSec::Response.negotiate(env).to_sinatra_response
+              request_return = nil
+            end
+
+            request_return
+          end
+        end
+
+        # Hook into Base#route_eval, which
+        # path params are returned by pattern.params in process_route, then
+        # merged with normal params, so we get both
+        module RoutePatch
+          def process_route(*)
+            env = @request.env
+
+            context = env['datadog.waf.context']
+
+            return super unless context
+
+            # process_route is called repeatedly until a route is found.
+            # Until then, params has no route params.
+            # Capture normal params.
+            base_params = params
+
+            super do |*args|
+              # This block is called only once the route is found.
+              # At this point params has both route params and normal params.
+              route_params = params.each.with_object({}) { |(k, v), h| h[k] = v unless base_params.key?(k) }
+
+              gateway_request = Gateway::Request.new(env)
+              gateway_route_params = Gateway::RouteParams.new(route_params)
+
+              _, request_response = Instrumentation.gateway.push(
+                'sinatra.request.routed',
+                [gateway_request, gateway_route_params]
+              )
+
+              if request_response && request_response.any? { |action, _event| action == :block }
+                self.response = AppSec::Response.negotiate(env).to_sinatra_response
+
+                # interrupt request and return response to dispatch! for consistency
+                throw(Ext::ROUTE_INTERRUPT, response)
+              end
+
+              yield(*args)
+            end
+          end
+        end
+
         # Patcher for AppSec on Sinatra
         module Patcher
           include Datadog::AppSec::Contrib::Patcher
@@ -57,9 +129,11 @@ module Datadog
           end
 
           def patch
+            Gateway::Watcher.watch
             patch_default_middlewares
+            patch_dispatch
+            patch_route
             setup_security
-
             Patcher.instance_variable_set(:@patched, true)
           end
 
@@ -70,6 +144,14 @@ module Datadog
           def patch_default_middlewares
             ::Sinatra::Base.singleton_class.prepend(DefaultMiddlewarePatch)
           end
+
+          def patch_dispatch
+            ::Sinatra::Base.prepend(DispatchPatch)
+          end
+
+          def patch_route
+            ::Sinatra::Base.prepend(RoutePatch)
+          end
         end
       end
     end

data/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Reactive
+          # Dispatch data from a Sinatra request to the WAF context
+          module Routed
+            ADDRESSES = [
+              'sinatra.request.route_params',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, data)
+              _request, route_params = data
+
+              catch(:block) do
+                op.publish('sinatra.request.route_params', route_params.params)
+
+                nil
+              end
+            end
+
+            def self.subscribe(op, waf_context)
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
+                path_params = values[0]
+
+                waf_args = {
+                  'server.request.path_params' => path_params,
+                }
+
+                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                result = waf_context.run(waf_args, waf_timeout)
+
+                Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+                case result.status
+                when :match
+                  Datadog.logger.debug { "WAF: #{result.inspect}" }
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
+                  Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+                when :invalid_call
+                  Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+                when :invalid_rule, :invalid_flow, :no_rule
+                  Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+                else
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
+                end
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/request_middleware.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/event.rb

@@ -1,8 +1,6 @@
-# typed: false
+require 'json'
 
-require 'datadog/appsec/contrib/rack/request'
-require 'datadog/appsec/contrib/rack/response'
-require 'datadog/appsec/rate_limiter'
+require_relative 'rate_limiter'
 
 module Datadog
   module AppSec
@@ -36,13 +34,20 @@ module Datadog
         Content-Language
       ].map!(&:downcase).freeze
 
+      # Record events for a trace
+      #
+      # This is expected to be called only once per trace for the rate limiter
+      # to properly apply
       def self.record(*events)
+        # ensure rate limiter is called only when there are events to record
+        return if events.empty?
+
         Datadog::AppSec::RateLimiter.limit(:traces) do
           record_via_span(*events)
         end
       end
 
-      # rubocop:disable Metrics/AbcSize
+      # rubocop:disable Metrics/MethodLength
       def self.record_via_span(*events)
         events.group_by { |e| e[:trace] }.each do |trace, event_group|
           unless trace
@@ -51,37 +56,39 @@ module Datadog
           end
 
           trace.keep!
+          trace.set_tag(
+            Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+            Datadog::Tracing::Sampling::Ext::Decision::ASM
+          )
 
           # prepare and gather tags to apply
           trace_tags = event_group.each_with_object({}) do |event, tags|
-            span = event[:span]
+            # TODO: assume HTTP request context for now
 
-            span.set_tag('appsec.event', 'true') if span
+            if (request = event[:request])
+              request_headers = request.headers.select do |k, _|
+                ALLOWED_REQUEST_HEADERS.include?(k.downcase)
+              end
 
-            request = event[:request]
-            response = event[:response]
+              request_headers.each do |header, value|
+                tags["http.request.headers.#{header}"] = value
+              end
 
-            # TODO: assume HTTP request context for now
-            request_headers = AppSec::Contrib::Rack::Request.headers(request).select do |k, _|
-              ALLOWED_REQUEST_HEADERS.include?(k.downcase)
-            end
-            response_headers = AppSec::Contrib::Rack::Response.headers(response).select do |k, _|
-              ALLOWED_RESPONSE_HEADERS.include?(k.downcase)
+              tags['http.host'] = request.host
+              tags['http.useragent'] = request.user_agent
+              tags['network.client.ip'] = request.remote_addr
             end
 
-            request_headers.each do |header, value|
-              tags["http.request.headers.#{header}"] = value
-            end
+            if (response = event[:response])
+              response_headers = response.headers.select do |k, _|
+                ALLOWED_RESPONSE_HEADERS.include?(k.downcase)
+              end
 
-            response_headers.each do |header, value|
-              tags["http.response.headers.#{header}"] = value
+              response_headers.each do |header, value|
+                tags["http.response.headers.#{header}"] = value
+              end
             end
 
-            tags['http.host'] = request.host
-            tags['http.useragent'] = request.user_agent
-            tags['network.client.ip'] = request.ip
-
-            # tags['actor.ip'] = request.ip # TODO: uses client IP resolution algorithm
             tags['_dd.origin'] = 'appsec'
 
             # accumulate triggers
@@ -100,7 +107,7 @@ module Datadog
           end
         end
       end
-      # rubocop:enable Metrics/AbcSize
+      # rubocop:enable Metrics/MethodLength
     end
   end
 end

data/lib/datadog/appsec/ext.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Ext
+      INTERRUPT = :datadog_appsec_interrupt
+    end
+  end
+end

data/lib/datadog/appsec/extensions.rb

@@ -1,7 +1,4 @@
-# typed: false
-
-require 'forwardable'
-require 'datadog/appsec/configuration'
+require_relative 'configuration'
 
 module Datadog
   module AppSec
@@ -25,40 +22,39 @@ module Datadog
       # Merges {Datadog::AppSec::Configuration::Settings} and {Datadog::AppSec::Configuration::DSL}
       # into a single read/write object.
       class AppSecAdapter
-        extend Forwardable
-
         def initialize(settings)
           @settings = settings
         end
 
         # Writer methods
-        def trace_rate_limit=(arg)
+
+        def instrument(name, options = {})
           dsl = AppSec::Configuration::DSL.new
-          dsl.trace_rate_limit = arg
+          dsl.instrument(name, options)
           @settings.merge(dsl)
         end
 
-        def options(arg)
+        def enabled=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.options arg
+          dsl.enabled = arg
           @settings.merge(dsl)
         end
 
-        def instruments(arg)
+        def ruleset=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.instruments arg
+          dsl.ruleset = arg
           @settings.merge(dsl)
         end
 
-        def ruleset=(arg)
+        def ip_denylist=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.ruleset = arg
+          dsl.ip_denylist = arg
           @settings.merge(dsl)
         end
 
-        def instrument(*args)
+        def user_id_denylist=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.instrument(*args)
+          dsl.user_id_denylist = arg
           @settings.merge(dsl)
         end
 
@@ -68,33 +64,54 @@ module Datadog
           @settings.merge(dsl)
         end
 
-        def enabled=(arg)
+        def waf_debug=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.enabled = arg
+          dsl.waf_debug = arg
           @settings.merge(dsl)
         end
 
-        def waf_debug=(arg)
+        def trace_rate_limit=(arg)
           dsl = AppSec::Configuration::DSL.new
-          dsl.waf_debug = arg
+          dsl.trace_rate_limit = arg
+          @settings.merge(dsl)
+        end
+
+        def obfuscator_key_regex=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.obfuscator_key_regex = arg
+          @settings.merge(dsl)
+        end
+
+        def obfuscator_value_regex=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.obfuscator_value_regex = arg
           @settings.merge(dsl)
         end
 
         # Reader methods
-        def [](arg)
-          @settings[arg]
+
+        def [](key)
+          @settings[key]
+        end
+
+        def enabled
+          @settings.enabled
         end
 
         def ruleset
           @settings.ruleset
         end
 
-        def waf_timeout
-          @settings.waf_timeout
+        def ip_denylist
+          @settings.ip_denylist
         end
 
-        def enabled
-          @settings.enabled
+        def user_id_denylist
+          @settings.user_id_denylist
+        end
+
+        def waf_timeout
+          @settings.waf_timeout
         end
 
         def waf_debug
@@ -105,6 +122,14 @@ module Datadog
           @settings.trace_rate_limit
         end
 
+        def obfuscator_key_regex
+          @settings.obfuscator_key_regex
+        end
+
+        def obfuscator_value_regex
+          @settings.obfuscator_key_regex
+        end
+
         def merge(arg)
           @settings.merge(arg)
         end

data/lib/datadog/appsec/instrumentation/gateway/argument.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Instrumentation
+      class Gateway
+        # Base class for Gateway Arguments
+        class Argument
+          def initialize(*); end
+        end
+
+        # Gateway User argument
+        class User < Argument
+          attr_reader :id
+
+          def initialize(id)
+            super
+            @id = id
+          end
+        end
+      end
+    end
+  end
+end