ddtrace 1.1.0 → 1.12.1

data/lib/datadog/appsec/contrib/sinatra/framework.rb

@@ -1,4 +1,4 @@
-# typed: true
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
@@ -12,21 +12,9 @@ module Datadog
           # Configure Rack from Sinatra, but only if Rack has not been configured manually beforehand
           def self.setup
             Datadog::AppSec.configure do |datadog_config|
-              sinatra_config = config_with_defaults(datadog_config)
-              activate_rack!(datadog_config, sinatra_config)
+              datadog_config.instrument(:rack)
             end
           end
-
-          def self.config_with_defaults(datadog_config)
-            datadog_config[:sinatra]
-          end
-
-          # Apply relevant configuration from Sinatra to Rack
-          def self.activate_rack!(datadog_config, sinatra_config)
-            datadog_config.instrument(
-              :rack,
-            )
-          end
         end
       end
     end

data/lib/datadog/appsec/contrib/sinatra/gateway/request.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require_relative '../../rack/gateway/request'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Gateway
+          # Gateway Request argument. Normalized extration of data from Rack::Request
+          class Request < Rack::Gateway::Request
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/gateway/route_params.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative '../../../instrumentation/gateway/argument'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Gateway
+          # Gateway Route Params argument.
+          class RouteParams < Instrumentation::Gateway::Argument
+            attr_reader :params
+
+            def initialize(params)
+              super()
+              @params = params
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -1,119 +1,108 @@
-# typed: false
-
-require 'datadog/appsec/instrumentation/gateway'
-require 'datadog/appsec/reactive/operation'
-require 'datadog/appsec/contrib/rack/reactive/request_body'
-require 'datadog/appsec/contrib/sinatra/reactive/routed'
-require 'datadog/appsec/event'
+require_relative '../../../instrumentation/gateway'
+require_relative '../../../reactive/operation'
+require_relative '../../rack/reactive/request_body'
+require_relative '../reactive/routed'
+require_relative '../../../event'
 
 module Datadog
   module AppSec
     module Contrib
       module Sinatra
         module Gateway
-          # Watcher for Rails gateway events
+          # Watcher for Sinatra gateway events
           module Watcher
-            # rubocop:disable Metrics/MethodLength
-            def self.watch
-              Instrumentation.gateway.watch('sinatra.request.dispatch') do |stack, request|
-                block = false
-                event = nil
-                waf_context = request.env['datadog.waf.context']
-
-                AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
-                  trace = active_trace
-                  span = active_span
-
-                  Rack::Reactive::RequestBody.subscribe(op, waf_context) do |action, result, _block|
-                    record = [:block, :monitor].include?(action)
-                    if record
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: trace,
-                        span: span,
-                        request: request,
-                        action: action
-                      }
-
-                      waf_context.events << event
-                    end
-                  end
-
-                  _action, _result, block = Rack::Reactive::RequestBody.publish(op, request)
-                end
-
-                next [nil, [[:block, event]]] if block
-
-                ret, res = stack.call(request)
-
-                if event
-                  res ||= []
-                  res << [:monitor, event]
-                end
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
 
-                [ret, res]
+                watch_request_dispatch(gateway)
+                watch_request_routed(gateway)
               end
 
-              Instrumentation.gateway.watch('sinatra.request.routed') do |stack, (request, route_params)|
-                block = false
-                event = nil
-                waf_context = request.env['datadog.waf.context']
-
-                AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
-                  trace = active_trace
-                  span = active_span
-
-                  Sinatra::Reactive::Routed.subscribe(op, waf_context) do |action, result, _block|
-                    record = [:block, :monitor].include?(action)
-                    if record
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: trace,
-                        span: span,
-                        request: request,
-                        action: action
-                      }
-
-                      waf_context.events << event
+              def watch_request_dispatch(gateway = Instrumentation.gateway)
+                gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
+                  block = false
+                  event = nil
+                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
+
+                  AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
+                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: scope.trace,
+                          span: scope.service_entry_span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        if scope.service_entry_span
+                          scope.service_entry_span.set_tag('appsec.blocked', 'true') if result.actions.include?('block')
+                          scope.service_entry_span.set_tag('appsec.event', 'true')
+                        end
+
+                        scope.processor_context.events << event
+                      end
                     end
+
+                    _result, block = Rack::Reactive::RequestBody.publish(op, gateway_request)
                   end
 
-                  _action, _result, block = Sinatra::Reactive::Routed.publish(op, [request, route_params])
-                end
+                  next [nil, [[:block, event]]] if block
 
-                next [nil, [[:block, event]]] if block
+                  ret, res = stack.call(gateway_request.request)
 
-                ret, res = stack.call(request)
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
 
-                if event
-                  res ||= []
-                  res << [:monitor, event]
+                  [ret, res]
                 end
-
-                [ret, res]
               end
-            end
-            # rubocop:enable Metrics/MethodLength
-
-            class << self
-              private
 
-              def active_trace
-                # TODO: factor out tracing availability detection
+              def watch_request_routed(gateway = Instrumentation.gateway)
+                gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
+                  block = false
+                  event = nil
+                  scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
+
+                  AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
+                    Sinatra::Reactive::Routed.subscribe(op, scope.processor_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: scope.trace,
+                          span: scope.service_entry_span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        if scope.service_entry_span
+                          scope.service_entry_span.set_tag('appsec.blocked', 'true') if result.actions.include?('block')
+                          scope.service_entry_span.set_tag('appsec.event', 'true')
+                        end
+
+                        scope.processor_context.events << event
+                      end
+                    end
 
-                return unless defined?(Datadog::Tracing)
+                    _result, block = Sinatra::Reactive::Routed.publish(op, [gateway_request, gateway_route_params])
+                  end
 
-                Datadog::Tracing.active_trace
-              end
+                  next [nil, [[:block, event]]] if block
 
-              def active_span
-                # TODO: factor out tracing availability detection
+                  ret, res = stack.call(gateway_request.request)
 
-                return unless defined?(Datadog::Tracing)
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
 
-                Datadog::Tracing.active_span
+                  [ret, res]
+                end
               end
             end
           end

data/lib/datadog/appsec/contrib/sinatra/integration.rb

@@ -1,10 +1,7 @@
-# typed: ignore
+require_relative '../integration'
 
-require 'datadog/appsec/contrib/integration'
-
-require 'datadog/appsec/contrib/sinatra/configuration/settings'
-require 'datadog/appsec/contrib/sinatra/patcher'
-require 'datadog/appsec/contrib/sinatra/request_middleware'
+require_relative 'patcher'
+require_relative 'request_middleware'
 
 module Datadog
   module AppSec
@@ -34,10 +31,6 @@ module Datadog
             true
           end
 
-          def default_configuration
-            Configuration::Settings.new
-          end
-
           def patcher
             Patcher
           end

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -1,12 +1,14 @@
-# typed: ignore
-
-require 'datadog/tracing/contrib/rack/middlewares'
-
-require 'datadog/appsec/contrib/patcher'
-require 'datadog/appsec/contrib/rack/request_middleware'
-require 'datadog/appsec/contrib/sinatra/framework'
-require 'datadog/appsec/contrib/sinatra/gateway/watcher'
-require 'datadog/tracing/contrib/sinatra/framework'
+require_relative '../../../tracing/contrib/rack/middlewares'
+
+require_relative '../patcher'
+require_relative '../../response'
+require_relative '../rack/request_middleware'
+require_relative 'framework'
+require_relative 'ext'
+require_relative 'gateway/watcher'
+require_relative 'gateway/route_params'
+require_relative 'gateway/request'
+require_relative '../../../tracing/contrib/sinatra/framework'
 
 module Datadog
   module AppSec
@@ -31,9 +33,11 @@ module Datadog
               tracing_middleware = Datadog::Tracing::Contrib::Rack::TraceMiddleware
 
               if tracing_sinatra_framework.include_middleware?(tracing_middleware, builder)
-                tracing_sinatra_framework.add_middleware_after(tracing_middleware,
-                                                               Datadog::AppSec::Contrib::Rack::RequestMiddleware,
-                                                               builder)
+                tracing_sinatra_framework.add_middleware_after(
+                  tracing_middleware,
+                  Datadog::AppSec::Contrib::Rack::RequestMiddleware,
+                  builder
+                )
               else
                 tracing_sinatra_framework.add_middleware(Datadog::AppSec::Contrib::Rack::RequestMiddleware, builder)
               end
@@ -48,20 +52,21 @@ module Datadog
           def dispatch!
             env = @request.env
 
-            context = env['datadog.waf.context']
+            context = env[Datadog::AppSec::Ext::SCOPE_KEY]
 
             return super unless context
 
             # TODO: handle exceptions, except for super
 
-            request_return, request_response = Instrumentation.gateway.push('sinatra.request.dispatch', request) do
-              super
+            gateway_request = Gateway::Request.new(env)
+
+            request_return, request_response = Instrumentation.gateway.push('sinatra.request.dispatch', gateway_request) do
+              # handle process_route interruption
+              catch(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT) { super }
             end
 
             if request_response && request_response.any? { |action, _event| action == :block }
-              self.response = ::Sinatra::Response.new([Datadog::AppSec::Assets.blocked],
-                                                      403,
-                                                      { 'Content-Type' => 'text/html' })
+              self.response = AppSec::Response.negotiate(env).to_sinatra_response
               request_return = nil
             end
 
@@ -76,7 +81,7 @@ module Datadog
           def process_route(*)
             env = @request.env
 
-            context = env['datadog.waf.context']
+            context = env[Datadog::AppSec::Ext::SCOPE_KEY]
 
             return super unless context
 
@@ -90,9 +95,20 @@ module Datadog
               # At this point params has both route params and normal params.
               route_params = params.each.with_object({}) { |(k, v), h| h[k] = v unless base_params.key?(k) }
 
-              Instrumentation.gateway.push('sinatra.request.routed', [request, route_params])
+              gateway_request = Gateway::Request.new(env)
+              gateway_route_params = Gateway::RouteParams.new(route_params)
 
-              # TODO: handle block
+              _, request_response = Instrumentation.gateway.push(
+                'sinatra.request.routed',
+                [gateway_request, gateway_route_params]
+              )
+
+              if request_response && request_response.any? { |action, _event| action == :block }
+                self.response = AppSec::Response.negotiate(env).to_sinatra_response
+
+                # interrupt request and return response to dispatch! for consistency
+                throw(Datadog::AppSec::Contrib::Sinatra::Ext::ROUTE_INTERRUPT, response)
+              end
 
               yield(*args)
             end

data/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb

@@ -1,29 +1,30 @@
-# typed: true
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
     module Contrib
       module Sinatra
         module Reactive
-          # Dispatch data from a Rack request to the WAF context
+          # Dispatch data from a Sinatra request to the WAF context
           module Routed
+            ADDRESSES = [
+              'sinatra.request.route_params',
+            ].freeze
+            private_constant :ADDRESSES
+
             def self.publish(op, data)
               _request, route_params = data
 
               catch(:block) do
-                op.publish('sinatra.request.route_params', route_params)
+                op.publish('sinatra.request.route_params', route_params.params)
 
                 nil
               end
             end
 
             def self.subscribe(op, waf_context)
-              addresses = [
-                'sinatra.request.route_params',
-              ]
-
-              op.subscribe(*addresses) do |*values|
-                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 path_params = values[0]
 
                 waf_args = {
@@ -31,27 +32,27 @@ module Datadog
                 }
 
                 waf_timeout = Datadog::AppSec.settings.waf_timeout
-                action, result = waf_context.run(waf_args, waf_timeout)
+                result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
 
-                # TODO: encapsulate return array in a type
-                case action
-                when :monitor
-                  Datadog.logger.debug { "WAF: #{result.inspect}" }
-                  yield [action, result, false]
-                when :block
+                case result.status
+                when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
-                  yield [action, result, true]
-                  throw(:block, [action, result, true])
-                when :good
+
+                  block = result.actions.include?('block')
+
+                  yield [result, block]
+
+                  throw(:block, [result, true]) if block
+                when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call
                   Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
                 when :invalid_rule, :invalid_flow, :no_rule
                   Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
                 else
-                  Datadog.logger.debug { "WAF UNKNOWN: #{action.inspect} #{result.inspect}" }
+                  Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
                 end
               end
             end

data/lib/datadog/appsec/contrib/sinatra/request_middleware.rb

@@ -1,4 +1,4 @@
-# typed: true
+# frozen_string_literal: true
 
 module Datadog
   module AppSec

data/lib/datadog/appsec/event.rb

@@ -1,10 +1,6 @@
-# typed: false
-
 require 'json'
 
-require 'datadog/appsec/contrib/rack/request'
-require 'datadog/appsec/contrib/rack/response'
-require 'datadog/appsec/rate_limiter'
+require_relative 'rate_limiter'
 
 module Datadog
   module AppSec
@@ -42,18 +38,16 @@ module Datadog
       #
       # This is expected to be called only once per trace for the rate limiter
       # to properly apply
-      def self.record(*events)
+      def self.record(span, *events)
         # ensure rate limiter is called only when there are events to record
         return if events.empty?
 
         Datadog::AppSec::RateLimiter.limit(:traces) do
-          record_via_span(*events)
+          record_via_span(span, *events)
         end
       end
 
-      # rubocop:disable Metrics/AbcSize
-      # rubocop:disable Metrics/MethodLength
-      def self.record_via_span(*events)
+      def self.record_via_span(span, *events)
         events.group_by { |e| e[:trace] }.each do |trace, event_group|
           unless trace
             Datadog.logger.debug { "{ error: 'no trace: cannot record', event_group: #{event_group.inspect}}" }
@@ -61,61 +55,59 @@ module Datadog
           end
 
           trace.keep!
+          trace.set_tag(
+            Datadog::Tracing::Metadata::Ext::Distributed::TAG_DECISION_MAKER,
+            Datadog::Tracing::Sampling::Ext::Decision::ASM
+          )
 
           # prepare and gather tags to apply
-          trace_tags = event_group.each_with_object({}) do |event, tags|
-            span = event[:span]
-
-            span.set_tag('appsec.event', 'true') if span
-
-            # TODO: assume HTTP request context for now
+          service_entry_tags = build_service_entry_tags(event_group)
+          # complex types are unsupported, we need to serialize to a string
+          triggers = service_entry_tags.delete('_dd.appsec.triggers')
+          span.set_tag('_dd.appsec.json', JSON.dump({ triggers: triggers }))
 
-            if (request = event[:request])
-              request_headers = AppSec::Contrib::Rack::Request.headers(request).select do |k, _|
-                ALLOWED_REQUEST_HEADERS.include?(k.downcase)
-              end
+          # apply tags to service entry span
+          service_entry_tags.each do |key, value|
+            span.set_tag(key, value)
+          end
+        end
+      end
 
-              request_headers.each do |header, value|
-                tags["http.request.headers.#{header}"] = value
-              end
+      def self.build_service_entry_tags(event_group)
+        event_group.each_with_object({}) do |event, tags|
+          # TODO: assume HTTP request context for now
 
-              tags['http.host'] = request.host
-              tags['http.useragent'] = request.user_agent
-              tags['network.client.ip'] = request.ip
+          if (request = event[:request])
+            request_headers = request.headers.select do |k, _|
+              ALLOWED_REQUEST_HEADERS.include?(k.downcase)
+            end
 
-              # tags['actor.ip'] = request.ip # TODO: uses client IP resolution algorithm
+            request_headers.each do |header, value|
+              tags["http.request.headers.#{header}"] = value
             end
 
-            if (response = event[:response])
-              response_headers = AppSec::Contrib::Rack::Response.headers(response).select do |k, _|
-                ALLOWED_RESPONSE_HEADERS.include?(k.downcase)
-              end
+            tags['http.host'] = request.host
+            tags['http.useragent'] = request.user_agent
+            tags['network.client.ip'] = request.remote_addr
+          end
 
-              response_headers.each do |header, value|
-                tags["http.response.headers.#{header}"] = value
-              end
+          if (response = event[:response])
+            response_headers = response.headers.select do |k, _|
+              ALLOWED_RESPONSE_HEADERS.include?(k.downcase)
             end
 
-            tags['_dd.origin'] = 'appsec'
-
-            # accumulate triggers
-            tags['_dd.appsec.triggers'] ||= []
-            tags['_dd.appsec.triggers'] += event[:waf_result].data
+            response_headers.each do |header, value|
+              tags["http.response.headers.#{header}"] = value
+            end
           end
 
-          # apply tags to root span
+          tags['_dd.origin'] = 'appsec'
 
-          # complex types are unsupported, we need to serialize to a string
-          triggers = trace_tags.delete('_dd.appsec.triggers')
-          trace.set_tag('_dd.appsec.json', JSON.dump({ triggers: triggers }))
-
-          trace_tags.each do |key, value|
-            trace.set_tag(key, value)
-          end
+          # accumulate triggers
+          tags['_dd.appsec.triggers'] ||= []
+          tags['_dd.appsec.triggers'] += event[:waf_result].data
         end
       end
-      # rubocop:enable Metrics/MethodLength
-      # rubocop:enable Metrics/AbcSize
     end
   end
 end

data/lib/datadog/appsec/ext.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Ext
+      INTERRUPT = :datadog_appsec_interrupt
+      SCOPE_KEY = 'datadog.appsec.scope'
+    end
+  end
+end