ddtrace 1.11.0 → 1.11.1

Sign up to get free protection for your applications and to get access to all the features.
Files changed (12) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +13 -1
  3. data/lib/datadog/appsec/assets/blocked.html +1 -1
  4. data/lib/datadog/appsec/processor/rule_loader.rb +3 -3
  5. data/lib/datadog/appsec/processor/rule_merger.rb +7 -27
  6. data/lib/datadog/appsec/remote.rb +6 -10
  7. data/lib/datadog/appsec/response.rb +18 -10
  8. data/lib/datadog/core/configuration/components.rb +9 -3
  9. data/lib/datadog/core/telemetry/client.rb +1 -1
  10. data/lib/datadog/core/telemetry/http/transport.rb +1 -0
  11. data/lib/ddtrace/version.rb +1 -1
  12. metadata +3 -3
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: bf1177aae94a3724758e48ce461638de0a4b75956c8c1318251f2b568de28c5d
4
- data.tar.gz: f42454cd32ff7eaf91c7beda1e6ff8a99726efddc8e01fdb4797b4f115c29df4
3
+ metadata.gz: fab36ba8f93f2c9b067c2fcb4916d6aff5ef906d6608671f035490f3b287c6c9
4
+ data.tar.gz: 0f62cd63c95aa669f8981cb79c56e49228351a01920c142a36170a9443b60400
5
5
  SHA512:
6
- metadata.gz: 5d5787eb9f073043151922af478a75affcfe8f2a9723fbe6c8e0561be6c7f95c700c91e1f4ca10401e018f1587f0289b1720d5c38e2cccdb80f7fcffd7eba0ba
7
- data.tar.gz: 5f9d0adcfc38de9d60c51a46360ce60351228db21cabd07dc176a99f4bf77f80b0cc8f12dbe844ea3ae88f2384174158415a28de3e6adc1b6b54e56be1186665
6
+ metadata.gz: 6a747def8ca5cef1d31d72fff939567669c72db53b8c30a3b7cd14df8b52da21a4f5d18efbeba1a22686196923ed49195194b7a9136840428d73f4f8e985da67
7
+ data.tar.gz: 72f36c83fac54b4d503d38f40759a89d400c5d70b24fbcb7ebc8a291d603c0bab07f28ca58082b732afb66960fe9d6e7ab7148147f0e1b727bbaeb4f08a885a6
data/CHANGELOG.md CHANGED
@@ -2,6 +2,14 @@
2
2
 
3
3
  ## [Unreleased]
4
4
 
5
+ ## [1.11.1] - 2023-05-03
6
+
7
+ ### Fixed
8
+
9
+ * Appsec: Remove misreported `ASM_CUSTOM_RULES` capability ([#2829][])
10
+ * Appsec: Fix block response content negotiation ([#2824][])
11
+ * Appsec: Fix incorrect remote configuration payload key handling ([#2822][])
12
+
5
13
  ## [1.11.0] - 2023-04-27
6
14
 
7
15
  ### Highlights
@@ -2402,7 +2410,8 @@ Release notes: https://github.com/DataDog/dd-trace-rb/releases/tag/v0.3.1
2402
2410
 
2403
2411
  Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
2404
2412
 
2405
- [Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v1.11.0...master
2413
+ [Unreleased]: https://github.com/DataDog/dd-trace-rb/compare/v1.11.1...master
2414
+ [1.11.1]: https://github.com/DataDog/dd-trace-rb/compare/v1.10.1...v1.11.1
2406
2415
  [1.11.0]: https://github.com/DataDog/dd-trace-rb/compare/v1.10.1...v1.11.0
2407
2416
  [1.11.0.beta1]: https://github.com/DataDog/dd-trace-rb/compare/v1.10.1...v1.11.0.beta1
2408
2417
  [1.10.1]: https://github.com/DataDog/dd-trace-rb/compare/v1.10.0...v1.10.1
@@ -3457,6 +3466,9 @@ Git diff: https://github.com/DataDog/dd-trace-rb/compare/v0.3.0...v0.3.1
3457
3466
  [#2805]: https://github.com/DataDog/dd-trace-rb/issues/2805
3458
3467
  [#2806]: https://github.com/DataDog/dd-trace-rb/issues/2806
3459
3468
  [#2810]: https://github.com/DataDog/dd-trace-rb/issues/2810
3469
+ [#2822]: https://github.com/DataDog/dd-trace-rb/issues/2822
3470
+ [#2824]: https://github.com/DataDog/dd-trace-rb/issues/2824
3471
+ [#2829]: https://github.com/DataDog/dd-trace-rb/issues/2829
3460
3472
  [@AdrianLC]: https://github.com/AdrianLC
3461
3473
  [@Azure7111]: https://github.com/Azure7111
3462
3474
  [@BabyGroot]: https://github.com/BabyGroot
data/lib/datadog/appsec/assets/blocked.html CHANGED
@@ -1,4 +1,4 @@
1
- <!-- Sorry, you’ve been blocked -->
1
+ <!-- Sorry, you've been blocked -->
2
2
  <!DOCTYPE html>
3
3
  <html lang="en">
4
4
 
data/lib/datadog/appsec/processor/rule_loader.rb CHANGED
@@ -41,10 +41,10 @@ module Datadog
41
41
 
42
42
  def load_data(ip_denylist: [], user_id_denylist: [])
43
43
  data = []
44
- data << { 'rules_data' => [denylist_data('blocked_ips', ip_denylist)] } if ip_denylist.any?
45
- data << { 'rules_data' => [denylist_data('blocked_users', user_id_denylist)] } if user_id_denylist.any?
44
+ data << [denylist_data('blocked_ips', ip_denylist)] if ip_denylist.any?
45
+ data << [denylist_data('blocked_users', user_id_denylist)] if user_id_denylist.any?
46
46
 
47
- data.any? ? data : nil
47
+ data
48
48
  end
49
49
 
50
50
  private
data/lib/datadog/appsec/processor/rule_merger.rb CHANGED
@@ -17,12 +17,12 @@ module Datadog
17
17
  end
18
18
 
19
19
  class << self
20
- def merge(rules:, data: nil, overrides: nil, exclusions: nil)
20
+ def merge(rules:, data: [], overrides: [], exclusions: [])
21
21
  combined_rules = combine_rules(rules)
22
22
 
23
- rules_data = combine_data(data) if data
24
- rules_overrides = combine_overrides(overrides) if overrides
25
- rules_exclusions = combine_exclusions(exclusions) if exclusions
23
+ rules_data = combine_data(data) if data.any?
24
+ rules_overrides = combine_overrides(overrides) if overrides.any?
25
+ rules_exclusions = combine_exclusions(exclusions) if exclusions.any?
26
26
 
27
27
  combined_rules['rules_data'] = rules_data if rules_data
28
28
  combined_rules['rules_override'] = rules_overrides if rules_overrides
@@ -62,7 +62,7 @@ module Datadog
62
62
  result = []
63
63
 
64
64
  data.each do |data_entry|
65
- data_entry['rules_data'].each do |value|
65
+ data_entry.each do |value|
66
66
  existing_data = result.find { |x| x['id'] == value['id'] }
67
67
 
68
68
  if existing_data && existing_data['type'] == value['type']
@@ -113,31 +113,11 @@ module Datadog
113
113
  end
114
114
 
115
115
  def combine_overrides(overrides)
116
- rules_override = []
117
-
118
- overrides.each do |override|
119
- override['rules_override'].each do |rule_override|
120
- rules_override << rule_override
121
- end
122
- end
123
-
124
- return if rules_override.empty?
125
-
126
- rules_override
116
+ overrides.flatten
127
117
  end
128
118
 
129
119
  def combine_exclusions(exclusions)
130
- rules_exclusions = []
131
-
132
- exclusions.each do |exclusion|
133
- exclusion['exclusions'].each do |rule_exclusion|
134
- rules_exclusions << rule_exclusion
135
- end
136
- end
137
-
138
- return if rules_exclusions.empty?
139
-
140
- rules_exclusions
120
+ exclusions.flatten
141
121
  end
142
122
  end
143
123
  end
data/lib/datadog/appsec/remote.rb CHANGED
@@ -26,7 +26,6 @@ module Datadog
26
26
  ASM_CAPABILITIES = [
27
27
  CAP_ASM_IP_BLOCKING,
28
28
  CAP_ASM_USER_BLOCKING,
29
- CAP_ASM_CUSTOM_RULES,
30
29
  CAP_ASM_EXCLUSIONS,
31
30
  CAP_ASM_REQUEST_BLOCKING,
32
31
  CAP_ASM_RESPONSE_BLOCKING,
@@ -48,7 +47,6 @@ module Datadog
48
47
  remote_features_enabled? ? ASM_PRODUCTS : []
49
48
  end
50
49
 
51
- # rubocop:disable Metrics/MethodLength
52
50
  def receivers
53
51
  return [] unless remote_features_enabled?
54
52
 
@@ -63,18 +61,17 @@ module Datadog
63
61
  overrides = []
64
62
  exclusions = []
65
63
 
66
- asm_data_config_types = ['blocked_ips', 'blocked_users']
67
- asm_overrides_config_types = ['blocking', 'disabled_rules']
68
-
69
64
  repository.contents.each do |content|
65
+ parsed_content = parse_content(content)
66
+
70
67
  case content.path.product
71
68
  when 'ASM_DD'
72
- rules << parse_content(content)
69
+ rules << parsed_content
73
70
  when 'ASM_DATA'
74
- data << parse_content(content) if asm_data_config_types.include?(content.path.config_id)
71
+ data << parsed_content['rules_data'] if parsed_content['rules_data']
75
72
  when 'ASM'
76
- overrides << parse_content(content) if asm_overrides_config_types.include?(content.path.config_id)
77
- exclusions << parse_content(content) if content.path.config_id == 'exclusion_filters'
73
+ overrides << parsed_content['rules_override'] if parsed_content['rules_override']
74
+ exclusions << parsed_content['exclusions'] if parsed_content['exclusions']
78
75
  end
79
76
  end
80
77
 
@@ -98,7 +95,6 @@ module Datadog
98
95
 
99
96
  [receiver]
100
97
  end
101
- # rubocop:enable Metrics/MethodLength
102
98
 
103
99
  private
104
100
 
data/lib/datadog/appsec/response.rb CHANGED
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require_relative 'assets'
2
4
  require_relative 'utils/http/media_range'
3
5
 
@@ -27,33 +29,39 @@ module Datadog
27
29
 
28
30
  class << self
29
31
  def negotiate(env)
32
+ content_type = content_type(env)
33
+
34
+ Datadog.logger.debug { "negotiated response content type: #{content_type}" }
35
+
30
36
  Response.new(
31
37
  status: 403,
32
- headers: { 'Content-Type' => 'text/html' },
33
- body: [Datadog::AppSec::Assets.blocked(format: format(env))]
38
+ headers: { 'Content-Type' => content_type },
39
+ body: [Datadog::AppSec::Assets.blocked(format: FORMAT_MAP[content_type])]
34
40
  )
35
41
  end
36
42
 
37
43
  private
38
44
 
39
45
  FORMAT_MAP = {
46
+ 'text/plain' => :text,
40
47
  'text/html' => :html,
41
48
  'application/json' => :json,
42
- 'text/plain' => :text,
43
49
  }.freeze
44
50
 
45
- DEFAULT_FORMAT = :text
51
+ DEFAULT_CONTENT_TYPE = 'text/plain'
46
52
 
47
- def format(env)
48
- return DEFAULT_FORMAT unless env.key?('HTTP_ACCEPT')
53
+ def content_type(env)
54
+ return DEFAULT_CONTENT_TYPE unless env.key?('HTTP_ACCEPT')
49
55
 
50
- accepted = env['HTTP_ACCEPT'].split(',').map { |m| Utils::HTTP::MediaRange.new(m) }.sort
56
+ accepted = env['HTTP_ACCEPT'].split(',').map { |m| Utils::HTTP::MediaRange.new(m) }.sort!.reverse!
51
57
 
52
- accepted.each_with_object(DEFAULT_FORMAT) do |_default, range|
53
- format = FORMAT_MAP.keys.find { |type, _format| range === type }
58
+ accepted.each_with_object(DEFAULT_CONTENT_TYPE) do |range, _default|
59
+ match = FORMAT_MAP.keys.find { |type| range === type }
54
60
 
55
- return FORMAT_MAP[format] if format
61
+ return match if match
56
62
  end
63
+ rescue Datadog::AppSec::Utils::HTTP::MediaRange::ParseError
64
+ DEFAULT_CONTENT_TYPE
57
65
  end
58
66
  end
59
67
  end
data/lib/datadog/core/configuration/components.rb CHANGED
@@ -52,8 +52,14 @@ module Datadog
52
52
  Core::Workers::RuntimeMetrics.new(options)
53
53
  end
54
54
 
55
- def build_telemetry(settings)
56
- Telemetry::Client.new(enabled: settings.telemetry.enabled)
55
+ def build_telemetry(settings, agent_settings, logger)
56
+ enabled = settings.telemetry.enabled
57
+ if agent_settings.adapter != Datadog::Transport::Ext::HTTP::ADAPTER
58
+ enabled = false
59
+ logger.debug { "Telemetry disabled. Agent network adapter not supported: #{agent_settings.adapter}" }
60
+ end
61
+
62
+ Telemetry::Client.new(enabled: enabled)
57
63
  end
58
64
  end
59
65
 
@@ -81,7 +87,7 @@ module Datadog
81
87
  )
82
88
  @runtime_metrics = self.class.build_runtime_metrics_worker(settings)
83
89
  @health_metrics = self.class.build_health_metrics(settings)
84
- @telemetry = self.class.build_telemetry(settings)
90
+ @telemetry = self.class.build_telemetry(settings, agent_settings, logger)
85
91
  @appsec = Datadog::AppSec::Component.build_appsec_component(settings)
86
92
  end
87
93
 
data/lib/datadog/core/telemetry/client.rb CHANGED
@@ -5,7 +5,7 @@ require_relative '../utils/forking'
5
5
  module Datadog
6
6
  module Core
7
7
  module Telemetry
8
- # Telemetry entrypoint, coordinates sending telemetry events at various points in app lifecyle
8
+ # Telemetry entrypoint, coordinates sending telemetry events at various points in app lifecycle.
9
9
  class Client
10
10
  attr_reader \
11
11
  :emitter,
data/lib/datadog/core/telemetry/http/transport.rb CHANGED
@@ -10,6 +10,7 @@ module Datadog
10
10
  module Telemetry
11
11
  module Http
12
12
  # Class to send telemetry data to Telemetry API
13
+ # Currently only supports the HTTP protocol.
13
14
  class Transport
14
15
  attr_reader \
15
16
  :host,
data/lib/ddtrace/version.rb CHANGED
@@ -4,7 +4,7 @@ module DDTrace
4
4
  module VERSION
5
5
  MAJOR = 1
6
6
  MINOR = 11
7
- PATCH = 0
7
+ PATCH = 1
8
8
  PRE = nil
9
9
  BUILD = nil
10
10
  # PRE and BUILD above are modified for dev gems during gem build GHA workflow
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: ddtrace
3
3
  version: !ruby/object:Gem::Version
4
- version: 1.11.0
4
+ version: 1.11.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - Datadog, Inc.
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2023-04-27 00:00:00.000000000 Z
11
+ date: 1980-01-01 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: msgpack
@@ -883,7 +883,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
883
883
  - !ruby/object:Gem::Version
884
884
  version: 2.0.0
885
885
  requirements: []
886
- rubygems_version: 3.4.5
886
+ rubygems_version: 3.3.20
887
887
  signing_key:
888
888
  specification_version: 4
889
889
  summary: Datadog tracing code for your Ruby applications