ddtrace 1.12.1 → 1.18.0

data/lib/datadog/appsec/configuration/settings.rb

@@ -1,223 +1,201 @@
 # frozen_string_literal: true
 
-require 'set'
+require_relative '../../core/utils/duration'
+require_relative '../sample_rate'
 
 module Datadog
   module AppSec
     module Configuration
-      # Configuration settings, acting as an integration registry
-      # TODO: as with Configuration, this is a trivial implementation
-      class Settings
-        class << self
-          def boolean
-            # @type ^(::String) -> bool
-            ->(v) do # rubocop:disable Style/Lambda
-              case v
-              when /(1|true)/i
-                true
-              when /(0|false)/i, nil
-                false
-              else
-                raise ArgumentError, "invalid boolean: #{v.inspect}"
-              end
-            end
-          end
+      # Settings
+      module Settings
+        # rubocop:disable Layout/LineLength
+        DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'
+        DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'
+        # rubocop:enable Layout/LineLength
+        APPSEC_VALID_TRACK_USER_EVENTS_MODE = [
+          'safe',
+          'extended'
+        ].freeze
+        APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES = [
+          '1',
+          'true'
+        ].concat(APPSEC_VALID_TRACK_USER_EVENTS_MODE).freeze
+
+        def self.extended(base)
+          base = base.singleton_class unless base.is_a?(Class)
+          add_settings!(base)
+        end
 
-          # TODO: allow symbols
-          def string
-            # @type ^(::String) -> ::String
-            ->(v) { v.to_s }
-          end
+        # rubocop:disable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+        def self.add_settings!(base)
+          base.class_eval do
+            settings :appsec do
+              option :enabled do |o|
+                o.type :bool
+                o.env 'DD_APPSEC_ENABLED'
+                o.default false
+              end
 
-          def integer
-            # @type ^(::String) -> ::Integer
-            ->(v) do # rubocop:disable Style/Lambda
-              case v
-              when /(\d+)/
-                Regexp.last_match(1).to_i
-              else
-                raise ArgumentError, "invalid integer: #{v.inspect}"
+              define_method(:instrument) do |integration_name|
+                if enabled
+                  registered_integration = Datadog::AppSec::Contrib::Integration.registry[integration_name]
+                  if registered_integration
+                    klass = registered_integration.klass
+                    if klass.loaded? && klass.compatible?
+                      instance = klass.new
+                      instance.patcher.patch unless instance.patcher.patched?
+                    end
+                  end
+                end
               end
-            end
-          end
 
-          # rubocop:disable Metrics/MethodLength
-          def duration(base = :ns, type = :integer)
-            # @type ^(::String) -> ::Integer | ::Float
-            ->(v) do # rubocop:disable Style/Lambda
-              cast = case type
-                     when :integer, Integer
-                       method(:Integer)
-                     when :float, Float
-                       method(:Float)
-                     else
-                       raise ArgumentError, "invalid type: #{v.inspect}"
-                     end
-
-              scale = case base
-                      when :s
-                        1_000_000_000
-                      when :ms
-                        1_000_000
-                      when :us
-                        1000
-                      when :ns
-                        1
-                      else
-                        raise ArgumentError, "invalid base: #{v.inspect}"
-                      end
+              option :ruleset do |o|
+                o.env 'DD_APPSEC_RULES'
+                o.default :recommended
+              end
 
-              case v
-              when /^(\d+)h$/
-                cast.call(Regexp.last_match(1)) * 1_000_000_000 * 60 * 60 / scale
-              when /^(\d+)m$/
-                cast.call(Regexp.last_match(1)) * 1_000_000_000 * 60 / scale
-              when /^(\d+)s$/
-                cast.call(Regexp.last_match(1)) * 1_000_000_000 / scale
-              when /^(\d+)ms$/
-                cast.call(Regexp.last_match(1)) * 1_000_000 / scale
-              when /^(\d+)us$/
-                cast.call(Regexp.last_match(1)) * 1_000 / scale
-              when /^(\d+)ns$/
-                cast.call(Regexp.last_match(1)) / scale
-              when /^(\d+)$/
-                cast.call(Regexp.last_match(1))
-              else
-                raise ArgumentError, "invalid duration: #{v.inspect}"
+              option :ip_passlist do |o|
+                o.default []
               end
-            end
-          end
-          # rubocop:enable Metrics/MethodLength
-        end
 
-        # rubocop:disable Layout/LineLength
-        DEFAULT_OBFUSCATOR_KEY_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'
-        DEFAULT_OBFUSCATOR_VALUE_REGEX = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\s*=[^;]|"\s*:\s*"[^"]+")|bearer\s+[a-z0-9\._\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\w=-]+\.ey[I-L][\w=-]+(?:\.[\w.+\/=-]+)?|[\-]{5}BEGIN[a-z\s]+PRIVATE\sKEY[\-]{5}[^\-]+[\-]{5}END[a-z\s]+PRIVATE\sKEY|ssh-rsa\s*[a-z0-9\/\.+]{100,}'
-        # rubocop:enable Layout/LineLength
+              option :ip_denylist do |o|
+                o.type :array
+                o.default []
+              end
 
-        DEFAULTS = {
-          enabled: false,
-          ruleset: :recommended,
-          waf_timeout: 5_000, # us
-          waf_debug: false,
-          trace_rate_limit: 100, # traces/s
-          obfuscator_key_regex: DEFAULT_OBFUSCATOR_KEY_REGEX,
-          obfuscator_value_regex: DEFAULT_OBFUSCATOR_VALUE_REGEX,
-        }.freeze
-
-        ENVS = {
-          'DD_APPSEC_ENABLED' => [:enabled, Settings.boolean],
-          'DD_APPSEC_RULES' => [:ruleset, Settings.string],
-          'DD_APPSEC_WAF_TIMEOUT' => [:waf_timeout, Settings.duration(:us)],
-          'DD_APPSEC_WAF_DEBUG' => [:waf_debug, Settings.boolean],
-          'DD_APPSEC_TRACE_RATE_LIMIT' => [:trace_rate_limit, Settings.integer],
-          'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP' => [:obfuscator_key_regex, Settings.string],
-          'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP' => [:obfuscator_value_regex, Settings.string],
-        }.freeze
-
-        # Struct constant whisker cast for Steep
-        Integration = _ = Struct.new(:integration) # rubocop:disable Naming/ConstantName
-
-        def initialize
-          @integrations = []
-          # Stores which options have been configured using Datadog.configure block or ENV variables
-          @configured = Set.new
-          @options = DEFAULTS.dup.tap do |options|
-            ENVS.each do |env, (key, conv)|
-              if ENV[env]
-                options[key] = conv.call(ENV[env])
-                @configured << key
+              option :user_id_denylist do |o|
+                o.type :array
+                o.default []
               end
-            end
-          end
-        end
 
-        def enabled
-          # Cast for Steep
-          _ = @options[:enabled]
-        end
+              option :waf_timeout do |o|
+                o.env 'DD_APPSEC_WAF_TIMEOUT' # us
+                o.default 5_000
+                o.setter do |v|
+                  Datadog::Core::Utils::Duration.call(v.to_s, base: :us)
+                end
+              end
 
-        def ruleset
-          # Cast for Steep
-          _ = @options[:ruleset]
-        end
+              option :waf_debug do |o|
+                o.env 'DD_APPSEC_WAF_DEBUG'
+                o.default false
+                o.type :bool
+              end
 
-        # EXPERIMENTAL: This configurable is not meant to be publicly used, but
-        #               is very useful for testing. It may change at any point in time.
-        def ip_denylist
-          # Cast for Steep
-          _ = @options[:ip_denylist] || []
-        end
+              option :trace_rate_limit do |o|
+                o.type :int
+                o.env 'DD_APPSEC_TRACE_RATE_LIMIT' # trace/s
+                o.default 100
+              end
 
-        # EXPERIMENTAL: This configurable is not meant to be publicly used, but
-        #               is very useful for testing. It may change at any point in time.
-        def user_id_denylist
-          # Cast for Steep
-          _ = @options[:user_id_denylist] || []
-        end
+              option :obfuscator_key_regex do |o|
+                o.type :string
+                o.env 'DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP'
+                o.default DEFAULT_OBFUSCATOR_KEY_REGEX
+              end
 
-        def waf_timeout
-          # Cast for Steep
-          _ = @options[:waf_timeout]
-        end
+              option :obfuscator_value_regex do |o|
+                o.type :string
+                o.env 'DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP'
+                o.default DEFAULT_OBFUSCATOR_VALUE_REGEX
+              end
 
-        def waf_debug
-          # Cast for Steep
-          _ = @options[:waf_debug]
-        end
+              settings :block do
+                settings :templates do
+                  option :html do |o|
+                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML'
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        raise(ArgumentError, "appsec.templates.html: file not found: #{value}") unless File.exist?(value)
 
-        def trace_rate_limit
-          # Cast for Steep
-          _ = @options[:trace_rate_limit]
-        end
+                        File.open(value, 'rb', &:read) || ''
+                      end
+                    end
+                  end
 
-        def obfuscator_key_regex
-          # Cast for Steep
-          _ = @options[:obfuscator_key_regex]
-        end
+                  option :json do |o|
+                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON'
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        raise(ArgumentError, "appsec.templates.json: file not found: #{value}") unless File.exist?(value)
 
-        def obfuscator_value_regex
-          # Cast for Steep
-          _ = @options[:obfuscator_value_regex]
-        end
+                        File.open(value, 'rb', &:read) || ''
+                      end
+                    end
+                  end
 
-        def merge(dsl)
-          dsl.options.each do |k, v|
-            unless v.nil?
-              @options[k] = v
-              @configured << k
-            end
-          end
+                  option :text do |o|
+                    o.env 'DD_APPSEC_HTTP_BLOCKED_TEMPLATE_TEXT'
+                    o.type :string, nilable: true
+                    o.setter do |value|
+                      if value
+                        raise(ArgumentError, "appsec.templates.text: file not found: #{value}") unless File.exist?(value)
 
-          return self unless @options[:enabled]
+                        File.open(value, 'rb', &:read) || ''
+                      end
+                    end
+                  end
+                end
+              end
 
-          # patcher.patch may call configure again, hence merge might be called again so it needs to be reentrant
-          dsl.instruments.each do |instrument|
-            # TODO: error handling
-            registered_integration = Datadog::AppSec::Contrib::Integration.registry[instrument.name]
-            @integrations << Integration.new(registered_integration)
+              settings :track_user_events do
+                option :enabled do |o|
+                  o.default true
+                  o.type :bool
+                  o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
+                  o.env_parser do |env_value|
+                    if env_value == 'disabled'
+                      false
+                    else
+                      APPSEC_VALID_TRACK_USER_EVENTS_ENABLED_VALUES.include?(env_value.strip.downcase)
+                    end
+                  end
+                end
+
+                option :mode do |o|
+                  o.type :string
+                  o.env 'DD_APPSEC_AUTOMATED_USER_EVENTS_TRACKING'
+                  o.default 'safe'
+                  o.setter do |v|
+                    if APPSEC_VALID_TRACK_USER_EVENTS_MODE.include?(v)
+                      v
+                    elsif v == 'disabled'
+                      'safe'
+                    else
+                      Datadog.logger.warn(
+                        'The appsec.track_user_events.mode value provided is not supported.' \
+                        'Supported values are: safe | extended.' \
+                        'Using default value `safe`'
+                      )
+                      'safe'
+                    end
+                  end
+                end
+              end
 
-            # TODO: move to a separate apply step
-            klass = registered_integration.klass
-            if klass.loaded? && klass.compatible?
-              instance = klass.new
-              instance.patcher.patch
+              settings :api_security do
+                option :enabled do |o|
+                  o.type :bool
+                  o.env 'DD_EXPERIMENTAL_API_SECURITY_ENABLED'
+                  o.default false
+                end
+
+                option :sample_rate do |o|
+                  o.type :float
+                  o.env 'DD_API_SECURITY_REQUEST_SAMPLE_RATE'
+                  o.default 0.1
+                  o.setter do |value|
+                    value = 1 if value > 1
+                    SampleRate.new(value)
+                  end
+                end
+              end
             end
           end
-
-          self
-        end
-
-        private
-
-        def default?(option)
-          !@configured.include?(option)
-        end
-
-        # Restore to original state, for testing only.
-        def reset!
-          initialize
         end
+        # rubocop:enable Metrics/AbcSize,Metrics/MethodLength,Metrics/BlockLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
       end
     end
   end

data/lib/datadog/appsec/configuration.rb

@@ -5,86 +5,7 @@ require_relative 'configuration/settings'
 module Datadog
   module AppSec
     # Configuration for AppSec
-    # TODO: this is a trivial implementation, check with shareable code with
-    # tracer and other products
     module Configuration
-      def self.included(base)
-        base.extend(ClassMethods)
-      end
-
-      # Configuration DSL implementation
-      class DSL
-        # Struct constant whisker cast for Steep
-        Instrument = _ = Struct.new(:name) # rubocop:disable Naming/ConstantName
-
-        def initialize
-          @instruments = []
-          @options = {}
-        end
-
-        attr_reader :instruments, :options
-
-        def instrument(name)
-          @instruments << Instrument.new(name)
-        end
-
-        def enabled=(value)
-          options[:enabled] = value
-        end
-
-        def ruleset=(value)
-          options[:ruleset] = value
-        end
-
-        def ip_denylist=(value)
-          options[:ip_denylist] = value
-        end
-
-        def user_id_denylist=(value)
-          options[:user_id_denylist] = value
-        end
-
-        # in microseconds
-        def waf_timeout=(value)
-          options[:waf_timeout] = value
-        end
-
-        def waf_debug=(value)
-          options[:waf_debug] = value
-        end
-
-        def trace_rate_limit=(value)
-          options[:trace_rate_limit] = value
-        end
-
-        def obfuscator_key_regex=(value)
-          options[:obfuscator_key_regex] = value
-        end
-
-        def obfuscator_value_regex=(value)
-          options[:obfuscator_value_regex] = value
-        end
-      end
-
-      # class-level methods for Configuration
-      module ClassMethods
-        def configure
-          dsl = DSL.new
-          yield dsl
-          settings.merge(dsl)
-          settings
-        end
-
-        def settings
-          @settings ||= Settings.new
-        end
-
-        private
-
-        def default_setting?(setting)
-          settings.send(:default?, setting)
-        end
-      end
     end
   end
 end

data/lib/datadog/appsec/contrib/auto_instrument.rb

@@ -15,10 +15,8 @@ module Datadog
             integrations << integration.name
           end
 
-          Datadog::AppSec.configure do |c|
-            integrations.each do |integration_name|
-              c.instrument integration_name
-            end
+          integrations.each do |integration_name|
+            Datadog.configuration.appsec.instrument integration_name
           end
         end
       end

data/lib/datadog/appsec/contrib/devise/event.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Class to extract event information from the resource
+        class Event
+          UUID_REGEX = /^\h{8}-\h{4}-\h{4}-\h{4}-\h{12}$/.freeze
+
+          SAFE_MODE = 'safe'
+          EXTENDED_MODE = 'extended'
+
+          attr_reader :user_id
+
+          def initialize(resource, mode)
+            @resource = resource
+            @mode = mode
+            @user_id = nil
+            @email = nil
+            @username = nil
+
+            extract if @resource
+          end
+
+          def to_h
+            return @event if defined?(@event)
+
+            @event = {}
+            @event[:email] = @email if @email
+            @event[:username] = @username if @username
+            @event
+          end
+
+          private
+
+          def extract
+            @user_id = @resource.id
+
+            case @mode
+            when EXTENDED_MODE
+              @email = @resource.email
+              @username = @resource.username
+            when SAFE_MODE
+              @user_id = nil unless @user_id && @user_id.to_s =~ UUID_REGEX
+            else
+              Datadog.logger.warn(
+                "Invalid automated user evenst mode: `#{@mode}`. "\
+                              'Supported modes are: `safe` and `extended`.'
+              )
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/ext.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Devise integration constants
+        module Ext
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/integration.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require_relative '../integration'
+
+require_relative 'patcher'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Description of Devise integration
+        class Integration
+          include Datadog::AppSec::Contrib::Integration
+
+          MINIMUM_VERSION = Gem::Version.new('3.2.1')
+
+          register_as :devise, auto_patch: true
+
+          def self.version
+            Gem.loaded_specs['devise'] && Gem.loaded_specs['devise'].version
+          end
+
+          def self.loaded?
+            !defined?(::Devise).nil?
+          end
+
+          def self.compatible?
+            super && version >= MINIMUM_VERSION
+          end
+
+          def self.auto_instrument?
+            true
+          end
+
+          def patcher
+            Patcher
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/patcher/authenticatable_patch.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require_relative '../tracking'
+require_relative '../resource'
+require_relative '../event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        module Patcher
+          # Hook in devise validate method
+          module AuthenticatablePatch
+            # rubocop:disable Metrics/MethodLength
+            def validate(resource, &block)
+              result = super
+              return result unless AppSec.enabled?
+
+              track_user_events_configuration = Datadog.configuration.appsec.track_user_events
+
+              return result unless track_user_events_configuration.enabled
+
+              automated_track_user_events_mode = track_user_events_configuration.mode
+
+              appsec_scope = Datadog::AppSec.active_scope
+
+              return result unless appsec_scope
+
+              devise_resource = resource ? Resource.new(resource) : nil
+
+              event_information = Event.new(devise_resource, automated_track_user_events_mode)
+
+              if result
+                if event_information.user_id
+                  Datadog.logger.debug { 'User Login Event success' }
+                else
+                  Datadog.logger.debug { 'User Login Event success, but can\'t extract user ID. Tracking empty event' }
+                end
+
+                Tracking.track_login_success(
+                  appsec_scope.trace,
+                  appsec_scope.service_entry_span,
+                  user_id: event_information.user_id,
+                  **event_information.to_h
+                )
+
+                return result
+              end
+
+              user_exists = nil
+
+              if resource
+                user_exists = true
+                Datadog.logger.debug { 'User Login Event failure users exists' }
+              else
+                user_exists = false
+                Datadog.logger.debug { 'User Login Event failure user do not exists' }
+              end
+
+              Tracking.track_login_failure(
+                appsec_scope.trace,
+                appsec_scope.service_entry_span,
+                user_id: event_information.user_id,
+                user_exists: user_exists,
+                **event_information.to_h
+              )
+
+              result
+            end
+            # rubocop:enable Metrics/MethodLength
+          end
+        end
+      end
+    end
+  end
+end