ddtrace 1.12.1 → 1.23.2

data/lib/datadog/appsec/contrib/devise/patcher/registration_controller_patch.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require_relative '../tracking'
+require_relative '../resource'
+require_relative '../event'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        module Patcher
+          # Hook in devise registration controller
+          module RegistrationControllerPatch
+            def create
+              return super unless AppSec.enabled?
+
+              track_user_events_configuration = Datadog.configuration.appsec.track_user_events
+
+              return super unless track_user_events_configuration.enabled
+
+              automated_track_user_events_mode = track_user_events_configuration.mode
+
+              appsec_scope = Datadog::AppSec.active_scope
+              return super unless appsec_scope
+
+              super do |resource|
+                if resource.persisted?
+                  devise_resource = Resource.new(resource)
+
+                  event_information = Event.new(devise_resource, automated_track_user_events_mode)
+
+                  if event_information.user_id
+                    Datadog.logger.debug { 'User Signup Event' }
+                  else
+                    Datadog.logger.warn { 'User Signup Event, but can\'t extract user ID. Tracking empty event' }
+                  end
+
+                  Tracking.track_signup(
+                    appsec_scope.trace,
+                    appsec_scope.service_entry_span,
+                    user_id: event_information.user_id,
+                    **event_information.to_h
+                  )
+                end
+
+                yield resource if block_given?
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/patcher.rb

@@ -0,0 +1,45 @@
+# frozen_string_literal: true
+
+require_relative '../patcher'
+require_relative 'patcher/authenticatable_patch'
+require_relative 'patcher/registration_controller_patch'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Patcher for AppSec on Devise
+        module Patcher
+          include Datadog::AppSec::Contrib::Patcher
+
+          module_function
+
+          def patched?
+            Patcher.instance_variable_get(:@patched)
+          end
+
+          def target_version
+            Integration.version
+          end
+
+          def patch
+            patch_authenticable_strategy
+            patch_registration_controller
+
+            Patcher.instance_variable_set(:@patched, true)
+          end
+
+          def patch_authenticable_strategy
+            ::Devise::Strategies::Authenticatable.prepend(AuthenticatablePatch)
+          end
+
+          def patch_registration_controller
+            ::ActiveSupport.on_load(:after_initialize) do
+              ::Devise::RegistrationsController.prepend(RegistrationControllerPatch)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/resource.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Class to encpasulate extracting information from a Devise resource
+        # Normally a devise resource would be an Active::Record instance
+        class Resource
+          def initialize(resource)
+            @resource = resource
+          end
+
+          def id
+            extract(:id) || extract(:uuid)
+          end
+
+          def email
+            extract(:email)
+          end
+
+          def username
+            extract(:username)
+          end
+
+          private
+
+          def extract(method)
+            @resource.send(method) if @resource.respond_to?(method)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/devise/tracking.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require_relative '../../../kit/identity'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Devise
+        # Internal module to track user events
+        module Tracking
+          LOGIN_SUCCESS_EVENT = 'users.login.success'
+          LOGIN_FAILURE_EVENT = 'users.login.failure'
+          SIGNUP_EVENT = 'users.signup'
+
+          def self.track_login_success(trace, span, user_id:, **others)
+            return if trace.nil? || span.nil?
+
+            track(LOGIN_SUCCESS_EVENT, trace, span, **others)
+
+            Kit::Identity.set_user(trace, span, id: user_id.to_s, **others) if user_id
+          end
+
+          def self.track_login_failure(trace, span, user_id:, user_exists:, **others)
+            return if trace.nil? || span.nil?
+
+            track(LOGIN_FAILURE_EVENT, trace, span, **others)
+
+            span.set_tag('appsec.events.users.login.failure.usr.id', user_id) if user_id
+            span.set_tag('appsec.events.users.login.failure.usr.exists', user_exists)
+          end
+
+          def self.track_signup(trace, span, user_id:, **others)
+            return if trace.nil? || span.nil?
+
+            track(SIGNUP_EVENT, trace, span, **others)
+            Kit::Identity.set_user(trace, id: user_id.to_s, **others) if user_id
+          end
+
+          def self.track(event, trace, span, **others)
+            return if trace.nil? || span.nil?
+
+            span.set_tag("appsec.events.#{event}.track", 'true')
+            span.set_tag("_dd.appsec.events.#{event}.auto.mode", Datadog.configuration.appsec.track_user_events.mode)
+
+            others.each do |k, v|
+              raise ArgumentError, 'key cannot be :track' if k.to_sym == :track
+
+              span.set_tag("appsec.events.#{event}.#{k}", v) unless v.nil?
+            end
+
+            trace.keep!
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rack/ext.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
+
 module Datadog
   module AppSec
     module Contrib
       module Rack
         # Rack integration constants
         module Ext
-          APP = 'rack'.freeze
         end
       end
     end

data/lib/datadog/appsec/contrib/rack/gateway/request.rb

@@ -40,9 +40,13 @@ module Datadog
             end
 
             def headers
-              request.env.each_with_object({}) do |(k, v), h|
-                h[k.gsub(/^HTTP_/, '').downcase.tr('_', '-')] = v if k =~ /^HTTP_/
+              result = request.env.each_with_object({}) do |(k, v), h|
+                h[k.gsub(/^HTTP_/, '').downcase!.tr('_', '-')] = v if k =~ /^HTTP_/
               end
+
+              result['content-type'] = request.content_type if request.content_type
+              result['content-length'] = request.content_length if request.content_length
+              result
             end
 
             def body

data/lib/datadog/appsec/contrib/rack/gateway/watcher.rb

@@ -28,7 +28,7 @@ module Datadog
                   scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
 
                   AppSec::Reactive::Operation.new('rack.request') do |op|
-                    Rack::Reactive::Request.subscribe(op, scope.processor_context) do |result, _block|
+                    Rack::Reactive::Request.subscribe(op, scope.processor_context) do |result|
                       if result.status == :match
                         # TODO: should this hash be an Event instance instead?
                         event = {
@@ -48,7 +48,7 @@ module Datadog
                       end
                     end
 
-                    _result, block = Rack::Reactive::Request.publish(op, gateway_request)
+                    block = Rack::Reactive::Request.publish(op, gateway_request)
                   end
 
                   next [nil, [[:block, event]]] if block
@@ -67,11 +67,12 @@ module Datadog
               def watch_response(gateway = Instrumentation.gateway)
                 gateway.watch('rack.response', :appsec) do |stack, gateway_response|
                   block = false
+
                   event = nil
                   scope = gateway_response.scope
 
                   AppSec::Reactive::Operation.new('rack.response') do |op|
-                    Rack::Reactive::Response.subscribe(op, scope.processor_context) do |result, _block|
+                    Rack::Reactive::Response.subscribe(op, scope.processor_context) do |result|
                       if result.status == :match
                         # TODO: should this hash be an Event instance instead?
                         event = {
@@ -91,7 +92,7 @@ module Datadog
                       end
                     end
 
-                    _result, block = Rack::Reactive::Response.publish(op, gateway_response)
+                    block = Rack::Reactive::Response.publish(op, gateway_response)
                   end
 
                   next [nil, [[:block, event]]] if block
@@ -110,11 +111,12 @@ module Datadog
               def watch_request_body(gateway = Instrumentation.gateway)
                 gateway.watch('rack.request.body', :appsec) do |stack, gateway_request|
                   block = false
+
                   event = nil
                   scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
 
                   AppSec::Reactive::Operation.new('rack.request.body') do |op|
-                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result, _block|
+                    Rack::Reactive::RequestBody.subscribe(op, scope.processor_context) do |result|
                       if result.status == :match
                         # TODO: should this hash be an Event instance instead?
                         event = {
@@ -134,7 +136,7 @@ module Datadog
                       end
                     end
 
-                    _result, block = Rack::Reactive::RequestBody.publish(op, gateway_request)
+                    block = Rack::Reactive::RequestBody.publish(op, gateway_request)
                   end
 
                   next [nil, [[:block, event]]] if block

data/lib/datadog/appsec/contrib/rack/reactive/request.rb

@@ -30,7 +30,6 @@ module Datadog
               end
             end
 
-            # rubocop:disable Metrics/MethodLength
             def self.subscribe(op, waf_context)
               op.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
@@ -52,7 +51,7 @@ module Datadog
                   'server.request.method' => request_method,
                 }
 
-                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                waf_timeout = Datadog.configuration.appsec.waf_timeout
                 result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
@@ -61,11 +60,8 @@ module Datadog
                 when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
 
-                  block = result.actions.include?('block')
-
-                  yield [result, block]
-
-                  throw(:block, [result, true]) if block
+                  yield result
+                  throw(:block, true) unless result.actions.empty?
                 when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call
@@ -76,7 +72,6 @@ module Datadog
                   Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
                 end
               end
-              # rubocop:enable Metrics/MethodLength
             end
           end
         end

data/lib/datadog/appsec/contrib/rack/reactive/request_body.rb

@@ -30,7 +30,7 @@ module Datadog
                   'server.request.body' => body,
                 }
 
-                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                waf_timeout = Datadog.configuration.appsec.waf_timeout
                 result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
@@ -39,11 +39,8 @@ module Datadog
                 when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
 
-                  block = result.actions.include?('block')
-
-                  yield [result, block]
-
-                  throw(:block, [result, true]) if block
+                  yield result
+                  throw(:block, true) unless result.actions.empty?
                 when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call

data/lib/datadog/appsec/contrib/rack/reactive/response.rb

@@ -36,7 +36,7 @@ module Datadog
                   'server.response.headers.no_cookies' => response_headers_no_cookies,
                 }
 
-                waf_timeout = Datadog::AppSec.settings.waf_timeout
+                waf_timeout = Datadog.configuration.appsec.waf_timeout
                 result = waf_context.run(waf_args, waf_timeout)
 
                 Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
@@ -45,11 +45,8 @@ module Datadog
                 when :match
                   Datadog.logger.debug { "WAF: #{result.inspect}" }
 
-                  block = result.actions.include?('block')
-
-                  yield [result, block]
-
-                  throw(:block, [result, true]) if block
+                  yield result
+                  throw(:block, true) unless result.actions.empty?
                 when :ok
                   Datadog.logger.debug { "WAF OK: #{result.inspect}" }
                 when :invalid_call

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -30,8 +30,9 @@ module Datadog
               @app.call(env)
             end
 
-            if request_response && request_response.any? { |action, _event| action == :block }
-              request_return = AppSec::Response.negotiate(env).to_rack
+            if request_response
+              blocked_event = request_response.find { |action, _event| action == :block }
+              request_return = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_rack if blocked_event
             end
 
             request_return

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -13,6 +13,18 @@ module Datadog
   module AppSec
     module Contrib
       module Rack
+        # Create an array of lowercased headers
+        WAF_VENDOR_HEADERS_TAGS = %w[
+          X-Amzn-Trace-Id
+          Cloudfront-Viewer-Ja3-Fingerprint
+          Cf-Ray
+          X-Cloud-Trace-Context
+          X-Appgw-Trace-id
+          X-SigSci-RequestID
+          X-SigSci-Tags
+          Akamai-User-Risk
+        ].map(&:downcase).freeze
+
         # Topmost Rack middleware for AppSec
         # This should be inserted just below Datadog::Tracing::Contrib::Rack::TraceMiddleware
         class RequestMiddleware
@@ -20,13 +32,15 @@ module Datadog
             @app = app
 
             @oneshot_tags_sent = false
+            @rack_headers = {}
           end
 
           # rubocop:disable Metrics/AbcSize,Metrics/PerceivedComplexity,Metrics/CyclomaticComplexity,Metrics/MethodLength
           def call(env)
             return @app.call(env) unless Datadog::AppSec.enabled?
 
-            Datadog::Core::Remote.active_remote.barrier(:once) unless Datadog::Core::Remote.active_remote.nil?
+            boot = Datadog::Core::Remote::Tie.boot
+            Datadog::Core::Remote::Tie::Tracing.tag(boot, active_span)
 
             processor = nil
             ready = false
@@ -53,7 +67,8 @@ module Datadog
 
             gateway_request = Gateway::Request.new(env)
 
-            add_appsec_tags(processor, scope.trace, scope.service_entry_span, env)
+            add_appsec_tags(processor, scope)
+            add_request_tags(scope, env)
 
             request_return, request_response = catch(::Datadog::AppSec::Ext::INTERRUPT) do
               Instrumentation.gateway.push('rack.request', gateway_request) do
@@ -61,19 +76,30 @@ module Datadog
               end
             end
 
-            if request_response && request_response.any? { |action, _event| action == :block }
-              request_return = AppSec::Response.negotiate(env).to_rack
+            if request_response
+              blocked_event = request_response.find { |action, _options| action == :block }
+              request_return = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_rack if blocked_event
             end
 
             gateway_response = Gateway::Response.new(
               request_return[2],
               request_return[0],
               request_return[1],
-              scope: scope
+              scope: scope,
             )
 
             _response_return, response_response = Instrumentation.gateway.push('rack.response', gateway_response)
 
+            result = scope.processor_context.extract_schema
+
+            if result
+              scope.processor_context.events << {
+                trace: scope.trace,
+                span: scope.service_entry_span,
+                waf_result: result,
+              }
+            end
+
             scope.processor_context.events.each do |e|
               e[:response] ||= gateway_response
               e[:request]  ||= gateway_request
@@ -81,14 +107,15 @@ module Datadog
 
             AppSec::Event.record(scope.service_entry_span, *scope.processor_context.events)
 
-            if response_response && response_response.any? { |action, _event| action == :block }
-              request_return = AppSec::Response.negotiate(env).to_rack
+            if response_response
+              blocked_event = response_response.find { |action, _options| action == :block }
+              request_return = AppSec::Response.negotiate(env, blocked_event.last[:actions]).to_rack if blocked_event
             end
 
             request_return
           ensure
             if scope
-              add_waf_runtime_tags(scope.service_entry_span, scope.processor_context)
+              add_waf_runtime_tags(scope)
               Datadog::AppSec::Scope.deactivate_scope
             end
           end
@@ -116,35 +143,29 @@ module Datadog
             Datadog::Tracing.active_span
           end
 
-          def add_appsec_tags(processor, trace, span, env)
-            return unless trace
+          def add_appsec_tags(processor, scope)
+            span = scope.service_entry_span
+            trace = scope.trace
+
+            return unless trace && span
 
             span.set_tag('_dd.appsec.enabled', 1)
             span.set_tag('_dd.runtime_family', 'ruby')
             span.set_tag('_dd.appsec.waf.version', Datadog::AppSec::WAF::VERSION::BASE_STRING)
 
-            if span && span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
-              request_header_collection = Datadog::Tracing::Contrib::Rack::Header::RequestHeaderCollection.new(env)
+            if processor.diagnostics
+              diagnostics = processor.diagnostics
 
-              # always collect client ip, as this is part of AppSec provided functionality
-              Datadog::Tracing::ClientIp.set_client_ip_tag!(
-                span,
-                headers: request_header_collection,
-                remote_ip: env['REMOTE_ADDR']
-              )
-            end
-
-            if processor.ruleset_info
-              span.set_tag('_dd.appsec.event_rules.version', processor.ruleset_info[:version])
+              span.set_tag('_dd.appsec.event_rules.version', diagnostics['ruleset_version'])
 
               unless @oneshot_tags_sent
                 # Small race condition, but it's inoccuous: worst case the tags
                 # are sent a couple of times more than expected
                 @oneshot_tags_sent = true
 
-                span.set_tag('_dd.appsec.event_rules.loaded', processor.ruleset_info[:loaded].to_f)
-                span.set_tag('_dd.appsec.event_rules.error_count', processor.ruleset_info[:failed].to_f)
-                span.set_tag('_dd.appsec.event_rules.errors', JSON.dump(processor.ruleset_info[:errors]))
+                span.set_tag('_dd.appsec.event_rules.loaded', diagnostics['rules']['loaded'].size.to_f)
+                span.set_tag('_dd.appsec.event_rules.error_count', diagnostics['rules']['failed'].size.to_f)
+                span.set_tag('_dd.appsec.event_rules.errors', JSON.dump(diagnostics['rules']['errors']))
                 span.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(processor.addresses))
 
                 # Ensure these tags reach the backend
@@ -157,9 +178,34 @@ module Datadog
             end
           end
 
-          def add_waf_runtime_tags(span, context)
+          def add_request_tags(scope, env)
+            span = scope.service_entry_span
+
             return unless span
-            return unless context
+
+            # Always add WAF vendors headers
+            WAF_VENDOR_HEADERS_TAGS.each do |lowercase_header|
+              rack_header = to_rack_header(lowercase_header)
+              span.set_tag("http.request.headers.#{lowercase_header}", env[rack_header]) if env[rack_header]
+            end
+
+            if span && span.get_tag(Tracing::Metadata::Ext::HTTP::TAG_CLIENT_IP).nil?
+              request_header_collection = Datadog::Tracing::Contrib::Rack::Header::RequestHeaderCollection.new(env)
+
+              # always collect client ip, as this is part of AppSec provided functionality
+              Datadog::Tracing::ClientIp.set_client_ip_tag!(
+                span,
+                headers: request_header_collection,
+                remote_ip: env['REMOTE_ADDR']
+              )
+            end
+          end
+
+          def add_waf_runtime_tags(scope)
+            span = scope.service_entry_span
+            context = scope.processor_context
+
+            return unless span && context
 
             span.set_tag('_dd.appsec.waf.timeouts', context.timeouts)
 
@@ -167,6 +213,10 @@ module Datadog
             span.set_tag('_dd.appsec.waf.duration', context.time_ns / 1000.0)
             span.set_tag('_dd.appsec.waf.duration_ext', context.time_ext_ns / 1000.0)
           end
+
+          def to_rack_header(header)
+            @rack_headers[header] ||= Datadog::Tracing::Contrib::Rack::Header.to_rack_header(header)
+          end
         end
       end
     end

data/lib/datadog/appsec/contrib/rails/ext.rb

@@ -1,10 +1,11 @@
+# frozen_string_literal: true
+
 module Datadog
   module AppSec
     module Contrib
       module Rails
-        # Rack integration constants
+        # Rails integration constants
         module Ext
-          APP = 'rails'.freeze
         end
       end
     end

data/lib/datadog/appsec/contrib/rails/framework.rb

@@ -7,9 +7,7 @@ module Datadog
         # Rails specific framework tie
         module Framework
           def self.setup
-            Datadog::AppSec.configure do |datadog_config|
-              datadog_config.instrument(:rack)
-            end
+            Datadog.configuration.appsec.instrument(:rack)
           end
         end
       end

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -20,11 +20,12 @@ module Datadog
               def watch_request_action(gateway = Instrumentation.gateway)
                 gateway.watch('rails.request.action', :appsec) do |stack, gateway_request|
                   block = false
+
                   event = nil
                   scope = gateway_request.env[Datadog::AppSec::Ext::SCOPE_KEY]
 
                   AppSec::Reactive::Operation.new('rails.request.action') do |op|
-                    Rails::Reactive::Action.subscribe(op, scope.processor_context) do |result, _block|
+                    Rails::Reactive::Action.subscribe(op, scope.processor_context) do |result|
                       if result.status == :match
                         # TODO: should this hash be an Event instance instead?
                         event = {
@@ -44,7 +45,7 @@ module Datadog
                       end
                     end
 
-                    _result, block = Rails::Reactive::Action.publish(op, gateway_request)
+                    block = Rails::Reactive::Action.publish(op, gateway_request)
                   end
 
                   next [nil, [[:block, event]]] if block