ddtrace 1.12.1 → 1.23.2

data/lib/datadog/appsec/processor/rule_loader.rb

@@ -47,6 +47,13 @@ module Datadog
             data
           end
 
+          def load_exclusions(ip_passlist: [])
+            exclusions = []
+            exclusions << [passlist_exclusions(ip_passlist)] if ip_passlist.any?
+
+            exclusions
+          end
+
           private
 
           def denylist_data(id, denylist)
@@ -56,6 +63,59 @@ module Datadog
               'data' => denylist.map { |v| { 'value' => v.to_s, 'expiration' => 2**63 } }
             }
           end
+
+          def passlist_exclusions(ip_passlist) # rubocop:disable Metrics/MethodLength
+            case ip_passlist
+            when Array
+              pass = ip_passlist
+              monitor = []
+            when Hash
+              pass = ip_passlist[:pass]
+              monitor = ip_passlist[:monitor]
+            else
+              pass = []
+              monitor = []
+            end
+
+            exclusions = []
+
+            exclusions << {
+              'conditions' => [
+                {
+                  'operator' => 'ip_match',
+                  'parameters' => {
+                    'inputs' => [
+                      {
+                        'address' => 'http.client_ip'
+                      }
+                    ],
+                    'list' => pass
+                  }
+                }
+              ],
+              'id' => SecureRandom.uuid,
+            }
+
+            exclusions << {
+              'conditions' => [
+                {
+                  'operator' => 'ip_match',
+                  'parameters' => {
+                    'inputs' => [
+                      {
+                        'address' => 'http.client_ip'
+                      }
+                    ],
+                    'list' => monitor
+                  }
+                }
+              ],
+              'id' => SecureRandom.uuid,
+              'on_match' => 'monitor'
+            }
+
+            exclusions
+          end
         end
       end
     end

data/lib/datadog/appsec/processor/rule_merger.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative '../assets'
+
 module Datadog
   module AppSec
     class Processor
@@ -16,8 +18,25 @@ module Datadog
           end
         end
 
+        DEFAULT_WAF_PROCESSORS = begin
+          JSON.parse(Datadog::AppSec::Assets.waf_processors)
+        rescue StandardError => e
+          Datadog.logger.error { "libddwaf rulemerger failed to parse default waf processors. Error: #{e.inspect}" }
+          []
+        end
+
+        DEFAULT_WAF_SCANNERS = begin
+          JSON.parse(Datadog::AppSec::Assets.waf_scanners)
+        rescue StandardError => e
+          Datadog.logger.error { "libddwaf rulemerger failed to parse default waf scanners. Error: #{e.inspect}" }
+          []
+        end
+
         class << self
-          def merge(rules:, data: [], overrides: [], exclusions: [], custom_rules: [])
+          def merge(
+            rules:, data: [], overrides: [], exclusions: [], custom_rules: [],
+            processors: DEFAULT_WAF_PROCESSORS, scanners: DEFAULT_WAF_SCANNERS
+          )
             combined_rules = combine_rules(rules)
 
             combined_data = combine_data(data) if data.any?
@@ -29,7 +48,8 @@ module Datadog
             combined_rules['rules_override'] = combined_overrides if combined_overrides
             combined_rules['exclusions'] = combined_exclusions if combined_exclusions
             combined_rules['custom_rules'] = combined_custom_rules if combined_custom_rules
-
+            combined_rules['processors'] = processors
+            combined_rules['scanners'] = scanners
             combined_rules
           end
 

data/lib/datadog/appsec/processor.rb

@@ -22,8 +22,15 @@ module Datadog
 
           start_ns = Core::Utils::Time.get_time(:nanosecond)
 
-          # this WAF::Context#run call is not thread safe as it mutates the context
-          # TODO: remove multiple assignment
+          input.reject! do |_, v|
+            case v
+            when TrueClass, FalseClass
+              false
+            else
+              v.nil? ? true : v.empty?
+            end
+          end
+
           _code, res = @context.run(input, timeout)
 
           stop_ns = Core::Utils::Time.get_time(:nanosecond)
@@ -38,17 +45,38 @@ module Datadog
           @run_mutex.unlock
         end
 
+        def extract_schema
+          return unless extract_schema?
+
+          input = {
+            'waf.context.processor' => {
+              'extract-schema' => true
+            }
+          }
+
+          _code, res = @context.run(input, WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)
+
+          res
+        end
+
         def finalize
           @context.finalize
         end
+
+        private
+
+        def extract_schema?
+          Datadog.configuration.appsec.api_security.enabled &&
+            Datadog.configuration.appsec.api_security.sample_rate.sample?
+        end
       end
 
-      attr_reader :ruleset_info, :addresses
+      attr_reader :diagnostics, :addresses
 
       def initialize(ruleset:)
-        @ruleset_info = nil
+        @diagnostics = nil
         @addresses = []
-        settings = Datadog::AppSec.settings
+        settings = Datadog.configuration.appsec
 
         unless load_libddwaf && create_waf_handle(settings, ruleset)
           Datadog.logger.warn { 'AppSec is disabled, see logged errors above' }
@@ -83,7 +111,7 @@ module Datadog
         }
 
         @handle = Datadog::AppSec::WAF::Handle.new(ruleset, obfuscator: obfuscator_config)
-        @ruleset_info = @handle.ruleset_info
+        @diagnostics = @handle.diagnostics
         @addresses = @handle.required_addresses
 
         true
@@ -92,7 +120,7 @@ module Datadog
           "libddwaf failed to initialize, error: #{e.inspect}"
         end
 
-        @ruleset_info = e.ruleset_info if e.ruleset_info
+        @diagnostics = e.diagnostics if e.diagnostics
 
         false
       rescue StandardError => e

data/lib/datadog/appsec/rate_limiter.rb

@@ -50,7 +50,7 @@ module Datadog
         end
 
         def trace_rate_limit
-          Datadog::AppSec.settings.trace_rate_limit
+          Datadog.configuration.appsec.trace_rate_limit
         end
       end
     end

data/lib/datadog/appsec/remote.rb

@@ -12,15 +12,17 @@ module Datadog
       class NoRulesError < StandardError; end
 
       class << self
-        CAP_ASM_ACTIVATION                = 1 << 1 # Remote activation via ASM_FEATURES product
-        CAP_ASM_IP_BLOCKING               = 1 << 2 # accept IP blocking data from ASM_DATA product
-        CAP_ASM_DD_RULES                  = 1 << 3 # read ASM rules from ASM_DD product
-        CAP_ASM_EXCLUSIONS                = 1 << 4 # exclusion filters (passlist) via ASM product
-        CAP_ASM_REQUEST_BLOCKING          = 1 << 5 # can block on request info
-        CAP_ASM_RESPONSE_BLOCKING         = 1 << 6 # can block on response info
-        CAP_ASM_USER_BLOCKING             = 1 << 7 # accept user blocking data from ASM_DATA product
-        CAP_ASM_CUSTOM_RULES              = 1 << 8 # accept custom rules
-        CAP_ASM_CUSTOM_BLOCKING_RESPONSE  = 1 << 9 # supports custom http code or redirect sa blocking response
+        CAP_ASM_RESERVED_1                = 1 << 0   # RESERVED
+        CAP_ASM_ACTIVATION                = 1 << 1   # Remote activation via ASM_FEATURES product
+        CAP_ASM_IP_BLOCKING               = 1 << 2   # accept IP blocking data from ASM_DATA product
+        CAP_ASM_DD_RULES                  = 1 << 3   # read ASM rules from ASM_DD product
+        CAP_ASM_EXCLUSIONS                = 1 << 4   # exclusion filters (passlist) via ASM product
+        CAP_ASM_REQUEST_BLOCKING          = 1 << 5   # can block on request info
+        CAP_ASM_RESPONSE_BLOCKING         = 1 << 6   # can block on response info
+        CAP_ASM_USER_BLOCKING             = 1 << 7   # accept user blocking data from ASM_DATA product
+        CAP_ASM_CUSTOM_RULES              = 1 << 8   # accept custom rules
+        CAP_ASM_CUSTOM_BLOCKING_RESPONSE  = 1 << 9   # supports custom http code or redirect sa blocking response
+        CAP_ASM_TRUSTED_IPS               = 1 << 10  # supports trusted ip
 
         # TODO: we need to dynamically add CAP_ASM_ACTIVATION once we support it
         ASM_CAPABILITIES = [
@@ -31,6 +33,8 @@ module Datadog
           CAP_ASM_RESPONSE_BLOCKING,
           CAP_ASM_DD_RULES,
           CAP_ASM_CUSTOM_RULES,
+          CAP_ASM_CUSTOM_BLOCKING_RESPONSE,
+          CAP_ASM_TRUSTED_IPS,
         ].freeze
 
         ASM_PRODUCTS = [
@@ -63,6 +67,7 @@ module Datadog
             data = []
             overrides = []
             exclusions = []
+            actions = []
 
             repository.contents.each do |content|
               parsed_content = parse_content(content)
@@ -76,6 +81,7 @@ module Datadog
                 overrides << parsed_content['rules_override'] if parsed_content['rules_override']
                 exclusions << parsed_content['exclusions'] if parsed_content['exclusions']
                 custom_rules << parsed_content['custom_rules'] if parsed_content['custom_rules']
+                actions.concat(parsed_content['actions']) if parsed_content['actions']
               end
             end
 
@@ -95,7 +101,7 @@ module Datadog
               custom_rules: custom_rules,
             )
 
-            Datadog::AppSec.reconfigure(ruleset: ruleset)
+            Datadog::AppSec.reconfigure(ruleset: ruleset, actions: actions)
           end
 
           [receiver]
@@ -105,7 +111,7 @@ module Datadog
         private
 
         def remote_features_enabled?
-          Datadog::AppSec.send(:default_setting?, :ruleset)
+          Datadog.configuration.appsec.using_default?(:ruleset)
         end
 
         def parse_content(content)

data/lib/datadog/appsec/response.rb

@@ -28,19 +28,80 @@ module Datadog
       end
 
       class << self
-        def negotiate(env)
+        def negotiate(env, actions)
+          # @type var configured_response: Response?
+          configured_response = nil
+          actions.each do |action|
+            # Need to use next to make steep happy :(
+            # I rather use break to stop the execution
+            next if configured_response
+
+            action_configuration = AppSec::Processor::Actions.fecth_configuration(action)
+            next unless action_configuration
+
+            configured_response = case action_configuration['type']
+                                  when 'block_request'
+                                    block_response(env, action_configuration['parameters'])
+                                  when 'redirect_request'
+                                    redirect_response(env, action_configuration['parameters'])
+                                  end
+          end
+
+          configured_response || default_response(env)
+        end
+
+        private
+
+        def default_response(env)
           content_type = content_type(env)
 
-          Datadog.logger.debug { "negotiated response content type: #{content_type}" }
+          body = []
+          body << content(content_type)
 
           Response.new(
             status: 403,
             headers: { 'Content-Type' => content_type },
-            body: [Datadog::AppSec::Assets.blocked(format: CONTENT_TYPE_TO_FORMAT[content_type])]
+            body: body,
           )
         end
 
-        private
+        def block_response(env, options)
+          content_type = if options['type'] == 'auto'
+                           content_type(env)
+                         else
+                           FORMAT_TO_CONTENT_TYPE[options['type']]
+                         end
+
+          body = []
+          body << content(content_type)
+
+          Response.new(
+            status: options['status_code'] || 403,
+            headers: { 'Content-Type' => content_type },
+            body: body,
+          )
+        end
+
+        def redirect_response(env, options)
+          if options['location'] && !options['location'].empty?
+            content_type = content_type(env)
+
+            status = options['status_code'] >= 300 && options['status_code'] < 400 ? options['status_code'] : 303
+
+            headers = {
+              'Content-Type' => content_type,
+              'Location' => options['location']
+            }
+
+            Response.new(
+              status: status,
+              headers: headers,
+              body: [],
+            )
+          else
+            default_response(env)
+          end
+        end
 
         CONTENT_TYPE_TO_FORMAT = {
           'application/json' => :json,
@@ -48,6 +109,11 @@ module Datadog
           'text/plain' => :text,
         }.freeze
 
+        FORMAT_TO_CONTENT_TYPE = {
+          'json' => 'application/json',
+          'html' => 'text/html',
+        }.freeze
+
         DEFAULT_CONTENT_TYPE = 'application/json'
 
         def content_type(env)
@@ -67,6 +133,18 @@ module Datadog
         rescue Datadog::AppSec::Utils::HTTP::MediaRange::ParseError
           DEFAULT_CONTENT_TYPE
         end
+
+        def content(content_type)
+          content_format = CONTENT_TYPE_TO_FORMAT[content_type]
+
+          using_default = Datadog.configuration.appsec.block.templates.using_default?(content_format)
+
+          if using_default
+            Datadog::AppSec::Assets.blocked(format: content_format)
+          else
+            Datadog.configuration.appsec.block.templates.send(content_format)
+          end
+        end
       end
     end
   end

data/lib/datadog/appsec/sample_rate.rb

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # SampleRate basic sample rate
+    class SampleRate
+      attr_reader :rate
+
+      def initialize(rate)
+        @rate = rate
+      end
+
+      def sample?
+        return false if rate <= 0
+        return true if rate >= 1
+
+        Kernel.rand < rate
+      end
+    end
+  end
+end

data/lib/datadog/appsec.rb

@@ -8,8 +8,6 @@ require_relative 'appsec/ext'
 module Datadog
   # Namespace for Datadog AppSec instrumentation
   module AppSec
-    include Configuration
-
     class << self
       def enabled?
         Datadog.configuration.appsec.enabled
@@ -25,12 +23,12 @@ module Datadog
         appsec_component.processor if appsec_component
       end
 
-      def reconfigure(ruleset:)
+      def reconfigure(ruleset:, actions:)
         appsec_component = components.appsec
 
         return unless appsec_component
 
-        appsec_component.reconfigure(ruleset: ruleset)
+        appsec_component.reconfigure(ruleset: ruleset, actions: actions)
       end
 
       def reconfigure_lock(&block)
@@ -57,5 +55,6 @@ end
 require_relative 'appsec/contrib/rack/integration'
 require_relative 'appsec/contrib/sinatra/integration'
 require_relative 'appsec/contrib/rails/integration'
+require_relative 'appsec/contrib/devise/integration'
 
 require_relative 'appsec/autoload'

data/lib/datadog/auto_instrument.rb

@@ -0,0 +1,3 @@
+# frozen_string_literal: true
+
+require_relative '../ddtrace/auto_instrument'

data/lib/datadog/core/backport.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+module Datadog
+  module Core
+    # This module is used to provide features from Ruby 2.5+ to older Rubies
+    module BackportFrom25
+      if ::String.method_defined?(:delete_prefix)
+        def self.string_delete_prefix(string, prefix)
+          string.delete_prefix(prefix)
+        end
+      else
+        def self.string_delete_prefix(string, prefix)
+          prefix = prefix.to_s
+          if string.start_with?(prefix)
+            string[prefix.length..-1] || raise('rbs-guard: String#[] is non-nil as `prefix` is guaranteed present')
+          else
+            string.dup
+          end
+        end
+      end
+    end
+
+    # This module is used to provide features from Ruby 2.4+ to older Rubies
+    module BackportFrom24
+      if RUBY_VERSION < '2.4'
+        def self.dup(value)
+          case value
+          when NilClass, TrueClass, FalseClass, Numeric
+            value
+          else
+            value.dup
+          end
+        end
+      else
+        def self.dup(value)
+          value.dup
+        end
+      end
+
+      if ::Hash.method_defined?(:compact!)
+        def self.hash_compact!(hash)
+          hash.compact!
+        end
+      else
+        def self.hash_compact!(hash)
+          hash.reject! { |_key, value| value.nil? }
+        end
+      end
+    end
+  end
+end