ddtrace 1.9.0 → 1.10.0

data/lib/datadog/appsec/processor.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative 'assets'
 
 module Datadog
@@ -39,19 +37,44 @@ module Datadog
         end
       end
 
+      class << self
+        def active_context
+          Thread.current[:datadog_current_waf_context]
+        end
+
+        private
+
+        def active_context=(context)
+          unless context.instance_of?(Context)
+            raise ArgumentError,
+              "The context provide: #{context.inspect} is not a Datadog::AppSec::Processor::Context"
+          end
+
+          Thread.current[:datadog_current_waf_context] = context
+        end
+
+        def reset_active_context
+          Thread.current[:datadog_current_waf_context] = nil
+        end
+      end
+
+      class NoActiveContextError < StandardError; end
+      class AlreadyActiveContextError < StandardError; end
+
       attr_reader :ruleset_info, :addresses
 
       def initialize
         @ruleset_info = nil
         @addresses = []
+        settings = Datadog::AppSec.settings
 
-        unless load_libddwaf && load_ruleset && create_waf_handle
+        unless load_libddwaf && load_ruleset(settings) && create_waf_handle(settings)
           Datadog.logger.warn { 'AppSec is disabled, see logged errors above' }
 
           return
         end
 
-        update_ip_denylist
+        apply_denylist_data(settings)
       end
 
       def ready?
@@ -62,6 +85,23 @@ module Datadog
         Context.new(self)
       end
 
+      def activate_context
+        existing_active_context = Processor.active_context
+        raise AlreadyActiveContextError if existing_active_context
+
+        context = new_context
+        Processor.send(:active_context=, context)
+        context
+      end
+
+      def deactivate_context
+        context = Processor.active_context
+        raise NoActiveContextError unless context
+
+        Processor.send(:reset_active_context)
+        context.finalize
+      end
+
       def update_rule_data(data)
         @handle.update_rule_data(data)
       end
@@ -70,20 +110,6 @@ module Datadog
         @handle.toggle_rules(map)
       end
 
-      def update_ip_denylist(denylist = Datadog::AppSec.settings.ip_denylist, id: 'blocked_ips')
-        denylist ||= []
-
-        ruledata_setting = [
-          {
-            'id' => id,
-            'type' => 'data_with_expiration',
-            'data' => denylist.map { |ip| { 'value' => ip.to_s, 'expiration' => 2**63 } }
-          }
-        ]
-
-        update_rule_data(ruledata_setting)
-      end
-
       def finalize
         @handle.finalize
       end
@@ -94,17 +120,40 @@ module Datadog
 
       private
 
+      def apply_denylist_data(settings)
+        ruledata_setting = []
+        ruledata_setting << denylist_data('blocked_ips', settings.ip_denylist)
+        ruledata_setting << denylist_data('blocked_users', settings.user_id_denylist)
+
+        update_rule_data(ruledata_setting)
+      end
+
+      def denylist_data(id, denylist)
+        {
+          'id' => id,
+          'type' => 'data_with_expiration',
+          'data' => denylist.map { |v| { 'value' => v.to_s, 'expiration' => 2**63 } }
+        }
+      end
+
       def load_libddwaf
         Processor.require_libddwaf && Processor.libddwaf_provides_waf?
       end
 
-      def load_ruleset
-        ruleset_setting = Datadog::AppSec.settings.ruleset
+      def load_ruleset(settings)
+        ruleset_setting = settings.ruleset
 
         begin
           @ruleset = case ruleset_setting
-                     when :recommended, :risky, :strict
+                     when :recommended, :strict
                        JSON.parse(Datadog::AppSec::Assets.waf_rules(ruleset_setting))
+                     when :risky
+                       JSON.parse(Datadog::AppSec::Assets.waf_rules(:recommended))
+                       Datadog.logger.warn(
+                         'The :risky Application Security Management ruleset has been deprecated and no longer available.'\
+                         'The `:recommended` ruleset will be used instead.'\
+                         'Please remove the `appsec.ruleset = :risky` setting from your Datadog.configure block.'
+                       )
                      when String
                        JSON.parse(File.read(ruleset_setting))
                      when File, StringIO
@@ -125,13 +174,13 @@ module Datadog
         end
       end
 
-      def create_waf_handle
+      def create_waf_handle(settings)
         # TODO: this may need to be reset if the main Datadog logging level changes after initialization
-        Datadog::AppSec::WAF.logger = Datadog.logger if Datadog.logger.debug? && Datadog::AppSec.settings.waf_debug
+        Datadog::AppSec::WAF.logger = Datadog.logger if Datadog.logger.debug? && settings.waf_debug
 
         obfuscator_config = {
-          key_regex: Datadog::AppSec.settings.obfuscator_key_regex,
-          value_regex: Datadog::AppSec.settings.obfuscator_value_regex,
+          key_regex: settings.obfuscator_key_regex,
+          value_regex: settings.obfuscator_value_regex,
         }
         @handle = Datadog::AppSec::WAF::Handle.new(@ruleset, obfuscator: obfuscator_config)
         @ruleset_info = @handle.ruleset_info

data/lib/datadog/appsec/rate_limiter.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     # Simple per-thread rate limiter

data/lib/datadog/appsec/reactive/address_hash.rb

@@ -1,10 +1,14 @@
-# typed: ignore
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
     module Reactive
-      # Address for Reactive Engine
+      # AddressHash for Reactive Engine
       class AddressHash < Hash
+        def self.new(*arguments, &block)
+          super { |h, k| h[k] = [] }
+        end
+
         def addresses
           keys.flatten
         end

data/lib/datadog/appsec/reactive/engine.rb

@@ -1,4 +1,4 @@
-# typed: ignore
+# frozen_string_literal: true
 
 require_relative 'address_hash'
 require_relative 'subscriber'
@@ -10,20 +10,19 @@ module Datadog
       class Engine
         def initialize
           @data = {}
-          @subscribers = AddressHash.new { |h, k| h[k] = [] } # TODO: move to AddressHash initializer
-          @children = []
+          @subscribers = AddressHash.new
         end
 
         def subscribe(*addresses, &block)
-          @subscribers[addresses.freeze] << Subscriber.new(&block).freeze # TODO: move freeze to Subscriber
+          @subscribers[addresses.freeze] << Subscriber.new(&block)
         end
 
-        def publish(address, data)
+        def publish(address, value)
           # check if someone has address subscribed
           if @subscribers.addresses.include?(address)
 
-            # someone will be interested, set data
-            @data[address] = data
+            # someone will be interested, set value
+            @data[address] = value
 
             # find candidates i.e address groups that contain the just posted address
             @subscribers.with(address).each do |addresses|
@@ -38,6 +37,10 @@ module Datadog
             end
           end
         end
+
+        private
+
+        attr_reader :subscribers, :data
       end
     end
   end

data/lib/datadog/appsec/reactive/operation.rb

@@ -1,4 +1,4 @@
-# typed: ignore
+# frozen_string_literal: true
 
 require_relative 'engine'
 
@@ -15,7 +15,7 @@ module Datadog
           Datadog.logger.debug { "operation: #{name} initialize" }
           @name = name
           @parent = parent
-          @reactive = reactive_engine || (parent.reactive unless parent.nil?) || Reactive::Engine.new
+          @reactive = select_reactive_engine(reactive_engine, parent)
 
           # TODO: concurrent store
           # TODO: constant
@@ -40,10 +40,27 @@ module Datadog
           Thread.current[:datadog_security_active_operation] = parent
         end
 
+        private
+
+        def select_reactive_engine(reactive, parent)
+          return reactive if reactive
+
+          return parent.reactive unless parent.nil?
+
+          Reactive::Engine.new
+        end
+
         class << self
           def active
             Thread.current[:datadog_security_active_operation]
           end
+
+          private
+
+          # For testing only.
+          def reset!
+            Thread.current[:datadog_security_active_operation] = nil
+          end
         end
       end
     end

data/lib/datadog/appsec/reactive/subscriber.rb

@@ -1,4 +1,4 @@
-# typed: ignore
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
@@ -7,6 +7,7 @@ module Datadog
       class Subscriber
         def initialize(&block)
           @block = block
+          freeze
         end
 
         def call(*args)

data/lib/datadog/appsec/response.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative 'assets'
 require_relative 'utils/http/media_range'
 

data/lib/datadog/appsec/utils/http/media_range.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative 'media_type'
 
 module Datadog

data/lib/datadog/appsec/utils/http/media_type.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     module Utils

data/lib/datadog/appsec.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative 'appsec/configuration'
 require_relative 'appsec/extensions'
 
@@ -8,6 +6,24 @@ module Datadog
   module AppSec
     include Configuration
 
+    class << self
+      def enabled?
+        Datadog.configuration.appsec.enabled
+      end
+
+      def processor
+        appsec_component = components.appsec
+
+        appsec_component.processor if appsec_component
+      end
+
+      private
+
+      def components
+        Datadog.send(:components)
+      end
+    end
+
     def self.writer
       @writer ||= Writer.new
     end
@@ -21,3 +37,5 @@ end
 require_relative 'appsec/contrib/rack/integration'
 require_relative 'appsec/contrib/sinatra/integration'
 require_relative 'appsec/contrib/rails/integration'
+
+require_relative 'appsec/autoload'

data/lib/datadog/ci/configuration/components.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative '../flush'
 
 module Datadog

data/lib/datadog/ci/configuration/settings.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 require_relative '../ext/settings'
 
 module Datadog

data/lib/datadog/ci/contrib/cucumber/configuration/settings.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 require_relative '../../../../tracing/contrib/configuration/settings'
 require_relative '../ext'
 

data/lib/datadog/ci/contrib/cucumber/ext.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module CI
     module Contrib

data/lib/datadog/ci/contrib/cucumber/formatter.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative '../../test'
 require_relative '../../ext/app_types'
 require_relative '../../ext/environment'

data/lib/datadog/ci/contrib/cucumber/instrumentation.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative 'formatter'
 
 module Datadog

data/lib/datadog/ci/contrib/cucumber/integration.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 require_relative '../../../tracing/contrib/integration'
 
 require_relative 'configuration/settings'

data/lib/datadog/ci/contrib/cucumber/patcher.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative '../../../tracing/contrib/patcher'
 require_relative 'instrumentation'
 

data/lib/datadog/ci/contrib/rspec/configuration/settings.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 require_relative '../../../../tracing/contrib/configuration/settings'
 require_relative '../ext'
 

data/lib/datadog/ci/contrib/rspec/example.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 require_relative '../../test'
 
 require_relative '../../ext/app_types'

data/lib/datadog/ci/contrib/rspec/ext.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module CI
     module Contrib

data/lib/datadog/ci/contrib/rspec/integration.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 require_relative '../../../tracing/contrib/integration'
 
 require_relative 'configuration/settings'

data/lib/datadog/ci/contrib/rspec/patcher.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative '../../../tracing/contrib/patcher'
 require_relative 'example'
 

data/lib/datadog/ci/ext/app_types.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module CI
     module Ext

data/lib/datadog/ci/ext/environment.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-# typed: true
-
 require_relative '../../core/git/ext'
 
 require 'open3'
@@ -12,8 +10,6 @@ module Datadog
     module Ext
       # Defines constants for CI tags
       module Environment
-        include Kernel # Ensure that kernel methods are always available (https://sorbet.org/docs/error-reference#7003)
-
         TAG_JOB_NAME = 'ci.job.name'
         TAG_JOB_URL = 'ci.job.url'
         TAG_PIPELINE_ID = 'ci.pipeline.id'

data/lib/datadog/ci/ext/settings.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module CI
     module Ext

data/lib/datadog/ci/ext/test.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module CI
     module Ext

data/lib/datadog/ci/extensions.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative '../core/configuration/settings'
 require_relative '../core/configuration/components'
 

data/lib/datadog/ci/flush.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative '../tracing/metadata/ext'
 require_relative '../tracing/flush'
 

data/lib/datadog/ci/test.rb

@@ -1,7 +1,5 @@
 # frozen_string_literal: true
 
-# typed: false
-
 require_relative '../tracing/contrib/analytics'
 
 require_relative 'ext/app_types'

data/lib/datadog/ci.rb

@@ -1,5 +1,3 @@
-# typed: strict
-
 require_relative 'core'
 require_relative 'tracing'
 require_relative 'tracing/contrib'

data/lib/datadog/core/buffer/cruby.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative 'random'
 
 module Datadog

data/lib/datadog/core/buffer/random.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 module Datadog
   module Core
     module Buffer

data/lib/datadog/core/buffer/thread_safe.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require_relative 'random'
 
 module Datadog

data/lib/datadog/core/chunker.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 module Datadog
   module Core
     # Chunks list of elements into batches

data/lib/datadog/core/configuration/agent_settings_resolver.rb

@@ -1,5 +1,3 @@
-# typed: true
-
 require 'uri'
 
 require_relative 'settings'
@@ -49,21 +47,6 @@ module Datadog
               )
               freeze
             end
-
-            # Returns a frozen copy of this struct
-            # with the provided +member_values+ modified.
-            #
-            # TODO: This is only used when configuring profiling, and can be removed once
-            # https://github.com/DataDog/dd-trace-rb/pull/1924 is merged
-            def merge(**member_values)
-              new_struct = dup
-
-              member_values.each do |member, value|
-                new_struct[member] = value
-              end
-
-              new_struct.freeze
-            end
           end
 
         def self.call(settings, logger: Datadog.logger)

data/lib/datadog/core/configuration/base.rb

@@ -1,5 +1,3 @@
-# typed: false
-
 require_relative '../environment/variable_helpers'
 require_relative 'options'