ddtrace 1.9.0 → 1.10.0

data/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative '../../../instrumentation/gateway'
 require_relative '../../../reactive/operation'
 require_relative '../../rack/reactive/request_body'
@@ -13,93 +11,100 @@ module Datadog
         module Gateway
           # Watcher for Sinatra gateway events
           module Watcher
-            # rubocop:disable Metrics/MethodLength
-            def self.watch
-              Instrumentation.gateway.watch('sinatra.request.dispatch', :appsec) do |stack, request|
-                block = false
-                event = nil
-                waf_context = request.env['datadog.waf.context']
-
-                AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
-                  trace = active_trace
-                  span = active_span
-
-                  Rack::Reactive::RequestBody.subscribe(op, waf_context) do |result, _block|
-                    if result.status == :match
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: trace,
-                        span: span,
-                        request: request,
-                        actions: result.actions
-                      }
-
-                      span.set_tag('appsec.event', 'true') if span
-
-                      waf_context.events << event
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
+
+                watch_request_dispatch(gateway)
+                watch_request_routed(gateway)
+              end
+
+              def watch_request_dispatch(gateway = Instrumentation.gateway)
+                gateway.watch('sinatra.request.dispatch', :appsec) do |stack, gateway_request|
+                  block = false
+                  event = nil
+                  waf_context = gateway_request.env['datadog.waf.context']
+
+                  AppSec::Reactive::Operation.new('sinatra.request.dispatch') do |op|
+                    trace = active_trace
+                    span = active_span
+
+                    Rack::Reactive::RequestBody.subscribe(op, waf_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: trace,
+                          span: span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        span.set_tag('appsec.event', 'true') if span
+
+                        waf_context.events << event
+                      end
                     end
+
+                    _result, block = Rack::Reactive::RequestBody.publish(op, gateway_request)
                   end
 
-                  _result, block = Rack::Reactive::RequestBody.publish(op, request)
-                end
+                  next [nil, [[:block, event]]] if block
 
-                next [nil, [[:block, event]]] if block
+                  ret, res = stack.call(gateway_request.request)
 
-                ret, res = stack.call(request)
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
 
-                if event
-                  res ||= []
-                  res << [:monitor, event]
+                  [ret, res]
                 end
-
-                [ret, res]
               end
 
-              Instrumentation.gateway.watch('sinatra.request.routed', :appsec) do |stack, (request, route_params)|
-                block = false
-                event = nil
-                waf_context = request.env['datadog.waf.context']
-
-                AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
-                  trace = active_trace
-                  span = active_span
-
-                  Sinatra::Reactive::Routed.subscribe(op, waf_context) do |result, _block|
-                    if result.status == :match
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: trace,
-                        span: span,
-                        request: request,
-                        actions: result.actions
-                      }
-
-                      span.set_tag('appsec.event', 'true') if span
-
-                      waf_context.events << event
+              def watch_request_routed(gateway = Instrumentation.gateway)
+                gateway.watch('sinatra.request.routed', :appsec) do |stack, (gateway_request, gateway_route_params)|
+                  block = false
+                  event = nil
+                  waf_context = gateway_request.env['datadog.waf.context']
+
+                  AppSec::Reactive::Operation.new('sinatra.request.routed') do |op|
+                    trace = active_trace
+                    span = active_span
+
+                    Sinatra::Reactive::Routed.subscribe(op, waf_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: trace,
+                          span: span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        span.set_tag('appsec.event', 'true') if span
+
+                        waf_context.events << event
+                      end
                     end
+
+                    _result, block = Sinatra::Reactive::Routed.publish(op, [gateway_request, gateway_route_params])
                   end
 
-                  _result, block = Sinatra::Reactive::Routed.publish(op, [request, route_params])
-                end
+                  next [nil, [[:block, event]]] if block
 
-                next [nil, [[:block, event]]] if block
+                  ret, res = stack.call(gateway_request.request)
 
-                ret, res = stack.call(request)
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
 
-                if event
-                  res ||= []
-                  res << [:monitor, event]
+                  [ret, res]
                 end
-
-                [ret, res]
               end
-            end
-            # rubocop:enable Metrics/MethodLength
 
-            class << self
               private
 
               def active_trace

data/lib/datadog/appsec/contrib/sinatra/integration.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative '../integration'
 
 require_relative 'configuration/settings'

data/lib/datadog/appsec/contrib/sinatra/patcher.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative '../../../tracing/contrib/rack/middlewares'
 
 require_relative '../patcher'
@@ -7,6 +5,8 @@ require_relative '../../response'
 require_relative '../rack/request_middleware'
 require_relative 'framework'
 require_relative 'gateway/watcher'
+require_relative 'gateway/route_params'
+require_relative 'gateway/request'
 require_relative '../../../tracing/contrib/sinatra/framework'
 
 module Datadog
@@ -57,7 +57,9 @@ module Datadog
 
             # TODO: handle exceptions, except for super
 
-            request_return, request_response = Instrumentation.gateway.push('sinatra.request.dispatch', request) do
+            gateway_request = Gateway::Request.new(env)
+
+            request_return, request_response = Instrumentation.gateway.push('sinatra.request.dispatch', gateway_request) do
               # handle process_route interruption
               catch(Ext::ROUTE_INTERRUPT) { super }
             end
@@ -92,7 +94,13 @@ module Datadog
               # At this point params has both route params and normal params.
               route_params = params.each.with_object({}) { |(k, v), h| h[k] = v unless base_params.key?(k) }
 
-              _, request_response = Instrumentation.gateway.push('sinatra.request.routed', [request, route_params])
+              gateway_request = Gateway::Request.new(env)
+              gateway_route_params = Gateway::RouteParams.new(route_params)
+
+              _, request_response = Instrumentation.gateway.push(
+                'sinatra.request.routed',
+                [gateway_request, gateway_route_params]
+              )
 
               if request_response && request_response.any? { |action, _event| action == :block }
                 self.response = AppSec::Response.negotiate(env).to_sinatra_response

data/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb

@@ -1,29 +1,30 @@
-# typed: ignore
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
     module Contrib
       module Sinatra
         module Reactive
-          # Dispatch data from a Rack request to the WAF context
+          # Dispatch data from a Sinatra request to the WAF context
           module Routed
+            ADDRESSES = [
+              'sinatra.request.route_params',
+            ].freeze
+            private_constant :ADDRESSES
+
             def self.publish(op, data)
               _request, route_params = data
 
               catch(:block) do
-                op.publish('sinatra.request.route_params', route_params)
+                op.publish('sinatra.request.route_params', route_params.params)
 
                 nil
               end
             end
 
             def self.subscribe(op, waf_context)
-              addresses = [
-                'sinatra.request.route_params',
-              ]
-
-              op.subscribe(*addresses) do |*values|
-                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 path_params = values[0]
 
                 waf_args = {

data/lib/datadog/appsec/contrib/sinatra/request_middleware.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/event.rb

@@ -1,9 +1,5 @@
-# typed: ignore
-
 require 'json'
 
-require_relative 'contrib/rack/request'
-require_relative 'contrib/rack/response'
 require_relative 'rate_limiter'
 
 module Datadog
@@ -52,7 +48,7 @@ module Datadog
       end
 
       # rubocop:disable Metrics/MethodLength
-      def self.record_via_span(*events) # rubocop:disable Metrics/AbcSize
+      def self.record_via_span(*events)
         events.group_by { |e| e[:trace] }.each do |trace, event_group|
           unless trace
             Datadog.logger.debug { "{ error: 'no trace: cannot record', event_group: #{event_group.inspect}}" }
@@ -70,7 +66,7 @@ module Datadog
             # TODO: assume HTTP request context for now
 
             if (request = event[:request])
-              request_headers = AppSec::Contrib::Rack::Request.headers(request).select do |k, _|
+              request_headers = request.headers.select do |k, _|
                 ALLOWED_REQUEST_HEADERS.include?(k.downcase)
               end
 
@@ -80,11 +76,11 @@ module Datadog
 
               tags['http.host'] = request.host
               tags['http.useragent'] = request.user_agent
-              tags['network.client.ip'] = request.env['REMOTE_ADDR'] if request.env['REMOTE_ADDR']
+              tags['network.client.ip'] = request.remote_addr
             end
 
             if (response = event[:response])
-              response_headers = AppSec::Contrib::Rack::Response.headers(response).select do |k, _|
+              response_headers = response.headers.select do |k, _|
                 ALLOWED_RESPONSE_HEADERS.include?(k.downcase)
               end
 

data/lib/datadog/appsec/ext.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Ext
+      INTERRUPT = :datadog_appsec_interrupt
+    end
+  end
+end

data/lib/datadog/appsec/extensions.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative 'configuration'
 
 module Datadog
@@ -54,6 +52,12 @@ module Datadog
           @settings.merge(dsl)
         end
 
+        def user_id_denylist=(arg)
+          dsl = AppSec::Configuration::DSL.new
+          dsl.user_id_denylist = arg
+          @settings.merge(dsl)
+        end
+
         def waf_timeout=(arg)
           dsl = AppSec::Configuration::DSL.new
           dsl.waf_timeout = arg
@@ -102,6 +106,10 @@ module Datadog
           @settings.ip_denylist
         end
 
+        def user_id_denylist
+          @settings.user_id_denylist
+        end
+
         def waf_timeout
           @settings.waf_timeout
         end

data/lib/datadog/appsec/instrumentation/gateway/argument.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Instrumentation
+      class Gateway
+        # Base class for Gateway Arguments
+        class Argument
+          def initialize(*); end
+        end
+
+        # Gateway User argument
+        class User < Argument
+          attr_reader :id
+
+          def initialize(id)
+            super
+            @id = id
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/instrumentation/gateway.rb

@@ -1,4 +1,4 @@
-# typed: ignore
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
@@ -20,6 +20,8 @@ module Datadog
           end
         end
 
+        private_constant :Middleware
+
         def initialize
           @middlewares = Hash.new { |h, k| h[k] = [] }
         end
@@ -27,16 +29,16 @@ module Datadog
         def push(name, env, &block)
           block ||= -> {}
 
-          middlewares = @middlewares[name]
+          middlewares_for_name = middlewares[name]
 
-          return [block.call, nil] if middlewares.empty?
+          return [block.call, nil] if middlewares_for_name.empty?
 
           wrapped = lambda do |_env|
             [block.call, nil]
           end
 
           # TODO: handle exceptions, except for wrapped
-          stack = middlewares.reverse.reduce(wrapped) do |next_, middleware|
+          stack = middlewares_for_name.reverse.reduce(wrapped) do |next_, middleware|
             lambda do |env_|
               middleware.call(next_, env_)
             end
@@ -46,8 +48,12 @@ module Datadog
         end
 
         def watch(name, key, &block)
-          @middlewares[name] << Middleware.new(key, &block) unless @middlewares[name].any? { |m| m.key == key }
+          @middlewares[name] << Middleware.new(key, &block) unless middlewares[name].any? { |m| m.key == key }
         end
+
+        private
+
+        attr_reader :middlewares
       end
 
       def self.gateway

data/lib/datadog/appsec/instrumentation.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    # Instrumentation for AppSec
+    module Instrumentation
+    end
+  end
+end

data/lib/datadog/appsec/monitor/gateway/watcher.rb

@@ -0,0 +1,86 @@
+# frozen_string_literal: true
+
+require_relative '../../ext'
+require_relative '../../instrumentation/gateway'
+require_relative '../../reactive/operation'
+require_relative '../reactive/set_user'
+
+module Datadog
+  module AppSec
+    module Monitor
+      module Gateway
+        # Watcher for Apssec internal events
+        module Watcher
+          class << self
+            def watch
+              gateway = Instrumentation.gateway
+
+              watch_user_id(gateway)
+            end
+
+            def watch_user_id(gateway = Instrumentation.gateway)
+              gateway.watch('identity.set_user', :appsec) do |stack, user|
+                block = false
+                event = nil
+                waf_context = Datadog::AppSec::Processor.active_context
+
+                AppSec::Reactive::Operation.new('identity.set_user') do |op|
+                  trace = active_trace
+                  span = active_span
+
+                  Monitor::Reactive::SetUser.subscribe(op, waf_context) do |result, _block|
+                    if result.status == :match
+                      # TODO: should this hash be an Event instance instead?
+                      event = {
+                        waf_result: result,
+                        trace: trace,
+                        span: span,
+                        user: user,
+                        actions: result.actions
+                      }
+
+                      span.set_tag('appsec.event', 'true') if span
+
+                      waf_context.events << event
+                    end
+                  end
+
+                  _result, block = Monitor::Reactive::SetUser.publish(op, user)
+                end
+
+                throw(Datadog::AppSec::Ext::INTERRUPT, [nil, [:block, event]]) if block
+
+                ret, res = stack.call(user)
+
+                if event
+                  res ||= []
+                  res << [:monitor, event]
+                end
+
+                [ret, res]
+              end
+            end
+
+            private
+
+            def active_trace
+              # TODO: factor out tracing availability detection
+
+              return unless defined?(Datadog::Tracing)
+
+              Datadog::Tracing.active_trace
+            end
+
+            def active_span
+              # TODO: factor out tracing availability detection
+
+              return unless defined?(Datadog::Tracing)
+
+              Datadog::Tracing.active_span
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/monitor/reactive/set_user.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module Monitor
+      module Reactive
+        # Dispatch data from Datadog::Kit::Identity.set_user to the WAF context
+        module SetUser
+          ADDRESSES = [
+            'usr.id',
+          ].freeze
+          private_constant :ADDRESSES
+
+          def self.publish(op, user)
+            catch(:block) do
+              op.publish('usr.id', user.id)
+
+              nil
+            end
+          end
+
+          def self.subscribe(op, waf_context)
+            op.subscribe(*ADDRESSES) do |*values|
+              Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
+
+              user_id = values[0]
+
+              waf_args = {
+                'usr.id' => user_id,
+              }
+
+              waf_timeout = Datadog::AppSec.settings.waf_timeout
+              result = waf_context.run(waf_args, waf_timeout)
+
+              Datadog.logger.debug { "WAF TIMEOUT: #{result.inspect}" } if result.timeout
+
+              case result.status
+              when :match
+                Datadog.logger.debug { "WAF: #{result.inspect}" }
+
+                block = result.actions.include?('block')
+
+                yield [result, block]
+
+                throw(:block, [result, true]) if block
+              when :ok
+                Datadog.logger.debug { "WAF OK: #{result.inspect}" }
+              when :invalid_call
+                Datadog.logger.debug { "WAF CALL ERROR: #{result.inspect}" }
+              when :invalid_rule, :invalid_flow, :no_rule
+                Datadog.logger.debug { "WAF RULE ERROR: #{result.inspect}" }
+              else
+                Datadog.logger.debug { "WAF UNKNOWN: #{result.status.inspect} #{result.inspect}" }
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/monitor.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require_relative 'monitor/gateway/watcher'
+
+module Datadog
+  module AppSec
+    # Monitor for internal AppSec Events
+    module Monitor
+    end
+  end
+end