ddtrace 1.9.0 → 1.10.1

data/lib/datadog/appsec/contrib/rack/reactive/request.rb

@@ -1,6 +1,4 @@
-# typed: ignore
-
-require_relative '../request'
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
@@ -9,30 +7,30 @@ module Datadog
         module Reactive
           # Dispatch data from a Rack request to the WAF context
           module Request
-            def self.publish(op, request)
+            ADDRESSES = [
+              'request.headers',
+              'request.uri.raw',
+              'request.query',
+              'request.cookies',
+              'request.client_ip',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_request)
               catch(:block) do
-                op.publish('request.query', Rack::Request.query(request))
-                op.publish('request.headers', Rack::Request.headers(request))
-                op.publish('request.uri.raw', Rack::Request.url(request))
-                op.publish('request.cookies', Rack::Request.cookies(request))
-                op.publish('request.client_ip', Rack::Request.client_ip(request))
+                op.publish('request.query', gateway_request.query)
+                op.publish('request.headers', gateway_request.headers)
+                op.publish('request.uri.raw', gateway_request.url)
+                op.publish('request.cookies', gateway_request.cookies)
+                op.publish('request.client_ip', gateway_request.client_ip)
 
                 nil
               end
             end
 
-            # rubocop:disable Metrics/MethodLength
             def self.subscribe(op, waf_context)
-              addresses = [
-                'request.headers',
-                'request.uri.raw',
-                'request.query',
-                'request.cookies',
-                'request.client_ip',
-              ]
-
-              op.subscribe(*addresses) do |*values|
-                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 headers = values[0]
                 headers_no_cookies = headers.dup.tap { |h| h.delete('cookie') }
                 uri_raw = values[1]
@@ -74,7 +72,6 @@ module Datadog
                 end
               end
             end
-            # rubocop:enable Metrics/MethodLength
           end
         end
       end

data/lib/datadog/appsec/contrib/rack/reactive/request_body.rb

@@ -1,6 +1,4 @@
-# typed: ignore
-
-require_relative '../request'
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
@@ -9,22 +7,23 @@ module Datadog
         module Reactive
           # Dispatch data from a Rack request to the WAF context
           module RequestBody
-            def self.publish(op, request)
+            ADDRESSES = [
+              'request.body',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_request)
               catch(:block) do
                 # params have been parsed from the request body
-                op.publish('request.body', Rack::Request.form_hash(request))
+                op.publish('request.body', gateway_request.form_hash)
 
                 nil
               end
             end
 
             def self.subscribe(op, waf_context)
-              addresses = [
-                'request.body',
-              ]
-
-              op.subscribe(*addresses) do |*values|
-                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 body = values[0]
 
                 waf_args = {

data/lib/datadog/appsec/contrib/rack/reactive/response.rb

@@ -1,6 +1,4 @@
-# typed: ignore
-
-require_relative '../response'
+# frozen_string_literal: true
 
 module Datadog
   module AppSec
@@ -9,21 +7,22 @@ module Datadog
         module Reactive
           # Dispatch data from a Rack response to the WAF context
           module Response
-            def self.publish(op, response)
+            ADDRESSES = [
+              'response.status',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_response)
               catch(:block) do
-                op.publish('response.status', Rack::Response.status(response))
+                op.publish('response.status', gateway_response.status)
 
                 nil
               end
             end
 
             def self.subscribe(op, waf_context)
-              addresses = [
-                'response.status',
-              ]
-
-              op.subscribe(*addresses) do |*values|
-                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
 
                 response_status = values[0]
 

data/lib/datadog/appsec/contrib/rack/request_body_middleware.rb

@@ -1,5 +1,6 @@
-# typed: ignore
+# frozen_string_literal: true
 
+require_relative 'gateway/request'
 require_relative '../../instrumentation/gateway'
 require_relative '../../response'
 
@@ -22,9 +23,10 @@ module Datadog
 
             # TODO: handle exceptions, except for @app.call
 
-            request = ::Rack::Request.new(env)
-
-            request_return, request_response = Instrumentation.gateway.push('rack.request.body', request) do
+            request_return, request_response = Instrumentation.gateway.push(
+              'rack.request.body',
+              Gateway::Request.new(env)
+            ) do
               @app.call(env)
             end
 

data/lib/datadog/appsec/contrib/rack/request_middleware.rb

@@ -1,7 +1,8 @@
-# typed: ignore
-
 require 'json'
 
+require_relative 'gateway/request'
+require_relative 'gateway/response'
+require_relative '../../ext'
 require_relative '../../instrumentation/gateway'
 require_relative '../../processor'
 require_relative '../../response'
@@ -20,47 +21,60 @@ module Datadog
             @app = app
 
             @oneshot_tags_sent = false
-            @processor = Datadog::AppSec::Processor.new
           end
 
           def call(env)
-            return @app.call(env) unless Datadog.configuration.appsec.enabled && @processor.ready?
+            return @app.call(env) unless Datadog::AppSec.enabled?
 
-            # TODO: handle exceptions, except for @app.call
+            processor = Datadog::AppSec.processor
+
+            return @app.call(env) if processor.nil? || !processor.ready?
 
-            context = @processor.new_context
+            # TODO: handle exceptions, except for @app.call
 
+            context = processor.activate_context
             env['datadog.waf.context'] = context
-            request = ::Rack::Request.new(env)
 
-            add_appsec_tags(active_trace, active_span, env)
+            gateway_request = Gateway::Request.new(env)
+
+            add_appsec_tags(processor, active_trace, active_span, env)
 
-            request_return, request_response = Instrumentation.gateway.push('rack.request', request) do
-              @app.call(env)
+            request_return, request_response = catch(::Datadog::AppSec::Ext::INTERRUPT) do
+              Instrumentation.gateway.push('rack.request', gateway_request) do
+                @app.call(env)
+              end
             end
 
             if request_response && request_response.any? { |action, _event| action == :block }
               request_return = AppSec::Response.negotiate(env).to_rack
             end
 
-            response = ::Rack::Response.new(request_return[2], request_return[0], request_return[1])
-            response.instance_eval do
-              @waf_context = context
-            end
+            gateway_response = Gateway::Response.new(
+              request_return[2],
+              request_return[0],
+              request_return[1],
+              active_context: context
+            )
 
-            _response_return, _response_response = Instrumentation.gateway.push('rack.response', response)
+            _response_return, response_response = Instrumentation.gateway.push('rack.response', gateway_response)
 
             context.events.each do |e|
-              e[:response] ||= response
-              e[:request]  ||= request
+              e[:response] ||= gateway_response
+              e[:request]  ||= gateway_request
             end
 
             AppSec::Event.record(*context.events)
 
+            if response_response && response_response.any? { |action, _event| action == :block }
+              request_return = AppSec::Response.negotiate(env).to_rack
+            end
+
             request_return
           ensure
-            add_waf_runtime_tags(active_trace, context) if context
-            context.finalize if context
+            if context
+              add_waf_runtime_tags(active_trace, context)
+              processor.deactivate_context
+            end
           end
 
           private
@@ -81,7 +95,7 @@ module Datadog
             Datadog::Tracing.active_span
           end
 
-          def add_appsec_tags(trace, span, env)
+          def add_appsec_tags(processor, trace, span, env)
             return unless trace
 
             trace.set_tag('_dd.appsec.enabled', 1)
@@ -99,18 +113,18 @@ module Datadog
               )
             end
 
-            if @processor.ruleset_info
-              trace.set_tag('_dd.appsec.event_rules.version', @processor.ruleset_info[:version])
+            if processor.ruleset_info
+              trace.set_tag('_dd.appsec.event_rules.version', processor.ruleset_info[:version])
 
               unless @oneshot_tags_sent
                 # Small race condition, but it's inoccuous: worst case the tags
                 # are sent a couple of times more than expected
                 @oneshot_tags_sent = true
 
-                trace.set_tag('_dd.appsec.event_rules.loaded', @processor.ruleset_info[:loaded].to_f)
-                trace.set_tag('_dd.appsec.event_rules.error_count', @processor.ruleset_info[:failed].to_f)
-                trace.set_tag('_dd.appsec.event_rules.errors', JSON.dump(@processor.ruleset_info[:errors]))
-                trace.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(@processor.addresses))
+                trace.set_tag('_dd.appsec.event_rules.loaded', processor.ruleset_info[:loaded].to_f)
+                trace.set_tag('_dd.appsec.event_rules.error_count', processor.ruleset_info[:failed].to_f)
+                trace.set_tag('_dd.appsec.event_rules.errors', JSON.dump(processor.ruleset_info[:errors]))
+                trace.set_tag('_dd.appsec.event_rules.addresses', JSON.dump(processor.addresses))
 
                 # Ensure these tags reach the backend
                 trace.keep!

data/lib/datadog/appsec/contrib/rails/configuration/settings.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative '../../configuration/settings'
 require_relative '../ext'
 

data/lib/datadog/appsec/contrib/rails/ext.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rails/framework.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rails/gateway/request.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require_relative '../../../instrumentation/gateway/argument'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Rails
+        module Gateway
+          # Gateway Request argument. Normalized extration of data from ActionDispatch::Request
+          class Request < Instrumentation::Gateway::Argument
+            attr_reader :request
+
+            def initialize(request)
+              super
+              @request = request
+            end
+
+            def env
+              request.env
+            end
+
+            def headers
+              request.headers
+            end
+
+            def host
+              request.host
+            end
+
+            def user_agent
+              request.user_agent
+            end
+
+            def remote_addr
+              request.remote_addr
+            end
+
+            def parsed_body
+              # force body parameter parsing, which is done lazily by Rails
+              request.parameters
+
+              # usually Hash<String,String> but can be a more complex
+              # Hash<String,String||Array||Hash> when e.g coming from JSON or
+              # with Rails advanced param square bracket parsing
+              body = request.env['action_dispatch.request.request_parameters']
+
+              return if body.nil?
+
+              body.reject do |k, _v|
+                request.env['action_dispatch.request.path_parameters'].key?(k)
+              end
+            end
+
+            def route_params
+              excluded = [:controller, :action]
+
+              request.env['action_dispatch.request.path_parameters'].reject do |k, _v|
+                excluded.include?(k)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/rails/gateway/watcher.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative '../../../instrumentation/gateway'
 require_relative '../../../reactive/operation'
 require_relative '../reactive/action'
@@ -12,50 +10,56 @@ module Datadog
         module Gateway
           # Watcher for Rails gateway events
           module Watcher
-            def self.watch
-              Instrumentation.gateway.watch('rails.request.action', :appsec) do |stack, request|
-                block = false
-                event = nil
-                waf_context = request.env['datadog.waf.context']
-
-                AppSec::Reactive::Operation.new('rails.request.action') do |op|
-                  trace = active_trace
-                  span = active_span
-
-                  Rails::Reactive::Action.subscribe(op, waf_context) do |result, _block|
-                    if result.status == :match
-                      # TODO: should this hash be an Event instance instead?
-                      event = {
-                        waf_result: result,
-                        trace: trace,
-                        span: span,
-                        request: request,
-                        actions: result.actions
-                      }
-
-                      span.set_tag('appsec.event', 'true') if span
-
-                      waf_context.events << event
+            class << self
+              def watch
+                gateway = Instrumentation.gateway
+
+                watch_request_action(gateway)
+              end
+
+              def watch_request_action(gateway = Instrumentation.gateway)
+                gateway.watch('rails.request.action', :appsec) do |stack, gateway_request|
+                  block = false
+                  event = nil
+                  waf_context = gateway_request.env['datadog.waf.context']
+
+                  AppSec::Reactive::Operation.new('rails.request.action') do |op|
+                    trace = active_trace
+                    span = active_span
+
+                    Rails::Reactive::Action.subscribe(op, waf_context) do |result, _block|
+                      if result.status == :match
+                        # TODO: should this hash be an Event instance instead?
+                        event = {
+                          waf_result: result,
+                          trace: trace,
+                          span: span,
+                          request: gateway_request,
+                          actions: result.actions
+                        }
+
+                        span.set_tag('appsec.event', 'true') if span
+
+                        waf_context.events << event
+                      end
                     end
+
+                    _result, block = Rails::Reactive::Action.publish(op, gateway_request)
                   end
 
-                  _result, block = Rails::Reactive::Action.publish(op, request)
-                end
+                  next [nil, [[:block, event]]] if block
 
-                next [nil, [[:block, event]]] if block
+                  ret, res = stack.call(gateway_request.request)
 
-                ret, res = stack.call(request)
+                  if event
+                    res ||= []
+                    res << [:monitor, event]
+                  end
 
-                if event
-                  res ||= []
-                  res << [:monitor, event]
+                  [ret, res]
                 end
-
-                [ret, res]
               end
-            end
 
-            class << self
               private
 
               def active_trace

data/lib/datadog/appsec/contrib/rails/integration.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative '../integration'
 
 require_relative 'configuration/settings'

data/lib/datadog/appsec/contrib/rails/patcher.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative '../../../core/utils/only_once'
 
 require_relative '../patcher'
@@ -8,6 +6,7 @@ require_relative '../../response'
 require_relative '../rack/request_middleware'
 require_relative '../rack/request_body_middleware'
 require_relative 'gateway/watcher'
+require_relative 'gateway/request'
 
 require_relative '../../../tracing/contrib/rack/middlewares'
 
@@ -79,7 +78,8 @@ module Datadog
 
               # TODO: handle exceptions, except for super
 
-              request_return, request_response = Instrumentation.gateway.push('rails.request.action', request) do
+              gateway_request = Gateway::Request.new(request)
+              request_return, request_response = Instrumentation.gateway.push('rails.request.action', gateway_request) do
                 super
               end
 

data/lib/datadog/appsec/contrib/rails/reactive/action.rb

@@ -1,4 +1,4 @@
-# typed: ignore
+# frozen_string_literal: true
 
 require_relative '../request'
 
@@ -9,24 +9,25 @@ module Datadog
         module Reactive
           # Dispatch data from a Rails request to the WAF context
           module Action
-            def self.publish(op, request)
+            ADDRESSES = [
+              'rails.request.body',
+              'rails.request.route_params',
+            ].freeze
+            private_constant :ADDRESSES
+
+            def self.publish(op, gateway_request)
               catch(:block) do
                 # params have been parsed from the request body
-                op.publish('rails.request.body', Rails::Request.parsed_body(request))
-                op.publish('rails.request.route_params', Rails::Request.route_params(request))
+                op.publish('rails.request.body', gateway_request.parsed_body)
+                op.publish('rails.request.route_params', gateway_request.route_params)
 
                 nil
               end
             end
 
             def self.subscribe(op, waf_context)
-              addresses = [
-                'rails.request.body',
-                'rails.request.route_params',
-              ]
-
-              op.subscribe(*addresses) do |*values|
-                Datadog.logger.debug { "reacted to #{addresses.inspect}: #{values.inspect}" }
+              op.subscribe(*ADDRESSES) do |*values|
+                Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 body = values[0]
                 path_params = values[1]
 

data/lib/datadog/appsec/contrib/rails/request.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/rails/request_middleware.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/sinatra/configuration/settings.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 require_relative '../../configuration/settings'
 require_relative '../ext'
 

data/lib/datadog/appsec/contrib/sinatra/ext.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/sinatra/framework.rb

@@ -1,5 +1,3 @@
-# typed: ignore
-
 module Datadog
   module AppSec
     module Contrib

data/lib/datadog/appsec/contrib/sinatra/gateway/request.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+require_relative '../../rack/gateway/request'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Gateway
+          # Gateway Request argument. Normalized extration of data from Rack::Request
+          class Request < Rack::Gateway::Request
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/contrib/sinatra/gateway/route_params.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require_relative '../../../instrumentation/gateway/argument'
+
+module Datadog
+  module AppSec
+    module Contrib
+      module Sinatra
+        module Gateway
+          # Gateway Route Params argument.
+          class RouteParams < Instrumentation::Gateway::Argument
+            attr_reader :params
+
+            def initialize(params)
+              super
+              @params = params
+            end
+          end
+        end
+      end
+    end
+  end
+end