@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/appsec/activation.js

@@ -0,0 +1,29 @@
+'use strict'
+
+const Activation = {
+  ONECLICK: 'OneClick',
+  ENABLED: 'Enabled',
+  DISABLED: 'Disabled',
+
+  fromConfig (config) {
+    switch (config.appsec.enabled) {
+      // ASM is activated by an env var DD_APPSEC_ENABLED=true
+      case true:
+        return Activation.ENABLED
+
+      // ASM is disabled by an env var DD_APPSEC_ENABLED=false
+      case false:
+        return Activation.DISABLED
+
+      // ASM is activated by one click remote config
+      case undefined:
+        return Activation.ONECLICK
+
+      // Any other value should never occur
+      default:
+        return Activation.DISABLED
+    }
+  },
+}
+
+module.exports = Activation

package/packages/dd-trace/src/appsec/addresses.js

@@ -0,0 +1,51 @@
+'use strict'
+
+// TODO: reorder all this, it's a mess
+module.exports = {
+  HTTP_INCOMING_BODY: 'server.request.body',
+  HTTP_INCOMING_QUERY: 'server.request.query',
+  HTTP_INCOMING_HEADERS: 'server.request.headers.no_cookies',
+  // TODO: 'server.request.trailers',
+  HTTP_INCOMING_URL: 'server.request.uri.raw',
+  HTTP_INCOMING_METHOD: 'server.request.method',
+  HTTP_INCOMING_PARAMS: 'server.request.path_params',
+  HTTP_INCOMING_COOKIES: 'server.request.cookies',
+  HTTP_INCOMING_RESPONSE_CODE: 'server.response.status',
+  HTTP_INCOMING_RESPONSE_HEADERS: 'server.response.headers.no_cookies',
+  // TODO: 'server.response.trailers',
+  HTTP_INCOMING_GRAPHQL_RESOLVERS: 'graphql.server.all_resolvers',
+  HTTP_INCOMING_GRAPHQL_RESOLVER: 'graphql.server.resolver',
+
+  HTTP_INCOMING_RESPONSE_BODY: 'server.response.body',
+
+  HTTP_CLIENT_IP: 'http.client_ip',
+
+  USER_ID: 'usr.id',
+  USER_LOGIN: 'usr.login',
+  USER_SESSION_ID: 'usr.session_id',
+
+  WAF_CONTEXT_PROCESSOR: 'waf.context.processor',
+
+  HTTP_OUTGOING_URL: 'server.io.net.url',
+  HTTP_OUTGOING_METHOD: 'server.io.net.request.method',
+  HTTP_OUTGOING_HEADERS: 'server.io.net.request.headers',
+  HTTP_OUTGOING_RESPONSE_STATUS: 'server.io.net.response.status',
+  HTTP_OUTGOING_RESPONSE_HEADERS: 'server.io.net.response.headers',
+  HTTP_OUTGOING_RESPONSE_BODY: 'server.io.net.response.body',
+
+  FS_OPERATION_PATH: 'server.io.fs.file',
+
+  DB_STATEMENT: 'server.db.statement',
+  DB_SYSTEM: 'server.db.system',
+
+  EXEC_COMMAND: 'server.sys.exec.cmd',
+  SHELL_COMMAND: 'server.sys.shell.cmd',
+
+  LOGIN_SUCCESS: 'server.business_logic.users.login.success',
+  LOGIN_FAILURE: 'server.business_logic.users.login.failure',
+
+  PAYMENT_CREATION: 'server.business_logic.payment.creation',
+  PAYMENT_SUCCESS: 'server.business_logic.payment.success',
+  PAYMENT_FAILURE: 'server.business_logic.payment.failure',
+  PAYMENT_CANCELLATION: 'server.business_logic.payment.cancellation',
+}

package/packages/dd-trace/src/appsec/api_security_sampler.js

@@ -0,0 +1,117 @@
+'use strict'
+
+const { TTLCache } = require('../../../../vendor/dist/@isaacs/ttlcache')
+const web = require('../plugins/util/web')
+const log = require('../log')
+const { AUTO_REJECT, USER_REJECT } = require('../../../../ext/priority')
+const { keepTrace } = require('../priority_sampler')
+const { ASM } = require('../standalone/product')
+
+const MAX_SIZE = 4096
+
+let enabled
+let asmStandaloneEnabled
+
+/**
+ * @type {TTLCache}
+ */
+let sampledRequests
+
+class NoopTTLCache {
+  clear () {}
+  set (_key, _value) {}
+  has (_key) { return false }
+}
+
+function configure ({ appsec, apmTracingEnabled }) {
+  enabled = appsec.apiSecurity.enabled
+  asmStandaloneEnabled = apmTracingEnabled === false
+  sampledRequests = appsec.apiSecurity.sampleDelay === 0
+    ? new NoopTTLCache()
+    : new TTLCache({ max: MAX_SIZE, ttl: appsec.apiSecurity.sampleDelay * 1000 })
+}
+
+function disable () {
+  enabled = false
+  sampledRequests?.clear()
+}
+
+function sampleRequest (req, res, force = false) {
+  if (!enabled) return false
+
+  const key = computeKey(req, res)
+  if (!key || isSampled(key)) return false
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return false
+
+  if (asmStandaloneEnabled) {
+    keepTrace(rootSpan, ASM)
+  } else {
+    let priority = getSpanPriority(rootSpan)
+    if (!priority) {
+      rootSpan._prioritySampler?.sample(rootSpan)
+      priority = getSpanPriority(rootSpan)
+    }
+
+    if (priority === AUTO_REJECT || priority === USER_REJECT) {
+      return false
+    }
+  }
+
+  if (force) {
+    sampledRequests.set(key, undefined)
+  }
+
+  return true
+}
+
+function isSampled (key) {
+  return sampledRequests.has(key)
+}
+
+function getRouteOrEndpoint (context, statusCode) {
+  // First try to get the route from the context paths
+  const route = context?.paths?.join('') || ''
+  if (route) {
+    return route
+  }
+
+  // If route is not available, fallback to http.endpoint
+  if (statusCode !== 404) {
+    const endpoint = context?.span?.context()?._tags?.['http.endpoint']
+    if (endpoint) {
+      return endpoint
+    }
+  }
+
+  return ''
+}
+
+function computeKey (req, res) {
+  const method = req.method
+  const status = res.statusCode
+
+  if (!method || !status) {
+    log.warn('[ASM] Unsupported groupkey for API security')
+    return null
+  }
+
+  const context = web.getContext(req)
+  const route = getRouteOrEndpoint(context, status)
+
+  return method + route + status
+}
+
+function getSpanPriority (span) {
+  const spanContext = span.context?.()
+  return spanContext._sampling?.priority
+}
+
+module.exports = {
+  configure,
+  disable,
+  sampleRequest,
+  isSampled,
+  computeKey,
+}

package/packages/dd-trace/src/appsec/blocked_templates.js

@@ -0,0 +1,14 @@
+/* eslint-disable @stylistic/max-len */
+'use strict'
+
+const html = '<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>You\'ve been blocked</title><style>a,body,div,html,span{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}body{background:-webkit-radial-gradient(26% 19%,circle,#fff,#f4f7f9);background:radial-gradient(circle at 26% 19%,#fff,#f4f7f9);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;width:100%;min-height:100vh;line-height:1;flex-direction:column}p{display:block}main{text-align:center;flex:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;flex-direction:column}p{font-size:18px;line-height:normal;color:#646464;font-family:sans-serif;font-weight:400}a{color:#4842b7}footer{width:100%;text-align:center}footer p{font-size:16px}</style></head><body><main><p>Sorry, you cannot access this page. Please contact the customer service team.</p></main><footer><p>Security provided by <a href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/" target="_blank">Datadog</a></p></footer></body></html>'
+
+const json = '{"errors":[{"title":"You\'ve been blocked","detail":"Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}'
+
+const graphqlJson = '{"errors":[{"message":"You\'ve been blocked","extensions":{"detail":"Sorry, you cannot perform this operation. Please contact the customer service team. Security provided by Datadog."}}]}'
+
+module.exports = {
+  html,
+  json,
+  graphqlJson,
+}

package/packages/dd-trace/src/appsec/blocking.js

@@ -0,0 +1,196 @@
+'use strict'
+
+const log = require('../log')
+const blockedTemplates = require('./blocked_templates')
+const { updateBlockFailureMetric } = require('./telemetry')
+
+const detectedSpecificEndpoints = {}
+
+let templateHtml = blockedTemplates.html
+let templateJson = blockedTemplates.json
+let templateGraphqlJson = blockedTemplates.graphqlJson
+
+let defaultBlockingActionParameters
+
+const responseBlockedSet = new WeakSet()
+
+const blockDelegations = new WeakMap()
+
+const specificBlockingTypes = {
+  GRAPHQL: 'graphql',
+}
+
+function getSpecificKey (method, url) {
+  return `${method}+${url}`
+}
+
+function addSpecificEndpoint (method, url, type) {
+  detectedSpecificEndpoints[getSpecificKey(method, url)] = type
+}
+
+function getBlockWithRedirectData (actionParameters) {
+  let statusCode = actionParameters.status_code
+  if (!statusCode || statusCode < 300 || statusCode >= 400) {
+    statusCode = 303
+  }
+  const headers = {
+    Location: actionParameters.location,
+  }
+
+  return { headers, statusCode }
+}
+
+function getSpecificBlockingData (type) {
+  switch (type) {
+    case specificBlockingTypes.GRAPHQL:
+      return {
+        type: 'application/json',
+        body: templateGraphqlJson,
+      }
+  }
+}
+
+function getBlockWithContentData (req, specificType, actionParameters) {
+  let type
+  let body
+
+  const specificBlockingType = specificType || detectedSpecificEndpoints[getSpecificKey(req.method, req.url)]
+  if (specificBlockingType) {
+    const specificBlockingContent = getSpecificBlockingData(specificBlockingType)
+    type = specificBlockingContent?.type
+    body = specificBlockingContent?.body
+  }
+
+  if (!type) {
+    // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
+    const accept = req.headers.accept?.split(',').map((str) => str.split(';', 1)[0].trim())
+
+    if (!actionParameters || actionParameters.type === 'auto') {
+      if (accept?.includes('text/html') && !accept.includes('application/json')) {
+        type = 'text/html; charset=utf-8'
+        body = templateHtml
+      } else {
+        type = 'application/json'
+        body = templateJson
+      }
+    } else {
+      if (actionParameters.type === 'html') {
+        type = 'text/html; charset=utf-8'
+        body = templateHtml
+      } else {
+        type = 'application/json'
+        body = templateJson
+      }
+    }
+  }
+
+  const statusCode = actionParameters?.status_code || 403
+
+  const headers = {
+    'Content-Type': type,
+    'Content-Length': Buffer.byteLength(body),
+  }
+
+  return { body, statusCode, headers }
+}
+
+function getBlockingData (req, specificType, actionParameters) {
+  return actionParameters?.location
+    ? getBlockWithRedirectData(actionParameters)
+    : getBlockWithContentData(req, specificType, actionParameters)
+}
+
+function block (req, res, rootSpan, abortController, actionParameters = defaultBlockingActionParameters) {
+  // synchronous blocking overrides previously created delegations
+  blockDelegations.delete(res)
+
+  try {
+    if (res.headersSent) {
+      log.warn('[ASM] Cannot send blocking response when headers have already been sent')
+
+      throw new Error('Headers have already been sent')
+    }
+
+    const { body, headers, statusCode } = getBlockingData(req, null, actionParameters)
+
+    for (const headerName of res.getHeaderNames()) {
+      res.removeHeader(headerName)
+    }
+
+    res.writeHead(statusCode, headers)
+
+    // this is needed to call the original end method, since express-session replaces it
+    res.constructor.prototype.end.call(res, body)
+
+    rootSpan.setTag('appsec.blocked', 'true')
+
+    responseBlockedSet.add(res)
+    abortController?.abort()
+
+    return true
+  } catch (err) {
+    rootSpan?.setTag('_dd.appsec.block.failed', 1)
+    log.error('[ASM] Blocking error', err)
+
+    // TODO: if blocking fails, then the response will never be sent ?
+
+    updateBlockFailureMetric(req)
+    return false
+  }
+}
+
+function registerBlockDelegation (req, res) {
+  const args = arguments
+
+  return new Promise((resolve) => {
+    // ignore subsequent delegations by never calling their resolve()
+    if (blockDelegations.has(res)) return
+
+    blockDelegations.set(res, { args, resolve })
+  })
+}
+
+function callBlockDelegation (res) {
+  const delegation = blockDelegations.get(res)
+  if (delegation) {
+    const result = block.apply(this, delegation.args)
+    delegation.resolve(result)
+    return result
+  }
+}
+
+function getBlockingAction (actions) {
+  // waf only returns one action, but it prioritizes redirect over block
+  return actions?.redirect_request || actions?.block_request
+}
+
+function setTemplates (config) {
+  templateHtml = config.appsec.blockedTemplateHtml || blockedTemplates.html
+
+  templateJson = config.appsec.blockedTemplateJson || blockedTemplates.json
+
+  templateGraphqlJson = config.appsec.blockedTemplateGraphql || blockedTemplates.graphqlJson
+}
+
+function isBlocked (res) {
+  return responseBlockedSet.has(res)
+}
+
+function setDefaultBlockingActionParameters (actions) {
+  const blockAction = actions?.find(action => action.id === 'block')
+
+  defaultBlockingActionParameters = blockAction?.parameters
+}
+
+module.exports = {
+  addSpecificEndpoint,
+  block,
+  registerBlockDelegation,
+  callBlockDelegation,
+  specificBlockingTypes,
+  getBlockingData,
+  getBlockingAction,
+  setTemplates,
+  isBlocked,
+  setDefaultBlockingActionParameters,
+}

package/packages/dd-trace/src/appsec/channels.js

@@ -0,0 +1,50 @@
+'use strict'
+
+const dc = require('dc-polyfill')
+
+// TODO: use TBD naming convention
+module.exports = {
+  apolloChannel: dc.tracingChannel('datadog:apollo:request'),
+  apolloHttpServerChannel: dc.tracingChannel('datadog:apollo:httpserver'),
+  apolloServerCoreChannel: dc.tracingChannel('datadog:apollo-server-core:request'),
+  bodyParser: dc.channel('datadog:body-parser:read:finish'),
+  childProcessExecutionTracingChannel: dc.tracingChannel('datadog:child_process:execution'),
+  cookieParser: dc.channel('datadog:cookie-parser:read:finish'),
+  expressMiddlewareError: dc.channel('apm:express:middleware:error'),
+  expressProcessParams: dc.channel('datadog:express:process_params:start'),
+  expressResponseRenderStart: dc.channel('tracing:datadog:express:response:render:start'),
+  expressSession: dc.channel('datadog:express-session:middleware:finish'),
+  fastifyBodyParser: dc.channel('datadog:fastify:body-parser:finish'),
+  fastifyCookieParser: dc.channel('datadog:fastify-cookie:read:finish'),
+  fastifyMiddlewareError: dc.channel('apm:fastify:middleware:error'),
+  fastifyPathParams: dc.channel('datadog:fastify:path-params:finish'),
+  fastifyQueryParams: dc.channel('datadog:fastify:query-params:finish'),
+  fastifyResponseChannel: dc.channel('datadog:fastify:response:finish'),
+  fsOperationStart: dc.channel('apm:fs:operation:start'),
+  graphqlMiddlewareChannel: dc.tracingChannel('datadog:apollo:middleware'),
+  httpClientRequestStart: dc.channel('apm:http:client:request:start'),
+  httpClientResponseFinish: dc.channel('apm:http:client:response:finish'),
+  incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
+  incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
+  multerParser: dc.channel('datadog:multer:read:finish'),
+  mysql2OuterQueryStart: dc.channel('datadog:mysql2:outerquery:start'),
+  nextBodyParsed: dc.channel('apm:next:body-parsed'),
+  nextQueryParsed: dc.channel('apm:next:query-parsed'),
+  passportUser: dc.channel('datadog:passport:deserializeUser:finish'),
+  passportVerify: dc.channel('datadog:passport:verify:finish'),
+  pgPoolQueryStart: dc.channel('datadog:pg:pool:query:start'),
+  pgQueryStart: dc.channel('apm:pg:query:start'),
+  queryParser: dc.channel('datadog:query:read:finish'),
+  responseBody: dc.channel('datadog:express:response:json:start'),
+  responseSetHeader: dc.channel('datadog:http:server:response:set-header:start'),
+  responseWriteHead: dc.channel('apm:http:server:response:writeHead:start'),
+  routerMiddlewareError: dc.channel('apm:router:middleware:error'),
+  routerParam: dc.channel('datadog:router:param:start'),
+  setCookieChannel: dc.channel('datadog:iast:set-cookie'),
+  setUncaughtExceptionCaptureCallbackStart: dc.channel('datadog:process:setUncaughtExceptionCaptureCallback:start'),
+  startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
+  stripeCheckoutSessionCreate: dc.channel('datadog:stripe:checkoutSession:create:finish'),
+  stripeConstructEvent: dc.channel('datadog:stripe:constructEvent:finish'),
+  stripePaymentIntentCreate: dc.channel('datadog:stripe:paymentIntent:create:finish'),
+  wafRunFinished: dc.channel('datadog:waf:run:finish'),
+}