@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -0,0 +1,302 @@
+'use strict'
+
+const web = require('../plugins/util/web')
+const log = require('../log')
+const {
+  HTTP_OUTGOING_METHOD,
+  HTTP_OUTGOING_HEADERS,
+  HTTP_OUTGOING_RESPONSE_STATUS,
+  HTTP_OUTGOING_RESPONSE_HEADERS,
+  HTTP_OUTGOING_RESPONSE_BODY,
+} = require('./addresses')
+
+const KNUTH_FACTOR = 11400714819323199488n // eslint-disable-line unicorn/numeric-separators-style
+const UINT64_MAX = (1n << 64n) - 1n
+
+let config
+let samplingRate
+let globalRequestCounter
+let bodyAnalysisCount
+let downstreamAnalysisCount
+let redirectBodyCollectionDecisions
+
+function enable (_config) {
+  config = _config
+  globalRequestCounter = 0n
+  bodyAnalysisCount = new WeakMap()
+  downstreamAnalysisCount = new WeakMap()
+  redirectBodyCollectionDecisions = new WeakMap()
+
+  const bodyAnalysisSampleRate = config.appsec.apiSecurity?.downstreamBodyAnalysisSampleRate
+  samplingRate = Math.min(Math.max(bodyAnalysisSampleRate, 0), 1)
+
+  if (samplingRate !== bodyAnalysisSampleRate) {
+    log.warn(
+      'DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE value is %s and it\'s out of range',
+      bodyAnalysisSampleRate)
+  }
+}
+
+function disable () {
+  config = null
+  globalRequestCounter = null
+  bodyAnalysisCount = null
+  downstreamAnalysisCount = null
+  redirectBodyCollectionDecisions = null
+}
+
+/**
+ * Check we have a stored redirect body collection decision for a given URL.
+ * @param {import('http').IncomingMessage} req outgoing request.
+ * @param {string} outgoingUrl the URL being requested.
+ * @returns {boolean} the stored decision
+ */
+function consumeRedirectBodyCollectionDecision (req, outgoingUrl) {
+  const decisions = redirectBodyCollectionDecisions.get(req)
+  if (!decisions) return false
+
+  return decisions.delete(outgoingUrl)
+}
+
+/**
+ * Stores a redirect body collection decision for a follow-up request.
+ * @param {import('http').IncomingMessage} req outgoing request.
+ * @param {string} redirectUrl the URL to redirect to.
+ */
+function storeRedirectBodyCollectionDecision (req, redirectUrl) {
+  let decisions = redirectBodyCollectionDecisions.get(req)
+
+  if (!decisions) {
+    decisions = new Set()
+    redirectBodyCollectionDecisions.set(req, decisions)
+  }
+
+  decisions.add(redirectUrl)
+}
+
+/**
+ * Determines whether the current downstream request/responses bodies should be sampled for analysis.
+ * @param {import('http').IncomingMessage} req outgoing request.
+ * @param {string} outgoingUrl the URL being requested (to check for redirect decisions).
+ * @returns {boolean} true when the downstream response body should be captured.
+ */
+function shouldSampleBody (req, outgoingUrl) {
+  // Check if there's a stored decision from a previous redirect
+  const storedDecision = consumeRedirectBodyCollectionDecision(req, outgoingUrl)
+  if (storedDecision) return true
+
+  globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
+
+  const currentCount = bodyAnalysisCount.get(req) || 0
+  if (currentCount >= config.appsec.apiSecurity?.maxDownstreamRequestBodyAnalysis) {
+    return false
+  }
+
+  const hashed = (globalRequestCounter * KNUTH_FACTOR) % UINT64_MAX
+  // Replace 1000n with the accuraccy that we want to maintain
+  const threshold = (UINT64_MAX * BigInt(Math.round(samplingRate * 1000))) / 1000n
+
+  const shouldCollectBody = hashed <= threshold
+
+  // Track body analysis count if we're sampling the response body
+  if (shouldCollectBody) {
+    incrementBodyAnalysisCount(req)
+  }
+
+  return shouldCollectBody
+}
+
+/**
+ * Increments the number of downstream body analyses performed for the given request.
+ * @param {import('http').IncomingMessage} req outgoing request.
+ */
+function incrementBodyAnalysisCount (req) {
+  const currentCount = bodyAnalysisCount.get(req) || 0
+  bodyAnalysisCount.set(req, currentCount + 1)
+}
+
+/**
+ *
+ * @param {object} headers
+ * @returns {object} the headers with all keys converted to lowercase
+ */
+function lowercaseHeaderKeys (headers) {
+  return Object.fromEntries(Object.entries(headers).map(([key, value]) => [key.toLowerCase(), value]))
+}
+
+/**
+ * Extracts request data from the context for WAF analysis
+ * @param {object} ctx context for the outgoing downstream request.
+ * @returns {object} a map of addresses and request data.
+ */
+function extractRequestData (ctx) {
+  const addresses = {}
+
+  const options = ctx?.args?.options || {}
+
+  addresses[HTTP_OUTGOING_METHOD] = getMethod(options.method)
+
+  const headers = options?.headers
+  if (headers && Object.keys(headers).length > 0) {
+    addresses[HTTP_OUTGOING_HEADERS] = lowercaseHeaderKeys(headers)
+  }
+
+  return addresses
+}
+
+/**
+ * Checks if a response is a redirect
+ * @param {import('http').IncomingMessage} req incoming server request.
+ * @param {import('http').IncomingMessage} res downstream response object.
+ * @returns {boolean} is redirect.
+ */
+function handleRedirectResponse (req, res) {
+  const isRedirect = res.statusCode >= 300 && res.statusCode < 400
+  const redirectLocation = res.headers?.location || ''
+
+  if (isRedirect && redirectLocation) {
+    // Store the body collection decision for the redirect target
+    storeRedirectBodyCollectionDecision(req, redirectLocation)
+    return true
+  }
+
+  return false
+}
+
+/**
+ * Extracts response data for WAF analysis.
+ * @param {import('http').IncomingMessage} res downstream response object.
+ * @param {Buffer|string|object|null} responseBody response body.
+ * @returns {object} a map of addresses and response data.
+ */
+function extractResponseData (res, responseBody) {
+  const addresses = {}
+
+  if (res.statusCode) {
+    addresses[HTTP_OUTGOING_RESPONSE_STATUS] = String(res.statusCode)
+  }
+
+  const headers = res.headers
+  if (headers && Object.keys(headers).length > 0) {
+    addresses[HTTP_OUTGOING_RESPONSE_HEADERS] = headers
+  }
+
+  if (responseBody) {
+    // Parse the body based on content-type
+    const contentType = res.headers?.['content-type']
+    const body = parseBody(responseBody, contentType)
+
+    if (body) {
+      addresses[HTTP_OUTGOING_RESPONSE_BODY] = body
+    }
+  }
+
+  return addresses
+}
+
+/**
+ * Tracks how many downstream analyses were executed for a given request and updates tracing tags.
+ * @param {import('http').IncomingMessage} req outgoing request.
+ */
+function incrementDownstreamAnalysisCount (req) {
+  const currentCount = downstreamAnalysisCount.get(req) || 0
+  downstreamAnalysisCount.set(req, currentCount + 1)
+
+  const span = web.root(req)
+
+  if (span) {
+    span.setTag('_dd.appsec.downstream_request', currentCount + 1)
+  }
+}
+
+/**
+ * Returns the HTTP method to use for a downstream request, defaulting to GET.
+ * @param {string} method method supplied in the outgoing request options.
+ * @returns {string} validated HTTP method.
+ */
+function getMethod (method) {
+  return typeof method === 'string' && method ? method : 'GET'
+}
+
+/**
+ * Parses a downstream response body.
+ * @param {Buffer|string|object|null} body raw response body
+ * @param {string|null} contentType response content-type used to select the parser.
+ * @returns {object|null} parsed body object or null when not supported.
+ */
+function parseBody (body, contentType) {
+  if (!body || !contentType) {
+    return null
+  }
+
+  const mime = extractMimeType(contentType)
+
+  try {
+    if (mime === 'application/json' || mime === 'text/json') {
+      if (typeof body === 'string') {
+        return JSON.parse(body)
+      }
+
+      if (Buffer.isBuffer(body)) {
+        return JSON.parse(body.toString('utf8'))
+      }
+
+      return null
+    }
+
+    if (mime === 'application/x-www-form-urlencoded') {
+      const formBody = Buffer.isBuffer(body) ? body.toString('utf8') : String(body)
+      const params = new URLSearchParams(formBody)
+      const result = {}
+      for (const [key, value] of params.entries()) {
+        if (key in result) {
+          const existing = result[key]
+          if (Array.isArray(existing)) {
+            existing.push(value)
+          } else {
+            result[key] = [existing, value]
+          }
+        } else {
+          result[key] = value
+        }
+      }
+
+      return result
+    }
+
+    // multipart/form-data is mentioned in RFC but parsing is complex.
+    // Other content-types also discarded per RFC
+
+    return null
+  } catch {
+    // Parsing failed: return null to avoid sending malformed body to WAF
+    return null
+  }
+}
+
+/**
+ * Extracts the MIME type portion of a content-type header value.
+ * @param {string|null} contentType raw content-type header value.
+ * @returns {string|null} lowercase mime type
+ */
+function extractMimeType (contentType) {
+  if (typeof contentType !== 'string') {
+    return null
+  }
+
+  return contentType.split(';', 1)[0].trim().toLowerCase()
+}
+
+module.exports = {
+  enable,
+  disable,
+  shouldSampleBody,
+  handleRedirectResponse,
+  incrementDownstreamAnalysisCount,
+  extractRequestData,
+  extractResponseData,
+  // exports for tests
+  parseBody,
+  getMethod,
+  storeRedirectBodyCollectionDecision,
+}

package/packages/dd-trace/src/appsec/graphql.js

@@ -0,0 +1,166 @@
+'use strict'
+
+const { storage } = require('../../../datadog-core')
+const log = require('../log')
+const web = require('../plugins/util/web')
+const {
+  addSpecificEndpoint,
+  specificBlockingTypes,
+  getBlockingData,
+  getBlockingAction,
+} = require('./blocking')
+const waf = require('./waf')
+const addresses = require('./addresses')
+const {
+  startGraphqlResolve,
+  graphqlMiddlewareChannel,
+  apolloHttpServerChannel,
+  apolloChannel,
+  apolloServerCoreChannel,
+} = require('./channels')
+const { updateBlockFailureMetric } = require('./telemetry')
+
+const graphqlRequestData = new WeakMap()
+
+function enable () {
+  enableApollo()
+  enableGraphql()
+}
+
+function disable () {
+  disableApollo()
+  disableGraphql()
+}
+
+function onGraphqlStartResolve ({ context, resolverInfo }) {
+  const req = storage('legacy').getStore()?.req
+
+  if (!req) return
+
+  if (!resolverInfo || typeof resolverInfo !== 'object') return
+
+  const result = waf.run({ ephemeral: { [addresses.HTTP_INCOMING_GRAPHQL_RESOLVER]: resolverInfo } }, req)
+  const blockingAction = getBlockingAction(result?.actions)
+  if (blockingAction) {
+    const requestData = graphqlRequestData.get(req)
+    if (requestData?.isInGraphqlRequest) {
+      requestData.blocked = true
+      requestData.wafAction = blockingAction
+      context?.abortController?.abort()
+    }
+  }
+}
+
+function enterInApolloMiddleware (data) {
+  const req = data?.req || storage('legacy').getStore()?.req
+  if (!req) return
+
+  graphqlRequestData.set(req, {
+    blocked: false,
+  })
+}
+
+function enterInApolloServerCoreRequest () {
+  const req = storage('legacy').getStore()?.req
+  if (!req) return
+
+  graphqlRequestData.set(req, {
+    isInGraphqlRequest: true,
+    blocked: false,
+  })
+}
+
+function enterInApolloRequest () {
+  const req = storage('legacy').getStore()?.req
+
+  const requestData = graphqlRequestData.get(req)
+  if (requestData) {
+    // Set isInGraphqlRequest=true since this function only runs for GraphQL requests
+    // This works for both Apollo v4 (middleware) and v5 (HTTP server) contexts
+    requestData.isInGraphqlRequest = true
+    addSpecificEndpoint(req.method, req.originalUrl || req.url, specificBlockingTypes.GRAPHQL)
+  }
+}
+
+function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {
+  const req = storage('legacy').getStore()?.req
+  if (!req) return
+
+  const requestData = graphqlRequestData.get(req)
+
+  if (requestData?.blocked) {
+    const rootSpan = web.root(req)
+    if (!rootSpan) return
+
+    try {
+      const blockingData = getBlockingData(req, specificBlockingTypes.GRAPHQL, requestData.wafAction)
+      abortData.statusCode = blockingData.statusCode
+      abortData.headers = blockingData.headers
+      abortData.message = blockingData.body
+
+      rootSpan.setTag('appsec.blocked', 'true')
+
+      abortController?.abort()
+    } catch (err) {
+      rootSpan.setTag('_dd.appsec.block.failed', 1)
+      log.error('[ASM] Blocking error', err)
+
+      updateBlockFailureMetric(req)
+    }
+  }
+
+  graphqlRequestData.delete(req)
+}
+
+function enableApollo () {
+  graphqlMiddlewareChannel.subscribe({
+    start: enterInApolloMiddleware,
+  })
+
+  apolloServerCoreChannel.subscribe({
+    start: enterInApolloServerCoreRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse,
+  })
+
+  apolloChannel.subscribe({
+    start: enterInApolloRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse,
+  })
+
+  apolloHttpServerChannel.subscribe({
+    start: enterInApolloMiddleware,
+  })
+}
+
+function disableApollo () {
+  graphqlMiddlewareChannel.unsubscribe({
+    start: enterInApolloMiddleware,
+  })
+
+  apolloServerCoreChannel.unsubscribe({
+    start: enterInApolloServerCoreRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse,
+  })
+
+  apolloChannel.unsubscribe({
+    start: enterInApolloRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse,
+  })
+
+  apolloHttpServerChannel.unsubscribe({
+    start: enterInApolloMiddleware,
+  })
+}
+
+function enableGraphql () {
+  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+}
+
+function disableGraphql () {
+  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+}
+
+module.exports = {
+  enable,
+  disable,
+}

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js

@@ -0,0 +1,24 @@
+'use strict'
+
+module.exports = {
+  CODE_INJECTION_ANALYZER: require('./code-injection-analyzer'),
+  COMMAND_INJECTION_ANALYZER: require('./command-injection-analyzer'),
+  HARCODED_PASSWORD_ANALYZER: require('./hardcoded-password-analyzer'),
+  HARCODED_SECRET_ANALYZER: require('./hardcoded-secret-analyzer'),
+  HSTS_HEADER_MISSING_ANALYZER: require('./hsts-header-missing-analyzer'),
+  INSECURE_COOKIE_ANALYZER: require('./insecure-cookie-analyzer'),
+  LDAP_ANALYZER: require('./ldap-injection-analyzer'),
+  NO_HTTPONLY_COOKIE_ANALYZER: require('./no-httponly-cookie-analyzer'),
+  NO_SAMESITE_COOKIE_ANALYZER: require('./no-samesite-cookie-analyzer'),
+  NOSQL_MONGODB_INJECTION: require('./nosql-injection-mongodb-analyzer'),
+  PATH_TRAVERSAL_ANALYZER: require('./path-traversal-analyzer'),
+  SQL_INJECTION_ANALYZER: require('./sql-injection-analyzer'),
+  SSRF: require('./ssrf-analyzer'),
+  TEMPLATE_INJECTION_ANALYZER: require('./template-injection-analyzer'),
+  UNVALIDATED_REDIRECT_ANALYZER: require('./unvalidated-redirect-analyzer'),
+  UNTRUSTED_DESERIALIZATION_ANALYZER: require('./untrusted-deserialization-analyzer'),
+  WEAK_CIPHER_ANALYZER: require('./weak-cipher-analyzer'),
+  WEAK_HASH_ANALYZER: require('./weak-hash-analyzer'),
+  WEAK_RANDOMNESS_ANALYZER: require('./weak-randomness-analyzer'),
+  XCONTENTTYPE_HEADER_MISSING_ANALYZER: require('./xcontenttype-header-missing-analyzer'),
+}

package/packages/dd-trace/src/appsec/iast/analyzers/code-injection-analyzer.js

@@ -0,0 +1,36 @@
+'use strict'
+
+const { CODE_INJECTION } = require('../vulnerabilities')
+const { INSTRUMENTED_SINK } = require('../telemetry/iast-metric')
+const { storage } = require('../../../../../datadog-core')
+const { getIastContext } = require('../iast-context')
+const StoredInjectionAnalyzer = require('./stored-injection-analyzer')
+
+class CodeInjectionAnalyzer extends StoredInjectionAnalyzer {
+  constructor () {
+    super(CODE_INJECTION)
+    this.evalInstrumentedInc = false
+  }
+
+  onConfigure () {
+    this.addSub('datadog:eval:call', ({ script }) => {
+      if (!this.evalInstrumentedInc) {
+        const store = storage('legacy').getStore()
+        const iastContext = getIastContext(store)
+        const tags = INSTRUMENTED_SINK.formatTags(CODE_INJECTION)
+
+        for (const tag of tags) {
+          INSTRUMENTED_SINK.inc(iastContext, tag)
+        }
+
+        this.evalInstrumentedInc = true
+      }
+
+      this.analyze(script)
+    })
+    this.addSub('datadog:vm:run-script:start', ({ code }) => this.analyze(code))
+    this.addSub('datadog:vm:source-text-module:start', ({ code }) => this.analyze(code))
+  }
+}
+
+module.exports = new CodeInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/command-injection-analyzer.js

@@ -0,0 +1,15 @@
+'use strict'
+const { COMMAND_INJECTION } = require('../vulnerabilities')
+const InjectionAnalyzer = require('./injection-analyzer')
+
+class CommandInjectionAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super(COMMAND_INJECTION)
+  }
+
+  onConfigure () {
+    this.addSub('tracing:datadog:child_process:execution:start', ({ command }) => this.analyze(command))
+  }
+}
+
+module.exports = new CommandInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/cookie-analyzer.js

@@ -0,0 +1,62 @@
+'use strict'
+
+const { getNodeModulesPaths } = require('../path-line')
+const Analyzer = require('./vulnerability-analyzer')
+
+const EXCLUDED_PATHS = [
+  // Express
+  getNodeModulesPaths('express/lib/response.js'),
+  // Fastify
+  getNodeModulesPaths('fastify/lib/reply.js'),
+  getNodeModulesPaths('fastify/lib/hooks.js'),
+  getNodeModulesPaths('@fastify/cookie/plugin.js'),
+]
+
+class CookieAnalyzer extends Analyzer {
+  constructor (type, propertyToBeSafe) {
+    super(type)
+    this.propertyToBeSafe = propertyToBeSafe.toLowerCase()
+  }
+
+  onConfigure () {
+    this.addSub(
+      { channelName: 'datadog:iast:set-cookie', moduleName: 'http' },
+      (cookieInfo) => this.analyze(cookieInfo)
+    )
+  }
+
+  _isVulnerable ({ cookieProperties, cookieValue }) {
+    return cookieValue && !(cookieProperties && cookieProperties
+      .map(x => x.toLowerCase().trim()).includes(this.propertyToBeSafe))
+  }
+
+  _getEvidence ({ cookieName }) {
+    return { value: cookieName }
+  }
+
+  _getExcludedPaths () {
+    return EXCLUDED_PATHS
+  }
+
+  _checkOCE (context, value) {
+    if (value?.location) {
+      return true
+    }
+    return super._checkOCE(context, value)
+  }
+
+  _getLocation (value, callSiteFrames) {
+    if (!value) {
+      return super._getLocation(value, callSiteFrames)
+    }
+
+    if (value.location) {
+      return value.location
+    }
+    const location = super._getLocation(value, callSiteFrames)
+    value.location = location
+    return location
+  }
+}
+
+module.exports = CookieAnalyzer

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-base-analyzer.js

@@ -0,0 +1,72 @@
+'use strict'
+
+const { getRelativePath } = require('../path-line')
+const Analyzer = require('./vulnerability-analyzer')
+
+class HardcodedBaseAnalyzer extends Analyzer {
+  constructor (type, allRules = [], valueOnlyRules = []) {
+    super(type)
+
+    this.allRules = allRules
+    this.valueOnlyRules = valueOnlyRules
+  }
+
+  onConfigure () {
+    this.addSub('datadog:secrets:result', (secrets) => { this.analyze(secrets) })
+  }
+
+  analyze (secrets) {
+    if (!secrets?.file || !secrets.literals) return
+
+    const { allRules, valueOnlyRules } = this
+
+    const matches = []
+    for (const literal of secrets.literals) {
+      const { value, locations } = literal
+      if (!value || !locations) continue
+
+      for (const location of locations) {
+        let match
+        if (location.ident) {
+          const fullValue = `${location.ident}=${value}`
+          match = allRules.find(rule => fullValue.match(rule.regex))
+        } else {
+          match = valueOnlyRules.find(rule => value.match(rule.regex))
+        }
+
+        if (match) {
+          matches.push({ location, ruleId: match.id })
+        }
+      }
+    }
+
+    if (matches.length) {
+      const file = getRelativePath(secrets.file)
+
+      for (const match of matches) {
+        this._report({
+          file,
+          line: match.location.line,
+          column: match.location.column,
+          ident: match.location.ident,
+          data: match.ruleId,
+        })
+      }
+    }
+  }
+
+  _getEvidence (value) {
+    return { value: `${value.data}` }
+  }
+
+  _getLocation (value) {
+    return {
+      path: value.file,
+      line: value.line,
+      column: value.column,
+      isInternal: false,
+    }
+  }
+}
+
+module.exports = HardcodedBaseAnalyzer

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-password-analyzer.js

@@ -0,0 +1,18 @@
+'use strict'
+
+const { HARDCODED_PASSWORD } = require('../vulnerabilities')
+const HardcodedBaseAnalyzer = require('./hardcoded-base-analyzer')
+
+const allRules = require('./hardcoded-password-rules')
+
+class HardcodedPasswordAnalyzer extends HardcodedBaseAnalyzer {
+  constructor () {
+    super(HARDCODED_PASSWORD, allRules)
+  }
+
+  _getEvidence (value) {
+    return { value: `${value.ident}` }
+  }
+}
+
+module.exports = new HardcodedPasswordAnalyzer()