@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/appsec/iast/analyzers/sql-injection-analyzer.js

@@ -0,0 +1,102 @@
+'use strict'
+
+const { SQL_INJECTION } = require('../vulnerabilities')
+const { getRanges } = require('../taint-tracking/operations')
+const { storage } = require('../../../../../datadog-core')
+const { getNodeModulesPaths } = require('../path-line')
+const StoredInjectionAnalyzer = require('./stored-injection-analyzer')
+
+const EXCLUDED_PATHS = getNodeModulesPaths('mysql', 'mysql2', 'sequelize', 'pg-pool', 'knex')
+
+class SqlInjectionAnalyzer extends StoredInjectionAnalyzer {
+  constructor () {
+    super(SQL_INJECTION)
+  }
+
+  onConfigure () {
+    this.addSub('apm:mysql:query:start', ({ sql }) => this.analyze(sql, undefined, 'MYSQL'))
+    this.addSub('datadog:mysql2:outerquery:start', ({ sql }) => this.analyze(sql, undefined, 'MYSQL'))
+    this.addSub(
+      'apm:pg:query:start',
+      ({ originalText, query }) => this.analyze(originalText || query.text, undefined, 'POSTGRES')
+    )
+
+    this.addBind(
+      'datadog:sequelize:query:start',
+      ({ sql, dialect }) => this.getStoreAndAnalyze(sql, dialect.toUpperCase())
+    )
+    this.addSub('datadog:sequelize:query:finish', () => this.returnToParentStore())
+
+    this.addBind('datadog:pg:pool:query:start', ({ query }) => this.getStoreAndAnalyze(query.text, 'POSTGRES'))
+    this.addSub('datadog:pg:pool:query:finish', () => this.returnToParentStore())
+
+    this.addSub('datadog:mysql:pool:query:start', ({ sql }) => this.setStoreAndAnalyze(sql, 'MYSQL'))
+    this.addSub('datadog:mysql:pool:query:finish', () => this.returnToParentStore())
+
+    this.addBind('datadog:knex:raw:start', (context) => {
+      const { sql, dialect: knexDialect } = context
+      const dialect = this.normalizeKnexDialect(knexDialect)
+      const currentStore = this.getStoreAndAnalyze(sql, dialect)
+      context.currentStore = currentStore
+      return currentStore
+    })
+
+    this.addBind('datadog:knex:raw:subscribes', ({ currentStore }) => currentStore)
+    this.addBind('datadog:knex:raw:finish', ({ currentStore }) => currentStore?.sqlParentStore)
+  }
+
+  setStoreAndAnalyze (query, dialect) {
+    const store = this.getStoreAndAnalyze(query, dialect)
+
+    if (store) {
+      storage('legacy').enterWith(store)
+    }
+  }
+
+  getStoreAndAnalyze (query, dialect) {
+    const parentStore = storage('legacy').getStore()
+    if (parentStore) {
+      this.analyze(query, parentStore, dialect)
+
+      return { ...parentStore, sqlAnalyzed: true, sqlParentStore: parentStore }
+    }
+  }
+
+  returnToParentStore (store = storage('legacy').getStore()) {
+    if (store && store.sqlParentStore) {
+      storage('legacy').enterWith(store.sqlParentStore)
+    }
+  }
+
+  _getEvidence (value, iastContext, dialect) {
+    const ranges = getRanges(iastContext, value)
+    return { value, ranges, dialect }
+  }
+
+  analyze (value, store, dialect) {
+    store = store || storage('legacy').getStore()
+    if (!(store && store.sqlAnalyzed)) {
+      super.analyze(value, store, dialect)
+    }
+  }
+
+  _getExcludedPaths () {
+    return EXCLUDED_PATHS
+  }
+
+  normalizeKnexDialect (knexDialect) {
+    if (knexDialect === 'postgresql') {
+      return 'POSTGRES'
+    }
+
+    if (knexDialect === 'sqlite3') {
+      return 'SQLITE'
+    }
+
+    if (typeof knexDialect === 'string') {
+      return knexDialect.toUpperCase()
+    }
+  }
+}
+
+module.exports = new SqlInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/ssrf-analyzer.js

@@ -0,0 +1,37 @@
+'use strict'
+
+const { SSRF } = require('../vulnerabilities')
+const InjectionAnalyzer = require('./injection-analyzer')
+
+class SSRFAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super(SSRF)
+  }
+
+  onConfigure () {
+    this.addSub('apm:http:client:request:start', ({ args }) => {
+      if (typeof args.originalUrl === 'string') {
+        this.analyze(args.originalUrl)
+      } else if (args.options?.host) {
+        this.analyze(args.options.host)
+      }
+    })
+
+    this.addSub('apm:http2:client:connect:start', ({ authority }) => {
+      if (authority && typeof authority === 'string') {
+        this.analyze(authority)
+      }
+    })
+  }
+
+  _isRangeSecure (range, value) {
+    const fragmentIndex = value.indexOf('#')
+    if (fragmentIndex !== -1 && range.start >= fragmentIndex) {
+      return true
+    }
+
+    return super._isRangeSecure(range, value)
+  }
+}
+
+module.exports = new SSRFAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/stored-injection-analyzer.js

@@ -0,0 +1,11 @@
+'use strict'
+
+const InjectionAnalyzer = require('./injection-analyzer')
+
+class StoredInjectionAnalyzer extends InjectionAnalyzer {
+  _areRangesVulnerable (ranges) {
+    return ranges?.length > 0
+  }
+}
+
+module.exports = StoredInjectionAnalyzer

package/packages/dd-trace/src/appsec/iast/analyzers/template-injection-analyzer.js

@@ -0,0 +1,18 @@
+'use strict'
+
+const { TEMPLATE_INJECTION } = require('../vulnerabilities')
+const StoredInjectionAnalyzer = require('./stored-injection-analyzer')
+
+class TemplateInjectionAnalyzer extends StoredInjectionAnalyzer {
+  constructor () {
+    super(TEMPLATE_INJECTION)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:handlebars:compile:start', ({ source }) => this.analyze(source))
+    this.addSub('datadog:handlebars:register-partial:start', ({ partial }) => this.analyze(partial))
+    this.addSub('datadog:pug:compile:start', ({ source }) => this.analyze(source))
+  }
+}
+
+module.exports = new TemplateInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/untrusted-deserialization-analyzer.js

@@ -0,0 +1,16 @@
+'use strict'
+
+const { UNTRUSTED_DESERIALIZATION } = require('../vulnerabilities')
+const InjectionAnalyzer = require('./injection-analyzer')
+
+class UntrustedDeserializationAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super(UNTRUSTED_DESERIALIZATION)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:node-serialize:unserialize:start', ({ obj }) => this.analyze(obj))
+  }
+}
+
+module.exports = new UntrustedDeserializationAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/unvalidated-redirect-analyzer.js

@@ -0,0 +1,64 @@
+'use strict'
+
+const { UNVALIDATED_REDIRECT } = require('../vulnerabilities')
+const { getNodeModulesPaths } = require('../path-line')
+const { getRanges } = require('../taint-tracking/operations')
+const {
+  HTTP_REQUEST_BODY,
+  HTTP_REQUEST_PARAMETER,
+} = require('../taint-tracking/source-types')
+const InjectionAnalyzer = require('./injection-analyzer')
+
+const EXCLUDED_PATHS = [
+  getNodeModulesPaths('express/lib/response.js'),
+  getNodeModulesPaths('fastify/lib/reply.js'),
+]
+
+const VULNERABLE_SOURCE_TYPES = new Set([
+  HTTP_REQUEST_BODY,
+  HTTP_REQUEST_PARAMETER,
+])
+
+class UnvalidatedRedirectAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super(UNVALIDATED_REDIRECT)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:http:server:response:set-header:finish', ({ name, value }) => this.analyze(name, value))
+    this.addSub('datadog:fastify:set-header:finish', ({ name, value }) => this.analyze(name, value))
+  }
+
+  analyze (name, value) {
+    if (!this.isLocationHeader(name) || typeof value !== 'string') return
+
+    super.analyze(value)
+  }
+
+  isLocationHeader (name) {
+    return name?.trim().toLowerCase() === 'location'
+  }
+
+  _isVulnerable (value, iastContext) {
+    if (!value) return false
+
+    const ranges = getRanges(iastContext, value)
+    return ranges?.length > 0 && this._hasUnsafeRange(ranges)
+  }
+
+  _hasUnsafeRange (ranges) {
+    return ranges.some(
+      range => this._isVulnerableRange(range)
+    )
+  }
+
+  _isVulnerableRange (range) {
+    return VULNERABLE_SOURCE_TYPES.has(range.iinfo.type)
+  }
+
+  _getExcludedPaths () {
+    return EXCLUDED_PATHS
+  }
+}
+
+module.exports = new UnvalidatedRedirectAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/vulnerability-analyzer.js

@@ -0,0 +1,181 @@
+'use strict'
+
+const { storage } = require('../../../../../datadog-core')
+const { getCallSiteFramesForLocation } = require('../path-line')
+const { getIastContext, getIastStackTraceId } = require('../iast-context')
+const overheadController = require('../overhead-controller')
+const { SinkIastPlugin } = require('../iast-plugin')
+const {
+  addVulnerability,
+  getVulnerabilityCallSiteFrames,
+  replaceCallSiteFromSourceMap,
+} = require('../vulnerability-reporter')
+const { getMarkFromVulnerabilityType } = require('../taint-tracking/secure-marks')
+const { SUPPRESSED_VULNERABILITIES } = require('../telemetry/iast-metric')
+
+class Analyzer extends SinkIastPlugin {
+  constructor (type) {
+    super()
+    this._type = type
+    this._secureMark = getMarkFromVulnerabilityType(type)
+  }
+
+  _isVulnerable (value, context) {
+    return false
+  }
+
+  _isExcluded (location) {
+    return false
+  }
+
+  _report (value, context, meta) {
+    const evidence = this._getEvidence(value, context, meta)
+    this._reportEvidence(value, context, evidence)
+  }
+
+  _reportEvidence (value, context, evidence) {
+    const callSiteFrames = getVulnerabilityCallSiteFrames()
+    const frames = getCallSiteFramesForLocation(callSiteFrames, this._getExcludedPaths())
+    const location = this._getLocation(value, frames)
+
+    if (!this._isExcluded(location)) {
+      const originalLocation = this._getOriginalLocation(location)
+      const spanId = context?.rootSpan?.context().toSpanId()
+      const stackId = getIastStackTraceId(context)
+      const vulnerability = this._createVulnerability(
+        this._type,
+        evidence,
+        spanId,
+        originalLocation,
+        stackId
+      )
+
+      addVulnerability(context, vulnerability, frames)
+    }
+  }
+
+  _reportIfVulnerable (value, context, meta) {
+    if (this._isVulnerable(value, context) && this._checkOCE(context, value)) {
+      this._report(value, context, meta)
+      return true
+    }
+    return false
+  }
+
+  _getEvidence (value) {
+    return { value }
+  }
+
+  _getLocation (value, callSiteFrames) {
+    return callSiteFrames[0]
+  }
+
+  _getOriginalLocation (location) {
+    const locationFromSourceMap = replaceCallSiteFromSourceMap(location)
+    const originalLocation = {}
+
+    if (locationFromSourceMap?.path) {
+      originalLocation.path = locationFromSourceMap.path
+    }
+
+    if (locationFromSourceMap?.line) {
+      originalLocation.line = locationFromSourceMap.line
+    }
+
+    if (location?.class_name) {
+      originalLocation.class = location.class_name
+    }
+
+    if (location?.function) {
+      originalLocation.method = location.function
+    }
+
+    return originalLocation
+  }
+
+  _getExcludedPaths () {}
+
+  _isInvalidContext (store, iastContext) {
+    return store && !iastContext
+  }
+
+  analyze (value, store = storage('legacy').getStore(), meta) {
+    const iastContext = getIastContext(store)
+    if (this._isInvalidContext(store, iastContext)) return
+
+    this._reportIfVulnerable(value, iastContext, meta)
+  }
+
+  analyzeAll (...values) {
+    const store = storage('legacy').getStore()
+    const iastContext = getIastContext(store)
+    if (this._isInvalidContext(store, iastContext)) return
+
+    for (const value of values) {
+      if (this._isVulnerable(value, iastContext)) {
+        // TODO(BridgeAR): Here are multiple cases that receive a different
+        // number of arguments than passed through. Fix those cases.
+        if (this._checkOCE(iastContext, value)) {
+          this._report(value, iastContext)
+        }
+        break
+      }
+    }
+  }
+
+  _checkOCE (context) {
+    return overheadController.hasQuota(overheadController.OPERATIONS.REPORT_VULNERABILITY, context, this._type)
+  }
+
+  _createVulnerability (type, evidence, spanId, location, stackId) {
+    if (type && evidence) {
+      const _spanId = spanId || 0
+      return {
+        type,
+        evidence,
+        location: {
+          spanId: _spanId,
+          stackId,
+          ...location,
+        },
+        hash: this._createHash(this._createHashSource(type, evidence, location)),
+      }
+    }
+    return null
+  }
+
+  _createHashSource (type, evidence, location) {
+    return location ? `${type}:${location.path}:${location.line}` : type
+  }
+
+  _createHash (hashSource) {
+    let hash = 0
+    let offset = 0
+    const size = hashSource.length
+    for (let i = 0; i < size; i++) {
+      hash = ((hash << 5) - hash) + hashSource.charCodeAt(offset++)
+    }
+    return hash
+  }
+
+  _getSuppressedMetricTag () {
+    if (!this._suppressedMetricTag) {
+      this._suppressedMetricTag = SUPPRESSED_VULNERABILITIES.formatTags(this._type)[0]
+    }
+    return this._suppressedMetricTag
+  }
+
+  _incrementSuppressedMetric (iastContext) {
+    SUPPRESSED_VULNERABILITIES.inc(iastContext, this._getSuppressedMetricTag())
+  }
+
+  addSub (iastSubOrChannelName, handler) {
+    const iastSub = typeof iastSubOrChannelName === 'string'
+      ? { channelName: iastSubOrChannelName }
+      : iastSubOrChannelName
+
+    super.addSub({ tag: this._type, ...iastSub }, handler)
+  }
+}
+
+module.exports = Analyzer

package/packages/dd-trace/src/appsec/iast/analyzers/weak-cipher-analyzer.js

@@ -0,0 +1,31 @@
+'use strict'
+const { WEAK_CIPHER } = require('../vulnerabilities')
+const Analyzer = require('./vulnerability-analyzer')
+
+const INSECURE_CIPHERS = new Set([
+  'des', 'des-cbc', 'des-cfb', 'des-cfb1', 'des-cfb8', 'des-ecb', 'des-ede', 'des-ede-cbc', 'des-ede-cfb',
+  'des-ede-ecb', 'des-ede-ofb', 'des-ede3', 'des-ede3-cbc', 'des-ede3-cfb', 'des-ede3-cfb1', 'des-ede3-cfb8',
+  'des-ede3-ecb', 'des-ede3-ofb', 'des-ofb', 'des3', 'des3-wrap',
+  'rc2', 'rc2-128', 'rc2-40', 'rc2-40-cbc', 'rc2-64', 'rc2-64-cbc', 'rc2-cbc', 'rc2-cfb', 'rc2-ecb', 'rc2-ofb',
+  'blowfish',
+  'rc4', 'rc4-40', 'rc4-hmac-md5',
+].map(algorithm => algorithm.toLowerCase()))
+
+class WeakCipherAnalyzer extends Analyzer {
+  constructor () {
+    super(WEAK_CIPHER)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:crypto:cipher:start', ({ algorithm }) => this.analyze(algorithm))
+  }
+
+  _isVulnerable (algorithm) {
+    if (algorithm && typeof algorithm === 'string') {
+      return INSECURE_CIPHERS.has(algorithm.toLowerCase())
+    }
+    return false
+  }
+}
+
+module.exports = new WeakCipherAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/weak-hash-analyzer.js

@@ -0,0 +1,64 @@
+'use strict'
+
+const path = require('path')
+
+const { getNodeModulesPaths } = require('../path-line')
+const { WEAK_HASH } = require('../vulnerabilities')
+const Analyzer = require('./vulnerability-analyzer')
+
+const INSECURE_HASH_ALGORITHMS = new Set([
+  'md4', 'md4WithRSAEncryption', 'RSA-MD4',
+  'RSA-MD5', 'md5', 'md5-sha1', 'ssl3-md5', 'md5WithRSAEncryption',
+  'RSA-SHA1', 'RSA-SHA1-2', 'sha1', 'md5-sha1', 'sha1WithRSAEncryption', 'ssl3-sha1',
+].map(algorithm => algorithm.toLowerCase()))
+
+const EXCLUDED_LOCATIONS = getNodeModulesPaths(
+  'etag/index.js',
+  '@mikro-orm/core/utils/Utils.js',
+  'mongodb/lib/core/connection/connection.js',
+  'mysql2/lib/auth_41.js',
+  'pusher/lib/utils.js',
+  'redlock/dist/cjs',
+  'sqreen/lib/package-reader/index.js',
+  'ws/lib/websocket-server.js',
+  'google-gax/build/src/grpc.js',
+  'cookie-signature/index.js',
+  'express-session/index.js',
+  'node-preload/preload-list-env.js'
+)
+
+const EXCLUDED_PATHS_FROM_STACK = [
+  path.join('node_modules', 'object-hash', path.sep),
+  path.join('node_modules', 'aws-sdk', 'lib', 'util.js'),
+  path.join('node_modules', 'keygrip', path.sep),
+]
+class WeakHashAnalyzer extends Analyzer {
+  constructor () {
+    super(WEAK_HASH)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:crypto:hashing:start', ({ algorithm }) => this.analyze(algorithm))
+  }
+
+  _isVulnerable (algorithm) {
+    if (typeof algorithm === 'string') {
+      return INSECURE_HASH_ALGORITHMS.has(algorithm.toLowerCase())
+    }
+    return false
+  }
+
+  _isExcluded (location) {
+    if (!location) return false
+
+    return EXCLUDED_LOCATIONS.some(excludedLocation => {
+      return location.path.includes(excludedLocation)
+    })
+  }
+
+  _getExcludedPaths () {
+    return EXCLUDED_PATHS_FROM_STACK
+  }
+}
+
+module.exports = new WeakHashAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/weak-randomness-analyzer.js

@@ -0,0 +1,19 @@
+'use strict'
+const { WEAK_RANDOMNESS } = require('../vulnerabilities')
+const Analyzer = require('./vulnerability-analyzer')
+
+class WeakRandomnessAnalyzer extends Analyzer {
+  constructor () {
+    super(WEAK_RANDOMNESS)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:random:call', ({ fn }) => this.analyze(fn))
+  }
+
+  _isVulnerable (fn) {
+    return fn === Math.random
+  }
+}
+
+module.exports = new WeakRandomnessAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/xcontenttype-header-missing-analyzer.js

@@ -0,0 +1,19 @@
+'use strict'
+
+const { XCONTENTTYPE_HEADER_MISSING } = require('../vulnerabilities')
+const { MissingHeaderAnalyzer } = require('./missing-header-analyzer')
+
+const XCONTENTTYPEOPTIONS_HEADER_NAME = 'X-Content-Type-Options'
+
+class XcontenttypeHeaderMissingAnalyzer extends MissingHeaderAnalyzer {
+  constructor () {
+    super(XCONTENTTYPE_HEADER_MISSING, XCONTENTTYPEOPTIONS_HEADER_NAME)
+  }
+
+  _isVulnerableFromRequestAndResponse (req, res, storedHeaders) {
+    const headerValues = this._getHeaderValues(res, storedHeaders, XCONTENTTYPEOPTIONS_HEADER_NAME)
+    return headerValues.length === 0 || headerValues.some(headerValue => headerValue.trim().toLowerCase() !== 'nosniff')
+  }
+}
+
+module.exports = new XcontenttypeHeaderMissingAnalyzer()

package/packages/dd-trace/src/appsec/iast/context/context-plugin.js

@@ -0,0 +1,89 @@
+'use strict'
+
+const { storage } = require('../../../../../datadog-core')
+const iastContextFunctions = require('../iast-context')
+const overheadController = require('../overhead-controller')
+const { IastPlugin } = require('../iast-plugin')
+const { IAST_ENABLED_TAG_KEY } = require('../tags')
+const { createTransaction, removeTransaction } = require('../taint-tracking/operations')
+const vulnerabilityReporter = require('../vulnerability-reporter')
+const { TagKey } = require('../telemetry/iast-metric')
+
+class IastContextPlugin extends IastPlugin {
+  startCtxOn (channelName, tag) {
+    super.addSub(channelName, (message) => this.startContext(message?.currentStore))
+
+    this._getAndRegisterSubscription({
+      channelName,
+      tag,
+      tagKey: TagKey.SOURCE_TYPE,
+    })
+  }
+
+  finishCtxOn (channelName) {
+    super.addSub(channelName, (message) => this.finishContext())
+  }
+
+  getRootSpan (store) {
+    return store?.span
+  }
+
+  getTopContext () {
+    return {}
+  }
+
+  newIastContext (rootSpan) {
+    return { rootSpan }
+  }
+
+  addIastEnabledTag (isRequestAcquired, rootSpan) {
+    if (rootSpan?.addTags) {
+      rootSpan.addTags({
+        [IAST_ENABLED_TAG_KEY]: isRequestAcquired ? 1 : 0,
+      })
+    }
+  }
+
+  startContext (store = storage('legacy').getStore()) {
+    let isRequestAcquired = false
+    let iastContext
+
+    if (store) {
+      const topContext = this.getTopContext()
+      const rootSpan = this.getRootSpan(store)
+
+      isRequestAcquired = overheadController.acquireRequest(rootSpan)
+      if (isRequestAcquired) {
+        iastContext = iastContextFunctions.saveIastContext(store, topContext, this.newIastContext(rootSpan))
+        createTransaction(rootSpan.context().toSpanId(), iastContext)
+        overheadController.initializeRequestContext(iastContext)
+      }
+      this.addIastEnabledTag(isRequestAcquired, rootSpan)
+    }
+
+    return {
+      isRequestAcquired,
+      iastContext,
+      store,
+    }
+  }
+
+  finishContext () {
+    const store = storage('legacy').getStore()
+    if (store) {
+      const topContext = this.getTopContext()
+      const iastContext = iastContextFunctions.getIastContext(store, topContext)
+      const rootSpan = iastContext?.rootSpan
+      if (iastContext && rootSpan) {
+        vulnerabilityReporter.sendVulnerabilities(iastContext.vulnerabilities, rootSpan)
+        removeTransaction(iastContext)
+      }
+
+      if (iastContextFunctions.cleanIastContext(store, topContext, iastContext)) {
+        overheadController.releaseRequest()
+      }
+    }
+  }
+}
+
+module.exports = IastContextPlugin

package/packages/dd-trace/src/appsec/iast/context/kafka-ctx-plugin.js

@@ -0,0 +1,14 @@
+'use strict'
+
+const { KAFKA_MESSAGE_KEY, KAFKA_MESSAGE_VALUE } = require('../taint-tracking/source-types')
+const IastContextPlugin = require('./context-plugin')
+
+class KafkaContextPlugin extends IastContextPlugin {
+  onConfigure () {
+    this.startCtxOn('dd-trace:kafkajs:consumer:afterStart', [KAFKA_MESSAGE_KEY, KAFKA_MESSAGE_VALUE])
+
+    this.finishCtxOn('dd-trace:kafkajs:consumer:beforeFinish')
+  }
+}
+
+module.exports = new KafkaContextPlugin()