@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/appsec/iast/path-line.js

@@ -0,0 +1,116 @@
+'use strict'
+
+const path = require('path')
+const process = require('process')
+const { fileURLToPath } = require('url')
+const { ddBasePath } = require('../../util')
+const { getOriginalPathAndLineFromSourceMap } = require('./taint-tracking/rewriter')
+const pathLine = {
+  getNodeModulesPaths,
+  getRelativePath,
+  getCallSiteFramesForLocation,
+  ddBasePath, // Exported only for test purposes
+}
+
+const EXCLUDED_PATHS = [
+  path.join(path.sep, 'node_modules', 'dc-polyfill'),
+]
+
+/**
+ * Processes and filters call site frames to find the best location for a vulnerability.
+ * Returns client frames if available, otherwise falls back to all processed frames.
+ * Excludes dd-trace frames and all Node.js built-in/internal modules (node:*).
+ * @param {CallSiteFrame[]} callSiteFrames
+ * @param {string[]} externallyExcludedPaths
+ * @returns {CallSiteFrame[]} Client frames if available, otherwise all processed frames
+ *
+ * @typedef {object} CallSiteFrame
+ * @property {number} id
+ * @property {string} file - Original file path
+ * @property {number} line
+ * @property {number} column
+ * @property {string} function
+ * @property {string} class_name
+ * @property {boolean} isNative
+ * @property {string} [path] - Relative path, added during processing
+ * @property {boolean} [isInternal] - Whether the frame is internal, added during processing
+ */
+function getCallSiteFramesForLocation (callSiteFrames, externallyExcludedPaths) {
+  if (!callSiteFrames) {
+    return []
+  }
+
+  const allFrames = []
+  const clientFrames = []
+
+  for (const callsite of callSiteFrames) {
+    let filepath = callsite.file?.startsWith('file://') ? fileURLToPath(callsite.file) : callsite.file
+
+    if (globalThis.__DD_ESBUILD_IAST_WITH_SM) {
+      const callsiteLocation = {
+        path: filepath,
+        line: callsite.line,
+        column: callsite.column,
+      }
+      const { path: originalPath, line, column } = getOriginalPathAndLineFromSourceMap(callsiteLocation)
+      callsite.path = filepath = originalPath
+      callsite.line = line
+      callsite.column = column
+    }
+
+    if (filepath) {
+      callsite.path = getRelativePath(filepath)
+      callsite.isInternal = !path.isAbsolute(filepath)
+
+      allFrames.push(callsite)
+
+      if (
+        !isExcluded(callsite, externallyExcludedPaths) &&
+        (!filepath.includes(pathLine.ddBasePath) || globalThis.__DD_ESBUILD_IAST_WITH_NO_SM)
+      ) {
+        clientFrames.push(callsite)
+      }
+    }
+  }
+
+  return clientFrames.length > 0 ? clientFrames : allFrames
+}
+
+function getRelativePath (filepath) {
+  return filepath && path.relative(process.cwd(), filepath)
+}
+
+function isExcluded (callsite, externallyExcludedPaths) {
+  if (callsite.isNative) return true
+
+  const filename = globalThis.__DD_ESBUILD_IAST_WITH_SM ? callsite.path : callsite.file
+  if (!filename || filename.startsWith('node:')) {
+    return true
+  }
+
+  let excludedPaths = EXCLUDED_PATHS
+  if (externallyExcludedPaths) {
+    excludedPaths = [...excludedPaths, ...externallyExcludedPaths]
+  }
+
+  for (const excludedPath of excludedPaths) {
+    if (filename.includes(excludedPath)) {
+      return true
+    }
+  }
+
+  return false
+}
+
+function getNodeModulesPaths (...paths) {
+  const nodeModulesPaths = []
+
+  for (const p of paths) {
+    const pathParts = p.split('/')
+    nodeModulesPaths.push(path.join('node_modules', ...pathParts))
+  }
+
+  return nodeModulesPaths
+}
+
+module.exports = pathLine

package/packages/dd-trace/src/appsec/iast/security-controls/index.js

@@ -0,0 +1,179 @@
+'use strict'
+
+const path = require('path')
+const dc = require('dc-polyfill')
+const { storage } = require('../../../../../datadog-core')
+const shimmer = require('../../../../../datadog-shimmer')
+const log = require('../../../log')
+const TaintTrackingOperations = require('../taint-tracking/operations')
+const { getIastContext } = require('../iast-context')
+const { iterateObjectStrings } = require('../utils')
+const { parse, SANITIZER_TYPE } = require('./parser')
+
+// esm
+const moduleLoadStartChannel = dc.channel('dd-trace:moduleLoadStart')
+
+// cjs
+const moduleLoadEndChannel = dc.channel('dd-trace:moduleLoadEnd')
+
+let controls
+let controlsKeys
+let hooks
+
+function configure (iastConfig) {
+  if (!iastConfig?.securityControlsConfiguration) return
+
+  try {
+    controls = parse(iastConfig.securityControlsConfiguration)
+    if (controls?.size > 0) {
+      hooks = new WeakSet()
+      controlsKeys = [...controls.keys()]
+
+      moduleLoadStartChannel.subscribe(onModuleLoaded)
+      moduleLoadEndChannel.subscribe(onModuleLoaded)
+    }
+  } catch (e) {
+    log.error('[ASM] Error configuring IAST Security Controls', e)
+  }
+}
+
+function onModuleLoaded (payload) {
+  if (!payload?.module || hooks?.has(payload.module)) return
+
+  const { filename, module } = payload
+
+  const controlsByFile = getControls(filename)
+  if (controlsByFile) {
+    const hook = hookModule(filename, module, controlsByFile)
+    payload.module = hook
+    hooks.add(hook)
+  }
+}
+
+function getControls (filename) {
+  if (filename.startsWith('file://')) {
+    filename = filename.slice(7)
+  }
+
+  let key = path.isAbsolute(filename) ? path.relative(process.cwd(), filename) : filename
+  key = key.replaceAll(path.sep, path.posix.sep)
+
+  if (key.includes('node_modules')) {
+    key = controlsKeys.find(file => key.endsWith(file))
+  }
+
+  return controls.get(key)
+}
+
+function hookModule (filename, module, controlsByFile) {
+  try {
+    for (const { type, method, parameters, secureMarks } of controlsByFile) {
+      const { target, parent, methodName } = resolve(method, module)
+      if (!target) {
+        log.error('[ASM] Unable to resolve IAST security control %s:%s', filename, method)
+        continue
+      }
+
+      const wrapper = type === SANITIZER_TYPE
+        ? wrapSanitizer(target, secureMarks)
+        : wrapInputValidator(target, parameters, secureMarks)
+
+      if (methodName) {
+        parent[methodName] = wrapper
+      } else {
+        module = wrapper
+      }
+    }
+  } catch (e) {
+    log.error('[ASM] Error initializing IAST security control for %s', filename, e)
+  }
+
+  return module
+}
+
+function resolve (path, obj, separator = '.') {
+  if (!path) {
+    // esm module with default export
+    return obj?.default ? { target: obj.default, parent: obj, methodName: 'default' } : { target: obj, parent: obj }
+  }
+
+  const properties = path.split(separator)
+
+  let parent
+  let methodName
+  const target = properties.reduce((prev, curr) => {
+    parent = prev
+    methodName = curr
+    return prev?.[curr]
+  }, obj)
+
+  return { target, parent, methodName }
+}
+
+function wrapSanitizer (target, secureMarks) {
+  return shimmer.wrapFunction(target, orig => function () {
+    const result = orig.apply(this, arguments)
+
+    try {
+      return addSecureMarks(result, secureMarks)
+    } catch (e) {
+      log.error('[ASM] Error adding Secure mark for sanitizer', e)
+    }
+
+    return result
+  })
+}
+
+function wrapInputValidator (target, parameters, secureMarks) {
+  const allParameters = !parameters?.length
+
+  return shimmer.wrapFunction(target, orig => function (...args) {
+    try {
+      for (let index = 0; index < args.length; index++) {
+        if (allParameters || parameters.includes(index)) {
+          addSecureMarks(args[index], secureMarks, false)
+        }
+      }
+    } catch (error) {
+      log.error('[ASM] Error adding Secure mark for input validator', error)
+    }
+
+    return orig.apply(this, args)
+  })
+}
+
+function addSecureMarks (value, secureMarks, createNewTainted = true) {
+  if (!value) return
+
+  const store = storage('legacy').getStore()
+  const iastContext = getIastContext(store)
+
+  if (typeof value === 'string') {
+    return TaintTrackingOperations.addSecureMark(iastContext, value, secureMarks, createNewTainted)
+  }
+  iterateObjectStrings(value, (value, levelKeys, parent, lastKey) => {
+    try {
+      const securedTainted = TaintTrackingOperations.addSecureMark(iastContext, value, secureMarks, createNewTainted)
+      if (createNewTainted) {
+        parent[lastKey] = securedTainted
+      }
+    } catch {
+      // if it is a readonly property, do nothing
+    }
+  })
+  return value
+}
+
+function disable () {
+  if (moduleLoadStartChannel.hasSubscribers) moduleLoadStartChannel.unsubscribe(onModuleLoaded)
+  if (moduleLoadEndChannel.hasSubscribers) moduleLoadEndChannel.unsubscribe(onModuleLoaded)
+
+  controls = undefined
+  controlsKeys = undefined
+  hooks = undefined
+}
+
+module.exports = {
+  configure,
+  disable,
+}

package/packages/dd-trace/src/appsec/iast/security-controls/parser.js

@@ -0,0 +1,128 @@
+'use strict'
+
+const log = require('../../../log')
+const { getMarkFromVulnerabilityType, CUSTOM_SECURE_MARK } = require('../taint-tracking/secure-marks')
+
+const SECURITY_CONTROL_DELIMITER = ';'
+const SECURITY_CONTROL_FIELD_DELIMITER = ':'
+const SECURITY_CONTROL_ELEMENT_DELIMITER = ','
+
+const INPUT_VALIDATOR_TYPE = 'INPUT_VALIDATOR'
+const SANITIZER_TYPE = 'SANITIZER'
+
+const validTypes = new Set([INPUT_VALIDATOR_TYPE, SANITIZER_TYPE])
+
+/**
+ * @param {string} securityControlsConfiguration
+ * @returns {Map<string, Array<{
+ *   type: string,
+ *   secureMarks: number,
+ *   file: string,
+ *   method: string,
+ *   parameters: number[] | undefined
+ * }>>}
+ */
+function parse (securityControlsConfiguration) {
+  const controls = new Map()
+
+  const potentialControls = securityControlsConfiguration
+    .replaceAll(/[\r\n\t\v\f]*/g, '')
+    .split(SECURITY_CONTROL_DELIMITER)
+
+  for (const potentialControl of potentialControls) {
+    const control = parseControl(potentialControl)
+    if (control) {
+      const fileControls = controls.get(control.file)
+      if (fileControls) {
+        fileControls.push(control)
+      } else {
+        controls.set(control.file, [control])
+      }
+    }
+  }
+
+  return controls
+}
+
+/**
+ * @param {string} control
+ * @returns {{
+ *   type: string,
+ *   secureMarks: number,
+ *   file: string,
+ *   method: string,
+ *   parameters: number[] | undefined
+ * } | undefined}
+ */
+function parseControl (control) {
+  if (!control) return
+
+  const fields = control.split(SECURITY_CONTROL_FIELD_DELIMITER)
+
+  if (fields.length < 3 || fields.length > 5) {
+    log.warn('[ASM] Security control configuration is invalid: %s', control)
+    return
+  }
+
+  let [type, marks, file, method, parameters] = fields
+
+  type = type.trim().toUpperCase()
+  if (!validTypes.has(type)) {
+    log.warn('[ASM] Invalid security control type: %s', type)
+    return
+  }
+
+  let secureMarks = CUSTOM_SECURE_MARK
+  for (const mark of getSecureMarks(marks)) {
+    secureMarks |= mark
+  }
+  if (secureMarks === CUSTOM_SECURE_MARK) {
+    log.warn('[ASM] Invalid security control mark: %s', marks)
+    return
+  }
+
+  file = file.trim()
+
+  method = method?.trim()
+
+  try {
+    const parsedParameters = getParameters(parameters)
+    return { type, secureMarks, file, method, parameters: parsedParameters }
+  } catch {
+    log.warn('[ASM] Invalid non-numeric security control parameter %s', parameters)
+  }
+}
+
+/**
+ * @param {string} marks
+ * @returns {number[]}
+ */
+function getSecureMarks (marks) {
+  return marks.split(SECURITY_CONTROL_ELEMENT_DELIMITER)
+    .map(getMarkFromVulnerabilityType)
+    .filter(Boolean)
+}
+
+/**
+ * @param {string | undefined} parameters
+ */
+function getParameters (parameters) {
+  return parameters?.split(SECURITY_CONTROL_ELEMENT_DELIMITER)
+    .map(param => {
+      const parsedParam = Number.parseInt(param, 10)
+
+      // discard the securityControl if there is an incorrect parameter
+      if (Number.isNaN(parsedParam)) {
+        throw new TypeError('Invalid non-numeric security control parameter')
+      }
+
+      return parsedParam
+    })
+}
+
+module.exports = {
+  parse,
+
+  INPUT_VALIDATOR_TYPE,
+  SANITIZER_TYPE,
+}

package/packages/dd-trace/src/appsec/iast/tags.js

@@ -0,0 +1,7 @@
+'use strict'
+
+module.exports = {
+  IAST_ENABLED_TAG_KEY: '_dd.iast.enabled',
+  IAST_JSON_TAG_KEY: '_dd.iast.json',
+  IAST_TRACE_METRIC_PREFIX: '_dd.iast.telemetry',
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/constants.js

@@ -0,0 +1,6 @@
+'use strict'
+
+module.exports = {
+  LOG_MESSAGE: 'LOG',
+  REWRITTEN_MESSAGE: 'REWRITTEN',
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/csi-methods.js

@@ -0,0 +1,24 @@
+'use strict'
+
+const csiMethods = [
+  { src: 'concat' },
+  { src: 'join' },
+  { src: 'parse' },
+  { src: 'plusOperator', operator: true },
+  { src: 'random' },
+  { src: 'replace' },
+  { src: 'slice' },
+  { src: 'substr' },
+  { src: 'substring' },
+  { src: 'toLowerCase', dst: 'stringCase' },
+  { src: 'toUpperCase', dst: 'stringCase' },
+  { src: 'tplOperator', operator: true },
+  { src: 'trim' },
+  { src: 'trimEnd' },
+  { src: 'trimStart', dst: 'trim' },
+  { src: 'eval', allowedWithoutCallee: true },
+]
+
+module.exports = {
+  csiMethods,
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/filter.js

@@ -0,0 +1,16 @@
+'use strict'
+
+const NODE_MODULES = 'node_modules'
+
+const isPrivateModule = function (file) {
+  return file && !file.includes(NODE_MODULES)
+}
+
+const isDdTrace = function (file) {
+  return Boolean(file?.includes('dd-trace'))
+}
+
+module.exports = {
+  isPrivateModule,
+  isDdTrace,
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/index.js

@@ -0,0 +1,36 @@
+'use strict'
+
+const kafkaContextPlugin = require('../context/kafka-ctx-plugin')
+const {
+  createTransaction,
+  removeTransaction,
+  setMaxTransactions,
+  enableTaintOperations,
+  disableTaintOperations,
+} = require('./operations')
+
+const taintTrackingPlugin = require('./plugin')
+const kafkaConsumerPlugin = require('./plugins/kafka')
+
+module.exports = {
+  enableTaintTracking (config, telemetryVerbosity) {
+    enableTaintOperations(telemetryVerbosity)
+    taintTrackingPlugin.enable(config)
+
+    kafkaContextPlugin.enable(config)
+    kafkaConsumerPlugin.enable(config)
+
+    setMaxTransactions(config.maxConcurrentRequests)
+  },
+  disableTaintTracking () {
+    disableTaintOperations()
+    taintTrackingPlugin.disable()
+
+    kafkaContextPlugin.disable()
+    kafkaConsumerPlugin.disable()
+  },
+  setMaxTransactions,
+  createTransaction,
+  removeTransaction,
+  taintTrackingPlugin,
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/operations-taint-object.js

@@ -0,0 +1,88 @@
+'use strict'
+
+const TaintedUtils = require('@datadog/native-iast-taint-tracking')
+const { IAST_TRANSACTION_ID } = require('../iast-context')
+const log = require('../../../log')
+const { HTTP_REQUEST_PARAMETER } = require('./source-types')
+
+const SEPARATOR = '\u0000' // Unit Separator (cannot be in URL keys)
+
+function taintObject (iastContext, object, type) {
+  let result = object
+  const transactionId = iastContext?.[IAST_TRANSACTION_ID]
+  if (transactionId) {
+    const queue = [{ parent: null, property: null, value: object }]
+    const visited = new WeakSet()
+
+    while (queue.length > 0) {
+      const { parent, property, value, key } = queue.pop()
+      if (value === null) {
+        continue
+      }
+
+      try {
+        if (typeof value === 'string') {
+          const tainted = TaintedUtils.newTaintedString(transactionId, value, property, type)
+          if (parent) {
+            parent[key] = tainted
+          } else {
+            result = tainted
+          }
+        } else if (typeof value === 'object' && !visited.has(value)) {
+          visited.add(value)
+
+          for (const key of Object.keys(value)) {
+            queue.push({ parent: value, property: property ? `${property}.${key}` : key, value: value[key], key })
+          }
+        }
+      } catch (e) {
+        log.error('[ASM] Error in taintObject when visiting property : %s', property, e)
+      }
+    }
+  }
+  return result
+}
+
+function taintQueryWithCache (iastContext, query) {
+  const transactionId = iastContext?.[IAST_TRANSACTION_ID]
+  if (!transactionId || !query) return query
+
+  iastContext.queryCache ??= new Map() // key: "a.b.c", value: tainted string
+
+  traverseAndTaint(query, '', iastContext.queryCache, transactionId)
+  return query
+}
+
+function traverseAndTaint (node, path, cache, transactionId) {
+  if (node == null) return node
+
+  if (typeof node === 'string') {
+    const cachedValue = cache.get(path)
+
+    if (cachedValue === node) {
+      return cachedValue
+    }
+
+    const tainted = TaintedUtils.newTaintedString(transactionId, node, path, HTTP_REQUEST_PARAMETER)
+    cache.set(path, tainted)
+
+    return tainted
+  }
+
+  if (typeof node === 'object') {
+    const keys = Array.isArray(node) ? node.keys() : Object.keys(node)
+
+    for (const key of keys) {
+      const childPath = path ? `${path}${SEPARATOR}${key}` : String(key)
+      const tainted = traverseAndTaint(node[key], childPath, cache, transactionId)
+      node[key] = tainted
+    }
+  }
+
+  return node
+}
+
+module.exports = {
+  taintObject,
+  taintQueryWithCache,
+}