@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/appsec/iast/taint-tracking/operations.js

@@ -0,0 +1,108 @@
+'use strict'
+
+const dc = require('dc-polyfill')
+const TaintedUtils = require('@datadog/native-iast-taint-tracking')
+const { IAST_TRANSACTION_ID } = require('../iast-context')
+const iastTelemetry = require('../telemetry')
+const { REQUEST_TAINTED } = require('../telemetry/iast-metric')
+const { isInfoAllowed } = require('../telemetry/verbosity')
+const {
+  getTaintTrackingImpl,
+  getTaintTrackingNoop,
+  lodashTaintTrackingHandler,
+} = require('./taint-tracking-impl')
+const { taintObject, taintQueryWithCache } = require('./operations-taint-object')
+
+const lodashOperationCh = dc.channel('datadog:lodash:operation')
+
+function createTransaction (id, iastContext) {
+  if (id && iastContext) {
+    iastContext[IAST_TRANSACTION_ID] = TaintedUtils.createTransaction(id)
+  }
+}
+
+let onRemoveTransaction = (transactionId, iastContext) => {}
+
+function onRemoveTransactionInformationTelemetry (transactionId, iastContext) {
+  const metrics = TaintedUtils.getMetrics(transactionId, iastTelemetry.verbosity)
+  if (metrics?.requestCount) {
+    REQUEST_TAINTED.inc(iastContext, metrics.requestCount)
+  }
+}
+
+function removeTransaction (iastContext) {
+  const transactionId = iastContext?.[IAST_TRANSACTION_ID]
+  if (transactionId) {
+    onRemoveTransaction(transactionId, iastContext)
+
+    TaintedUtils.removeTransaction(transactionId)
+    delete iastContext[IAST_TRANSACTION_ID]
+  }
+}
+
+function newTaintedString (iastContext, string, name, type) {
+  const transactionId = iastContext?.[IAST_TRANSACTION_ID]
+  return transactionId ? TaintedUtils.newTaintedString(transactionId, string, name, type) : string
+}
+
+function newTaintedObject (iastContext, obj, name, type) {
+  const transactionId = iastContext?.[IAST_TRANSACTION_ID]
+  return transactionId ? TaintedUtils.newTaintedObject(transactionId, obj, name, type) : obj
+}
+
+function isTainted (iastContext, string) {
+  const transactionId = iastContext?.[IAST_TRANSACTION_ID]
+  return transactionId ? TaintedUtils.isTainted(transactionId, string) : false
+}
+
+function getRanges (iastContext, string) {
+  const transactionId = iastContext?.[IAST_TRANSACTION_ID]
+  return transactionId ? TaintedUtils.getRanges(transactionId, string) : []
+}
+
+function addSecureMark (iastContext, string, mark, createNewTainted = true) {
+  const transactionId = iastContext?.[IAST_TRANSACTION_ID]
+  if (transactionId) {
+    return TaintedUtils.addSecureMarksToTaintedString(transactionId, string, mark, createNewTainted)
+  }
+
+  return string
+}
+
+function enableTaintOperations (telemetryVerbosity) {
+  if (isInfoAllowed(telemetryVerbosity)) {
+    onRemoveTransaction = onRemoveTransactionInformationTelemetry
+  }
+
+  global._ddiast = getTaintTrackingImpl(telemetryVerbosity)
+  lodashOperationCh.subscribe(lodashTaintTrackingHandler)
+}
+
+function disableTaintOperations () {
+  global._ddiast = getTaintTrackingNoop()
+  lodashOperationCh.unsubscribe(lodashTaintTrackingHandler)
+}
+
+function setMaxTransactions (transactions) {
+  if (!transactions) {
+    return
+  }
+
+  TaintedUtils.setMaxTransactions(transactions)
+}
+
+module.exports = {
+  addSecureMark,
+  createTransaction,
+  removeTransaction,
+  newTaintedString,
+  newTaintedObject,
+  taintObject,
+  taintQueryWithCache,
+  isTainted,
+  getRanges,
+  enableTaintOperations,
+  disableTaintOperations,
+  setMaxTransactions,
+  IAST_TRANSACTION_ID,
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -0,0 +1,293 @@
+'use strict'
+
+const { SourceIastPlugin } = require('../iast-plugin')
+const { getIastContext } = require('../iast-context')
+const { storage } = require('../../../../../datadog-core')
+const { EXECUTED_SOURCE } = require('../telemetry/iast-metric')
+const { taintObject, newTaintedString, getRanges, taintQueryWithCache } = require('./operations')
+const {
+  HTTP_REQUEST_BODY,
+  HTTP_REQUEST_COOKIE_VALUE,
+  HTTP_REQUEST_COOKIE_NAME,
+  HTTP_REQUEST_HEADER_VALUE,
+  HTTP_REQUEST_HEADER_NAME,
+  HTTP_REQUEST_PARAMETER,
+  HTTP_REQUEST_PATH_PARAM,
+  HTTP_REQUEST_URI,
+  SQL_ROW_VALUE,
+} = require('./source-types')
+
+const REQ_HEADER_TAGS = EXECUTED_SOURCE.formatTags(HTTP_REQUEST_HEADER_VALUE, HTTP_REQUEST_HEADER_NAME)
+const REQ_URI_TAGS = EXECUTED_SOURCE.formatTags(HTTP_REQUEST_URI)
+
+class TaintTrackingPlugin extends SourceIastPlugin {
+  constructor () {
+    super()
+    this._type = 'taint-tracking'
+    this._taintedURLs = new WeakMap()
+  }
+
+  configure (config) {
+    super.configure(config)
+
+    let rowsToTaint = this.iastConfig?.dbRowsToTaint
+    if (typeof rowsToTaint !== 'number') {
+      rowsToTaint = 1
+    }
+    this._rowsToTaint = rowsToTaint
+  }
+
+  onConfigure () {
+    this.addBodyParsingSubscriptions()
+
+    this.addQueryParameterSubscriptions()
+
+    this.addCookieSubscriptions()
+
+    this.addDatabaseSubscriptions()
+
+    this.addPathParameterSubscriptions()
+
+    this.addGraphQLSubscriptions()
+
+    this.addURLParsingSubscriptions()
+
+    // this is a special case to increment INSTRUMENTED_SOURCE metric for header
+    this.addInstrumentedSource('http', [HTTP_REQUEST_HEADER_VALUE, HTTP_REQUEST_HEADER_NAME])
+  }
+
+  addBodyParsingSubscriptions () {
+    const onRequestBody = ({ req }) => {
+      const iastContext = getIastContext(storage('legacy').getStore())
+      if (iastContext && iastContext.body !== req.body) {
+        this._taintTrackingHandler(HTTP_REQUEST_BODY, req, 'body', iastContext)
+        iastContext.body = req.body
+      }
+    }
+
+    this.addSub(
+      { channelName: 'datadog:body-parser:read:finish', tag: HTTP_REQUEST_BODY },
+      onRequestBody
+    )
+
+    this.addSub(
+      { channelName: 'datadog:multer:read:finish', tag: HTTP_REQUEST_BODY },
+      onRequestBody
+    )
+
+    this.addSub(
+      { channelName: 'datadog:fastify:body-parser:finish', tag: HTTP_REQUEST_BODY },
+      ({ body }) => {
+        const iastContext = getIastContext(storage('legacy').getStore())
+        if (iastContext && iastContext.body !== body) {
+          this._taintTrackingHandler(HTTP_REQUEST_BODY, body)
+          iastContext.body = body
+        }
+      }
+    )
+
+    this.addSub(
+      { channelName: 'apm:express:middleware:next', tag: HTTP_REQUEST_BODY },
+      ({ req }) => {
+        if (req && req.body !== null && typeof req.body === 'object') {
+          const iastContext = getIastContext(storage('legacy').getStore())
+          if (iastContext && iastContext.body !== req.body) {
+            this._taintTrackingHandler(HTTP_REQUEST_BODY, req, 'body', iastContext)
+            iastContext.body = req.body
+          }
+        }
+      }
+    )
+  }
+
+  addQueryParameterSubscriptions () {
+    this.addSub(
+      { channelName: 'datadog:query:read:finish', tag: HTTP_REQUEST_PARAMETER },
+      ({ query }) => this._taintTrackingHandler(HTTP_REQUEST_PARAMETER, query)
+    )
+
+    this.addSub(
+      { channelName: 'datadog:fastify:query-params:finish', tag: HTTP_REQUEST_PARAMETER },
+      ({ query }) => {
+        this._taintTrackingHandler(HTTP_REQUEST_PARAMETER, query)
+      }
+    )
+
+    this.addSub(
+      { channelName: 'datadog:express:query:finish', tag: HTTP_REQUEST_PARAMETER },
+      ({ query }) => {
+        const iastContext = getIastContext(storage('legacy').getStore())
+        if (!iastContext || !query) return
+
+        taintQueryWithCache(iastContext, query)
+      }
+    )
+  }
+
+  addCookieSubscriptions () {
+    this.addSub(
+      { channelName: 'datadog:cookie:parse:finish', tag: [HTTP_REQUEST_COOKIE_VALUE, HTTP_REQUEST_COOKIE_NAME] },
+      ({ cookies }) => this._cookiesTaintTrackingHandler(cookies)
+    )
+
+    this.addSub(
+      { channelName: 'datadog:fastify-cookie:read:finish', tag: [HTTP_REQUEST_COOKIE_VALUE, HTTP_REQUEST_COOKIE_NAME] },
+      ({ cookies }) => this._cookiesTaintTrackingHandler(cookies)
+    )
+  }
+
+  addDatabaseSubscriptions () {
+    this.addSub(
+      { channelName: 'datadog:sequelize:query:finish', tag: SQL_ROW_VALUE },
+      ({ result }) => this._taintDatabaseResult(result, 'sequelize', getIastContext(storage('legacy').getStore()))
+    )
+
+    this.addSub(
+      { channelName: 'apm:pg:query:finish', tag: SQL_ROW_VALUE },
+      ({ result, currentStore }) => this._taintDatabaseResult(result, 'pg', getIastContext(currentStore))
+    )
+  }
+
+  addPathParameterSubscriptions () {
+    const pathParamHandler = ({ req }) => {
+      if (req && req.params !== null && typeof req.params === 'object') {
+        this._taintTrackingHandler(HTTP_REQUEST_PATH_PARAM, req, 'params')
+      }
+    }
+
+    this.addSub(
+      { channelName: 'datadog:express:process_params:start', tag: HTTP_REQUEST_PATH_PARAM },
+      pathParamHandler
+    )
+
+    this.addSub(
+      { channelName: 'datadog:router:param:start', tag: HTTP_REQUEST_PATH_PARAM },
+      pathParamHandler
+    )
+
+    this.addSub(
+      { channelName: 'datadog:fastify:path-params:finish', tag: HTTP_REQUEST_PATH_PARAM },
+      ({ req, params }) => {
+        if (req) {
+          this._taintTrackingHandler(HTTP_REQUEST_PATH_PARAM, params)
+        }
+      }
+    )
+  }
+
+  addGraphQLSubscriptions () {
+    this.addSub(
+      { channelName: 'apm:graphql:resolve:start', tag: HTTP_REQUEST_BODY },
+      (data) => {
+        const iastContext = getIastContext(storage('legacy').getStore())
+        const source = data.rootCtx?.source
+        const ranges = source && getRanges(iastContext, source)
+        if (ranges?.length) {
+          this._taintTrackingHandler(ranges[0].iinfo.type, data.args, null, iastContext)
+        }
+      }
+    )
+  }
+
+  addURLParsingSubscriptions () {
+    const urlResultTaintedProperties = ['host', 'origin', 'hostname']
+    this.addSub(
+      { channelName: 'datadog:url:parse:finish' },
+      ({ input, base, parsed, isURL }) => {
+        const iastContext = getIastContext(storage('legacy').getStore())
+        const ranges = getRanges(iastContext, base || input)
+
+        if (ranges?.length) {
+          if (isURL) {
+            this._taintedURLs.set(parsed, ranges[0])
+          } else {
+            for (const param of urlResultTaintedProperties) {
+              this._taintTrackingHandler(ranges[0].iinfo.type, parsed, param, iastContext)
+            }
+          }
+        }
+      }
+    )
+
+    this.addSub(
+      { channelName: 'datadog:url:getter:finish' },
+      (context) => {
+        if (!urlResultTaintedProperties.includes(context.property)) return
+
+        const origRange = this._taintedURLs.get(context.urlObject)
+        if (!origRange) return
+
+        const iastContext = getIastContext(storage('legacy').getStore())
+        if (!iastContext) return
+
+        context.result =
+          newTaintedString(iastContext, context.result, origRange.iinfo.parameterName, origRange.iinfo.type)
+      })
+  }
+
+  _taintTrackingHandler (type, target, property, iastContext = getIastContext(storage('legacy').getStore())) {
+    if (!property) {
+      taintObject(iastContext, target, type)
+    } else if (target[property]) {
+      target[property] = taintObject(iastContext, target[property], type)
+    }
+  }
+
+  _cookiesTaintTrackingHandler (target) {
+    const iastContext = getIastContext(storage('legacy').getStore())
+    // Prevent tainting cookie names since it leads to taint literal string with same value.
+    taintObject(iastContext, target, HTTP_REQUEST_COOKIE_VALUE)
+  }
+
+  taintHeaders (headers, iastContext) {
+    // Prevent tainting header names since it leads to taint literal string with same value.
+    this.execSource({
+      handler: () => taintObject(iastContext, headers, HTTP_REQUEST_HEADER_VALUE),
+      tags: REQ_HEADER_TAGS,
+      iastContext,
+    })
+  }
+
+  taintUrl (req, iastContext) {
+    this.execSource({
+      handler: function () {
+        req.url = newTaintedString(iastContext, req.url, HTTP_REQUEST_URI, HTTP_REQUEST_URI)
+      },
+      tags: REQ_URI_TAGS,
+      iastContext,
+    })
+  }
+
+  taintRequest (req, iastContext) {
+    this.taintHeaders(req.headers, iastContext)
+    this.taintUrl(req, iastContext)
+  }
+
+  _taintDatabaseResult (result, dbOrigin, iastContext, name) {
+    if (!iastContext) return result
+
+    if (this._rowsToTaint === 0) return result
+
+    if (Array.isArray(result)) {
+      for (let i = 0; i < result.length && i < this._rowsToTaint; i++) {
+        const nextName = name ? `${name}.${i}` : String(i)
+        result[i] = this._taintDatabaseResult(result[i], dbOrigin, iastContext, nextName)
+      }
+    } else if (result && typeof result === 'object') {
+      if (dbOrigin === 'sequelize' && result.dataValues) {
+        result.dataValues = this._taintDatabaseResult(result.dataValues, dbOrigin, iastContext, name)
+      } else {
+        for (const key in result) {
+          const nextName = name ? `${name}.${key}` : key
+          result[key] = this._taintDatabaseResult(result[key], dbOrigin, iastContext, nextName)
+        }
+      }
+    } else if (typeof result === 'string') {
+      result = newTaintedString(iastContext, result, name, SQL_ROW_VALUE)
+    }
+
+    return result
+  }
+}
+
+module.exports = new TaintTrackingPlugin()

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugins/kafka.js

@@ -0,0 +1,46 @@
+'use strict'
+
+const shimmer = require('../../../../../../datadog-shimmer')
+const { getIastContext } = require('../../iast-context')
+const { KAFKA_MESSAGE_KEY, KAFKA_MESSAGE_VALUE } = require('../source-types')
+const { newTaintedObject, newTaintedString } = require('../operations')
+const { SourceIastPlugin } = require('../../iast-plugin')
+
+class KafkaConsumerIastPlugin extends SourceIastPlugin {
+  onConfigure () {
+    this.addSub({ channelName: 'dd-trace:kafkajs:consumer:afterStart', tag: [KAFKA_MESSAGE_KEY, KAFKA_MESSAGE_VALUE] },
+      ({ message, currentStore }) => this.taintKafkaMessage(message, currentStore)
+    )
+  }
+
+  getToStringWrap (toString, iastContext, type) {
+    return function () {
+      const res = toString.apply(this, arguments)
+      return newTaintedString(iastContext, res, undefined, type)
+    }
+  }
+
+  taintKafkaMessage (message, currentStore) {
+    const iastContext = getIastContext(currentStore)
+
+    if (iastContext && message) {
+      const { key, value } = message
+
+      if (key !== null && typeof key === 'object') {
+        shimmer.wrap(key, 'toString',
+          toString => this.getToStringWrap(toString, iastContext, KAFKA_MESSAGE_KEY))
+
+        newTaintedObject(iastContext, key, undefined, KAFKA_MESSAGE_KEY)
+      }
+
+      if (value !== null && typeof value === 'object') {
+        shimmer.wrap(value, 'toString',
+          toString => this.getToStringWrap(toString, iastContext, KAFKA_MESSAGE_VALUE))
+
+        newTaintedObject(iastContext, value, undefined, KAFKA_MESSAGE_VALUE)
+      }
+    }
+  }
+}
+
+module.exports = new KafkaConsumerIastPlugin()

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter-esm.mjs

@@ -0,0 +1,76 @@
+import path from 'path'
+import { URL } from 'url'
+import { getName } from '../telemetry/verbosity.js'
+import { isDdTrace, isPrivateModule } from './filter.js'
+import constants from './constants.js'
+
+const currentUrl = new URL(import.meta.url)
+const ddTraceDir = path.join(currentUrl.pathname, '..', '..', '..', '..', '..', '..')
+
+let port, rewriter, iastEnabled
+
+export async function initialize (data) {
+  if (rewriter) throw new Error('ALREADY INITIALIZED')
+
+  const { csiMethods, telemetryVerbosity, chainSourceMap, orchestrionConfig } = data
+  port = data.port
+  iastEnabled = data.iastEnabled
+
+  const iastRewriter = await import('@datadog/wasm-js-rewriter')
+
+  const { NonCacheRewriter } = iastRewriter.default
+
+  rewriter = new NonCacheRewriter({
+    csiMethods,
+    telemetryVerbosity: getName(telemetryVerbosity),
+    chainSourceMap,
+    orchestrion: orchestrionConfig,
+  })
+}
+
+export async function load (url, context, nextLoad) {
+  const result = await nextLoad(url, context)
+
+  if (!port) return result
+  if (!result.source) return result
+  if (url.includes(ddTraceDir) || url.includes('iitm=true')) return result
+
+  let passes
+  try {
+    if (isDdTrace(url)) {
+      return result
+    }
+    if (isPrivateModule(url)) {
+      // TODO error tracking needs to be added based on config
+      passes = ['error_tracking']
+      if (iastEnabled) {
+        passes.push('iast')
+      }
+    } else {
+      passes = [] // TODO: Re-enable Orchestrion when viable.
+    }
+    const rewritten = rewriter.rewrite(result.source.toString(), url, passes)
+
+    if (rewritten?.content) {
+      result.source = rewritten.content || result.source
+      const data = { url, rewritten }
+      port.postMessage({ type: constants.REWRITTEN_MESSAGE, data })
+    }
+  } catch (e) {
+    const newErrObject = {
+      message: e.message,
+      stack: e.stack,
+    }
+
+    const data = {
+      level: 'error',
+      messages: ['[ASM] Error rewriting file %s', url, newErrObject],
+    }
+    port.postMessage({
+      type: constants.LOG_MESSAGE,
+      data,
+    })
+  }
+
+  return result
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter-telemetry.js

@@ -0,0 +1,13 @@
+'use strict'
+
+const iastTelemetry = require('../telemetry')
+const { Verbosity } = require('../telemetry/verbosity')
+const { INSTRUMENTED_PROPAGATION } = require('../telemetry/iast-metric')
+
+function incrementTelemetryIfNeeded (metrics) {
+  if (iastTelemetry.verbosity !== Verbosity.OFF && metrics?.instrumentedPropagation) {
+    INSTRUMENTED_PROPAGATION.inc(undefined, metrics.instrumentedPropagation)
+  }
+}
+
+module.exports = { incrementTelemetryIfNeeded }