@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js

@@ -0,0 +1,266 @@
+'use strict'
+
+/* eslint n/no-unsupported-features/node-builtins: ['error', { ignores: ['module.register'] }] */
+
+const Module = require('module')
+const { pathToFileURL } = require('url')
+const { MessageChannel } = require('worker_threads')
+const { isMainThread } = require('worker_threads')
+const dc = require('dc-polyfill')
+const shimmer = require('../../../../../datadog-shimmer')
+const { getName } = require('../telemetry/verbosity')
+const telemetry = require('../telemetry')
+const log = require('../../../log')
+const orchestrionConfig = require('../../../../../datadog-instrumentations/src/orchestrion-config')
+const { getEnvironmentVariable } = require('../../../config/helper')
+const { LOG_MESSAGE, REWRITTEN_MESSAGE } = require('./constants')
+const { incrementTelemetryIfNeeded } = require('./rewriter-telemetry')
+const { csiMethods } = require('./csi-methods')
+const { isPrivateModule, isDdTrace } = require('./filter')
+
+let config
+const hardcodedSecretCh = dc.channel('datadog:secrets:result')
+let rewriter
+let unwrapCompile = () => {}
+let getPrepareStackTrace
+let cacheRewrittenSourceMap
+let kSymbolPrepareStackTrace
+
+function noop () {}
+
+function isFlagPresent (flag) {
+  return getEnvironmentVariable('NODE_OPTIONS')?.includes(flag) ||
+    process.execArgv?.some(arg => arg.includes(flag))
+}
+
+let getRewriterOriginalPathAndLineFromSourceMap = function (path, line, column) {
+  return { path, line, column }
+}
+
+function setGetOriginalPathAndLineFromSourceMapFunction (chainSourceMap, { getOriginalPathAndLineFromSourceMap }) {
+  if (!getOriginalPathAndLineFromSourceMap) return
+
+  getRewriterOriginalPathAndLineFromSourceMap = chainSourceMap
+    ? (path, line, column) => {
+      // if --enable-source-maps is present stacktraces of the rewritten files contain the original path, file and
+      // column because the sourcemap chaining is done during the rewriting process so we can skip it
+        return !globalThis.__DD_ESBUILD_IAST_WITH_SM && isPrivateModule(path) && !isDdTrace(path)
+          ? { path, line, column }
+          : getOriginalPathAndLineFromSourceMap(path, line, column)
+      }
+    : getOriginalPathAndLineFromSourceMap
+}
+
+function getRewriter (telemetryVerbosity) {
+  if (!rewriter) {
+    try {
+      const iastRewriter = require('@datadog/wasm-js-rewriter')
+      const Rewriter = iastRewriter.Rewriter
+      getPrepareStackTrace = iastRewriter.getPrepareStackTrace
+      kSymbolPrepareStackTrace = iastRewriter.kSymbolPrepareStackTrace
+      cacheRewrittenSourceMap = iastRewriter.cacheRewrittenSourceMap
+
+      const chainSourceMap = isFlagPresent('--enable-source-maps')
+      setGetOriginalPathAndLineFromSourceMapFunction(chainSourceMap, iastRewriter)
+
+      rewriter = new Rewriter({
+        csiMethods,
+        telemetryVerbosity: getName(telemetryVerbosity),
+        chainSourceMap,
+        orchestrion: orchestrionConfig,
+      })
+    } catch (e) {
+      log.error('Unable to initialize Rewriter', e)
+    }
+  }
+  return rewriter
+}
+
+let originalPrepareStackTrace
+function getPrepareStackTraceAccessor () {
+  if (!getPrepareStackTrace) {
+    getPrepareStackTrace = require('@datadog/wasm-js-rewriter/js/stack-trace').getPrepareStackTrace
+  }
+  originalPrepareStackTrace = Error.prepareStackTrace
+  let actual = getPrepareStackTrace(originalPrepareStackTrace)
+  return {
+    configurable: true,
+    get () {
+      return actual
+    },
+    set (value) {
+      actual = getPrepareStackTrace(value)
+      originalPrepareStackTrace = value
+    },
+  }
+}
+
+function getCompileMethodFn (compileMethod) {
+  let delegate = function (content, filename) {
+    try {
+      if (isDdTrace(filename)) {
+        return compileMethod.apply(this, [content, filename])
+      }
+      if (!isPrivateModule(filename) || !config.iast?.enabled) {
+        return compileMethod.apply(this, [content, filename])
+      }
+      // TODO when we have CJS support for orchestrion and taint-tracking, add
+      // them here as appropriate
+      const rewritten = rewriter.rewrite(content, filename, ['iast'])
+
+      incrementTelemetryIfNeeded(rewritten.metrics)
+
+      if (rewritten?.literalsResult && hardcodedSecretCh.hasSubscribers) {
+        hardcodedSecretCh.publish(rewritten.literalsResult)
+      }
+
+      if (rewritten?.content) {
+        return compileMethod.apply(this, [rewritten.content, filename])
+      }
+    } catch (e) {
+      log.error('Error rewriting file %s', filename, e)
+    }
+    return compileMethod.apply(this, [content, filename])
+  }
+
+  const shim = function () {
+    return delegate.apply(this, arguments)
+  }
+
+  unwrapCompile = function () {
+    delegate = compileMethod
+  }
+
+  return shim
+}
+
+function esmRewritePostProcess (rewritten, filename) {
+  const { literalsResult, metrics } = rewritten
+
+  if (metrics?.status === 'modified') {
+    if (filename.startsWith('file://')) {
+      filename = filename.slice(7)
+    }
+
+    cacheRewrittenSourceMap(filename, rewritten.content)
+  }
+
+  incrementTelemetryIfNeeded(metrics)
+
+  if (literalsResult && hardcodedSecretCh.hasSubscribers) {
+    hardcodedSecretCh.publish(literalsResult)
+  }
+}
+
+let shimmedPrepareStackTrace = false
+function shimPrepareStackTrace () {
+  if (shimmedPrepareStackTrace) {
+    return
+  }
+  const pstDescriptor = Object.getOwnPropertyDescriptor(global.Error, 'prepareStackTrace')
+  if (!pstDescriptor || pstDescriptor.configurable || pstDescriptor.writable) {
+    Object.defineProperty(global.Error, 'prepareStackTrace', getPrepareStackTraceAccessor())
+  }
+  shimmedPrepareStackTrace = true
+}
+
+function enableRewriter (telemetryVerbosity) {
+  try {
+    if (config.iast?.enabled) {
+      const rewriter = getRewriter(telemetryVerbosity)
+      if (rewriter) {
+        shimPrepareStackTrace()
+        if (!globalThis.__DD_ESBUILD_IAST_WITH_SM && !globalThis.__DD_ESBUILD_IAST_WITH_NO_SM) {
+          // Avoid rewriting twice when application has been bundled
+          shimmer.wrap(Module.prototype, '_compile', compileMethod => getCompileMethodFn(compileMethod))
+        }
+      }
+      enableEsmRewriter(telemetryVerbosity)
+    }
+  } catch (e) {
+    log.error('Error enabling Rewriter', e)
+  }
+}
+
+function isEsmConfigured () {
+  return (isFlagPresent('--loader') ||
+    isFlagPresent('--experimental-loader') ||
+    isFlagPresent('dd-trace/initialize.mjs')) ||
+    isFlagPresent('dd-trace/register.js')
+}
+
+let enableEsmRewriter = function (telemetryVerbosity) {
+  if (isMainThread && Module.register && isEsmConfigured()) {
+    shimPrepareStackTrace()
+
+    const { port1, port2 } = new MessageChannel()
+
+    port1.on('message', (message) => {
+      const { type, data } = message
+      switch (type) {
+        case LOG_MESSAGE:
+          log[data.level]?.(...data.messages)
+          break
+
+        case REWRITTEN_MESSAGE:
+          esmRewritePostProcess(data.rewritten, data.url)
+          break
+      }
+    })
+
+    port1.unref()
+    port2.unref()
+
+    try {
+      Module.register('./rewriter-esm.mjs', {
+        parentURL: pathToFileURL(__filename),
+        transferList: [port2],
+        data: {
+          port: port2,
+          csiMethods,
+          telemetryVerbosity,
+          chainSourceMap: isFlagPresent('--enable-source-maps'),
+          orchestrionConfig,
+          iastEnabled: config?.iast?.enabled,
+        },
+      })
+    } catch (e) {
+      log.error('Error enabling ESM Rewriter', e)
+      port1.close()
+      port2.close()
+    }
+
+    cacheRewrittenSourceMap = require('@datadog/wasm-js-rewriter/js/source-map').cacheRewrittenSourceMap
+
+    enableEsmRewriter = noop
+  }
+}
+
+function disable () {
+  unwrapCompile()
+
+  if (!Error.prepareStackTrace?.[kSymbolPrepareStackTrace]) return
+
+  try {
+    delete Error.prepareStackTrace
+
+    Error.prepareStackTrace = originalPrepareStackTrace
+
+    shimmedPrepareStackTrace = false
+  } catch (e) {
+    log.warn('Error disabling Rewriter', e)
+  }
+}
+
+function getOriginalPathAndLineFromSourceMap ({ path, line, column }) {
+  return getRewriterOriginalPathAndLineFromSourceMap(path, line, column)
+}
+
+function enable (configArg) {
+  config = configArg
+  enableRewriter(telemetry.verbosity || 'OFF')
+}
+
+module.exports = {
+  enable, disable, getOriginalPathAndLineFromSourceMap, getRewriter,
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/secure-marks-generator.js

@@ -0,0 +1,13 @@
+'use strict'
+
+let next = 0
+
+function getNextSecureMark () {
+  return (1 << next++) >>> 0
+}
+
+function reset () {
+  next = 0
+}
+
+module.exports = { getNextSecureMark, reset }

package/packages/dd-trace/src/appsec/iast/taint-tracking/secure-marks.js

@@ -0,0 +1,30 @@
+'use strict'
+
+const vulnerabilities = require('../vulnerabilities')
+const { getNextSecureMark } = require('./secure-marks-generator')
+
+const marks = {}
+for (const vulnerability of Object.keys(vulnerabilities)) {
+  marks[vulnerability + '_MARK'] = getNextSecureMark()
+}
+
+let asterisk = 0x0
+for (const mark of Object.values(marks)) {
+  asterisk |= mark
+}
+
+marks.ASTERISK_MARK = asterisk
+marks.CUSTOM_SECURE_MARK = getNextSecureMark()
+
+function getMarkFromVulnerabilityType (vulnerabilityType) {
+  vulnerabilityType = vulnerabilityType?.trim()
+  const mark = vulnerabilityType === '*' ? 'ASTERISK_MARK' : vulnerabilityType + '_MARK'
+  return marks[mark]
+}
+
+module.exports = {
+  ...marks,
+  getMarkFromVulnerabilityType,
+
+  ALL: marks,
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/source-types.js

@@ -0,0 +1,15 @@
+'use strict'
+
+module.exports = {
+  HTTP_REQUEST_BODY: 'http.request.body',
+  HTTP_REQUEST_COOKIE_VALUE: 'http.request.cookie.value',
+  HTTP_REQUEST_COOKIE_NAME: 'http.request.cookie.name',
+  HTTP_REQUEST_HEADER_NAME: 'http.request.header.name',
+  HTTP_REQUEST_HEADER_VALUE: 'http.request.header',
+  HTTP_REQUEST_PARAMETER: 'http.request.parameter',
+  HTTP_REQUEST_PATH_PARAM: 'http.request.path.parameter',
+  HTTP_REQUEST_URI: 'http.request.uri',
+  KAFKA_MESSAGE_KEY: 'kafka.message.key',
+  KAFKA_MESSAGE_VALUE: 'kafka.message.value',
+  SQL_ROW_VALUE: 'sql.row.value',
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/taint-tracking-impl.js

@@ -0,0 +1,258 @@
+'use strict'
+
+const dc = require('dc-polyfill')
+const TaintedUtils = require('@datadog/native-iast-taint-tracking')
+const { storage } = require('../../../../../datadog-core')
+const iastContextFunctions = require('../iast-context')
+const { EXECUTED_PROPAGATION } = require('../telemetry/iast-metric')
+const { isDebugAllowed } = require('../telemetry/verbosity')
+const log = require('../../../log')
+const { taintObject } = require('./operations-taint-object')
+
+const mathRandomCallCh = dc.channel('datadog:random:call')
+const evalCallCh = dc.channel('datadog:eval:call')
+
+const JSON_VALUE = 'json.value'
+
+function noop (res) { return res }
+// NOTE: methods of this object must be synchronized with csi-methods.js file definitions!
+// Otherwise you may end up rewriting a method and not providing its rewritten implementation
+const TaintTrackingNoop = {
+  concat: noop,
+  eval: noop,
+  join: noop,
+  parse: noop,
+  plusOperator: noop,
+  random: noop,
+  replace: noop,
+  slice: noop,
+  substr: noop,
+  substring: noop,
+  stringCase: noop,
+  tplOperator: noop,
+  trim: noop,
+  trimEnd: noop,
+}
+
+function getTransactionId (iastContext) {
+  return iastContext?.[iastContextFunctions.IAST_TRANSACTION_ID]
+}
+
+function getContextDefault () {
+  const store = storage('legacy').getStore()
+  return iastContextFunctions.getIastContext(store)
+}
+
+function getContextDebug () {
+  const iastContext = getContextDefault()
+  EXECUTED_PROPAGATION.inc(iastContext)
+  return iastContext
+}
+
+function getFilteredCsiFn (cb, filter, getContext) {
+  return function csiCall (res, fn, target, ...rest) {
+    try {
+      if (filter(res, fn, target)) { return res }
+
+      const context = getContext()
+      const transactionId = getTransactionId(context)
+      if (transactionId) {
+        return cb(transactionId, res, target, ...rest)
+      }
+    } catch (e) {
+      log.error('[ASM] Error invoking CSI %s', target, e)
+    }
+    return res
+  }
+}
+
+function notString () {
+  return Array.prototype.some.call(arguments, (p) => typeof p !== 'string')
+}
+
+function isValidCsiMethod (fn, protos) {
+  return protos.includes(fn)
+}
+
+function getCsiFn (cb, getContext, ...protos) {
+  let filter
+  if (!protos || protos.length === 0) {
+    filter = (res, fn, target) => notString(res, target)
+  } else if (protos.length === 1) {
+    const protoFn = protos[0]
+    filter = (res, fn, target) => notString(res, target) || fn !== protoFn
+  } else {
+    filter = (res, fn, target) => notString(res, target) || !isValidCsiMethod(fn, protos)
+  }
+  return getFilteredCsiFn(cb, filter, getContext)
+}
+
+function csiMethodsDefaults (names, excluded, getContext) {
+  const impl = {}
+  for (const name of names) {
+    if (excluded.includes(name)) continue
+    impl[name] = getCsiFn(
+      (transactionId, res, target, ...rest) => TaintedUtils[name](transactionId, res, target, ...rest),
+      getContext,
+      String.prototype[name]
+    )
+  }
+  return impl
+}
+
+function csiMethodsOverrides (getContext) {
+  return {
+    plusOperator: function (res, op1, op2) {
+      try {
+        if (notString(res) || (notString(op1) && notString(op2))) { return res }
+        const iastContext = getContext()
+        const transactionId = getTransactionId(iastContext)
+        if (transactionId) {
+          return TaintedUtils.concat(transactionId, res, op1, op2)
+        }
+      } catch (e) {
+        log.error('[ASM] Error invoking CSI plusOperator', e)
+      }
+      return res
+    },
+
+    tplOperator: function (res, ...rest) {
+      try {
+        const iastContext = getContext()
+        const transactionId = getTransactionId(iastContext)
+        if (transactionId) {
+          return TaintedUtils.concat(transactionId, res, ...rest)
+        }
+      } catch (e) {
+        log.error('[ASM] Error invoking CSI tplOperator', e)
+      }
+      return res
+    },
+
+    stringCase: getCsiFn(
+      (transactionId, res, target) => TaintedUtils.stringCase(transactionId, res, target),
+      getContext,
+      String.prototype.toLowerCase,
+      String.prototype.toUpperCase
+    ),
+
+    trim: getCsiFn(
+      (transactionId, res, target) => TaintedUtils.trim(transactionId, res, target),
+      getContext,
+      String.prototype.trim,
+      String.prototype.trimStart
+    ),
+
+    random: function (res, fn) {
+      if (mathRandomCallCh.hasSubscribers) {
+        mathRandomCallCh.publish({ fn })
+      }
+      return res
+    },
+
+    eval: function (res, fn, target, script) {
+      // eslint-disable-next-line no-eval
+      if (evalCallCh.hasSubscribers && fn === globalThis.eval) {
+        evalCallCh.publish({ script })
+      }
+
+      return res
+    },
+
+    parse: function (res, fn, target, json) {
+      if (fn === JSON.parse) {
+        try {
+          const iastContext = getContext()
+          const transactionId = getTransactionId(iastContext)
+          if (transactionId) {
+            const ranges = TaintedUtils.getRanges(transactionId, json)
+
+            // TODO: first version.
+            // here we are losing the original source because taintObject always creates a new tainted
+            if (ranges?.length > 0) {
+              const range = ranges.find(range => range.iinfo?.type)
+              res = taintObject(iastContext, res, range?.iinfo.type || JSON_VALUE)
+            }
+          }
+        } catch (e) {
+          log.error('[ASM] Error invoking CSI JSON.parse', e)
+        }
+      }
+
+      return res
+    },
+
+    join: function (res, fn, target, separator) {
+      if (fn === Array.prototype.join) {
+        try {
+          const iastContext = getContext()
+          const transactionId = getTransactionId(iastContext)
+          if (transactionId) {
+            res = TaintedUtils.arrayJoin(transactionId, res, target, separator)
+          }
+        } catch (e) {
+          log.error('[ASM] Error invoking CSI join', e)
+        }
+      }
+
+      return res
+    },
+  }
+}
+
+function createImplWith (getContext) {
+  const methodNames = Object.keys(TaintTrackingNoop)
+  const overrides = csiMethodsOverrides(getContext)
+
+  // impls could be cached but at the moment there is only one invocation to getTaintTrackingImpl
+  return {
+    ...csiMethodsDefaults(methodNames, Object.keys(overrides), getContext),
+    ...overrides,
+  }
+}
+
+function getTaintTrackingImpl (telemetryVerbosity, dummy = false) {
+  if (dummy) return TaintTrackingNoop
+
+  // with Verbosity.DEBUG every invocation of a TaintedUtils method increases the EXECUTED_PROPAGATION metric
+  return isDebugAllowed(telemetryVerbosity)
+    ? createImplWith(getContextDebug)
+    : createImplWith(getContextDefault)
+}
+
+function getTaintTrackingNoop () {
+  return getTaintTrackingImpl(null, true)
+}
+
+const lodashFns = {
+  join: TaintedUtils.arrayJoin,
+  toLower: TaintedUtils.stringCase,
+  toUpper: TaintedUtils.stringCase,
+  trim: TaintedUtils.trim,
+  trimEnd: TaintedUtils.trimEnd,
+  trimStart: TaintedUtils.trim,
+
+}
+
+function getLodashTaintedUtilFn (lodashFn) {
+  return lodashFns[lodashFn] || ((transactionId, result) => result)
+}
+
+function lodashTaintTrackingHandler (message) {
+  try {
+    if (!message.result) return
+    const context = getContextDefault()
+    const transactionId = getTransactionId(context)
+    if (transactionId) {
+      message.result = getLodashTaintedUtilFn(message.operation)(transactionId, message.result, ...message.arguments)
+    }
+  } catch (e) {
+    log.error('[ASM] Error invoking CSI lodash %s', message.operation, e)
+  }
+}
+
+module.exports = {
+  getTaintTrackingImpl,
+  getTaintTrackingNoop,
+  lodashTaintTrackingHandler,
+}

package/packages/dd-trace/src/appsec/iast/telemetry/iast-metric.js

@@ -0,0 +1,113 @@
+'use strict'
+
+const { getNamespaceFromContext, globalNamespace } = require('./namespaces')
+
+const Scope = {
+  GLOBAL: 'GLOBAL',
+  REQUEST: 'REQUEST',
+}
+
+const PropagationType = {
+  STRING: 'STRING',
+  JSON: 'JSON',
+  URL: 'URL',
+}
+
+const TagKey = {
+  VULNERABILITY_TYPE: 'vulnerability_type',
+  SOURCE_TYPE: 'source_type',
+  PROPAGATION_TYPE: 'propagation_type',
+}
+
+function formatTags (tags, tagKey) {
+  return tags.map(tagValue => tagValue ? [`${tagKey}:${tagValue.toLowerCase()}`] : undefined)
+}
+
+function getNamespace (scope, context) {
+  let namespace = globalNamespace
+
+  if (scope === Scope.REQUEST) {
+    namespace = getNamespaceFromContext(context) || globalNamespace
+  }
+  return namespace
+}
+
+class IastMetric {
+  constructor (name, scope, tagKey) {
+    this.name = name
+    this.scope = scope
+    this.tagKey = tagKey
+  }
+
+  formatTags (...tags) {
+    return formatTags(tags, this.tagKey)
+  }
+
+  inc (context, tags, value = 1) {
+    const namespace = getNamespace(this.scope, context)
+    namespace.count(this.name, tags).inc(value)
+  }
+}
+
+class NoTaggedIastMetric extends IastMetric {
+  constructor (name, scope) {
+    super(name, scope)
+
+    this.tags = []
+  }
+
+  inc (context, value = 1) {
+    const namespace = getNamespace(this.scope, context)
+    namespace.count(this.name, this.tags).inc(value)
+  }
+}
+
+function getExecutedMetric (tagKey) {
+  return tagKey === TagKey.VULNERABILITY_TYPE ? EXECUTED_SINK : EXECUTED_SOURCE
+}
+
+function getInstrumentedMetric (tagKey) {
+  return tagKey === TagKey.VULNERABILITY_TYPE ? INSTRUMENTED_SINK : INSTRUMENTED_SOURCE
+}
+
+const INSTRUMENTED_PROPAGATION = new NoTaggedIastMetric('instrumented.propagation', Scope.GLOBAL)
+const INSTRUMENTED_SOURCE = new IastMetric('instrumented.source', Scope.GLOBAL, TagKey.SOURCE_TYPE)
+const INSTRUMENTED_SINK = new IastMetric('instrumented.sink', Scope.GLOBAL, TagKey.VULNERABILITY_TYPE)
+
+const EXECUTED_SOURCE = new IastMetric('executed.source', Scope.REQUEST, TagKey.SOURCE_TYPE)
+const EXECUTED_SINK = new IastMetric('executed.sink', Scope.REQUEST, TagKey.VULNERABILITY_TYPE)
+
+const REQUEST_TAINTED = new NoTaggedIastMetric('request.tainted', Scope.REQUEST)
+
+// DEBUG using metrics
+const EXECUTED_PROPAGATION = new NoTaggedIastMetric('executed.propagation', Scope.REQUEST)
+const EXECUTED_TAINTED = new NoTaggedIastMetric('executed.tainted', Scope.REQUEST)
+
+const SUPPRESSED_VULNERABILITIES = new IastMetric('suppressed.vulnerabilities', Scope.REQUEST,
+  TagKey.VULNERABILITY_TYPE)
+
+module.exports = {
+  INSTRUMENTED_PROPAGATION,
+  INSTRUMENTED_SOURCE,
+  INSTRUMENTED_SINK,
+
+  EXECUTED_PROPAGATION,
+  EXECUTED_SOURCE,
+  EXECUTED_SINK,
+  EXECUTED_TAINTED,
+
+  REQUEST_TAINTED,
+
+  SUPPRESSED_VULNERABILITIES,
+
+  PropagationType,
+  TagKey,
+
+  IastMetric,
+  NoTaggedIastMetric,
+
+  getExecutedMetric,
+  getInstrumentedMetric,
+
+  formatTags,
+}