@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/appsec/rasp/index.js

@@ -0,0 +1,140 @@
+'use strict'
+
+const web = require('../../plugins/util/web')
+const {
+  setUncaughtExceptionCaptureCallbackStart,
+  expressMiddlewareError,
+  fastifyMiddlewareError,
+  routerMiddlewareError,
+} = require('../channels')
+const { block, registerBlockDelegation, isBlocked } = require('../blocking')
+const { updateRaspRuleMatchMetricTags } = require('../telemetry')
+const ssrf = require('./ssrf')
+const sqli = require('./sql_injection')
+const lfi = require('./lfi')
+const cmdi = require('./command_injection')
+
+const { DatadogRaspAbortError } = require('./utils')
+
+function removeAllListeners (emitter, event) {
+  const listeners = emitter.listeners(event)
+  emitter.removeAllListeners(event)
+
+  let cleaned = false
+  return function () {
+    if (cleaned === true) {
+      return
+    }
+    cleaned = true
+
+    for (const listener of listeners) {
+      emitter.on(event, listener)
+    }
+  }
+}
+
+function findDatadogRaspAbortError (err, deep = 10) {
+  if (err instanceof DatadogRaspAbortError) {
+    return err
+  }
+
+  if (err?.cause && deep > 0) {
+    return findDatadogRaspAbortError(err.cause, deep - 1)
+  }
+}
+
+function handleUncaughtExceptionMonitor (error) {
+  if (!blockOnDatadogRaspAbortError({ error, isTopLevel: true })) return
+
+  if (process.hasUncaughtExceptionCaptureCallback()) {
+    // uncaughtException event is not executed when hasUncaughtExceptionCaptureCallback is true
+    let previousCb
+    const cb = ({ currentCallback, abortController }) => {
+      setUncaughtExceptionCaptureCallbackStart.unsubscribe(cb)
+      if (!currentCallback) {
+        abortController.abort()
+        return
+      }
+
+      previousCb = currentCallback
+    }
+
+    setUncaughtExceptionCaptureCallbackStart.subscribe(cb)
+
+    process.setUncaughtExceptionCaptureCallback(null)
+
+    // For some reason, previous callback was defined before the instrumentation
+    // We can not restore it, so we let the app decide
+    if (previousCb) {
+      process.setUncaughtExceptionCaptureCallback(() => {
+        process.setUncaughtExceptionCaptureCallback(null)
+        process.setUncaughtExceptionCaptureCallback(previousCb)
+      })
+    }
+  } else {
+    const cleanUp = removeAllListeners(process, 'uncaughtException')
+    const handler = () => {}
+
+    setTimeout(() => {
+      process.removeListener('uncaughtException', handler)
+      cleanUp()
+    })
+
+    process.once('uncaughtException', handler)
+  }
+}
+
+function blockOnDatadogRaspAbortError ({ error, isTopLevel }) {
+  const abortError = findDatadogRaspAbortError(error)
+  if (!abortError) return false
+
+  const { req, res, blockingAction, raspRule, ruleTriggered } = abortError
+  if (!isBlocked(res)) {
+    const blockFn = isTopLevel ? block : registerBlockDelegation
+    const blocked = blockFn(req, res, web.root(req), null, blockingAction)
+    if (ruleTriggered) {
+      // block() returns a bool, and registerBlockDelegation() returns a promise
+      // we use Promise.resolve() to handle both cases
+      Promise.resolve(blocked).then(blocked => {
+        // TODO: bug: this metric is not called when the raspAbortError is caught by user
+        // or on subsequent blockDelegations
+        updateRaspRuleMatchMetricTags(req, raspRule, true, blocked)
+      })
+    }
+  }
+
+  return true
+}
+
+function enable (config) {
+  ssrf.enable(config)
+  sqli.enable(config)
+  lfi.enable(config)
+  cmdi.enable(config)
+
+  process.on('uncaughtExceptionMonitor', handleUncaughtExceptionMonitor)
+
+  expressMiddlewareError.subscribe(blockOnDatadogRaspAbortError)
+  fastifyMiddlewareError.subscribe(blockOnDatadogRaspAbortError)
+  routerMiddlewareError.subscribe(blockOnDatadogRaspAbortError)
+}
+
+function disable () {
+  ssrf.disable()
+  sqli.disable()
+  lfi.disable()
+  cmdi.disable()
+
+  process.off('uncaughtExceptionMonitor', handleUncaughtExceptionMonitor)
+
+  expressMiddlewareError.unsubscribe(blockOnDatadogRaspAbortError)
+  fastifyMiddlewareError.unsubscribe(blockOnDatadogRaspAbortError)
+  routerMiddlewareError.unsubscribe(blockOnDatadogRaspAbortError)
+}
+
+module.exports = {
+  enable,
+  disable,
+  handleUncaughtExceptionMonitor, // exported only for testing purpose
+  blockOnDatadogRaspAbortError, // exported only for testing purpose
+}

package/packages/dd-trace/src/appsec/rasp/lfi.js

@@ -0,0 +1,129 @@
+'use strict'
+
+const { isAbsolute } = require('path')
+
+const { fsOperationStart, incomingHttpRequestStart, expressResponseRenderStart } = require('../channels')
+const { storage } = require('../../../../datadog-core')
+const { FS_OPERATION_PATH } = require('../addresses')
+const waf = require('../waf')
+const { enable: enableFsPlugin, disable: disableFsPlugin, RASP_MODULE } = require('./fs-plugin')
+const { RULE_TYPES, handleResult } = require('./utils')
+
+let config
+let enabled
+let analyzeSubscribed
+
+function enable (_config) {
+  config = _config
+
+  if (enabled) return
+
+  enabled = true
+
+  incomingHttpRequestStart.subscribe(onFirstReceivedRequest)
+}
+
+function disable () {
+  if (fsOperationStart.hasSubscribers) fsOperationStart.unsubscribe(analyzeLfi)
+  if (incomingHttpRequestStart.hasSubscribers) incomingHttpRequestStart.unsubscribe(onFirstReceivedRequest)
+  if (expressResponseRenderStart.hasSubscribers) expressResponseRenderStart.unsubscribe(analyzeLfiInResponseRender)
+
+  disableFsPlugin(RASP_MODULE)
+
+  enabled = false
+  analyzeSubscribed = false
+}
+
+function onFirstReceivedRequest () {
+  // Node.js unsubscribe during publish bug: https://github.com/nodejs/node/pull/55116
+  process.nextTick(() => {
+    incomingHttpRequestStart.unsubscribe(onFirstReceivedRequest)
+  })
+
+  enableFsPlugin(RASP_MODULE)
+
+  if (!analyzeSubscribed) {
+    fsOperationStart.subscribe(analyzeLfi)
+    expressResponseRenderStart.subscribe(analyzeLfiInResponseRender)
+    analyzeSubscribed = true
+  }
+}
+
+function analyzeLfiInResponseRender (ctx) {
+  const store = storage('legacy').getStore()
+  if (!store) return
+
+  analyzeLfiPath(ctx.view, ctx.req, store.res, ctx.abortController)
+}
+
+function analyzeLfi (ctx) {
+  const store = storage('legacy').getStore()
+  if (!store) return
+
+  const { req, fs, res } = store
+  if (!req || !fs) return
+
+  for (const path of getPaths(ctx, fs)) {
+    analyzeLfiPath(path, req, res, ctx.abortController)
+  }
+}
+
+function analyzeLfiPath (path, req, res, abortController) {
+  const ephemeral = {
+    [FS_OPERATION_PATH]: path,
+  }
+
+  const raspRule = { type: RULE_TYPES.LFI }
+
+  const result = waf.run({ ephemeral }, req, raspRule)
+  handleResult(result, req, res, abortController, config, raspRule)
+}
+
+function getPaths (ctx, fs) {
+  // these properties could have String, Buffer, URL, Integer or FileHandle types
+  const pathArguments = [
+    ctx.dest,
+    ctx.existingPath,
+    ctx.file,
+    ctx.newPath,
+    ctx.oldPath,
+    ctx.path,
+    ctx.prefix,
+    ctx.src,
+    ctx.target,
+  ]
+
+  return pathArguments
+    .map(path => pathToStr(path))
+    .filter(path => shouldAnalyze(path, fs))
+}
+
+function pathToStr (path) {
+  if (!path) return
+
+  if (typeof path === 'string' ||
+      // eslint-disable-next-line unicorn/no-instanceof-builtins
+      path instanceof String ||
+      path instanceof Buffer ||
+      path instanceof URL) {
+    return path.toString()
+  }
+}
+
+function shouldAnalyze (path, fs) {
+  if (!path) return
+
+  const notExcludedRootOp = !fs.opExcluded && fs.root
+  return notExcludedRootOp && (isAbsolute(path) || path.includes('../') || shouldAnalyzeURLFile(path, fs))
+}
+
+function shouldAnalyzeURLFile (path, fs) {
+  if (path.startsWith('file://')) {
+    return shouldAnalyze(path.slice(7), fs)
+  }
+}
+
+module.exports = {
+  enable,
+  disable,
+}

package/packages/dd-trace/src/appsec/rasp/sql_injection.js

@@ -0,0 +1,108 @@
+'use strict'
+
+const {
+  pgQueryStart,
+  pgPoolQueryStart,
+  wafRunFinished,
+  mysql2OuterQueryStart,
+} = require('../channels')
+const { storage } = require('../../../../datadog-core')
+const addresses = require('../addresses')
+const waf = require('../waf')
+const { RULE_TYPES, handleResult } = require('./utils')
+
+const DB_SYSTEM_POSTGRES = 'postgresql'
+const DB_SYSTEM_MYSQL = 'mysql'
+const reqQueryMap = new WeakMap() // WeakMap<Request, Set<querytext>>
+
+let config
+
+function enable (_config) {
+  config = _config
+
+  pgQueryStart.subscribe(analyzePgSqlInjection)
+  pgPoolQueryStart.subscribe(analyzePgSqlInjection)
+  wafRunFinished.subscribe(clearQuerySet)
+
+  mysql2OuterQueryStart.subscribe(analyzeMysql2SqlInjection)
+}
+
+function disable () {
+  if (pgQueryStart.hasSubscribers) pgQueryStart.unsubscribe(analyzePgSqlInjection)
+  if (pgPoolQueryStart.hasSubscribers) pgPoolQueryStart.unsubscribe(analyzePgSqlInjection)
+  if (wafRunFinished.hasSubscribers) wafRunFinished.unsubscribe(clearQuerySet)
+  if (mysql2OuterQueryStart.hasSubscribers) mysql2OuterQueryStart.unsubscribe(analyzeMysql2SqlInjection)
+}
+
+function analyzeMysql2SqlInjection (ctx) {
+  const query = ctx.sql
+  if (!query) return
+
+  analyzeSqlInjection(query, DB_SYSTEM_MYSQL, ctx.abortController)
+}
+
+function analyzePgSqlInjection (ctx) {
+  const query = ctx.query?.text
+  if (!query) return
+
+  analyzeSqlInjection(query, DB_SYSTEM_POSTGRES, ctx.abortController)
+}
+
+function analyzeSqlInjection (query, dbSystem, abortController) {
+  const store = storage('legacy').getStore()
+  if (!store) return
+
+  const { req, res } = store
+
+  if (!req) return
+
+  let executedQueries = reqQueryMap.get(req)
+  if (executedQueries?.has(query)) return
+
+  // Do not waste time checking same query twice
+  // This also will prevent double calls in pg.Pool internal queries
+  if (!executedQueries) {
+    executedQueries = new Set()
+    reqQueryMap.set(req, executedQueries)
+  }
+  executedQueries.add(query)
+
+  const ephemeral = {
+    [addresses.DB_STATEMENT]: query,
+    [addresses.DB_SYSTEM]: dbSystem,
+  }
+
+  const raspRule = { type: RULE_TYPES.SQL_INJECTION }
+
+  const result = waf.run({ ephemeral }, req, raspRule)
+
+  handleResult(result, req, res, abortController, config, raspRule)
+}
+
+function hasInputAddress (payload) {
+  return hasAddressesObjectInputAddress(payload.ephemeral) || hasAddressesObjectInputAddress(payload.persistent)
+}
+
+function hasAddressesObjectInputAddress (addressesObject) {
+  return addressesObject && Object.keys(addressesObject)
+    .some(address => address.startsWith('server.request') || address.startsWith('graphql.server'))
+}
+
+function clearQuerySet ({ payload }) {
+  if (!payload) return
+
+  const store = storage('legacy').getStore()
+  if (!store) return
+
+  const { req } = store
+  if (!req) return
+
+  const executedQueries = reqQueryMap.get(req)
+  if (!executedQueries) return
+
+  if (hasInputAddress(payload)) {
+    executedQueries.clear()
+  }
+}
+
+module.exports = { enable, disable }

package/packages/dd-trace/src/appsec/rasp/ssrf.js

@@ -0,0 +1,102 @@
+'use strict'
+
+const { format } = require('url')
+const {
+  httpClientRequestStart,
+  httpClientResponseFinish,
+} = require('../channels')
+const { storage } = require('../../../../datadog-core')
+const addresses = require('../addresses')
+const waf = require('../waf')
+const downstream = require('../downstream_requests')
+const { updateRaspRuleMatchMetricTags } = require('../telemetry')
+const { RULE_TYPES, handleResult } = require('./utils')
+
+let config
+
+function enable (_config) {
+  config = _config
+  downstream.enable(_config)
+
+  httpClientRequestStart.subscribe(analyzeSsrf)
+  httpClientResponseFinish.subscribe(handleResponseFinish)
+}
+
+function disable () {
+  downstream.disable()
+
+  if (httpClientRequestStart.hasSubscribers) httpClientRequestStart.unsubscribe(analyzeSsrf)
+  if (httpClientResponseFinish.hasSubscribers) httpClientResponseFinish.unsubscribe(handleResponseFinish)
+}
+
+function analyzeSsrf (ctx) {
+  const store = storage('legacy').getStore()
+  const req = store?.req
+  const outgoingUrl = (ctx.args.options?.uri && format(ctx.args.options.uri)) ?? ctx.args.uri
+
+  if (!req || !outgoingUrl) return
+
+  // Determine if we should collect the response body based on sampling rate and redirect URL
+  ctx.shouldCollectBody = downstream.shouldSampleBody(req, outgoingUrl)
+
+  const requestAddresses = downstream.extractRequestData(ctx)
+
+  const ephemeral = {
+    [addresses.HTTP_OUTGOING_URL]: outgoingUrl,
+    ...requestAddresses,
+  }
+
+  const raspRule = { type: RULE_TYPES.SSRF, variant: 'request' }
+
+  const result = waf.run({ ephemeral }, req, raspRule)
+
+  handleResult(result, req, store?.res, ctx.abortController, config, raspRule)
+
+  downstream.incrementDownstreamAnalysisCount(req)
+}
+
+/**
+ * Finalizes body collection for the response and triggers RASP analysis.
+ * @param {{
+ *   ctx: object,
+ *   res: import('http').IncomingMessage,
+ *   body: string|Buffer|null
+ * }} payload event payload from the channel.
+ */
+function handleResponseFinish ({ ctx, res, body }) {
+  // downstream response object
+  if (!res) return
+
+  const store = storage('legacy').getStore()
+  const originatingRequest = store?.req
+  if (!originatingRequest) return
+
+  // Skip body analysis for redirect responses
+  const evaluateBody = ctx.shouldCollectBody && !downstream.handleRedirectResponse(originatingRequest, res)
+  const responseBody = evaluateBody ? body : null
+  runResponseEvaluation(res, originatingRequest, responseBody)
+}
+
+/**
+ * Evaluates the downstream response and records telemetry.
+ * @param {import('http').IncomingMessage} res incoming response from downstream service.
+ * @param {import('http').IncomingMessage} req originating request.
+ * @param {string|Buffer|null} responseBody collected downstream response body.
+ */
+function runResponseEvaluation (res, req, responseBody) {
+  const responseAddresses = downstream.extractResponseData(res, responseBody)
+
+  if (!Object.keys(responseAddresses).length) return
+
+  const raspRule = { type: RULE_TYPES.SSRF, variant: 'response' }
+  const result = waf.run({ ephemeral: responseAddresses }, req, raspRule)
+
+  // TODO: this should be done in the waf functions directly instead of calling it everywhere
+  const ruleTriggered = !!result?.events?.length
+
+  if (ruleTriggered) {
+    updateRaspRuleMatchMetricTags(req, raspRule, false, false)
+  }
+}
+
+module.exports = { enable, disable }

package/packages/dd-trace/src/appsec/rasp/utils.js

@@ -0,0 +1,85 @@
+'use strict'
+
+const web = require('../../plugins/util/web')
+const { getCallsiteFrames, reportStackTrace, canReportStackTrace } = require('../stack_trace')
+const { getBlockingAction } = require('../blocking')
+const log = require('../../log')
+const { updateRaspRuleMatchMetricTags } = require('../telemetry')
+
+const abortOnUncaughtException = process.execArgv?.includes('--abort-on-uncaught-exception')
+
+if (abortOnUncaughtException) {
+  log.warn('[ASM] The --abort-on-uncaught-exception flag is enabled. The RASP module will not block operations.')
+}
+
+const RULE_TYPES = {
+  COMMAND_INJECTION: 'command_injection',
+  LFI: 'lfi',
+  SQL_INJECTION: 'sql_injection',
+  SSRF: 'ssrf',
+}
+
+const ALLOWED_ROOTSPAN_NAMES = new Set([
+  'express.request',
+  'fastify.request',
+])
+
+class DatadogRaspAbortError extends Error {
+  constructor (req, res, blockingAction, raspRule, ruleTriggered) {
+    super('DatadogRaspAbortError')
+    this.name = 'DatadogRaspAbortError'
+    this.req = req
+    this.res = res
+    this.blockingAction = blockingAction
+    this.raspRule = raspRule
+    this.ruleTriggered = ruleTriggered
+
+    // hide these props to not pollute app logs
+    Object.defineProperties(this, {
+      req: { enumerable: false },
+      res: { enumerable: false },
+    })
+  }
+}
+
+function handleResult (result, req, res, abortController, config, raspRule) {
+  const generateStackTraceAction = result?.actions?.generate_stack
+
+  const { enabled, maxDepth, maxStackTraces } = config.appsec.stackTrace
+
+  const rootSpan = web.root(req)
+
+  const ruleTriggered = !!result?.events?.length
+
+  if (generateStackTraceAction && enabled && canReportStackTrace(rootSpan, maxStackTraces)) {
+    const frames = getCallsiteFrames(maxDepth, handleResult)
+
+    reportStackTrace(
+      rootSpan,
+      generateStackTraceAction.stack_id,
+      frames
+    )
+  }
+
+  if (abortController && !abortOnUncaughtException) {
+    const blockingAction = getBlockingAction(result?.actions)
+    const rootSpanName = rootSpan?.context?.()?._name
+
+    if (blockingAction && ALLOWED_ROOTSPAN_NAMES.has(rootSpanName)) {
+      const abortError = new DatadogRaspAbortError(req, res, blockingAction, raspRule, ruleTriggered)
+      abortController.abort(abortError)
+
+      return
+    }
+  }
+
+  if (ruleTriggered) {
+    updateRaspRuleMatchMetricTags(req, raspRule, false, false)
+  }
+}
+
+module.exports = {
+  handleResult,
+  RULE_TYPES,
+  DatadogRaspAbortError,
+}

package/packages/dd-trace/src/appsec/rc-products.js

@@ -0,0 +1,10 @@
+'use strict'
+
+// Remote Config product names used by ASM/WAF.
+const ASM_WAF_PRODUCTS = ['ASM', 'ASM_DD', 'ASM_DATA']
+const ASM_WAF_PRODUCTS_SET = new Set(ASM_WAF_PRODUCTS)
+
+module.exports = {
+  ASM_WAF_PRODUCTS,
+  ASM_WAF_PRODUCTS_SET,
+}