@depup/dd-trace 5.90.0-depup.0

package/packages/dd-trace/src/appsec/stack_trace.js

@@ -0,0 +1,117 @@
+'use strict'
+
+const { ddBasePath } = require('../util')
+const { getOriginalPathAndLineFromSourceMap } = require('./iast/taint-tracking/rewriter')
+
+const LIBRARY_FRAMES_BUFFER = 20
+
+const STACK_TRACE_NAMESPACES = {
+  RASP: 'exploit',
+  IAST: 'vulnerability',
+}
+
+function prepareStackTrace (_, callsites) {
+  return callsites
+}
+
+function getCallSiteList (maxDepth = 100, constructorOpt) {
+  const previousPrepareStackTrace = Error.prepareStackTrace
+  const previousStackTraceLimit = Error.stackTraceLimit
+  // Since some frames will be discarded because they come from tracer codebase, a buffer is added
+  // to the limit in order to get as close as `maxDepth` number of frames.
+  Error.stackTraceLimit = maxDepth + LIBRARY_FRAMES_BUFFER
+
+  try {
+    Error.prepareStackTrace = prepareStackTrace
+    const obj = {}
+    Error.captureStackTrace(obj, constructorOpt)
+    return obj.stack
+  } finally {
+    Error.prepareStackTrace = previousPrepareStackTrace
+    Error.stackTraceLimit = previousStackTraceLimit
+  }
+}
+
+function filterOutFramesFromLibrary (callSiteList) {
+  return callSiteList.filter(callSite => {
+    if (globalThis.__DD_ESBUILD_IAST_WITH_NO_SM) {
+      // bundled and no SourceMap, not possible to discriminate if the frame comes from dd-trace code or not
+      return true
+    }
+
+    if (globalThis.__DD_ESBUILD_IAST_WITH_SM) {
+      // bundled with SourceMap, get original file and line to discriminate if comes from dd-trace or not
+      const callSiteLocation = {
+        path: callSite.getTranslatedFileName?.() ?? callSite.getFileName(),
+        line: callSite.getTranslatedLineNumber?.() ?? callSite.getLineNumber(),
+        column: callSite.getTranslatedColumnNumber?.() ?? callSite.getColumnNumber(),
+      }
+      const { path } = getOriginalPathAndLineFromSourceMap(callSiteLocation)
+      return !path?.startsWith(ddBasePath)
+    }
+
+    return !callSite.getFileName()?.startsWith(ddBasePath)
+  })
+}
+
+function getCallsiteFrames (maxDepth = 32, constructorOpt = getCallsiteFrames, callSiteListGetter = getCallSiteList) {
+  if (maxDepth < 1) maxDepth = Infinity
+
+  const callSiteList = callSiteListGetter(maxDepth, constructorOpt)
+  const filteredFrames = filterOutFramesFromLibrary(callSiteList)
+
+  const half = filteredFrames.length > maxDepth ? Math.round(maxDepth / 2) : Infinity
+
+  const indexedFrames = []
+  for (let i = 0; i < Math.min(filteredFrames.length, maxDepth); i++) {
+    const index = i < half ? i : i + filteredFrames.length - maxDepth
+    const callSite = filteredFrames[index]
+    indexedFrames.push({
+      id: index,
+      file: callSite.getTranslatedFileName?.() ?? callSite.getFileName(),
+      line: callSite.getTranslatedLineNumber?.() ?? callSite.getLineNumber(),
+      column: callSite.getTranslatedColumnNumber?.() ?? callSite.getColumnNumber(),
+      function: callSite.getFunctionName(),
+      class_name: callSite.getTypeName(),
+      isNative: callSite.isNative(),
+    })
+  }
+
+  return indexedFrames
+}
+
+function reportStackTrace (rootSpan, stackId, frames, namespace = STACK_TRACE_NAMESPACES.RASP) {
+  if (!rootSpan) return
+  if (!Array.isArray(frames)) return
+
+  if (!rootSpan.meta_struct) {
+    rootSpan.meta_struct = {}
+  }
+
+  if (!rootSpan.meta_struct['_dd.stack']) {
+    rootSpan.meta_struct['_dd.stack'] = {}
+  }
+
+  if (!rootSpan.meta_struct['_dd.stack'][namespace]) {
+    rootSpan.meta_struct['_dd.stack'][namespace] = []
+  }
+
+  rootSpan.meta_struct['_dd.stack'][namespace].push({
+    id: stackId,
+    language: 'nodejs',
+    frames,
+  })
+}
+
+function canReportStackTrace (rootSpan, maxStackTraces, namespace = STACK_TRACE_NAMESPACES.RASP) {
+  if (!rootSpan) return false
+
+  return maxStackTraces < 1 || (rootSpan.meta_struct?.['_dd.stack']?.[namespace]?.length ?? 0) < maxStackTraces
+}
+
+module.exports = {
+  getCallsiteFrames,
+  reportStackTrace,
+  canReportStackTrace,
+  STACK_TRACE_NAMESPACES,
+}

package/packages/dd-trace/src/appsec/telemetry/common.js

@@ -0,0 +1,28 @@
+'use strict'
+
+const DD_TELEMETRY_REQUEST_METRICS = Symbol('_dd.appsec.telemetry.request.metrics')
+
+const tags = {
+  BLOCK_FAILURE: 'block_failure',
+  EVENT_RULES_VERSION: 'event_rules_version',
+  INPUT_TRUNCATED: 'input_truncated',
+  RATE_LIMITED: 'rate_limited',
+  REQUEST_BLOCKED: 'request_blocked',
+  RULE_TRIGGERED: 'rule_triggered',
+  WAF_ERROR: 'waf_error',
+  WAF_TIMEOUT: 'waf_timeout',
+  WAF_VERSION: 'waf_version',
+}
+
+function getVersionsTags (wafVersion, rulesVersion) {
+  return {
+    [tags.WAF_VERSION]: wafVersion,
+    [tags.EVENT_RULES_VERSION]: rulesVersion || 'unknown',
+  }
+}
+
+module.exports = {
+  tags,
+  getVersionsTags,
+  DD_TELEMETRY_REQUEST_METRICS,
+}

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -0,0 +1,184 @@
+'use strict'
+
+const { DD_TELEMETRY_REQUEST_METRICS } = require('./common')
+const { incrementMissingUserId, incrementMissingUserLogin, incrementSdkEvent } = require('./user')
+const {
+  addRaspRequestMetrics,
+  trackRaspMetrics,
+  trackRaspRuleMatch,
+  trackRaspRuleSkipped,
+} = require('./rasp')
+const {
+  addWafRequestMetrics,
+  trackWafMetrics,
+  incrementWafInit,
+  incrementWafUpdates,
+  incrementWafConfigErrors,
+  incrementWafRequests,
+} = require('./waf')
+
+const metricsStoreMap = new WeakMap()
+
+let enabled = false
+
+function enable (config) {
+  enabled = config.telemetry?.enabled && config.telemetry?.metrics
+}
+
+function disable () {
+  enabled = false
+}
+
+function newStore () {
+  return {
+    [DD_TELEMETRY_REQUEST_METRICS]: {
+      duration: 0,
+      durationExt: 0,
+      raspDuration: 0,
+      raspDurationExt: 0,
+      raspEvalCount: 0,
+      wafTimeouts: 0,
+      raspTimeouts: 0,
+      wafErrorCode: null,
+      raspErrorCode: null,
+      wafVersion: null,
+      rulesVersion: null,
+    },
+  }
+}
+
+function getStore (req) {
+  let store = metricsStoreMap.get(req)
+  if (!store) {
+    store = newStore()
+    metricsStoreMap.set(req, store)
+  }
+  return store
+}
+
+function updateRaspRequestsMetricTags (metrics, req, raspRule) {
+  if (!req) return
+
+  const store = getStore(req)
+
+  // it does not depend on whether telemetry is enabled or not
+  addRaspRequestMetrics(store, metrics)
+
+  if (!enabled) return
+
+  trackRaspMetrics(store, metrics, raspRule)
+}
+
+function updateRaspRuleMatchMetricTags (req, raspRule, blockTriggered, blocked) {
+  if (!enabled || !req) return
+
+  const store = getStore(req)
+
+  trackRaspRuleMatch(store, raspRule, blockTriggered, blocked)
+}
+
+function updateRaspRuleSkippedMetricTags (raspRule, reason) {
+  if (!enabled) return
+
+  trackRaspRuleSkipped(raspRule, reason)
+}
+
+function updateWafRequestsMetricTags (metrics, req) {
+  if (!req) return
+
+  const store = getStore(req)
+
+  // it does not depend on whether telemetry is enabled or not
+  addWafRequestMetrics(store, metrics)
+
+  if (!enabled) return
+
+  return trackWafMetrics(store, metrics)
+}
+
+function updateRateLimitedMetric (req) {
+  if (!enabled) return
+
+  const store = getStore(req)
+  trackWafMetrics(store, { rateLimited: true })
+}
+
+function updateBlockFailureMetric (req) {
+  if (!enabled) return
+
+  const store = getStore(req)
+  trackWafMetrics(store, { blockFailed: true })
+}
+
+function incrementWafInitMetric (wafVersion, rulesVersion, success) {
+  if (!enabled) return
+
+  incrementWafInit(wafVersion, rulesVersion, success)
+}
+
+function incrementWafUpdatesMetric (wafVersion, rulesVersion, success) {
+  if (!enabled) return
+
+  incrementWafUpdates(wafVersion, rulesVersion, success)
+}
+
+function incrementWafConfigErrorsMetric (wafVersion, rulesVersion) {
+  if (!enabled) return
+
+  incrementWafConfigErrors(wafVersion, rulesVersion)
+}
+
+function incrementWafRequestsMetric (req) {
+  if (!req || !enabled) return
+
+  const store = getStore(req)
+  incrementWafRequests(store)
+
+  metricsStoreMap.delete(req)
+}
+
+function incrementMissingUserLoginMetric (framework, eventType) {
+  if (!enabled) return
+
+  incrementMissingUserLogin(framework, eventType)
+}
+
+function incrementMissingUserIdMetric (framework, eventType) {
+  if (!enabled) return
+
+  incrementMissingUserId(framework, eventType)
+}
+
+function incrementSdkEventMetric (eventType, sdkVersion) {
+  if (!enabled) return
+
+  incrementSdkEvent(eventType, sdkVersion)
+}
+
+function getRequestMetrics (req) {
+  if (req) {
+    const store = getStore(req)
+    return store?.[DD_TELEMETRY_REQUEST_METRICS]
+  }
+}
+
+module.exports = {
+  enable,
+  disable,
+
+  updateWafRequestsMetricTags,
+  updateRateLimitedMetric,
+  updateBlockFailureMetric,
+  updateRaspRequestsMetricTags,
+  updateRaspRuleMatchMetricTags,
+  updateRaspRuleSkippedMetricTags,
+  incrementWafInitMetric,
+  incrementWafUpdatesMetric,
+  incrementWafConfigErrorsMetric,
+  incrementWafRequestsMetric,
+  incrementMissingUserLoginMetric,
+  incrementMissingUserIdMetric,
+  incrementSdkEventMetric,
+
+  getRequestMetrics,
+}

package/packages/dd-trace/src/appsec/telemetry/rasp.js

@@ -0,0 +1,103 @@
+'use strict'
+
+const telemetryMetrics = require('../../telemetry/metrics')
+const { DD_TELEMETRY_REQUEST_METRICS, getVersionsTags } = require('./common')
+
+const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+
+const BLOCKING_STATUS = {
+  FAILURE: 'failure',
+  IRRELEVANT: 'irrelevant',
+  SUCCESS: 'success',
+}
+
+function addRaspRequestMetrics (store, { duration, durationExt, wafTimeout, errorCode }) {
+  store[DD_TELEMETRY_REQUEST_METRICS].raspDuration += duration || 0
+  store[DD_TELEMETRY_REQUEST_METRICS].raspDurationExt += durationExt || 0
+  store[DD_TELEMETRY_REQUEST_METRICS].raspEvalCount++
+
+  if (wafTimeout) {
+    store[DD_TELEMETRY_REQUEST_METRICS].raspTimeouts++
+  }
+
+  if (errorCode) {
+    store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode = store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode
+      ? Math.max(
+        errorCode,
+        store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode
+      )
+      : errorCode
+  }
+}
+
+function trackRaspMetrics (store, metrics, raspRule) {
+  const versionsTags = getVersionsTags(metrics.wafVersion, metrics.rulesVersion)
+  const tags = { rule_type: raspRule.type, ...versionsTags }
+  const telemetryMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
+
+  if (raspRule.variant) {
+    tags.rule_variant = raspRule.variant
+  }
+
+  if (metrics.wafVersion) {
+    telemetryMetrics.wafVersion = metrics.wafVersion
+  }
+
+  if (metrics.rulesVersion) {
+    telemetryMetrics.rulesVersion = metrics.rulesVersion
+  }
+
+  appsecMetrics.count('rasp.rule.eval', tags).inc(1)
+
+  if (metrics.errorCode) {
+    const errorTags = { ...tags, waf_error: metrics.errorCode }
+
+    appsecMetrics.count('rasp.error', errorTags).inc(1)
+  }
+
+  if (metrics.wafTimeout) {
+    appsecMetrics.count('rasp.timeout', tags).inc(1)
+  }
+}
+
+function trackRaspRuleMatch (store, raspRule, blockTriggered, blocked) {
+  const telemetryMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
+
+  const tags = {
+    waf_version: telemetryMetrics.wafVersion,
+    event_rules_version: telemetryMetrics.rulesVersion,
+    rule_type: raspRule.type,
+    block: getRuleMatchBlockingStatus(blockTriggered, blocked),
+  }
+
+  if (raspRule.variant) {
+    tags.rule_variant = raspRule.variant
+  }
+
+  appsecMetrics.count('rasp.rule.match', tags).inc(1)
+}
+
+function trackRaspRuleSkipped (raspRule, reason) {
+  const tags = { reason, rule_type: raspRule.type }
+
+  if (raspRule.variant) {
+    tags.rule_variant = raspRule.variant
+  }
+
+  appsecMetrics.count('rasp.rule.skipped', tags).inc(1)
+}
+
+function getRuleMatchBlockingStatus (blockTriggered, blocked) {
+  if (!blockTriggered) {
+    return BLOCKING_STATUS.IRRELEVANT
+  }
+
+  return blocked ? BLOCKING_STATUS.SUCCESS : BLOCKING_STATUS.FAILURE
+}
+
+module.exports = {
+  addRaspRequestMetrics,
+  trackRaspMetrics,
+  trackRaspRuleMatch,
+  trackRaspRuleSkipped,
+}

package/packages/dd-trace/src/appsec/telemetry/user.js

@@ -0,0 +1,32 @@
+'use strict'
+
+const telemetryMetrics = require('../../telemetry/metrics')
+
+const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+
+function incrementMissingUserLogin (framework, eventType) {
+  appsecMetrics.count('instrum.user_auth.missing_user_login', {
+    framework,
+    event_type: eventType,
+  }).inc()
+}
+
+function incrementMissingUserId (framework, eventType) {
+  appsecMetrics.count('instrum.user_auth.missing_user_id', {
+    framework,
+    event_type: eventType,
+  }).inc()
+}
+
+function incrementSdkEvent (eventType, sdkVersion = 'v1') {
+  appsecMetrics.count('sdk.event', {
+    event_type: eventType,
+    sdk_version: sdkVersion,
+  }).inc()
+}
+
+module.exports = {
+  incrementMissingUserLogin,
+  incrementMissingUserId,
+  incrementSdkEvent,
+}

package/packages/dd-trace/src/appsec/telemetry/waf.js

@@ -0,0 +1,143 @@
+'use strict'
+
+const telemetryMetrics = require('../../telemetry/metrics')
+const { tags, getVersionsTags, DD_TELEMETRY_REQUEST_METRICS } = require('./common')
+
+const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+
+const DD_TELEMETRY_WAF_RESULT_TAGS = Symbol('_dd.appsec.telemetry.waf.result.tags')
+
+const TRUNCATION_FLAGS = {
+  STRING: 1,
+  CONTAINER_SIZE: 2,
+  CONTAINER_DEPTH: 4,
+}
+
+function addWafRequestMetrics (store, { duration, durationExt, wafTimeout, errorCode }) {
+  store[DD_TELEMETRY_REQUEST_METRICS].duration += duration || 0
+  store[DD_TELEMETRY_REQUEST_METRICS].durationExt += durationExt || 0
+
+  if (wafTimeout) {
+    store[DD_TELEMETRY_REQUEST_METRICS].wafTimeouts++
+  }
+
+  if (errorCode) {
+    store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode = store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode
+      ? Math.max(
+        errorCode,
+        store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode
+      )
+      : errorCode
+  }
+}
+
+function trackWafMetrics (store, metrics) {
+  const versionsTags = getVersionsTags(metrics.wafVersion, metrics.rulesVersion)
+
+  const metricTags = getOrCreateMetricTags(store, versionsTags)
+
+  if (metrics.blockFailed) {
+    metricTags[tags.BLOCK_FAILURE] = true
+  }
+
+  if (metrics.blockTriggered) {
+    metricTags[tags.REQUEST_BLOCKED] = true
+  }
+
+  if (metrics.rateLimited) {
+    metricTags[tags.RATE_LIMITED] = true
+  }
+
+  if (metrics.ruleTriggered) {
+    metricTags[tags.RULE_TRIGGERED] = true
+  }
+
+  if (metrics.errorCode) {
+    metricTags[tags.WAF_ERROR] = true
+    appsecMetrics.count('waf.error', { ...versionsTags, waf_error: metrics.errorCode }).inc()
+  }
+
+  if (metrics.wafTimeout) {
+    metricTags[tags.WAF_TIMEOUT] = true
+  }
+
+  const truncationReason = getTruncationReason(metrics)
+  if (truncationReason > 0) {
+    metricTags[tags.INPUT_TRUNCATED] = true
+    incrementTruncatedMetrics(metrics, truncationReason)
+  }
+
+  return metricTags
+}
+
+function getOrCreateMetricTags (store, versionsTags) {
+  let metricTags = store[DD_TELEMETRY_WAF_RESULT_TAGS]
+
+  if (!metricTags) {
+    metricTags = {
+      [tags.BLOCK_FAILURE]: false,
+      [tags.INPUT_TRUNCATED]: false,
+      [tags.RATE_LIMITED]: false,
+      [tags.REQUEST_BLOCKED]: false,
+      [tags.RULE_TRIGGERED]: false,
+      [tags.WAF_ERROR]: false,
+      [tags.WAF_TIMEOUT]: false,
+
+      ...versionsTags,
+    }
+    store[DD_TELEMETRY_WAF_RESULT_TAGS] = metricTags
+  }
+
+  return metricTags
+}
+
+function incrementWafInit (wafVersion, rulesVersion, success) {
+  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
+  appsecMetrics.count('waf.init', { ...versionsTags, success }).inc()
+
+  if (!success) {
+    appsecMetrics.count('waf.config_errors', { ...versionsTags, action: 'init' }).inc()
+  }
+}
+
+function incrementWafUpdates (wafVersion, rulesVersion, success) {
+  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
+  appsecMetrics.count('waf.updates', { ...versionsTags, success }).inc()
+}
+
+function incrementWafConfigErrors (wafVersion, rulesVersion) {
+  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
+  appsecMetrics.count('waf.config_errors', { ...versionsTags, action: 'update' }).inc()
+}
+
+function incrementWafRequests (store) {
+  const metricTags = store[DD_TELEMETRY_WAF_RESULT_TAGS]
+
+  if (metricTags) {
+    appsecMetrics.count('waf.requests', metricTags).inc()
+  }
+}
+
+function incrementTruncatedMetrics (metrics, truncationReason) {
+  const truncationTags = { truncation_reason: truncationReason }
+  appsecMetrics.count('waf.input_truncated', truncationTags).inc(1)
+}
+
+function getTruncationReason ({ maxTruncatedString, maxTruncatedContainerSize, maxTruncatedContainerDepth }) {
+  let reason = 0
+
+  if (maxTruncatedString) reason |= TRUNCATION_FLAGS.STRING
+  if (maxTruncatedContainerSize) reason |= TRUNCATION_FLAGS.CONTAINER_SIZE
+  if (maxTruncatedContainerDepth) reason |= TRUNCATION_FLAGS.CONTAINER_DEPTH
+
+  return reason
+}
+
+module.exports = {
+  addWafRequestMetrics,
+  trackWafMetrics,
+  incrementWafInit,
+  incrementWafUpdates,
+  incrementWafConfigErrors,
+  incrementWafRequests,
+}