dd-trace 2.4.2 → 2.7.0

package/packages/datadog-plugin-paperplane/src/index.js

@@ -1,111 +1,25 @@
 'use strict'
 
-const web = require('../../dd-trace/src/plugins/util/web')
+const Plugin = require('../../dd-trace/src/plugins/plugin')
+const PaperplaneLoggerPlugin = require('./logger')
+const PaperplaneServerPlugin = require('./server')
 
-const traceRoute = handler => req => {
-  const { original, route } = req
-
-  if (web.active(original)) {
-    web.enterRoute(original, route)
+class PaperplanePlugin extends Plugin {
+  static get name () {
+    return 'paperplane'
   }
 
-  return handler(req)
-}
-
-const wrapLogger = tracer => logger => record => {
-  const span = tracer.scope().active()
+  constructor (...args) {
+    super(...args)
 
-  if (!span) return logger(record)
-
-  const correlation = {
-    dd: {
-      trace_id: span.context().toTraceId(),
-      span_id: span.context().toSpanId()
-    }
+    this.server = new PaperplaneServerPlugin(...args)
+    this.logger = new PaperplaneLoggerPlugin(...args)
   }
 
-  record = record instanceof Error
-    ? Object.assign(record, correlation)
-    : Object.assign({}, record, correlation)
-
-  return logger(record)
-}
-
-const wrapMount = (tracer, config) => mount => opts => {
-  const handler = mount(opts)
-
-  const traced = (req, res) =>
-    web.instrument(
-      tracer, config, req, res, 'paperplane.request',
-      () => handler(req, res)
-    )
-
-  return traced
-}
-
-const wrapRoutes = tracer => routes => handlers => {
-  const traced = {}
-
-  for (const route in handlers) {
-    traced[route] = traceRoute(handlers[route])
+  configure (config) {
+    this.server.configure(config)
+    this.logger.configure(config)
   }
-
-  return routes(traced)
 }
 
-const nodeMajor = Number(process.versions.node.split('.')[0])
-const mainVersionRange = nodeMajor <= 12 ? ['>=2.3.2'] : nodeMajor <= 14 ? ['>=3.1.1'] : []
-
-module.exports = [
-  {
-    name: 'paperplane',
-    versions: mainVersionRange,
-    file: 'lib/logger.js',
-    patch (exports, tracer) {
-      if (tracer._logInjection) {
-        this.wrap(exports, 'logger', wrapLogger(tracer))
-      }
-    },
-    unpatch (exports) {
-      this.unwrap(exports, 'logger')
-    }
-  },
-  {
-    name: 'paperplane',
-    versions: mainVersionRange,
-    file: 'lib/mount.js',
-    patch (exports, tracer, config) {
-      config = web.normalizeConfig(config)
-      this.wrap(exports, 'mount', wrapMount(tracer, config))
-    },
-    unpatch (exports) {
-      this.unwrap(exports, 'mount')
-    }
-  },
-  {
-    name: 'paperplane',
-    versions: mainVersionRange,
-    file: 'lib/routes.js',
-    patch (exports, tracer) {
-      this.wrap(exports, 'routes', wrapRoutes(tracer))
-    },
-    unpatch (exports) {
-      this.unwrap(exports, 'routes')
-    }
-  }
-]
-
-if (nodeMajor <= 12) {
-  module.exports.push({
-    name: 'paperplane',
-    versions: ['2.3.0 - 2.3.1'],
-    patch (paperplane, tracer, config) {
-      config = web.normalizeConfig(config)
-      this.wrap(paperplane, 'mount', wrapMount(tracer, config))
-      this.wrap(paperplane, 'routes', wrapRoutes(tracer))
-    },
-    unpatch (paperplane) {
-      this.unwrap(paperplane, ['mount', 'routes'])
-    }
-  })
-}
+module.exports = PaperplanePlugin

package/packages/datadog-plugin-paperplane/src/logger.js

@@ -0,0 +1,11 @@
+'use strict'
+
+const LogPlugin = require('../../dd-trace/src/plugins/log_plugin')
+
+class PaperplaneLoggerPlugin extends LogPlugin {
+  static get name () {
+    return 'paperplane'
+  }
+}
+
+module.exports = PaperplaneLoggerPlugin

package/packages/datadog-plugin-paperplane/src/server.js

@@ -0,0 +1,24 @@
+'use strict'
+
+const RouterPlugin = require('../../datadog-plugin-router/src')
+const web = require('../../dd-trace/src/plugins/util/web')
+
+class PaperplaneServerPlugin extends RouterPlugin {
+  static get name () {
+    return 'paperplane'
+  }
+
+  constructor (...args) {
+    super(...args)
+
+    this.addSub('apm:paperplane:request:handle', req => {
+      this.setFramework(req, 'paperplane', this.config)
+    })
+
+    this.addSub('apm:paperplane:request:route', ({ req, route }) => {
+      web.setRoute(req, route)
+    })
+  }
+}
+
+module.exports = PaperplaneServerPlugin

package/packages/datadog-plugin-restify/src/index.js

@@ -1,86 +1,24 @@
 'use strict'
 
+const RouterPlugin = require('../../datadog-plugin-router/src')
 const web = require('../../dd-trace/src/plugins/util/web')
-const handlers = ['use', 'pre']
-const methods = ['del', 'get', 'head', 'opts', 'post', 'put', 'patch']
 
-function createWrapSetupRequest (tracer, config, withRoute) {
-  config = web.normalizeConfig(config)
-
-  return function wrapSetupRequest (setupRequest) {
-    return function setupRequestWithTrace (req, res) {
-      return web.instrument(tracer, config, req, res, 'restify.request', () => {
-        web.beforeEnd(req, () => {
-          if (req.route && withRoute) {
-            web.enterRoute(req, req.route.path)
-          }
-        })
-
-        return setupRequest.apply(this, arguments)
-      })
-    }
-  }
-}
-
-function createWrapMethod (tracer, config) {
-  return function wrapMethod (method) {
-    return function methodWithTrace (path) {
-      const middleware = wrapMiddleware(Array.prototype.slice.call(arguments, 1))
-
-      return method.apply(this, [path].concat(middleware))
-    }
+class RestifyPlugin extends RouterPlugin {
+  static get name () {
+    return 'restify'
   }
-}
-
-function createWrapHandler (tracer, config) {
-  return function wrapMethod (method) {
-    return function methodWithTrace () {
-      return method.apply(this, wrapMiddleware(arguments))
-    }
-  }
-}
 
-function wrapMiddleware (middleware) {
-  return Array.prototype.map.call(middleware, wrapFn)
-}
+  constructor (...args) {
+    super(...args)
 
-function wrapFn (fn) {
-  if (Array.isArray(fn)) return wrapMiddleware(fn)
+    this.addSub('apm:restify:request:handle', ({ req }) => {
+      this.setFramework(req, 'restify', this.config)
+    })
 
-  return function (req, res, next) {
-    return web.reactivate(req, () => fn.apply(this, arguments))
+    this.addSub('apm:restify:request:route', ({ req, route }) => {
+      web.setRoute(req, route)
+    })
   }
 }
 
-module.exports = [
-  {
-    name: 'restify',
-    versions: ['>=7'],
-    file: 'lib/server.js',
-    patch (Server, tracer, config) {
-      this.wrap(Server.prototype, '_setupRequest', createWrapSetupRequest(tracer, config))
-      this.wrap(Server.prototype, handlers, createWrapHandler(tracer, config))
-      this.wrap(Server.prototype, methods, createWrapMethod(tracer, config))
-    },
-    unpatch (Server) {
-      this.unwrap(Server.prototype, '_setupRequest')
-      this.unwrap(Server.prototype, handlers)
-      this.unwrap(Server.prototype, methods)
-    }
-  },
-  {
-    name: 'restify',
-    versions: ['3 - 6'],
-    file: 'lib/server.js',
-    patch (Server, tracer, config) {
-      this.wrap(Server.prototype, '_setupRequest', createWrapSetupRequest(tracer, config, true))
-      this.wrap(Server.prototype, handlers, createWrapHandler(tracer, config))
-      this.wrap(Server.prototype, methods, createWrapMethod(tracer, config))
-    },
-    unpatch (Server) {
-      this.unwrap(Server.prototype, '_setupRequest')
-      this.unwrap(Server.prototype, handlers)
-      this.unwrap(Server.prototype, methods)
-    }
-  }
-]
+module.exports = RestifyPlugin

package/packages/datadog-plugin-router/src/index.js

@@ -1,204 +1,107 @@
 'use strict'
 
-const METHODS = require('methods').concat('all')
-const pathToRegExp = require('path-to-regexp')
-const shimmer = require('../../datadog-shimmer')
 const web = require('../../dd-trace/src/plugins/util/web')
+const WebPlugin = require('../../datadog-plugin-web/src')
+const analyticsSampler = require('../../dd-trace/src/analytics_sampler')
+const { storage } = require('../../datadog-core')
 
-// TODO: stop checking for fast star and fast slash
-
-const contexts = new WeakMap()
-const layerMatchers = new WeakMap()
-const regexpCache = Object.create(null)
-
-function createWrapHandle (tracer, config) {
-  return function wrapHandle (handle) {
-    return function handleWithTrace (req, res, done) {
-      web.patch(req)
-
-      if (!contexts.has(req)) {
-        const context = {
-          route: '',
-          stack: []
-        }
-
-        web.beforeEnd(req, () => {
-          web.enterRoute(req, context.route)
-        })
-
-        contexts.set(req, context)
-      }
-
-      return handle.apply(this, arguments)
-    }
+class RouterPlugin extends WebPlugin {
+  static get name () {
+    return 'router'
   }
-}
 
-function wrapRouterMethod (original) {
-  return function methodWithTrace (fn) {
-    const offset = this.stack ? [].concat(this.stack).length : 0
-    const router = original.apply(this, arguments)
+  constructor (...args) {
+    super(...args)
 
-    if (typeof this.stack === 'function') {
-      this.stack = [{ handle: this.stack }]
-    }
+    this._contexts = new WeakMap()
 
-    wrapStack(this.stack, offset, extractMatchers(fn))
-
-    return router
-  }
-}
+    this.addSub(`apm:${this.constructor.name}:middleware:enter`, ({ req, name, route }) => {
+      const store = storage.getStore()
+      const context = this._createContext(req, route)
+      const span = this._getMiddlewareSpan(context, store, name)
 
-function wrapLayerHandle (layer, handle) {
-  handle._name = handle._name || layer.name
+      this.enter(span, store)
 
-  let wrapCallHandle
-
-  if (handle.length === 4) {
-    wrapCallHandle = shimmer.wrap(handle, function (error, req, res, next) {
-      return callHandle(layer, handle, req, [error, req, res, wrapNext(layer, req, next)])
-    })
-  } else {
-    wrapCallHandle = shimmer.wrap(handle, function (req, res, next) {
-      return callHandle(layer, handle, req, [req, res, wrapNext(layer, req, next)])
+      web.patch(req)
+      web.setRoute(req, context.route)
     })
-  }
 
-  // This is a workaround for the `loopback` library so that it can find the correct express layer
-  // that contains the real handle function
-  wrapCallHandle._datadog_orig = handle
+    this.addSub(`apm:${this.constructor.name}:middleware:exit`, ({ req }) => {
+      const context = this._contexts.get(req)
 
-  return wrapCallHandle
-}
+      if (!context) return
 
-function wrapStack (stack, offset, matchers) {
-  [].concat(stack).slice(offset).forEach(layer => {
-    if (layer.__handle) { // express-async-errors
-      layer.__handle = wrapLayerHandle(layer, layer.__handle)
-    } else {
-      layer.handle = wrapLayerHandle(layer, layer.handle)
-    }
-
-    layerMatchers.set(layer, matchers)
-
-    if (layer.route) {
-      METHODS.forEach(method => {
-        if (typeof layer.route.stack === 'function') {
-          layer.route.stack = [{ handle: layer.route.stack }]
-        }
+      context.stack.pop()
 
-        layer.route[method] = wrapRouterMethod(layer.route[method])
-      })
-    }
-  })
-}
+      if (context.middleware.length > 0) {
+        context.middleware.pop().finish()
+      }
+    })
 
-function wrapNext (layer, req, next) {
-  if (!next || !web.active(req)) return next
+    this.addSub(`apm:${this.constructor.name}:middleware:error`, this.addError)
 
-  const originalNext = next
-  const context = contexts.get(req)
-  const matchers = layerMatchers.get(layer)
+    this.addSub(`apm:http:server:request:finish`, ({ req }) => {
+      const context = this._contexts.get(req)
 
-  return function (error) {
-    if (layer.path && !isFastStar(layer, matchers) && !isFastSlash(layer, matchers)) {
-      context.stack.pop()
-    }
+      if (!context) return
 
-    web.finish(req, error)
+      let span
 
-    originalNext.apply(null, arguments)
+      while ((span = context.middleware.pop())) {
+        span.finish()
+      }
+    })
   }
-}
-
-function callHandle (layer, handle, req, args) {
-  const matchers = layerMatchers.get(layer)
 
-  if (web.active(req) && matchers) {
-    // Try to guess which path actually matched
-    for (let i = 0; i < matchers.length; i++) {
-      if (matchers[i].test(layer)) {
-        const context = contexts.get(req)
+  _getMiddlewareSpan (context, store, name) {
+    const childOf = store && store.span
 
-        context.stack.push(matchers[i].path)
-
-        const route = context.stack.join('')
-
-        // Longer route is more likely to be the actual route handler route.
-        if (route.length > context.route.length) {
-          context.route = route
-        }
+    if (this.config.middleware === false) {
+      return childOf
+    }
 
-        break
+    const span = this.tracer.startSpan(`${this.constructor.name}.middleware`, {
+      childOf,
+      tags: {
+        'resource.name': name || '<anonymous>'
       }
-    }
-  }
+    })
 
-  return web.wrapMiddleware(req, handle, 'express.middleware', () => {
-    return handle.apply(layer, args)
-  })
-}
+    context.middleware.push(span)
 
-function extractMatchers (fn) {
-  const arg = flatten([].concat(fn))
+    analyticsSampler.sample(span, this.config.measured)
 
-  if (typeof arg[0] === 'function') {
-    return []
+    return span
   }
 
-  return arg.map(pattern => ({
-    path: pattern instanceof RegExp ? `(${pattern})` : pattern,
-    test: layer => {
-      const matchers = layerMatchers.get(layer)
+  _createContext (req, route) {
+    let context = this._contexts.get(req)
 
-      return !isFastStar(layer, matchers) &&
-        !isFastSlash(layer, matchers) &&
-        cachedPathToRegExp(pattern).test(layer.path)
+    if (!route || route === '/' || route === '*') {
+      route = ''
     }
-  }))
-}
 
-function isFastStar (layer, matchers) {
-  if (layer.regexp.fast_star !== undefined) {
-    return layer.regexp.fast_star
-  }
+    if (context) {
+      context.stack.push(route)
 
-  return matchers.some(matcher => matcher.path === '*')
-}
+      route = context.stack.join('')
 
-function isFastSlash (layer, matchers) {
-  if (layer.regexp.fast_slash !== undefined) {
-    return layer.regexp.fast_slash
-  }
-
-  return matchers.some(matcher => matcher.path === '/')
-}
+      // Longer route is more likely to be the actual route handler route.
+      if (route.length > context.route.length) {
+        context.route = route
+      }
+    } else {
+      context = {
+        stack: [route],
+        route,
+        middleware: []
+      }
 
-function flatten (arr) {
-  return arr.reduce((acc, val) => Array.isArray(val) ? acc.concat(flatten(val)) : acc.concat(val), [])
-}
+      this._contexts.set(req, context)
+    }
 
-function cachedPathToRegExp (pattern) {
-  const maybeCached = regexpCache[pattern]
-  if (maybeCached) {
-    return maybeCached
+    return context
   }
-  const regexp = pathToRegExp(pattern)
-  regexpCache[pattern] = regexp
-  return regexp
 }
 
-module.exports = {
-  name: 'router',
-  versions: ['>=1'],
-  patch (Router, tracer, config) {
-    this.wrap(Router.prototype, 'handle', createWrapHandle(tracer, config))
-    this.wrap(Router.prototype, 'use', wrapRouterMethod)
-    this.wrap(Router.prototype, 'route', wrapRouterMethod)
-  },
-  unpatch (Router) {
-    this.unwrap(Router.prototype, 'handle')
-    this.unwrap(Router.prototype, 'use')
-    this.unwrap(Router.prototype, 'route')
-  }
-}
+module.exports = RouterPlugin

package/packages/datadog-plugin-web/src/index.js

@@ -0,0 +1,20 @@
+'use strict'
+
+const Plugin = require('../../dd-trace/src/plugins/plugin')
+const web = require('../../dd-trace/src/plugins/util/web')
+
+class WebPlugin extends Plugin {
+  static get name () {
+    return 'web'
+  }
+
+  configure (config) {
+    return super.configure(web.normalizeConfig(config))
+  }
+
+  setFramework (req, name, config) {
+    web.setFramework(req, name, config)
+  }
+}
+
+module.exports = WebPlugin

package/packages/dd-trace/lib/version.js

@@ -1 +1 @@
-module.exports = '2.4.2'
+module.exports = '2.7.0'

package/packages/dd-trace/src/appsec/callbacks/ddwaf.js

@@ -7,16 +7,14 @@ const Reporter = require('../reporter')
 
 const validAddressSet = new Set(Object.values(addresses))
 
-const DEFAULT_MAX_BUDGET = 5e3 // µs
-
 // TODO: put reusable code in a base class
 class WAFCallback {
-  static loadDDWAF (rules) {
+  static loadDDWAF (rules, config) {
     try {
       // require in `try/catch` because this can throw at require time
       const { DDWAF } = require('@datadog/native-appsec')
 
-      return new DDWAF(rules)
+      return new DDWAF(rules, config)
     } catch (err) {
       log.error('AppSec could not load native package. In-app WAF features will not be available.')
 
@@ -24,8 +22,24 @@ class WAFCallback {
     }
   }
 
-  constructor (rules) {
-    this.ddwaf = WAFCallback.loadDDWAF(rules)
+  constructor (rules, config) {
+    const { wafTimeout, obfuscatorKeyRegex, obfuscatorValueRegex } = config
+
+    this.ddwaf = WAFCallback.loadDDWAF(rules, { obfuscatorKeyRegex, obfuscatorValueRegex })
+
+    this.wafTimeout = wafTimeout
+
+    const version = this.ddwaf.constructor.version()
+
+    Reporter.metricsQueue.set('_dd.appsec.waf.version', `${version.major}.${version.minor}.${version.patch}`)
+
+    const { loaded, failed } = this.ddwaf.rulesInfo
+
+    Reporter.metricsQueue.set('_dd.appsec.event_rules.loaded', loaded)
+    Reporter.metricsQueue.set('_dd.appsec.event_rules.error_count', failed)
+
+    Reporter.metricsQueue.set('manual.keep', true)
+
     this.wafContextCache = new WeakMap()
 
     // closures are faster than binds
@@ -70,7 +84,7 @@ class WAFCallback {
       }
     }
 
-    if (!wafContext) {
+    if (!wafContext || wafContext.disposed) {
       wafContext = this.ddwaf.createContext()
     }
 
@@ -81,23 +95,31 @@ class WAFCallback {
 
     try {
       // TODO: possible optimizaion: only send params that haven't already been sent to this wafContext
-      const result = wafContext.run(params, DEFAULT_MAX_BUDGET)
+      const start = process.hrtime.bigint()
+
+      const result = wafContext.run(params, this.wafTimeout)
+
+      result.durationExt = parseInt(process.hrtime.bigint() - start)
 
       return this.applyResult(result, store)
     } catch (err) {
       log.error('Error while running the AppSec WAF')
       log.error(err)
+    } finally {
+      wafContext.dispose()
     }
   }
 
   applyResult (result, store) {
+    Reporter.reportMetrics({
+      duration: result.totalRuntime / 1e3,
+      durationExt: result.durationExt / 1e3,
+      rulesVersion: this.ddwaf.rulesInfo.version
+    }, store)
+
     if (result.data && result.data !== '[]') {
       Reporter.reportAttack(result.data, store)
     }
-
-    // TODO: use these values later for budget management
-    // result.perfData
-    // result.perfTotalRuntime
   }
 
   clear () {

package/packages/dd-trace/src/appsec/index.js

@@ -16,7 +16,7 @@ function enable (config) {
     let rules = fs.readFileSync(config.appsec.rules)
     rules = JSON.parse(rules)
 
-    RuleManager.applyRules(rules)
+    RuleManager.applyRules(rules, config.appsec)
   } catch (err) {
     log.error('Unable to start AppSec')
     log.error(err)
@@ -94,12 +94,16 @@ function incomingHttpEndTranslator (data) {
   }
 
   if (data.req.cookies && typeof data.req.cookies === 'object') {
-    payload[addresses.HTTP_INCOMING_COOKIES] = data.req.cookies
+    payload[addresses.HTTP_INCOMING_COOKIES] = {}
+
+    for (const k of Object.keys(data.req.cookies)) {
+      payload[addresses.HTTP_INCOMING_COOKIES][k] = [ data.req.cookies[k] ]
+    }
   }
 
   Gateway.propagate(payload, context)
 
-  Reporter.finishAttacks(data.req, context)
+  Reporter.finishRequest(data.req, context)
 }
 
 function disable () {