dd-trace 3.0.0-pre.2 → 3.2.0

package/LICENSE-3rdparty.csv

@@ -3,11 +3,12 @@ require,@datadog/native-appsec,Apache license 2.0,Copyright 2018 Datadog Inc.
 require,@datadog/native-metrics,Apache license 2.0,Copyright 2018 Datadog Inc.
 require,@datadog/pprof,Apache license 2.0,Copyright 2019 Google Inc.
 require,@datadog/sketches-js,Apache license 2.0,Copyright 2020 Datadog Inc.
-require,@types/node,MIT,Copyright Authors
+require,cidr-matcher,MIT,Copyright 2015 Marco Pracucci
 require,crypto-randomuuid,MIT,Copyright 2021 Node.js Foundation and contributors
 require,diagnostics_channel,MIT,Copyright 2021 Simon D.
 require,ignore,MIT,Copyright 2013 Kael Zhang and contributors
 require,import-in-the-middle,Apache license 2.0,Copyright 2021 Datadog Inc.
+require,istanbul-lib-coverage,BSD-3-Clause,Copyright 2012-2015 Yahoo! Inc.
 require,koalas,MIT,Copyright 2013-2017 Brian Woodward
 require,limiter,MIT,Copyright 2011 John Hurliman
 require,lodash.kebabcase,MIT,Copyright JS Foundation and other contributors
@@ -18,9 +19,9 @@ require,methods,MIT,Copyright 2013-2014 TJ Holowaychuk
 require,module-details-from-path,MIT,Copyright 2016 Thomas Watson Steen
 require,opentracing,MIT,Copyright 2016 Resonance Labs Inc
 require,path-to-regexp,MIT,Copyright 2014 Blake Embrey
-require,performance-now,MIT,Copyright 2013 Braveg1rl
 require,retry,MIT,Copyright 2011 Tim Koschützki Felix Geisendörfer
 require,semver,ISC,Copyright Isaac Z. Schlueter and Contributors
+dev,@types/node,MIT,Copyright Authors
 dev,autocannon,MIT,Copyright 2016 Matteo Collina
 dev,axios,MIT,Copyright 2014-present Matt Zabriskie
 dev,benchmark,MIT,Copyright 2010-2016 Mathias Bynens Robert Kieffer John-David Dalton

package/MIGRATING.md

@@ -4,6 +4,125 @@ This guide describes the steps to upgrade dd-trace from a major version to the
 next. If you are having any issues related to migrating, please feel free to
 open an issue or contact our [support](https://www.datadoghq.com/support/) team.
 
+## 2.0 to 3.0
+
+### Node 12 is no longer supported
+
+Node.js 12 has been EOL since April 2022 and is no longer supported. Generally
+speaking, we highly recommend always keeping Node.js up to date regardless of our
+support policy.
+
+### HTTP query string reported by default
+
+HTTP query strings are now reported by default as part of the `http.url` tag.
+This change is considered breaking only because there might be sensitive data
+in the query string. A default regular expression based obfuscator is provided
+for common use cases like API keys, but if your use case is not covered, the
+[DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP](https://datadoghq.dev/dd-trace-js/#tracer-settings)
+environment variable can be used to control what is obfuscated, and a value of
+`.*` would redact the query string entirely.
+
+### HTTP operation name change
+
+The HTTP integration now uses `web.request` for incoming requests and continues
+to use `http.request` for outgoing requests. When using a supported web
+framework like Express, this change will have no effect because the root span
+would already have an operation name override like `express.request`.
+Any [monitor](https://docs.datadoghq.com/monitors/create/types/apm/?tab=apmmetrics)
+on `http.request` for incoming requests should be updated to `web.request`.
+
+With this change, both operation names also appear under the main service name
+and are no longer split between the server service name and a separate client
+service name suffixed with `-http-client`.
+
+### gRPC operation name change
+
+The gRPC integration now uses `grpc.server` for incoming requests and
+`grpc.client` for outgoing requests. Any
+[monitor](https://docs.datadoghq.com/monitors/create/types/apm/?tab=apmmetrics)
+on `grpc.request` should be updated to one of these.
+
+With this change, both operation names also appear under the main service name
+and are no longer split between the server service name and a separate client
+service name suffixed with `-http-client`.
+
+### Removal of `fs` integration
+
+The `fs` integration was removed as it was originally added without an actual
+use case, and it's been problematic ever since. It's noisy, the output is
+confusing when using streams, errors that are handled higher in the stack end up
+being captured, etc.
+
+If you had any use for file system instrumentation, please let us know so we can
+provide an alternative.
+
+### Scope binding for promises and event emitters
+
+It's no longer possible to bind promises using `tracer.scope().bind(promise)` or
+event emitters using `tracer.scope().bind(emitter)`. These were historically
+added mostly for internal use, and changes to context propagation over the years
+made them unnecessary, both internally and externaly. If one of these is used
+anywhere, the call will simply be ignored and no binding will occur.
+
+To bind the `then` handler of a promise, bind the function directly directly:
+
+```js
+promise.then(tracer.scope().bind(handler))
+```
+
+To bind all listeners for an event, wrap the call to `emit` directly instead:
+
+```js
+tracer.scope().activate(span, () => {
+  emitter.emit('event')
+})
+```
+
+To bind individual listeners, bind the listener function directly instead:
+
+```js
+emitter.on('event', tracer.scope().bind(listener, span))
+```
+
+### Removed APIs
+
+The following APIs have been deprecated for a long time and have now been
+completely removed:
+
+- `tracer.currentSpan()`
+- `tracer.bindEmitter()`
+
+Since these have not been recommended nor publicly documented for years at this
+point, there should be no impact as no application is expected to be using them.
+
+### CI Visibility new entrypoints
+
+#### Cypress
+
+`dd-trace/cypress/plugin` and `dd-trace/cypress/support` are removed, so you won't 
+be able to use them for your `cypress` instrumentation. Use `dd-trace/ci/cypress/plugin`
+and `dd-trace/ci/cypress/support` instead for your plugin and support configuration 
+respectively. 
+
+#### Jest
+
+The use of `'dd-trace/ci/jest/env'` in [`testEnvironment`](https://jestjs.io/docs/configuration#testenvironment-string)
+is no longer supported. 
+To instrument `jest` tests now, add `'-r dd-trace/ci/init'` to the `NODE_OPTIONS` environment
+variable passed to the process running the tests, for example, `NODE_OPTIONS='-r dd-trace/ci/init' yarn test`.
+
+#### Mocha
+
+The use of `--require dd-trace/ci/init` as a `mocha` flag is no longer supported. 
+To instrument `mocha` tests now, add `'-r dd-trace/ci/init'` to the `NODE_OPTIONS` environment
+variable passed to the process running the tests, for example, `NODE_OPTIONS='-r dd-trace/ci/init' yarn test`.
+
+#### Cucumber
+
+The use of `--require-module dd-trace/ci/init` as a `cucumber-js` flag is no longer supported.
+To instrument `cucumber-js` tests now, add `'-r dd-trace/ci/init'` to the `NODE_OPTIONS` environment
+variable passed to the process running the tests, for example, `NODE_OPTIONS='-r dd-trace/ci/init' yarn test`.
+
 ## 1.0 to 2.0
 
 ### Configuration

package/ci/init.js

@@ -29,7 +29,6 @@ so dd-trace will not be initialized.`)
 
 if (shouldInit) {
   tracer.init(options)
-  tracer.use('fs', false)
 }
 
 module.exports = tracer

package/ext/formats.js

@@ -1,10 +1,8 @@
 'use strict'
 
-const opentracing = require('opentracing')
-
 module.exports = {
-  TEXT_MAP: opentracing.FORMAT_TEXT_MAP,
-  HTTP_HEADERS: opentracing.FORMAT_HTTP_HEADERS,
-  BINARY: opentracing.FORMAT_BINARY,
+  TEXT_MAP: 'text_map',
+  HTTP_HEADERS: 'http_headers',
+  BINARY: 'binary',
   LOG: 'log'
 }

package/ext/tags.d.ts

@@ -15,7 +15,8 @@ declare const tags: {
   HTTP_ROUTE: 'http.route'
   HTTP_REQUEST_HEADERS: 'http.request.headers'
   HTTP_RESPONSE_HEADERS: 'http.response.headers'
-  HTTP_USERAGENT: 'http.useragent'
+  HTTP_USERAGENT: 'http.useragent',
+  HTTP_CLIENT_IP: 'http.client_ip'
 }
 
 export = tags

package/ext/tags.js

@@ -20,7 +20,8 @@ const tags = {
   HTTP_ROUTE: 'http.route',
   HTTP_REQUEST_HEADERS: 'http.request.headers',
   HTTP_RESPONSE_HEADERS: 'http.response.headers',
-  HTTP_USERAGENT: 'http.useragent'
+  HTTP_USERAGENT: 'http.useragent',
+  HTTP_CLIENT_IP: 'http.client_ip'
 }
 
 // Deprecated

package/index.d.ts

@@ -267,6 +267,22 @@ export declare interface TracerOptions {
    */
   sampleRate?: number;
 
+  /**
+   * Global rate limit that is applied on the global sample rate and all rules,
+   * and controls the ingestion rate limit between the agent and the backend.
+   * Defaults to deferring the decision to the agent.
+   */
+  rateLimit?: Number,
+
+  /**
+   * Sampling rules to apply to priority samplin. Each rule is a JSON,
+   * consisting of `service` and `name`, which are regexes to match against
+   * a trace's `service` and `name`, and a corresponding `sampleRate`. If not
+   * specified, will defer to global sampling rate for all spans.
+   * @default []
+   */
+  samplingRules?: SamplingRule[]
+
   /**
    * Interval in milliseconds at which the tracer will submit traces to the agent.
    * @default 2000
@@ -298,7 +314,10 @@ export declare interface TracerOptions {
   protocolVersion?: string
 
   /**
-   * Configuration of the ingestion between the agent and the backend.
+   * Deprecated in favor of the global versions of the variables provided under this option
+   *
+   * @deprecated
+   * @hidden
    */
   ingestion?: {
     /**
@@ -307,7 +326,7 @@ export declare interface TracerOptions {
     sampleRate?: number
 
     /**
-     * Controls the ingestion rate limit between the agent and the backend.
+     * Controls the ingestion rate limit between the agent and the backend. Defaults to deferring the decision to the agent.
      */
     rateLimit?: number
   };
@@ -333,32 +352,36 @@ export declare interface TracerOptions {
     exporter?: 'log' | 'agent'
 
     /**
-     * Configuration of the priority sampler. Supports a global config and rules by span name or service name. The first matching rule is applied, and if no rule matches it falls back to the global config or on the rates provided by the agent if there is no global config.
+     * Whether to enable the experimental `getRumData` method.
+     * @default false
+     */
+    enableGetRumData?: boolean
+
+    /**
+     * Configuration of the IAST. Can be a boolean as an alias to `iast.enabled`.
      */
-    sampler?: {
+    iast?: boolean  | {
       /**
-       * Sample rate to apply globally when no other rule is matched. Omit to fallback on the dynamic rates returned by the agent instead.
+       * Whether to enable IAST.
+       * @default false
        */
-      sampleRate?: Number,
-
+      enabled?: boolean,
       /**
-       * Global rate limit that is applied on the global sample rate and all rules.
-       * @default 100
+       * Controls the percentage of requests that iast will analyze
+       * @default 30
        */
-      rateLimit?: Number,
-
+      requestSampling?: number,
+      /**
+       * Controls how many request can be analyzing code vulnerabilities at the same time
+       * @default 2
+       */
+      maxConcurrentRequests?: number,
       /**
-       * Sampling rules to apply to priority sampling.
-       * @default []
+       * Controls how many code vulnerabilities can be detected in the same request
+       * @default 2
        */
-      rules?: SamplingRule[]
+      maxContextOperations?: number
     }
-
-    /**
-     * Whether to enable the experimental `getRumData` method.
-     * @default false
-     */
-    enableGetRumData?: boolean
   };
 
   /**
@@ -491,15 +514,6 @@ export declare interface TracerOptions {
   [key: string]: string | undefined
 }
 
-/** @hidden */
-interface EventEmitter {
-  emit(eventName: string | symbol, ...args: any[]): any;
-  on?(eventName: string | symbol, listener: (...args: any[]) => any): any;
-  off?(eventName: string | symbol, listener: (...args: any[]) => any): any;
-  addListener?(eventName: string | symbol, listener: (...args: any[]) => any): any;
-  removeListener?(eventName: string | symbol, listener: (...args: any[]) => any): any;
-}
-
 /** @hidden */
 declare type anyObject = {
   [key: string]: any;
@@ -537,14 +551,13 @@ export declare interface Scope {
   /**
    * Binds a target to the provided span, or the active span if omitted.
    *
-   * @param {Function|Promise|EventEmitter} target Target that will have the span activated on its scope.
+   * @param {Function|Promise} target Target that will have the span activated on its scope.
    * @param {Span} [span=scope.active()] The span to activate.
    * @returns The bound target.
    */
   bind<T extends (...args: any[]) => void>(fn: T, span?: Span | null): T;
   bind<V, T extends (...args: any[]) => V>(fn: T, span?: Span | null): T;
   bind<T>(fn: Promise<T>, span?: Span | null): Promise<T>;
-  bind(emitter: EventEmitter, span?: Span | null): EventEmitter;
 }
 
 /** @hidden */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "3.0.0-pre.2",
+  "version": "3.2.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -55,18 +55,19 @@
   },
   "homepage": "https://github.com/DataDog/dd-trace-js#readme",
   "engines": {
-    "node": ">=12"
+    "node": ">=14"
   },
   "dependencies": {
     "@datadog/native-appsec": "^1.2.1",
-    "@datadog/native-metrics": "^1.4.1",
-    "@datadog/pprof": "^1.0.0",
-    "@datadog/sketches-js": "^1.0.5",
-    "@types/node": ">=12",
+    "@datadog/native-metrics": "^1.4.2",
+    "@datadog/pprof": "^1.0.2",
+    "@datadog/sketches-js": "^2.1.0",
+    "cidr-matcher": "^2.1.1",
     "crypto-randomuuid": "^1.0.0",
     "diagnostics_channel": "^1.1.0",
     "ignore": "^5.2.0",
-    "import-in-the-middle": "^1.3.0",
+    "import-in-the-middle": "^1.3.1",
+    "istanbul-lib-coverage": "3.2.0",
     "koalas": "^1.0.2",
     "limiter": "^1.1.4",
     "lodash.kebabcase": "^4.1.1",
@@ -77,11 +78,11 @@
     "module-details-from-path": "^1.0.3",
     "opentracing": ">=0.12.1",
     "path-to-regexp": "^0.1.2",
-    "performance-now": "^2.1.0",
     "retry": "^0.10.1",
     "semver": "^5.5.0"
   },
   "devDependencies": {
+    "@types/node": ">=14",
     "autocannon": "^4.5.2",
     "axios": "^0.21.2",
     "benchmark": "^2.1.4",

package/packages/datadog-core/src/storage/async_resource.js

@@ -6,9 +6,27 @@ const { channel } = require('diagnostics_channel')
 const beforeCh = channel('dd-trace:storage:before')
 const afterCh = channel('dd-trace:storage:after')
 
+let PrivateSymbol = Symbol
+function makePrivateSymbol () {
+  // eslint-disable-next-line no-new-func
+  PrivateSymbol = new Function('name', 'return %CreatePrivateSymbol(name)')
+}
+
+try {
+  makePrivateSymbol()
+} catch (e) {
+  try {
+    const v8 = require('v8')
+    v8.setFlagsFromString('--allow-natives-syntax')
+    makePrivateSymbol()
+    v8.setFlagsFromString('--no-allow-natives-syntax')
+  // eslint-disable-next-line no-empty
+  } catch (e) {}
+}
+
 class AsyncResourceStorage {
   constructor () {
-    this._ddResourceStore = Symbol('ddResourceStore')
+    this._ddResourceStore = PrivateSymbol('ddResourceStore')
     this._enabled = false
     this._hook = createHook(this._createHook())
   }

package/packages/datadog-core/src/storage/index.js

@@ -5,7 +5,7 @@
 const semver = require('semver')
 
 // https://github.com/nodejs/node/pull/33801
-const hasJavaScriptAsyncHooks = semver.satisfies(process.versions.node, '>=14.5 || ^12.19.0')
+const hasJavaScriptAsyncHooks = semver.satisfies(process.versions.node, '>=14.5')
 
 if (hasJavaScriptAsyncHooks) {
   module.exports = require('./async_resource')

package/packages/datadog-instrumentations/index.js

@@ -1,54 +1,3 @@
 'use strict'
 
-require('./src/amqplib')
-require('./src/amqp10')
-require('./src/aws-sdk')
-require('./src/bluebird')
-require('./src/bunyan')
-require('./src/cassandra-driver')
-require('./src/connect')
-require('./src/couchbase')
-require('./src/cucumber')
-require('./src/dns')
-require('./src/elasticsearch')
-require('./src/express')
-require('./src/fastify')
-require('./src/find-my-way')
-require('./src/generic-pool')
-require('./src/google-cloud-pubsub')
-require('./src/graphql')
-require('./src/grpc')
-require('./src/hapi')
-require('./src/http')
-require('./src/http2')
-require('./src/ioredis')
-require('./src/jest')
-require('./src/kafkajs')
-require('./src/knex')
-require('./src/koa')
-require('./src/memcached')
-require('./src/microgateway-core')
-require('./src/moleculer')
-require('./src/mongodb-core')
-require('./src/mongoose')
-require('./src/mysql')
-require('./src/mysql2')
-require('./src/mocha')
-require('./src/net')
-require('./src/next')
-require('./src/oracledb')
-require('./src/paperplane')
-require('./src/pino')
-require('./src/pg')
-require('./src/promise')
-require('./src/promise-js')
-require('./src/q')
-require('./src/redis')
-require('./src/restify')
-require('./src/router')
-require('./src/rhea')
-require('./src/sharedb')
-require('./src/tedious')
-require('./src/when')
-require('./src/winston')
-require('./src/limitd-client')
+require('./src/helpers/register')

package/packages/datadog-instrumentations/src/connect.js

@@ -98,7 +98,7 @@ function wrapNext (req, next) {
     nextChannel.publish({ req })
     exitChannel.publish({ req })
 
-    next.apply(null, arguments)
+    next.apply(this, arguments)
   }
 }
 

package/packages/datadog-instrumentations/src/crypto.js

@@ -0,0 +1,30 @@
+'use strict'
+
+const {
+  channel,
+  addHook
+} = require('./helpers/instrument')
+const shimmer = require('../../datadog-shimmer')
+
+const cryptoCh = channel('datadog:crypto:hashing:start')
+
+addHook({ name: 'crypto' }, crypto => {
+  shimmer.massWrap(
+    crypto,
+    ['createHash', 'createHmac', 'createSign', 'createVerify', 'sign', 'verify'],
+    wrapMethod
+  )
+  return crypto
+})
+
+function wrapMethod (cryptoMethod) {
+  return function () {
+    if (cryptoCh.hasSubscribers) {
+      if (arguments.length > 0) {
+        const algorithm = arguments[0]
+        cryptoCh.publish({ algorithm })
+      }
+    }
+    return cryptoMethod.apply(this, arguments)
+  }
+}

package/packages/datadog-instrumentations/src/cucumber.js

@@ -7,6 +7,7 @@ const runStartCh = channel('ci:cucumber:run:start')
 const runFinishCh = channel('ci:cucumber:run:finish')
 const runStepStartCh = channel('ci:cucumber:run-step:start')
 const errorCh = channel('ci:cucumber:error')
+const sessionFinishCh = channel('ci:cucumber:session:finish')
 
 // TODO: remove in a later major version
 const patched = new WeakSet()
@@ -128,4 +129,18 @@ addHook({
   file: 'lib/runtime/test_case_runner.js'
 }, testCaseHook)
 
+addHook({
+  name: '@cucumber/cucumber',
+  versions: ['>=7.0.0'],
+  file: 'lib/runtime/index.js'
+}, (Runtime) => {
+  shimmer.wrap(Runtime.default.prototype, 'start', start => async function () {
+    const result = await start.apply(this, arguments)
+    sessionFinishCh.publish(undefined)
+    return result
+  })
+
+  return Runtime
+})
+
 module.exports = { pickleHook, testCaseHook }

package/packages/datadog-instrumentations/src/grpc/client.js

@@ -232,9 +232,9 @@ function patch (grpc) {
   return grpc
 }
 
-addHook({ name: 'grpc', versions: ['>=1.20.2'] }, patch)
+addHook({ name: 'grpc', versions: ['>=1.24.3'] }, patch)
 
-addHook({ name: 'grpc', versions: ['>=1.20.2'], file: 'src/client.js' }, client => {
+addHook({ name: 'grpc', versions: ['>=1.24.3'], file: 'src/client.js' }, client => {
   shimmer.wrap(client, 'makeClientConstructor', createWrapMakeClientConstructor())
 
   return client

package/packages/datadog-instrumentations/src/grpc/server.js

@@ -131,7 +131,7 @@ function isEmitter (obj) {
   return typeof obj.emit === 'function' && typeof obj.once === 'function'
 }
 
-addHook({ name: 'grpc', versions: ['>=1.20.2'], file: 'src/server.js' }, server => {
+addHook({ name: 'grpc', versions: ['>=1.24.3'], file: 'src/server.js' }, server => {
   shimmer.wrap(server.Server.prototype, 'register', wrapRegister)
 
   return server

package/packages/datadog-instrumentations/src/hapi.js

@@ -62,16 +62,6 @@ function wrapDispatch (dispatch) {
   }
 }
 
-function wrapLifecycle (lifecycle) {
-  return function () {
-    const result = lifecycle.apply(this, arguments)
-
-    if (Array.isArray(result)) return result.map(wrapHandler)
-
-    return result
-  }
-}
-
 function wrapRebuild (rebuild) {
   return function (event) {
     const result = rebuild.apply(this, arguments)
@@ -166,20 +156,14 @@ addHook({ name: 'hapi', versions: ['>=17'] }, hapi => {
   return hapi
 })
 
-addHook({ name: 'hapi', versions: ['2 - 7.1', '8 - 16'] }, hapi => {
+addHook({ name: 'hapi', versions: ['16'] }, hapi => {
   shimmer.wrap(hapi.Server.prototype, 'start', wrapStart)
   shimmer.wrap(hapi.Server.prototype, 'ext', wrapExt)
 
   return hapi
 })
 
-addHook({ name: 'hapi', versions: ['^7.2'] }, hapi => {
-  shimmer.wrap(hapi, 'createServer', wrapServer)
-
-  return hapi
-})
-
-addHook({ name: 'hapi', versions: ['7.2 - 16'], file: 'lib/connection.js' }, Connection => {
+addHook({ name: 'hapi', versions: ['16'], file: 'lib/connection.js' }, Connection => {
   shimmer.wrap(Connection.prototype, '_dispatch', wrapDispatch)
 
   return Connection
@@ -191,20 +175,8 @@ addHook({ name: 'hapi', versions: ['>=17'], file: 'lib/core.js' }, Core => {
   return Core
 })
 
-addHook({ name: 'hapi', versions: ['2 - 7.1'], file: 'lib/server.js' }, Server => {
-  shimmer.wrap(Server.prototype, '_dispatch', wrapDispatch)
-
-  return Server
-})
-
-addHook({ name: 'hapi', versions: ['>=10.4'], file: 'lib/route.js' }, Route => {
+addHook({ name: 'hapi', versions: ['>=16'], file: 'lib/route.js' }, Route => {
   shimmer.wrap(Route.prototype, 'rebuild', wrapRebuild)
 
   return Route
 })
-
-addHook({ name: 'hapi', versions: ['2 - 10.3'], file: 'lib/route.js' }, Route => {
-  shimmer.wrap(Route.prototype, 'lifecycle', wrapLifecycle)
-
-  return Route
-})