dd-trace 3.18.0 → 3.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "3.18.0",
+  "version": "3.19.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -15,10 +15,10 @@
     "lint": "node scripts/check_licenses.js && eslint . && yarn audit --groups dependencies",
     "services": "node ./scripts/install_plugin_modules && node packages/dd-trace/test/setup/services",
     "test": "SERVICES=* yarn services && mocha --colors --exit --expose-gc 'packages/dd-trace/test/setup/node.js' 'packages/*/test/**/*.spec.js'",
-    "test:appsec": "mocha --colors --exit -r \"packages/dd-trace/test/setup/mocha.js\" --exclude \"packages/dd-trace/test/appsec/iast/**/*.plugin.spec.js\" \"packages/dd-trace/test/appsec/**/*.spec.js\"",
-    "test:appsec:ci": "nyc --no-clean --include \"packages/dd-trace/src/appsec/**/*.js\" --exclude \"packages/dd-trace/test/appsec/iast/**/*.plugin.spec.js\" -- npm run test:appsec",
-    "test:appsec:plugins": "mocha --colors --exit -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/dd-trace/test/appsec/iast/**/*.@($(echo $PLUGINS)).plugin.spec.js\"",
-    "test:appsec:plugins:ci": "yarn services && nyc --no-clean --include \"packages/dd-trace/test/appsec/iast/**/*.@($(echo $PLUGINS)).plugin.spec.js\" -- npm run test:appsec:plugins",
+    "test:appsec": "mocha --colors --exit -r \"packages/dd-trace/test/setup/mocha.js\" --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" \"packages/dd-trace/test/appsec/**/*.spec.js\"",
+    "test:appsec:ci": "nyc --no-clean --include \"packages/dd-trace/src/appsec/**/*.js\" --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" -- npm run test:appsec",
+    "test:appsec:plugins": "mocha --colors --exit -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/dd-trace/test/appsec/**/*.@($(echo $PLUGINS)).plugin.spec.js\"",
+    "test:appsec:plugins:ci": "yarn services && nyc --no-clean --include \"packages/dd-trace/test/appsec/**/*.@($(echo $PLUGINS)).plugin.spec.js\" -- npm run test:appsec:plugins",
     "test:trace:core": "tap packages/dd-trace/test/*.spec.js \"packages/dd-trace/test/{ci-visibility,encode,exporters,opentracing,plugins,telemetry}/**/*.spec.js\"",
     "test:trace:core:ci": "npm run test:trace:core -- --coverage --nyc-arg=--include=\"packages/dd-trace/src/**/*.js\"",
     "test:instrumentations": "mocha --colors -r 'packages/dd-trace/test/setup/mocha.js' 'packages/datadog-instrumentations/test/**/*.spec.js'",
@@ -65,7 +65,7 @@
     "node": ">=14"
   },
   "dependencies": {
-    "@datadog/native-appsec": "2.0.0",
+    "@datadog/native-appsec": "^3.1.0",
     "@datadog/native-iast-rewriter": "2.0.1",
     "@datadog/native-iast-taint-tracking": "^1.4.0",
     "@datadog/native-metrics": "^1.6.0",

package/packages/datadog-instrumentations/src/body-parser.js

@@ -1,14 +1,21 @@
 'use strict'
 
-const { channel, addHook, AsyncResource } = require('./helpers/instrument')
+const { AbortController } = require('node-abort-controller') // AbortController is not available in node <15
+const shimmer = require('../../datadog-shimmer')
+const { channel, addHook } = require('./helpers/instrument')
 
 const bodyParserReadCh = channel('datadog:body-parser:read:finish')
 
-function publishRequestBodyAndNext (request, next) {
+function publishRequestBodyAndNext (req, res, next) {
   return function () {
-    if (bodyParserReadCh.hasSubscribers && request) {
-      bodyParserReadCh.publish({ request })
+    if (bodyParserReadCh.hasSubscribers && req) {
+      const abortController = new AbortController()
+
+      bodyParserReadCh.publish({ req, res, abortController })
+
+      if (abortController.signal.aborted) return
     }
+
     next.apply(this, arguments)
   }
 }
@@ -16,11 +23,10 @@ function publishRequestBodyAndNext (request, next) {
 addHook({
   name: 'body-parser',
   file: 'lib/read.js',
-  versions: ['>=1']
+  versions: ['>=1.4.0']
 }, read => {
-  return function (req, res, next) {
-    const nextResource = new AsyncResource('bound-anonymous-fn')
-    arguments[2] = nextResource.bind(publishRequestBodyAndNext(req, next))
+  return shimmer.wrap(read, function (req, res, next) {
+    arguments[2] = publishRequestBodyAndNext(req, res, next)
     read.apply(this, arguments)
-  }
+  })
 })

package/packages/datadog-instrumentations/src/express.js

@@ -3,6 +3,7 @@
 const { createWrapRouterMethod } = require('./router')
 const shimmer = require('../../datadog-shimmer')
 const { addHook, channel } = require('./helpers/instrument')
+const { AbortController } = require('node-abort-controller')
 
 const handleChannel = channel('apm:express:request:handle')
 
@@ -25,3 +26,34 @@ addHook({ name: 'express', versions: ['>=4'] }, express => {
 
   return express
 })
+
+const queryParserReadCh = channel('datadog:query:read:finish')
+
+function publishQueryParsedAndNext (req, res, next) {
+  return function () {
+    if (queryParserReadCh.hasSubscribers && req) {
+      const abortController = new AbortController()
+
+      queryParserReadCh.publish({ req, res, abortController })
+
+      if (abortController.signal.aborted) return
+    }
+
+    next.apply(this, arguments)
+  }
+}
+
+addHook({
+  name: 'express',
+  versions: ['>=4'],
+  file: 'lib/middleware/query.js'
+}, query => {
+  return shimmer.wrap(query, function () {
+    const queryMiddleware = query.apply(this, arguments)
+
+    return shimmer.wrap(queryMiddleware, function (req, res, next) {
+      arguments[2] = publishQueryParsedAndNext(req, res, next)
+      return queryMiddleware.apply(this, arguments)
+    })
+  })
+})

package/packages/datadog-instrumentations/src/http/server.js

@@ -55,7 +55,8 @@ function wrapEmit (emit) {
 
       try {
         if (abortController.signal.aborted) {
-          return res.end()
+          // TODO: should this always return true ?
+          return this.listenerCount(eventName) > 0
         }
         return emit.apply(this, arguments)
       } catch (err) {

package/packages/datadog-instrumentations/src/playwright.js

@@ -72,6 +72,9 @@ function getRootDir (playwrightRunner) {
   if (playwrightRunner._configDir) {
     return playwrightRunner._configDir
   }
+  if (playwrightRunner._config && playwrightRunner._config.config) {
+    return playwrightRunner._config.config.rootDir
+  }
   return process.cwd()
 }
 

package/packages/datadog-plugin-amqp10/src/consumer.js

@@ -11,11 +11,9 @@ class Amqp10ConsumerPlugin extends ConsumerPlugin {
     const source = getShortName(link)
     const address = getAddress(link)
 
-    this.startSpan('amqp.receive', {
-      service: this.config.service || `${this.tracer._service}-amqp`,
+    this.startSpan({
       resource: ['receive', source].filter(v => v).join(' '),
       type: 'worker',
-      kind: 'consumer',
       meta: {
         'amqp.link.source.address': source,
         'amqp.link.role': 'receiver',

package/packages/datadog-plugin-amqp10/src/producer.js

@@ -13,10 +13,8 @@ class Amqp10ProducerPlugin extends ProducerPlugin {
     const address = getAddress(link)
     const target = getShortName(link)
 
-    this.startSpan('amqp.send', {
-      service: this.config.service || `${this.tracer._service}-amqp`,
+    this.startSpan({
       resource: ['send', target].filter(v => v).join(' '),
-      kind: 'producer',
       meta: {
         'amqp.link.target.address': target,
         'amqp.link.role': 'sender',

package/packages/datadog-plugin-amqplib/src/client.js

@@ -7,6 +7,7 @@ const { getResourceName } = require('./util')
 
 class AmqplibClientPlugin extends ClientPlugin {
   static get id () { return 'amqplib' }
+  static get type () { return 'messaging' }
   static get operation () { return 'command' }
 
   start ({ channel = {}, method, fields }) {
@@ -14,10 +15,10 @@ class AmqplibClientPlugin extends ClientPlugin {
     if (method === 'basic.publish') return
 
     const stream = (channel.connection && channel.connection.stream) || {}
-    const span = this.startSpan('amqp.command', {
-      service: this.config.service || `${this.tracer._service}-amqp`,
+    const span = this.startSpan(this.operationName(), {
+      service: this.config.service || this.serviceName(),
       resource: getResourceName(method, fields),
-      kind: 'client',
+      kind: this.constructor.kind,
       meta: {
         'out.host': stream._host,
         [CLIENT_PORT_KEY]: stream.remotePort,

package/packages/datadog-plugin-amqplib/src/consumer.js

@@ -13,11 +13,9 @@ class AmqplibConsumerPlugin extends ConsumerPlugin {
 
     const childOf = extract(this.tracer, message)
 
-    this.startSpan('amqp.command', {
+    this.startSpan({
       childOf,
-      service: this.config.service || `${this.tracer._service}-amqp`,
       resource: getResourceName(method, fields),
-      kind: 'consumer',
       type: 'worker',
       meta: {
         'amqp.queue': fields.queue,

package/packages/datadog-plugin-amqplib/src/producer.js

@@ -13,10 +13,8 @@ class AmqplibProducerPlugin extends ProducerPlugin {
     if (method !== 'basic.publish') return
 
     const stream = (channel.connection && channel.connection.stream) || {}
-    const span = this.startSpan('amqp.command', {
-      service: this.config.service || `${this.tracer._service}-amqp`,
+    const span = this.startSpan({
       resource: getResourceName(method, fields),
-      kind: 'producer',
       meta: {
         'out.host': stream._host,
         [CLIENT_PORT_KEY]: stream.remotePort,

package/packages/datadog-plugin-google-cloud-pubsub/src/client.js

@@ -4,15 +4,16 @@ const ClientPlugin = require('../../dd-trace/src/plugins/client')
 
 class GoogleCloudPubsubClientPlugin extends ClientPlugin {
   static get id () { return 'google-cloud-pubsub' }
+  static get type () { return 'messaging' }
   static get operation () { return 'request' }
 
   start ({ request, api, projectId }) {
     if (api === 'publish') return
 
-    this.startSpan('pubsub.request', {
-      service: this.config.service || `${this.tracer._service}-pubsub`,
+    this.startSpan(this.operationName(), {
+      service: this.config.service || this.serviceName(),
       resource: [api, request.name].filter(x => x).join(' '),
-      kind: 'client',
+      kind: this.constructor.kind,
       meta: {
         'pubsub.method': api,
         'gcloud.project_id': projectId

package/packages/datadog-plugin-google-cloud-pubsub/src/consumer.js

@@ -11,11 +11,9 @@ class GoogleCloudPubsubConsumerPlugin extends ConsumerPlugin {
     const topic = subscription.metadata && subscription.metadata.topic
     const childOf = this.tracer.extract('text_map', message.attributes) || null
 
-    this.startSpan('pubsub.receive', {
+    this.startSpan({
       childOf,
-      service: this.config.service,
       resource: topic,
-      kind: 'consumer',
       type: 'worker',
       meta: {
         'gcloud.project_id': subscription.pubsub.projectId,

package/packages/datadog-plugin-google-cloud-pubsub/src/producer.js

@@ -11,10 +11,8 @@ class GoogleCloudPubsubProducerPlugin extends ProducerPlugin {
 
     const messages = request.messages || []
     const topic = request.topic
-    const span = this.startSpan('pubsub.request', { // TODO: rename
-      service: this.config.service || `${this.tracer._service}-pubsub`,
+    const span = this.startSpan({ // TODO: rename
       resource: `${api} ${topic}`,
-      kind: 'producer',
       meta: {
         'gcloud.project_id': projectId,
         'pubsub.method': api, // TODO: remove

package/packages/datadog-plugin-http/src/server.js

@@ -3,7 +3,7 @@
 const Plugin = require('../../dd-trace/src/plugins/plugin')
 const { storage } = require('../../datadog-core')
 const web = require('../../dd-trace/src/plugins/util/web')
-const { incomingHttpRequestStart, incomingHttpRequestEnd } = require('../../dd-trace/src/appsec/gateway/channels')
+const { incomingHttpRequestStart, incomingHttpRequestEnd } = require('../../dd-trace/src/appsec/channels')
 const { COMPONENT } = require('../../dd-trace/src/constants')
 
 class HttpServerPlugin extends Plugin {
@@ -33,7 +33,7 @@ class HttpServerPlugin extends Plugin {
       }
 
       if (incomingHttpRequestStart.hasSubscribers) {
-        incomingHttpRequestStart.publish({ req, res, abortController })
+        incomingHttpRequestStart.publish({ req, res, abortController }) // TODO: no need to make a new object here
       }
     })
 

package/packages/datadog-plugin-http2/src/server.js

@@ -5,7 +5,6 @@
 const Plugin = require('../../dd-trace/src/plugins/plugin')
 const { storage } = require('../../datadog-core')
 const web = require('../../dd-trace/src/plugins/util/web')
-const { incomingHttpRequestStart } = require('../../dd-trace/src/appsec/gateway/channels')
 const { COMPONENT } = require('../../dd-trace/src/constants')
 
 class Http2ServerPlugin extends Plugin {
@@ -30,10 +29,6 @@ class Http2ServerPlugin extends Plugin {
         context.res.writeHead = web.wrapWriteHead(context)
         context.instrumented = true
       }
-
-      if (incomingHttpRequestStart.hasSubscribers) {
-        incomingHttpRequestStart.publish({ req, res })
-      }
     })
 
     this.addSub('apm:http2:server:request:error', (error) => {

package/packages/datadog-plugin-kafkajs/src/consumer.js

@@ -8,12 +8,9 @@ class KafkajsConsumerPlugin extends ConsumerPlugin {
 
   start ({ topic, partition, message }) {
     const childOf = extract(this.tracer, message.headers)
-
-    this.startSpan('kafka.consume', {
+    this.startSpan({
       childOf,
-      service: this.config.service || `${this.tracer._service}-kafka`,
       resource: topic,
-      kind: 'consumer',
       type: 'worker',
       meta: {
         'component': 'kafkajs',

package/packages/datadog-plugin-kafkajs/src/producer.js

@@ -7,10 +7,8 @@ class KafkajsProducerPlugin extends ProducerPlugin {
   static get operation () { return 'produce' }
 
   start ({ topic, messages }) {
-    const span = this.startSpan('kafka.produce', {
-      service: this.config.service || `${this.tracer._service}-kafka`,
+    const span = this.startSpan({
       resource: topic,
-      kind: 'producer',
       meta: {
         'component': 'kafkajs',
         'kafka.topic': topic

package/packages/datadog-plugin-rhea/src/consumer.js

@@ -19,12 +19,10 @@ class RheaConsumerPlugin extends ConsumerPlugin {
     const name = getResourceNameFromMessage(msgObj)
     const childOf = extractTextMap(msgObj, this.tracer)
 
-    this.startSpan('amqp.receive', {
+    this.startSpan({
       childOf,
-      service: this.config.service,
       resource: name,
       type: 'worker',
-      kind: 'consumer',
       meta: {
         'component': 'rhea',
         'amqp.link.source.address': name,

package/packages/datadog-plugin-rhea/src/producer.js

@@ -9,17 +9,13 @@ class RheaProducerPlugin extends ProducerPlugin {
 
   constructor (...args) {
     super(...args)
-
     this.addTraceSub('encode', this.encode.bind(this))
   }
 
   start ({ targetAddress, host, port }) {
     const name = targetAddress || 'amq.topic'
-
-    this.startSpan('amqp.send', {
-      service: this.config.service || `${this.tracer._service}-amqp-producer`,
+    this.startSpan({
       resource: name,
-      kind: 'producer',
       meta: {
         'component': 'rhea',
         'amqp.link.target.address': name,

package/packages/dd-trace/src/appsec/addresses.js

@@ -7,14 +7,11 @@ module.exports = {
   // TODO: 'server.request.trailers',
   HTTP_INCOMING_URL: 'server.request.uri.raw',
   HTTP_INCOMING_METHOD: 'server.request.method',
-  HTTP_INCOMING_ENDPOINT: 'server.request.framework_endpoint',
   HTTP_INCOMING_PARAMS: 'server.request.path_params',
   HTTP_INCOMING_COOKIES: 'server.request.cookies',
   HTTP_INCOMING_RESPONSE_CODE: 'server.response.status',
   HTTP_INCOMING_RESPONSE_HEADERS: 'server.response.headers.no_cookies',
   // TODO: 'server.response.trailers',
-  HTTP_INCOMING_REMOTE_IP: 'server.request.client_ip',
-  HTTP_INCOMING_REMOTE_PORT: 'server.request.client_port',
 
   HTTP_CLIENT_IP: 'http.client_ip',
 

package/packages/dd-trace/src/appsec/blocked_templates.js

@@ -1,7 +1,7 @@
 /* eslint-disable max-len */
 'use strict'
 
-const html = `<!-- Sorry, you've been blocked -->
+const html = `<!-- Sorry, you’ve been blocked -->
 <!DOCTYPE html>
 <html lang="en">
 
@@ -102,14 +102,7 @@ const html = `<!-- Sorry, you've been blocked -->
 </html>
 `
 
-const json = `{
-  "errors": [
-    {
-      "title": "You've been blocked",
-      "detail": "Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."
-    }
-  ]
-}`
+const json = `{"errors": [{"title": "You've been blocked", "detail": "Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}`
 
 module.exports = {
   html,

package/packages/dd-trace/src/appsec/blocking.js

@@ -19,7 +19,7 @@ function block (req, res, rootSpan, abortController) {
   const accept = req.headers.accept && req.headers.accept.split(',').map((str) => str.split(';', 1)[0].trim())
 
   if (accept && accept.includes('text/html') && !accept.includes('application/json')) {
-    type = 'text/html'
+    type = 'text/html; charset=utf-8'
     body = templateHtml
   } else {
     type = 'application/json'

package/packages/dd-trace/src/appsec/{gateway/channels.js → channels.js}

@@ -1,11 +1,11 @@
 'use strict'
 
-const dc = require('../../../../diagnostics_channel')
+const dc = require('../../../diagnostics_channel')
 
 // TODO: use TBD naming convention
-//       or directly use http plugin's channels
-//       when it gets converted to new plugin system
 module.exports = {
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
-  incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd')
+  incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
+  bodyParser: dc.channel('datadog:body-parser:read:finish'),
+  queryParser: dc.channel('datadog:query:read:finish')
 }

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -12,7 +12,7 @@ class TaintTrackingPlugin extends Plugin {
     this._type = 'taint-tracking'
     this.addSub(
       'datadog:body-parser:read:finish',
-      ({ request }) => this._taintTrackingHandler(HTTP_REQUEST_BODY, request, 'body')
+      ({ req }) => this._taintTrackingHandler(HTTP_REQUEST_BODY, req, 'body')
     )
     this.addSub(
       'datadog:qs:parse:finish',