dd-trace 3.3.1 → 3.12.1

package/packages/dd-trace/src/appsec/callbacks/ddwaf.js

@@ -29,9 +29,7 @@ class WAFCallback {
 
     this.wafTimeout = wafTimeout
 
-    const version = this.ddwaf.constructor.version()
-
-    Reporter.metricsQueue.set('_dd.appsec.waf.version', `${version.major}.${version.minor}.${version.patch}`)
+    Reporter.metricsQueue.set('_dd.appsec.waf.version', this.ddwaf.constructor.version())
 
     const { loaded, failed, errors } = this.ddwaf.rulesInfo
 
@@ -63,7 +61,7 @@ class WAFCallback {
 
           subscribedAddresses.add(address)
 
-          Gateway.manager.addSubscription({ addresses: [ address ], callback })
+          Gateway.manager.addSubscription({ addresses: [address], callback })
         }
       }
     }
@@ -121,14 +119,18 @@ class WAFCallback {
     if (result.data && result.data !== '[]') {
       Reporter.reportAttack(result.data, store)
     }
+
+    return result.actions
+  }
+
+  updateRuleData (ruleData) {
+    this.ddwaf.updateRuleData(ruleData)
   }
 
   clear () {
     this.ddwaf.dispose()
 
     this.wafContextCache = new WeakMap()
-
-    Gateway.manager.clear()
   }
 }
 

package/packages/dd-trace/src/appsec/gateway/engine/engine.js

@@ -28,7 +28,7 @@ class SubscriptionManager {
       const list = this.addressToSubscriptions.get(address)
 
       if (list === undefined) {
-        this.addressToSubscriptions.set(address, [ subscription ])
+        this.addressToSubscriptions.set(address, [subscription])
       } else {
         list.push(subscription)
       }

package/packages/dd-trace/src/appsec/gateway/engine/index.js

@@ -22,6 +22,10 @@ function getContext () {
   return store && store.get('context')
 }
 
+function needsAddress (address) {
+  return manager.addresses.has(address)
+}
+
 function propagate (data, context = getContext()) {
   if (!context) return
 
@@ -30,17 +34,18 @@ function propagate (data, context = getContext()) {
   for (let i = 0; i < keys.length; ++i) {
     const key = keys[i]
 
-    if (manager.addresses.has(key)) {
+    if (needsAddress(key)) {
       context.setValue(key, data[key])
     }
   }
 
-  context.dispatch()
+  return context.dispatch()
 }
 
 module.exports = {
   manager,
   startContext,
   getContext,
+  needsAddress,
   propagate
 }

package/packages/dd-trace/src/appsec/gateway/engine/runner.js

@@ -26,7 +26,6 @@ function runSubscriptions (subscriptions, params) {
       result = subscription.callback.method(params, store)
     } catch (err) {
       // TODO: log ?
-      result = {}
     }
 
     results.push(result)

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js

@@ -1,4 +1,7 @@
 module.exports = {
   'WEAK_CIPHER_ANALYZER': require('./weak-cipher-analyzer'),
-  'WEAK_HASH_ANALYZER': require('./weak-hash-analyzer')
+  'WEAK_HASH_ANALYZER': require('./weak-hash-analyzer'),
+  'SQL_INJECTION_ANALYZER': require('./sql-injection-analyzer'),
+  'COMMAND_INJECTION_ANALYZER': require('./command-injection-analyzer'),
+  'LDAP_ANALYZER': require('./ldap-injection-analyzer')
 }

package/packages/dd-trace/src/appsec/iast/analyzers/command-injection-analyzer.js

@@ -0,0 +1,11 @@
+'use strict'
+const InjectionAnalyzer = require('./injection-analyzer')
+
+class CommandInjectionAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super('COMMAND_INJECTION')
+    this.addSub('datadog:child_process:execution:start', ({ command }) => this.analyze(command))
+  }
+}
+
+module.exports = new CommandInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/injection-analyzer.js

@@ -0,0 +1,19 @@
+'use strict'
+const Analyzer = require('./vulnerability-analyzer')
+const { isTainted, getRanges } = require('../taint-tracking/operations')
+
+class InjectionAnalyzer extends Analyzer {
+  _isVulnerable (value, iastContext) {
+    if (value) {
+      return isTainted(iastContext, value)
+    }
+    return false
+  }
+
+  _getEvidence (value, iastContext) {
+    const ranges = getRanges(iastContext, value)
+    return { value, ranges }
+  }
+}
+
+module.exports = InjectionAnalyzer

package/packages/dd-trace/src/appsec/iast/analyzers/ldap-injection-analyzer.js

@@ -0,0 +1,11 @@
+'use strict'
+const InjectionAnalyzer = require('./injection-analyzer')
+
+class LdapInjectionAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super('LDAP_INJECTION')
+    this.addSub('datadog:ldapjs:client:search', ({ base, filter }) => this.analyzeAll(base, filter))
+  }
+}
+
+module.exports = new LdapInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/sql-injection-analyzer.js

@@ -0,0 +1,13 @@
+'use strict'
+const InjectionAnalyzer = require('./injection-analyzer')
+
+class SqlInjectionAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super('SQL_INJECTION')
+    this.addSub('apm:mysql:query:start', ({ sql }) => this.analyze(sql))
+    this.addSub('apm:mysql2:query:start', ({ sql }) => this.analyze(sql))
+    this.addSub('apm:pg:query:start', ({ originalQuery }) => this.analyze(originalQuery))
+  }
+}
+
+module.exports = new SqlInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/analyzers/vulnerability-analyzer.js

@@ -2,7 +2,8 @@
 
 const Plugin = require('../../../../src/plugins/plugin')
 const { storage } = require('../../../../../datadog-core')
-const { getFirstNonDDPathAndLine } = require('./../path-line')
+const log = require('../../../log')
+const { getFirstNonDDPathAndLine } = require('../path-line')
 const { createVulnerability, addVulnerability } = require('../vulnerability-reporter')
 const { getIastContext } = require('../iast-context')
 const overheadController = require('../overhead-controller')
@@ -13,18 +14,40 @@ class Analyzer extends Plugin {
     this._type = type
   }
 
+  _wrapHandler (handler) {
+    return (message, name) => {
+      try {
+        handler(message, name)
+      } catch (e) {
+        log.debug(e)
+      }
+    }
+  }
+
+  addSub (channelName, handler) {
+    super.addSub(channelName, this._wrapHandler(handler))
+  }
+
   _isVulnerable (value, context) {
     return false
   }
 
   _report (value, context) {
-    const evidence = this._getEvidence(value)
+    const evidence = this._getEvidence(value, context)
     const location = this._getLocation()
     const spanId = context && context.rootSpan && context.rootSpan.context().toSpanId()
     const vulnerability = createVulnerability(this._type, evidence, spanId, location)
     addVulnerability(context, vulnerability)
   }
 
+  _reportIfVulnerable (value, context) {
+    if (this._isVulnerable(value, context) && this._checkOCE(context)) {
+      this._report(value, context)
+      return true
+    }
+    return false
+  }
+
   _getEvidence (value) {
     return { value }
   }
@@ -34,9 +57,24 @@ class Analyzer extends Plugin {
   }
 
   analyze (value) {
-    const iastContext = getIastContext(storage.getStore())
-    if (iastContext && this._isVulnerable(value, iastContext) && this._checkOCE(iastContext)) {
-      this._report(value, iastContext)
+    const store = storage.getStore()
+    const iastContext = getIastContext(store)
+    if (store && !iastContext) return
+    this._reportIfVulnerable(value, iastContext)
+  }
+
+  analyzeAll (...values) {
+    const store = storage.getStore()
+    const iastContext = getIastContext(store)
+    if (store && !iastContext) return
+    for (let i = 0; i < values.length; i++) {
+      const value = values[i]
+      if (this._isVulnerable(value, iastContext)) {
+        if (this._checkOCE(iastContext)) {
+          this._report(value, iastContext)
+        }
+        break
+      }
     }
   }
 

package/packages/dd-trace/src/appsec/iast/iast-context.js

@@ -1,4 +1,5 @@
 const IAST_CONTEXT_KEY = Symbol('_dd.iast.context')
+const IAST_TRANSACTION_ID = Symbol('_dd.iast.transactionId')
 
 function getIastContext (store) {
   return store && store[IAST_CONTEXT_KEY]
@@ -46,5 +47,6 @@ module.exports = {
   getIastContext,
   saveIastContext,
   cleanIastContext,
-  IAST_CONTEXT_KEY
+  IAST_CONTEXT_KEY,
+  IAST_TRANSACTION_ID
 }

package/packages/dd-trace/src/appsec/iast/index.js

@@ -1,25 +1,33 @@
-const { sendVulnerabilities } = require('./vulnerability-reporter')
+const { sendVulnerabilities, setTracer } = require('./vulnerability-reporter')
 const { enableAllAnalyzers, disableAllAnalyzers } = require('./analyzers')
 const web = require('../../plugins/util/web')
 const { storage } = require('../../../../datadog-core')
 const overheadController = require('./overhead-controller')
 const dc = require('diagnostics_channel')
-const { saveIastContext, getIastContext, cleanIastContext } = require('./iast-context')
+const iastContextFunctions = require('./iast-context')
+const { enableTaintTracking, disableTaintTracking, createTransaction, removeTransaction } = require('./taint-tracking')
+
+const IAST_ENABLED_TAG_KEY = '_dd.iast.enabled'
 
 // TODO Change to `apm:http:server:request:[start|close]` when the subscription
 //  order of the callbacks can be enforce
 const requestStart = dc.channel('dd-trace:incomingHttpRequestStart')
 const requestClose = dc.channel('dd-trace:incomingHttpRequestEnd')
 
-function enable (config) {
+function enable (config, _tracer) {
   enableAllAnalyzers()
+  enableTaintTracking()
   requestStart.subscribe(onIncomingHttpRequestStart)
   requestClose.subscribe(onIncomingHttpRequestEnd)
   overheadController.configure(config.iast)
+  overheadController.startGlobalContext()
+  setTracer(_tracer)
 }
 
 function disable () {
   disableAllAnalyzers()
+  disableTaintTracking()
+  overheadController.finishGlobalContext()
   if (requestStart.hasSubscribers) requestStart.unsubscribe(onIncomingHttpRequestStart)
   if (requestClose.hasSubscribers) requestClose.unsubscribe(onIncomingHttpRequestEnd)
 }
@@ -33,9 +41,15 @@ function onIncomingHttpRequestStart (data) {
         const rootSpan = topContext.span
         const isRequestAcquired = overheadController.acquireRequest(rootSpan)
         if (isRequestAcquired) {
-          const iastContext = saveIastContext(store, topContext, { rootSpan, req: data.req })
+          const iastContext = iastContextFunctions.saveIastContext(store, topContext, { rootSpan, req: data.req })
+          createTransaction(rootSpan.context().toSpanId(), iastContext)
           overheadController.initializeRequestContext(iastContext)
         }
+        if (rootSpan.addTags) {
+          rootSpan.addTags({
+            [IAST_ENABLED_TAG_KEY]: isRequestAcquired ? '1' : '0'
+          })
+        }
       }
     }
   }
@@ -44,13 +58,15 @@ function onIncomingHttpRequestStart (data) {
 function onIncomingHttpRequestEnd (data) {
   if (data && data.req) {
     const store = storage.getStore()
-    const iastContext = getIastContext(storage.getStore())
+    const iastContext = iastContextFunctions.getIastContext(storage.getStore())
     if (iastContext && iastContext.rootSpan) {
-      overheadController.releaseRequest()
-      sendVulnerabilities(iastContext, iastContext.rootSpan)
+      const vulnerabilities = iastContext.vulnerabilities
+      const rootSpan = iastContext.rootSpan
+      sendVulnerabilities(vulnerabilities, rootSpan)
+      removeTransaction(iastContext)
     }
     // TODO web.getContext(data.req) is required when the request is aborted
-    if (cleanIastContext(store, web.getContext(data.req), iastContext)) {
+    if (iastContextFunctions.cleanIastContext(store, web.getContext(data.req), iastContext)) {
       overheadController.releaseRequest()
     }
   }

package/packages/dd-trace/src/appsec/iast/overhead-controller.js

@@ -2,8 +2,11 @@
 
 const OVERHEAD_CONTROLLER_CONTEXT_KEY = 'oce'
 const REPORT_VULNERABILITY = 'REPORT_VULNERABILITY'
+const INTERVAL_RESET_GLOBAL_CONTEXT = 60 * 1000
 
 const GLOBAL_OCE_CONTEXT = {}
+
+let resetGlobalContextInterval
 let config = {}
 let availableRequest = 0
 const OPERATIONS = {
@@ -80,11 +83,27 @@ function configure (cfg) {
   availableRequest = config.maxConcurrentRequests
 }
 
-_resetGlobalContext()
+function startGlobalContext () {
+  if (resetGlobalContextInterval) return
+  _resetGlobalContext()
+  resetGlobalContextInterval = setInterval(() => {
+    _resetGlobalContext()
+  }, INTERVAL_RESET_GLOBAL_CONTEXT)
+  resetGlobalContextInterval.unref && resetGlobalContextInterval.unref()
+}
+
+function finishGlobalContext () {
+  if (resetGlobalContextInterval) {
+    clearInterval(resetGlobalContextInterval)
+    resetGlobalContextInterval = null
+  }
+}
 
 module.exports = {
   OVERHEAD_CONTROLLER_CONTEXT_KEY,
   OPERATIONS,
+  startGlobalContext,
+  finishGlobalContext,
   _resetGlobalContext,
   initializeRequestContext,
   hasQuota,

package/packages/dd-trace/src/appsec/iast/path-line.js

@@ -1,4 +1,5 @@
 const path = require('path')
+const process = require('process')
 const pathLine = {
   getFirstNonDDPathAndLine,
   getFirstNonDDPathAndLineFromCallsites, // Exported only for test purposes
@@ -7,28 +8,35 @@ const pathLine = {
 }
 
 const EXCLUDED_PATHS = [
-  '/node_modules/diagnostics_channel'
+  path.join(path.sep, 'node_modules', 'diagnostics_channel')
 ]
 const EXCLUDED_PATH_PREFIXES = [
   'node:diagnostics_channel',
-  'diagnostics_channel'
+  'diagnostics_channel',
+  'node:child_process',
+  'child_process',
+  'node:async_hooks',
+  'async_hooks'
 ]
 
 function calculateDDBasePath (dirname) {
   const dirSteps = dirname.split(path.sep)
-  const packagesIndex = dirSteps.indexOf('packages')
+  const packagesIndex = dirSteps.lastIndexOf('packages')
   return dirSteps.slice(0, packagesIndex).join(path.sep) + path.sep
 }
 
 function getCallSiteInfo () {
   const previousPrepareStackTrace = Error.prepareStackTrace
+  const previousStackTraceLimit = Error.stackTraceLimit
   let callsiteList
+  Error.stackTraceLimit = 100
   Error.prepareStackTrace = function (_, callsites) {
     callsiteList = callsites
   }
   const e = new Error()
   e.stack
   Error.prepareStackTrace = previousPrepareStackTrace
+  Error.stackTraceLimit = previousStackTraceLimit
   return callsiteList
 }
 
@@ -36,10 +44,10 @@ function getFirstNonDDPathAndLineFromCallsites (callsites) {
   if (callsites) {
     for (let i = 0; i < callsites.length; i++) {
       const callsite = callsites[i]
-      const path = callsite.getFileName()
-      if (!isExcluded(callsite) && path.indexOf(pathLine.ddBasePath) === -1) {
+      const filepath = callsite.getFileName()
+      if (!isExcluded(callsite) && filepath.indexOf(pathLine.ddBasePath) === -1) {
         return {
-          path,
+          path: path.relative(process.cwd(), filepath),
           line: callsite.getLineNumber()
         }
       }
@@ -51,6 +59,9 @@ function getFirstNonDDPathAndLineFromCallsites (callsites) {
 function isExcluded (callsite) {
   if (callsite.isNative()) return true
   const filename = callsite.getFileName()
+  if (!filename) {
+    return true
+  }
   for (let i = 0; i < EXCLUDED_PATHS.length; i++) {
     if (filename.indexOf(EXCLUDED_PATHS[i]) > -1) {
       return true

package/packages/dd-trace/src/appsec/iast/taint-tracking/csi-methods.js

@@ -0,0 +1,17 @@
+'use strict'
+
+const csiMethods = [
+  { src: 'plusOperator', operator: true },
+  { src: 'trim' },
+  { src: 'trimStart', dst: 'trim' },
+  { src: 'trimEnd' },
+  { src: 'concat' },
+  { src: 'substring' },
+  { src: 'substr' },
+  { src: 'slice' },
+  { src: 'replace' }
+]
+
+module.exports = {
+  csiMethods
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/filter.js

@@ -0,0 +1,16 @@
+'use strict'
+
+const NODE_MODULES = 'node_modules'
+
+const isPrivateModule = function (file) {
+  return file && file.indexOf(NODE_MODULES) === -1
+}
+
+const isNotLibraryFile = function (file) {
+  return file && file.indexOf('dd-trace-js') === -1 && file.indexOf('dd-trace') === -1
+}
+
+module.exports = {
+  isPrivateModule,
+  isNotLibraryFile
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/index.js

@@ -0,0 +1,18 @@
+const { enableRewriter, disableRewriter } = require('./rewriter')
+const { createTransaction, removeTransaction, enableTaintOperations, disableTaintOperations } = require('./operations')
+const taintTrackingPlugin = require('./plugin')
+
+module.exports = {
+  enableTaintTracking () {
+    enableRewriter()
+    enableTaintOperations()
+    taintTrackingPlugin.enable()
+  },
+  disableTaintTracking () {
+    disableRewriter()
+    disableTaintOperations()
+    taintTrackingPlugin.disable()
+  },
+  createTransaction: createTransaction,
+  removeTransaction: removeTransaction
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/operations.js

@@ -0,0 +1,98 @@
+const TaintedUtils = require('@datadog/native-iast-taint-tracking')
+const { IAST_TRANSACTION_ID } = require('../iast-context')
+const { TaintTracking, TaintTrackingDummy } = require('./taint-tracking-impl')
+
+function createTransaction (id, iastContext) {
+  if (id && iastContext) {
+    iastContext[IAST_TRANSACTION_ID] = TaintedUtils.createTransaction(id)
+  }
+}
+
+function removeTransaction (iastContext) {
+  if (iastContext && iastContext[IAST_TRANSACTION_ID]) {
+    const transactionId = iastContext[IAST_TRANSACTION_ID]
+    TaintedUtils.removeTransaction(transactionId)
+    delete iastContext[IAST_TRANSACTION_ID]
+  }
+}
+
+function newTaintedString (iastContext, string, name, type) {
+  let result = string
+  if (iastContext && iastContext[IAST_TRANSACTION_ID]) {
+    const transactionId = iastContext[IAST_TRANSACTION_ID]
+    result = TaintedUtils.newTaintedString(transactionId, string, name, type)
+  } else {
+    result = string
+  }
+  return result
+}
+
+function taintObject (iastContext, object, type) {
+  let result = object
+  if (iastContext && iastContext[IAST_TRANSACTION_ID]) {
+    const transactionId = iastContext[IAST_TRANSACTION_ID]
+    const queue = [{ parent: null, property: null, value: object }]
+    const visited = new WeakSet()
+    while (queue.length > 0) {
+      const { parent, property, value } = queue.pop()
+      if (typeof value === 'string') {
+        const tainted = TaintedUtils.newTaintedString(transactionId, value, property, type)
+        if (!parent) {
+          result = tainted
+        } else {
+          parent[property] = tainted
+        }
+      } else if (typeof value === 'object' && !visited.has(value)) {
+        visited.add(value)
+        const keys = Object.keys(value)
+        for (let i = 0; i < keys.length; i++) {
+          const key = keys[i]
+          queue.push({ parent: value, property: property ? `${property}.${key}` : key, value: value[key] })
+        }
+      }
+    }
+  }
+  return result
+}
+
+function isTainted (iastContext, string) {
+  let result = false
+  if (iastContext && iastContext[IAST_TRANSACTION_ID]) {
+    const transactionId = iastContext[IAST_TRANSACTION_ID]
+    result = TaintedUtils.isTainted(transactionId, string)
+  } else {
+    result = false
+  }
+  return result
+}
+
+function getRanges (iastContext, string) {
+  let result = []
+  if (iastContext && iastContext[IAST_TRANSACTION_ID]) {
+    const transactionId = iastContext[IAST_TRANSACTION_ID]
+    result = TaintedUtils.getRanges(transactionId, string)
+  } else {
+    result = []
+  }
+  return result
+}
+
+function enableTaintOperations () {
+  global._ddiast = TaintTracking
+}
+
+function disableTaintOperations () {
+  global._ddiast = TaintTrackingDummy
+}
+
+module.exports = {
+  createTransaction,
+  removeTransaction,
+  newTaintedString,
+  taintObject,
+  isTainted,
+  getRanges,
+  enableTaintOperations,
+  disableTaintOperations,
+  IAST_TRANSACTION_ID
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/origin-types.js

@@ -0,0 +1,4 @@
+module.exports = {
+  HTTP_REQUEST_BODY: 'http.request.body',
+  HTTP_REQUEST_PARAMETER: 'http.request.parameter'
+}

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -0,0 +1,38 @@
+const Plugin = require('../../../plugins/plugin')
+const { getIastContext } = require('../iast-context')
+const { storage } = require('../../../../../datadog-core')
+const { HTTP_REQUEST_PARAMETER, HTTP_REQUEST_BODY } = require('./origin-types')
+const { taintObject } = require('./operations')
+
+class TaintTrackingPlugin extends Plugin {
+  constructor () {
+    super()
+    this._type = 'taint-tracking'
+    this.addSub(
+      'datadog:body-parser:read:finish',
+      ({ request }) => this._taintTrackingHandler(HTTP_REQUEST_BODY, request, 'body')
+    )
+    this.addSub(
+      'datadog:qs:parse:finish',
+      ({ qs }) => this._taintTrackingHandler(HTTP_REQUEST_PARAMETER, qs))
+  }
+
+  _taintTrackingHandler (type, target, property) {
+    const iastContext = getIastContext(storage.getStore())
+    if (!property) {
+      target = taintObject(iastContext, target, type)
+    } else {
+      target[property] = taintObject(iastContext, target[property], type)
+    }
+  }
+
+  enable () {
+    this.configure(true)
+  }
+
+  disable () {
+    this.configure(false)
+  }
+}
+
+module.exports = new TaintTrackingPlugin()