npm - dd-trace - Versions diffs - 3.3.1 → 3.12.1 - Mend

dd-trace 3.3.1 → 3.12.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (198) hide show

package/packages/dd-trace/src/appsec/rule_manager.js CHANGED Viewed

@@ -1,8 +1,10 @@
 'use strict'
 const callbacks = require('./callbacks')
+const Gateway = require('./gateway/engine')
 const appliedCallbacks = new Map()
+const appliedAsmData = new Map()
 function applyRules (rules, config) {
   if (appliedCallbacks.has(rules)) return
@@ -13,15 +15,73 @@ function applyRules (rules, config) {
   appliedCallbacks.set(rules, callback)
 }
+function updateAsmData (action, asmData, asmDataId) {
+  if (action === 'unapply') {
+    appliedAsmData.delete(asmDataId)
+  } else {
+    appliedAsmData.set(asmDataId, asmData)
+  }
+  const mergedRuleData = mergeRuleData(appliedAsmData.values())
+  for (const callback of appliedCallbacks.values()) {
+    callback.updateRuleData(mergedRuleData)
+  }
+}
+function mergeRuleData (asmDataValues) {
+  const mergedRulesData = new Map()
+  for (const asmData of asmDataValues) {
+    if (!asmData.rules_data) continue
+    for (const rulesData of asmData.rules_data) {
+      const key = `${rulesData.id}+${rulesData.type}`
+      if (mergedRulesData.has(key)) {
+        const existingRulesData = mergedRulesData.get(key)
+        rulesData.data.reduce(rulesReducer, existingRulesData.data)
+      } else {
+        mergedRulesData.set(key, copyRulesData(rulesData))
+      }
+    }
+  }
+  return [...mergedRulesData.values()]
+}
+function rulesReducer (existingEntries, rulesDataEntry) {
+  const existingEntry = existingEntries.find((entry) => entry.value === rulesDataEntry.value)
+  if (existingEntry && !('expiration' in existingEntry)) return existingEntries
+  if (existingEntry && 'expiration' in rulesDataEntry && rulesDataEntry.expiration > existingEntry.expiration) {
+    existingEntry.expiration = rulesDataEntry.expiration
+  } else if (existingEntry && !('expiration' in rulesDataEntry)) {
+    delete existingEntry.expiration
+  } else if (!existingEntry) {
+    existingEntries.push({ ...rulesDataEntry })
+  }
+  return existingEntries
+}
+function copyRulesData (rulesData) {
+  const copy = { ...rulesData }
+  if (copy.data) {
+    const data = []
+    copy.data.forEach(item => {
+      data.push({ ...item })
+    })
+    copy.data = data
+  }
+  return copy
+}
 function clearAllRules () {
+  Gateway.manager.clear()
   for (const [key, callback] of appliedCallbacks) {
     callback.clear()
     appliedCallbacks.delete(key)
   }
+  appliedAsmData.clear()
 }
 module.exports = {
   applyRules,
-  clearAllRules
+  clearAllRules,
+  updateAsmData
 }

package/packages/dd-trace/src/appsec/templates/blocked.html ADDED Viewed

@@ -0,0 +1,99 @@
+<!-- Sorry, you’ve been blocked -->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width,initial-scale=1">
+    <title>You've been blocked</title>
+    <style>
+        a,
+        body,
+        div,
+        html,
+        span {
+            margin: 0;
+            padding: 0;
+            border: 0;
+            font-size: 100%;
+            font: inherit;
+            vertical-align: baseline
+        }
+        body {
+            background: -webkit-radial-gradient(26% 19%, circle, #fff, #f4f7f9);
+            background: radial-gradient(circle at 26% 19%, #fff, #f4f7f9);
+            display: -webkit-box;
+            display: -ms-flexbox;
+            display: flex;
+            -webkit-box-pack: center;
+            -ms-flex-pack: center;
+            justify-content: center;
+            -webkit-box-align: center;
+            -ms-flex-align: center;
+            align-items: center;
+            -ms-flex-line-pack: center;
+            align-content: center;
+            width: 100%;
+            min-height: 100vh;
+            line-height: 1;
+            flex-direction: column
+        }
+        p {
+            display: block
+        }
+        main {
+            text-align: center;
+            flex: 1;
+            display: -webkit-box;
+            display: -ms-flexbox;
+            display: flex;
+            -webkit-box-pack: center;
+            -ms-flex-pack: center;
+            justify-content: center;
+            -webkit-box-align: center;
+            -ms-flex-align: center;
+            align-items: center;
+            -ms-flex-line-pack: center;
+            align-content: center;
+            flex-direction: column
+        }
+        p {
+            font-size: 18px;
+            line-height: normal;
+            color: #646464;
+            font-family: sans-serif;
+            font-weight: 400
+        }
+        a {
+            color: #4842b7
+        }
+        footer {
+            width: 100%;
+            text-align: center
+        }
+        footer p {
+            font-size: 16px
+        }
+    </style>
+</head>
+<body>
+    <main>
+        <p>Sorry, you cannot access this page. Please contact the customer service team.</p>
+    </main>
+    <footer>
+        <p>Security provided by <a
+                href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/"
+                target="_blank">Datadog</a></p>
+    </footer>
+</body>
+</html>

package/packages/dd-trace/src/appsec/templates/blocked.json ADDED Viewed

@@ -0,0 +1,8 @@
+{
+  "errors": [
+    {
+      "title": "You've been blocked",
+      "detail": "Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."
+    }
+  ]
+}

package/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js ADDED Viewed

@@ -0,0 +1,66 @@
+'use strict'
+const AgentWriter = require('../../../exporters/agent/writer')
+const AgentlessWriter = require('../agentless/writer')
+const CoverageWriter = require('../agentless/coverage-writer')
+const CiVisibilityExporter = require('../ci-visibility-exporter')
+const AGENT_EVP_PROXY_PATH = '/evp_proxy/v2'
+function getIsEvpCompatible (err, agentInfo) {
+  return !err && agentInfo.endpoints.some(url => url.includes(AGENT_EVP_PROXY_PATH))
+}
+class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {
+  constructor (config) {
+    super(config)
+    const {
+      tags,
+      prioritySampler,
+      lookup,
+      protocolVersion,
+      headers,
+      isGitUploadEnabled
+    } = config
+    this.getAgentInfo((err, agentInfo) => {
+      this._isInitialized = true
+      const isEvpCompatible = getIsEvpCompatible(err, agentInfo)
+      if (isEvpCompatible) {
+        this._isUsingEvpProxy = true
+        this._writer = new AgentlessWriter({
+          url: this._url,
+          tags,
+          evpProxyPrefix: AGENT_EVP_PROXY_PATH
+        })
+        this._coverageWriter = new CoverageWriter({
+          url: this._url,
+          evpProxyPrefix: AGENT_EVP_PROXY_PATH
+        })
+        if (isGitUploadEnabled) {
+          this.sendGitMetadata({ url: this._url, isEvpProxy: true })
+        }
+      } else {
+        this._writer = new AgentWriter({
+          url: this._url,
+          prioritySampler,
+          lookup,
+          protocolVersion,
+          headers
+        })
+        // coverages will never be used, so we discard them
+        this._coverageBuffer = []
+      }
+      this._resolveCanUseCiVisProtocol(isEvpCompatible)
+      this.exportUncodedTraces()
+      this.exportUncodedCoverages()
+    })
+  }
+  setUrl (url, coverageUrl) {
+    this._setUrl(url, coverageUrl)
+  }
+}
+module.exports = AgentProxyCiVisibilityExporter

package/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js CHANGED Viewed

@@ -12,10 +12,11 @@ function safeJSONStringify (value) {
 }
 class Writer extends BaseWriter {
-  constructor ({ url }) {
+  constructor ({ url, evpProxyPrefix = '' }) {
     super(...arguments)
     this._url = url
     this._encoder = new CoverageCIVisibilityEncoder(this)
+    this._evpProxyPrefix = evpProxyPrefix
   }
   _sendPayload (form, _, done) {
@@ -26,12 +27,15 @@ class Writer extends BaseWriter {
         'dd-api-key': process.env.DATADOG_API_KEY || process.env.DD_API_KEY,
         ...form.getHeaders()
       },
-      timeout: 15000
+      timeout: 15000,
+      url: this._url
     }
-    options.protocol = this._url.protocol
-    options.hostname = this._url.hostname
-    options.port = this._url.port
+    if (this._evpProxyPrefix) {
+      options.path = `${this._evpProxyPrefix}/api/v2/citestcov`
+      delete options.headers['dd-api-key']
+      options.headers['X-Datadog-EVP-Subdomain'] = 'event-platform-intake'
+    }
     log.debug(() => `Request to the intake: ${safeJSONStringify(options)}`)

package/packages/dd-trace/src/ci-visibility/exporters/agentless/index.js CHANGED Viewed

@@ -3,75 +3,43 @@
 const URL = require('url').URL
 const Writer = require('./writer')
 const CoverageWriter = require('./coverage-writer')
+const CiVisibilityExporter = require('../ci-visibility-exporter')
 const log = require('../../../log')
-class AgentlessCiVisibilityExporter {
+class AgentlessCiVisibilityExporter extends CiVisibilityExporter {
   constructor (config) {
-    this._config = config
-    const { tags, site, url, isIntelligentTestRunnerEnabled } = config
-    this._isIntelligentTestRunnerEnabled = isIntelligentTestRunnerEnabled
+    super(config)
+    const { tags, site, url, isGitUploadEnabled } = config
+    // we don't need to request /info because we are using agentless by configuration
+    this._isInitialized = true
+    this._resolveCanUseCiVisProtocol(true)
     this._url = url || new URL(`https://citestcycle-intake.${site}`)
     this._writer = new Writer({ url: this._url, tags })
-    this._timer = undefined
-    this._coverageTimer = undefined
     this._coverageUrl = url || new URL(`https://event-platform-intake.${site}`)
     this._coverageWriter = new CoverageWriter({ url: this._coverageUrl })
-    process.once('beforeExit', () => {
-      this._writer.flush()
-      this._coverageWriter.flush()
-    })
-  }
+    this._apiUrl = url || new URL(`https://api.${site}`)
-  exportCoverage ({ span, coverageFiles }) {
-    const formattedCoverage = {
-      traceId: span.context()._traceId,
-      spanId: span.context()._spanId,
-      files: coverageFiles
-    }
-    this._coverageWriter.append(formattedCoverage)
-    const { flushInterval } = this._config
-    if (flushInterval === 0) {
-      this._coverageWriter.flush()
-    } else if (flushInterval > 0 && !this._coverageTimer) {
-      this._coverageTimer = setTimeout(() => {
-        this._coverageWriter.flush()
-        this._coverageTimer = clearTimeout(this._coverageTimer)
-      }, flushInterval).unref()
+    if (isGitUploadEnabled) {
+      this.sendGitMetadata({ url: this._getApiUrl() })
     }
   }
-  export (trace) {
-    this._writer.append(trace)
-    const { flushInterval } = this._config
-    if (flushInterval === 0) {
-      this._writer.flush()
-    } else if (flushInterval > 0 && !this._timer) {
-      this._timer = setTimeout(() => {
-        this._writer.flush()
-        this._timer = clearTimeout(this._timer)
-      }, flushInterval).unref()
-    }
-  }
-  setUrl (url, coverageUrl = url) {
+  setUrl (url, coverageUrl = url, apiUrl = url) {
+    this._setUrl(url, coverageUrl)
     try {
-      url = new URL(url)
-      coverageUrl = new URL(coverageUrl)
-      this._url = url
-      this._coverageUrl = coverageUrl
-      this._writer.setUrl(url)
-      this._coverageWriter.setUrl(coverageUrl)
+      apiUrl = new URL(apiUrl)
+      this._apiUrl = apiUrl
     } catch (e) {
       log.error(e)
     }
   }
+  _getApiUrl () {
+    return this._apiUrl
+  }
 }
 module.exports = AgentlessCiVisibilityExporter

package/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js CHANGED Viewed

@@ -12,11 +12,12 @@ function safeJSONStringify (value) {
 }
 class Writer extends BaseWriter {
-  constructor ({ url, tags }) {
+  constructor ({ url, tags, evpProxyPrefix = '' }) {
     super(...arguments)
     const { 'runtime-id': runtimeId, env, service } = tags
     this._url = url
     this._encoder = new AgentlessCiVisibilityEncoder(this, { runtimeId, env, service })
+    this._evpProxyPrefix = evpProxyPrefix
   }
   _sendPayload (data, _, done) {
@@ -27,14 +28,18 @@ class Writer extends BaseWriter {
         'dd-api-key': process.env.DATADOG_API_KEY || process.env.DD_API_KEY,
         'Content-Type': 'application/msgpack'
       },
-      timeout: 15000
+      timeout: 15000,
+      url: this._url
     }
-    options.protocol = this._url.protocol
-    options.hostname = this._url.hostname
-    options.port = this._url.port
+    if (this._evpProxyPrefix) {
+      options.path = `${this._evpProxyPrefix}/api/v2/citestcycle`
+      delete options.headers['dd-api-key']
+      options.headers['X-Datadog-EVP-Subdomain'] = 'citestcycle-intake'
+    }
     log.debug(() => `Request to the intake: ${safeJSONStringify(options)}`)
     request(data, options, (err, res) => {
       if (err) {
         log.error(err)

package/packages/dd-trace/src/ci-visibility/exporters/ci-visibility-exporter.js ADDED Viewed

@@ -0,0 +1,202 @@
+'use strict'
+const URL = require('url').URL
+const { sendGitMetadata: sendGitMetadataRequest } = require('./git/git_metadata')
+const { getItrConfiguration: getItrConfigurationRequest } = require('../intelligent-test-runner/get-itr-configuration')
+const { getSkippableSuites: getSkippableSuitesRequest } = require('../intelligent-test-runner/get-skippable-suites')
+const log = require('../../log')
+const AgentInfoExporter = require('../../exporters/common/agent-info-exporter')
+function getIsTestSessionTrace (trace) {
+  return trace.some(span =>
+    span.type === 'test_session_end' || span.type === 'test_suite_end'
+  )
+}
+class CiVisibilityExporter extends AgentInfoExporter {
+  constructor (config) {
+    super(config)
+    this._timer = undefined
+    this._coverageTimer = undefined
+    this._coverageBuffer = []
+    // The library can use new features like ITR and test suite level visibility
+    // AKA CI Vis Protocol
+    this._canUseCiVisProtocol = false
+    // TODO: add timeout to reject this promise
+    this._gitUploadPromise = new Promise(resolve => {
+      this._resolveGit = resolve
+    })
+    // TODO: add timeout to reject this promise
+    this._canUseCiVisProtocolPromise = new Promise(resolve => {
+      this._resolveCanUseCiVisProtocol = (canUseCiVisProtocol) => {
+        this._canUseCiVisProtocol = canUseCiVisProtocol
+        resolve(canUseCiVisProtocol)
+      }
+    })
+    process.once('beforeExit', () => {
+      if (this._writer) {
+        this._writer.flush()
+      }
+      if (this._coverageWriter) {
+        this._coverageWriter.flush()
+      }
+    })
+  }
+  shouldRequestSkippableSuites () {
+    return !!(this._config.isIntelligentTestRunnerEnabled &&
+      this._canUseCiVisProtocol &&
+      this._itrConfig &&
+      this._itrConfig.isSuitesSkippingEnabled)
+  }
+  shouldRequestItrConfiguration () {
+    return this._config.isIntelligentTestRunnerEnabled
+  }
+  canReportSessionTraces () {
+    return this._canUseCiVisProtocol
+  }
+  canReportCodeCoverage () {
+    return this._canUseCiVisProtocol
+  }
+  // We can't call the skippable endpoint until git upload has finished,
+  // hence the this._gitUploadPromise.then
+  getSkippableSuites (testConfiguration, callback) {
+    if (!this.shouldRequestSkippableSuites()) {
+      return callback(null, [])
+    }
+    this._gitUploadPromise.then(gitUploadError => {
+      if (gitUploadError) {
+        return callback(gitUploadError, [])
+      }
+      const configuration = {
+        url: this._getApiUrl(),
+        site: this._config.site,
+        env: this._config.env,
+        service: this._config.service,
+        isEvpProxy: !!this._isUsingEvpProxy,
+        ...testConfiguration
+      }
+      getSkippableSuitesRequest(configuration, callback)
+    })
+  }
+  /**
+   * We can't request ITR configuration until we know whether we can use the
+   * CI Visibility Protocol, hence the this._canUseCiVisProtocol promise.
+   */
+  getItrConfiguration (testConfiguration, callback) {
+    if (!this.shouldRequestItrConfiguration()) {
+      return callback(null, {})
+    }
+    this._canUseCiVisProtocolPromise.then((canUseCiVisProtocol) => {
+      if (!canUseCiVisProtocol) {
+        return callback(null, {})
+      }
+      const configuration = {
+        url: this._getApiUrl(),
+        env: this._config.env,
+        service: this._config.service,
+        isEvpProxy: !!this._isUsingEvpProxy,
+        ...testConfiguration
+      }
+      getItrConfigurationRequest(configuration, (err, itrConfig) => {
+        /**
+         * **Important**: this._itrConfig remains empty in testing frameworks
+         * where the tests run in a subprocess, because `getItrConfiguration` is called only once.
+         */
+        this._itrConfig = itrConfig
+        callback(err, itrConfig)
+      })
+    })
+  }
+  sendGitMetadata ({ url, isEvpProxy }) {
+    sendGitMetadataRequest(url, isEvpProxy, (err) => {
+      if (err) {
+        log.error(`Error uploading git metadata: ${err.message}`)
+      } else {
+        log.debug('Successfully uploaded git metadata')
+      }
+      this._resolveGit(err)
+    })
+  }
+  export (trace) {
+    // Until it's initialized, we just store the traces as is
+    if (!this._isInitialized) {
+      this._traceBuffer.push(trace)
+      return
+    }
+    if (!this.canReportSessionTraces() && getIsTestSessionTrace(trace)) {
+      return
+    }
+    this._export(trace)
+  }
+  exportCoverage (coveragePayload) {
+    // Until it's initialized, we just store the coverages as is
+    if (!this._isInitialized) {
+      this._coverageBuffer.push(coveragePayload)
+      return
+    }
+    if (!this.canReportCodeCoverage()) {
+      return
+    }
+    const { span, coverageFiles } = coveragePayload
+    const formattedCoverage = {
+      traceId: span.context()._traceId,
+      spanId: span.context()._spanId,
+      files: coverageFiles
+    }
+    this._export(formattedCoverage, this._coverageWriter, '_coverageTimer')
+  }
+  flush (done = () => {}) {
+    if (!this._isInitialized) {
+      return done()
+    }
+    this._writer.flush(() => {
+      if (this._coverageWriter) {
+        this._coverageWriter.flush(done)
+      } else {
+        done()
+      }
+    })
+  }
+  exportUncodedCoverages () {
+    this._coverageBuffer.forEach(oldCoveragePayload => {
+      this.exportCoverage(oldCoveragePayload)
+    })
+    this._coverageBuffer = []
+  }
+  _setUrl (url, coverageUrl = url) {
+    try {
+      url = new URL(url)
+      coverageUrl = new URL(coverageUrl)
+      this._url = url
+      this._coverageUrl = coverageUrl
+      this._writer.setUrl(url)
+      this._coverageWriter.setUrl(coverageUrl)
+    } catch (e) {
+      log.error(e)
+    }
+  }
+  _getApiUrl () {
+    return this._url
+  }
+}
+module.exports = CiVisibilityExporter