dd-trace 3.38.1 → 3.40.0

package/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js

@@ -7,6 +7,7 @@ const { getNodeModulesPaths } = require('../path-line')
 const { getNextSecureMark } = require('../taint-tracking/secure-marks-generator')
 const { storage } = require('../../../../../datadog-core')
 const { getIastContext } = require('../iast-context')
+const { HTTP_REQUEST_PARAMETER, HTTP_REQUEST_BODY } = require('../taint-tracking/source-types')
 
 const EXCLUDED_PATHS_FROM_STACK = getNodeModulesPaths('mongodb', 'mongoose')
 const MONGODB_NOSQL_SECURE_MARK = getNextSecureMark()
@@ -113,6 +114,12 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
     })
   }
 
+  _isVulnerableRange (range) {
+    const rangeType = range?.iinfo?.type
+    const isVulnerableType = rangeType === HTTP_REQUEST_PARAMETER || rangeType === HTTP_REQUEST_BODY
+    return isVulnerableType && (range.secureMarks & MONGODB_NOSQL_SECURE_MARK) !== MONGODB_NOSQL_SECURE_MARK
+  }
+
   _isVulnerable (value, iastContext) {
     if (value?.filter && iastContext) {
       let isVulnerable = false
@@ -124,13 +131,13 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
       const rangesByKey = {}
       const allRanges = []
 
-      iterateObjectStrings(value.filter, function (val, nextLevelKeys) {
+      iterateObjectStrings(value.filter, (val, nextLevelKeys) => {
         const ranges = getRanges(iastContext, val)
         if (ranges?.length) {
           const filteredRanges = []
 
           for (const range of ranges) {
-            if ((range.secureMarks & MONGODB_NOSQL_SECURE_MARK) !== MONGODB_NOSQL_SECURE_MARK) {
+            if (this._isVulnerableRange(range)) {
               isVulnerable = true
               filteredRanges.push(range)
             }

package/packages/dd-trace/src/appsec/iast/analyzers/xcontenttype-header-missing-analyzer.js

@@ -11,8 +11,8 @@ class XcontenttypeHeaderMissingAnalyzer extends MissingHeaderAnalyzer {
   }
 
   _isVulnerableFromRequestAndResponse (req, res) {
-    const headerToCheck = res.getHeader(XCONTENTTYPEOPTIONS_HEADER_NAME)
-    return !headerToCheck || headerToCheck.trim().toLowerCase() !== 'nosniff'
+    const headerValues = this._getHeaderValues(res, XCONTENTTYPEOPTIONS_HEADER_NAME)
+    return headerValues.length === 0 || headerValues.some(headerValue => headerValue.trim().toLowerCase() !== 'nosniff')
   }
 }
 

package/packages/dd-trace/src/appsec/iast/iast-log.js

@@ -1,9 +1,11 @@
 'use strict'
 
+const dc = require('dc-polyfill')
 const log = require('../../log')
-const telemetryLogs = require('./telemetry/log')
 const { calculateDDBasePath } = require('../../util')
 
+const telemetryLog = dc.channel('datadog:telemetry:log')
+
 const ddBasePath = calculateDDBasePath(__dirname)
 const EOL = '\n'
 const STACK_FRAME_LINE_REGEX = /^\s*at\s/gm
@@ -80,9 +82,8 @@ const iastLog = {
   },
 
   publish (data, level) {
-    if (telemetryLogs.isLevelEnabled(level)) {
-      const telemetryLog = getTelemetryLog(data, level)
-      telemetryLogs.publish(telemetryLog)
+    if (telemetryLog.hasSubscribers) {
+      telemetryLog.publish(getTelemetryLog(data, level))
     }
     return this
   },
@@ -92,6 +93,10 @@ const iastLog = {
     return this.publish(data, 'DEBUG')
   },
 
+  /**
+   * forward 'INFO' log level to 'DEBUG' telemetry log level
+   * see also {@link ../../telemetry/logs#isLevelEnabled } method
+   */
   infoAndPublish (data) {
     this.info(data)
     return this.publish(data, 'DEBUG')

package/packages/dd-trace/src/appsec/iast/iast-plugin.js

@@ -1,6 +1,6 @@
 'use strict'
 
-const { channel } = require('../../../../diagnostics_channel')
+const { channel } = require('dc-polyfill')
 
 const iastLog = require('./iast-log')
 const Plugin = require('../../plugins/plugin')

package/packages/dd-trace/src/appsec/iast/index.js

@@ -3,7 +3,7 @@ const { enableAllAnalyzers, disableAllAnalyzers } = require('./analyzers')
 const web = require('../../plugins/util/web')
 const { storage } = require('../../../../datadog-core')
 const overheadController = require('./overhead-controller')
-const dc = require('../../../../diagnostics_channel')
+const dc = require('dc-polyfill')
 const iastContextFunctions = require('./iast-context')
 const {
   enableTaintTracking,

package/packages/dd-trace/src/appsec/iast/path-line.js

@@ -6,13 +6,14 @@ const { calculateDDBasePath } = require('../../util')
 const pathLine = {
   getFirstNonDDPathAndLine,
   getNodeModulesPaths,
+  getRelativePath,
   getFirstNonDDPathAndLineFromCallsites, // Exported only for test purposes
   calculateDDBasePath, // Exported only for test purposes
   ddBasePath: calculateDDBasePath(__dirname) // Only for test purposes
 }
 
 const EXCLUDED_PATHS = [
-  path.join(path.sep, 'node_modules', 'diagnostics_channel')
+  path.join(path.sep, 'node_modules', 'dc-polyfill')
 ]
 const EXCLUDED_PATH_PREFIXES = [
   'node:diagnostics_channel',
@@ -45,7 +46,7 @@ function getFirstNonDDPathAndLineFromCallsites (callsites, externallyExcludedPat
       const filepath = callsite.getFileName()
       if (!isExcluded(callsite, externallyExcludedPaths) && filepath.indexOf(pathLine.ddBasePath) === -1) {
         return {
-          path: path.relative(process.cwd(), filepath),
+          path: getRelativePath(filepath),
           line: callsite.getLineNumber(),
           column: callsite.getColumnNumber(),
           isInternal: !path.isAbsolute(filepath)
@@ -56,6 +57,10 @@ function getFirstNonDDPathAndLineFromCallsites (callsites, externallyExcludedPat
   return null
 }
 
+function getRelativePath (filepath) {
+  return path.relative(process.cwd(), filepath)
+}
+
 function isExcluded (callsite, externallyExcludedPaths) {
   if (callsite.isNative()) return true
   const filename = callsite.getFileName()

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js

@@ -7,7 +7,9 @@ const { isPrivateModule, isNotLibraryFile } = require('./filter')
 const { csiMethods } = require('./csi-methods')
 const { getName } = require('../telemetry/verbosity')
 const { getRewriteFunction } = require('./rewriter-telemetry')
+const dc = require('dc-polyfill')
 
+const hardcodedSecretCh = dc.channel('datadog:secrets:result')
 let rewriter
 let getPrepareStackTrace
 
@@ -50,7 +52,11 @@ function getRewriter (telemetryVerbosity) {
           getGetOriginalPathAndLineFromSourceMapFunction(chainSourceMap, getOriginalPathAndLineFromSourceMap)
       }
 
-      rewriter = new Rewriter({ csiMethods, telemetryVerbosity: getName(telemetryVerbosity), chainSourceMap })
+      rewriter = new Rewriter({
+        csiMethods,
+        telemetryVerbosity: getName(telemetryVerbosity),
+        chainSourceMap
+      })
     } catch (e) {
       iastLog.error('Unable to initialize TaintTracking Rewriter')
         .errorAndPublish(e)
@@ -80,7 +86,12 @@ function getCompileMethodFn (compileMethod) {
     try {
       if (isPrivateModule(filename) && isNotLibraryFile(filename)) {
         const rewritten = rewriteFn(content, filename)
-        if (rewritten && rewritten.content) {
+
+        if (rewritten?.literalsResult && hardcodedSecretCh.hasSubscribers) {
+          hardcodedSecretCh.publish(rewritten.literalsResult)
+        }
+
+        if (rewritten?.content) {
           return compileMethod.apply(this, [rewritten.content, filename])
         }
       }

package/packages/dd-trace/src/appsec/iast/telemetry/index.js

@@ -1,21 +1,12 @@
 'use strict'
 
 const telemetryMetrics = require('../../../telemetry/metrics')
-const telemetryLogs = require('./log')
 const { Verbosity, getVerbosity } = require('./verbosity')
 const { initRequestNamespace, finalizeRequestNamespace, globalNamespace } = require('./namespaces')
 
-function isIastMetricsEnabled (metrics) {
-  // TODO: let DD_TELEMETRY_METRICS_ENABLED as undefined in config.js to avoid read here the env property
-  return process.env.DD_TELEMETRY_METRICS_ENABLED !== undefined ? metrics : true
-}
-
 class Telemetry {
   configure (config, verbosity) {
-    const telemetryAndMetricsEnabled = config &&
-      config.telemetry &&
-      config.telemetry.enabled &&
-      isIastMetricsEnabled(config.telemetry.metrics)
+    const telemetryAndMetricsEnabled = config?.telemetry?.enabled && config.telemetry.metrics
 
     this.verbosity = telemetryAndMetricsEnabled ? getVerbosity(verbosity) : Verbosity.OFF
     this.enabled = this.verbosity !== Verbosity.OFF
@@ -23,15 +14,11 @@ class Telemetry {
     if (this.enabled) {
       telemetryMetrics.manager.set('iast', globalNamespace)
     }
-
-    telemetryLogs.start()
   }
 
   stop () {
     this.enabled = false
     telemetryMetrics.manager.delete('iast')
-
-    telemetryLogs.stop()
   }
 
   isEnabled () {

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const iastLog = require('../../iast-log')
 const vulnerabilities = require('../../vulnerabilities')
 
 const { contains, intersects, remove } = require('./range-utils')
@@ -263,6 +264,24 @@ class SensitiveHandler {
       valueParts.push({ redacted: true })
     }
   }
+
+  setRedactionPatterns (redactionNamePattern, redactionValuePattern) {
+    if (redactionNamePattern) {
+      try {
+        this._namePattern = new RegExp(redactionNamePattern, 'gmi')
+      } catch (e) {
+        iastLog.warn('Redaction name pattern is not valid')
+      }
+    }
+
+    if (redactionValuePattern) {
+      try {
+        this._valuePattern = new RegExp(redactionValuePattern, 'gmi')
+      } catch (e) {
+        iastLog.warn('Redaction value pattern is not valid')
+      }
+    }
+  }
 }
 
 module.exports = new SensitiveHandler()

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/index.js

@@ -8,8 +8,9 @@ class VulnerabilityFormatter {
     this._redactVulnearbilities = true
   }
 
-  setRedactVulnerabilities (shouldRedactVulnerabilities) {
+  setRedactVulnerabilities (shouldRedactVulnerabilities, redactionNamePattern, redactionValuePattern) {
     this._redactVulnearbilities = shouldRedactVulnerabilities
+    sensitiveHandler.setRedactionPatterns(redactionNamePattern, redactionValuePattern)
   }
 
   extractSourcesFromVulnerability (vulnerability) {

package/packages/dd-trace/src/appsec/iast/vulnerabilities.js

@@ -1,5 +1,6 @@
 module.exports = {
   COMMAND_INJECTION: 'COMMAND_INJECTION',
+  HARDCODED_SECRET: 'HARDCODED_SECRET',
   HSTS_HEADER_MISSING: 'HSTS_HEADER_MISSING',
   INSECURE_COOKIE: 'INSECURE_COOKIE',
   LDAP_INJECTION: 'LDAP_INJECTION',

package/packages/dd-trace/src/appsec/iast/vulnerability-reporter.js

@@ -95,7 +95,11 @@ function deduplicateVulnerabilities (vulnerabilities) {
 
 function start (config, _tracer) {
   deduplicationEnabled = config.iast.deduplicationEnabled
-  vulnerabilitiesFormatter.setRedactVulnerabilities(config.iast.redactionEnabled)
+  vulnerabilitiesFormatter.setRedactVulnerabilities(
+    config.iast.redactionEnabled,
+    config.iast.redactionNamePattern,
+    config.iast.redactionValuePattern
+  )
   if (deduplicationEnabled) {
     startClearCacheTimer()
   }