dd-trace 3.8.0 → 3.9.1

package/LICENSE-3rdparty.csv

@@ -1,6 +1,8 @@
 Component,Origin,License,Copyright
 require,@datadog/native-appsec,Apache license 2.0,Copyright 2018 Datadog Inc.
 require,@datadog/native-metrics,Apache license 2.0,Copyright 2018 Datadog Inc.
+require,@datadog/native-iast-rewriter,Apache license 2.0,Copyright 2018 Datadog Inc.
+require,@datadog/native-iast-taint-tracking,Apache license 2.0,Copyright 2018 Datadog Inc.
 require,@datadog/pprof,Apache license 2.0,Copyright 2019 Google Inc.
 require,@datadog/sketches-js,Apache license 2.0,Copyright 2020 Datadog Inc.
 require,crypto-randomuuid,MIT,Copyright 2021 Node.js Foundation and contributors

package/index.d.ts

@@ -15,7 +15,7 @@ export declare interface Tracer extends opentracing.Tracer {
    * @param {SpanOptions} [options] Options for the newly created span.
    * @returns {Span} A new Span object.
    */
-  startSpan(name: string, options?: SpanOptions): Span;
+  startSpan (name: string, options?: SpanOptions): Span;
 
   /**
    * Injects the given SpanContext instance for cross-process propagation
@@ -27,7 +27,7 @@ export declare interface Tracer extends opentracing.Tracer {
    * @param  {string} format The format of the carrier.
    * @param  {any} carrier The carrier object.
    */
-  inject(spanContext: SpanContext | Span, format: string, carrier: any): void;
+  inject (spanContext: SpanContext | Span, format: string, carrier: any): void;
 
   /**
    * Returns a SpanContext instance extracted from `carrier` in the given
@@ -38,31 +38,31 @@ export declare interface Tracer extends opentracing.Tracer {
    *         The extracted SpanContext, or null if no such SpanContext could
    *         be found in `carrier`
    */
-  extract(format: string, carrier: any): SpanContext | null;
+  extract (format: string, carrier: any): SpanContext | null;
 
   /**
    * Initializes the tracer. This should be called before importing other libraries.
    */
-  init(options?: TracerOptions): this;
+  init (options?: TracerOptions): this;
 
   /**
    * Sets the URL for the trace agent. This should only be called _after_
    * init() is called, only in cases where the URL needs to be set after
    * initialization.
    */
-  setUrl(url: string): this;
+  setUrl (url: string): this;
 
   /**
    * Enable and optionally configure a plugin.
    * @param plugin The name of a built-in plugin.
    * @param config Configuration options. Can also be `false` to disable the plugin.
    */
-  use<P extends keyof Plugins>(plugin: P, config?: Plugins[P] | boolean): this;
+  use<P extends keyof Plugins> (plugin: P, config?: Plugins[P] | boolean): this;
 
   /**
    * Returns a reference to the current scope.
    */
-  scope(): Scope;
+  scope (): Scope;
 
   /**
    * Instruments a function by automatically creating a span activated on its
@@ -81,8 +81,8 @@ export declare interface Tracer extends opentracing.Tracer {
    * If the `orphanable` option is set to false, the function will not be traced
    * unless there is already an active span or `childOf` option.
    */
-  trace<T>(name: string, fn: (span?: Span, fn?: (error?: Error) => any) => T): T;
-  trace<T>(name: string, options: TraceOptions & SpanOptions, fn: (span?: Span, done?: (error?: Error) => string) => T): T;
+  trace<T> (name: string, fn: (span?: Span, fn?: (error?: Error) => any) => T): T;
+  trace<T> (name: string, options: TraceOptions & SpanOptions, fn: (span?: Span, done?: (error?: Error) => string) => T): T;
 
   /**
    * Wrap a function to automatically create a span activated on its
@@ -98,23 +98,23 @@ export declare interface Tracer extends opentracing.Tracer {
    * * The function doesn't accept a callback and doesn't return a promise, in
    * which case the span will finish at the end of the function execution.
    */
-  wrap<T = (...args: any[]) => any>(name: string, fn: T, requiresParent?: boolean): T;
-  wrap<T = (...args: any[]) => any>(name: string, options: TraceOptions & SpanOptions, fn: T): T;
-  wrap<T = (...args: any[]) => any>(name: string, options: (...args: any[]) => TraceOptions & SpanOptions, fn: T): T;
+  wrap<T = (...args: any[]) => any> (name: string, fn: T, requiresParent?: boolean): T;
+  wrap<T = (...args: any[]) => any> (name: string, options: TraceOptions & SpanOptions, fn: T): T;
+  wrap<T = (...args: any[]) => any> (name: string, options: (...args: any[]) => TraceOptions & SpanOptions, fn: T): T;
 
   /**
    * Create and return a string that can be included in the <head> of a
    * document to enable RUM tracing to include it. The resulting string
    * should not be cached.
    */
-  getRumData(): string;
+  getRumData (): string;
 
   /**
    * Links an authenticated user to the current trace.
    * @param {User} user Properties of the authenticated user. Accepts custom fields.
    * @returns {Tracer} The Tracer instance for chaining.
    */
-  setUser(user: User): Tracer;
+  setUser (user: User): Tracer;
 }
 
 export declare interface TraceOptions extends Analyzable {
@@ -144,7 +144,7 @@ export declare interface TraceOptions extends Analyzable {
  * have children.
  */
 export declare interface Span extends opentracing.Span {
-  context(): SpanContext;
+  context (): SpanContext;
 }
 
 /**
@@ -161,12 +161,17 @@ export declare interface SpanContext extends opentracing.SpanContext {
   /**
    * Returns the string representation of the internal trace ID.
    */
-  toTraceId(): string;
+  toTraceId (): string;
 
   /**
    * Returns the string representation of the internal span ID.
    */
-  toSpanId(): string;
+  toSpanId (): string;
+
+  /**
+   * Returns the string representation used for DBM integration.
+   */
+  toTraceparent (): string;
 }
 
 /**
@@ -324,7 +329,7 @@ export declare interface TracerOptions {
    *  Number of spans before partially exporting a trace. This prevents keeping all the spans in memory for very large traces.
    * @default 1000
    */
-   flushMinSpans?: number;
+  flushMinSpans?: number;
 
   /**
    * Whether to enable runtime metrics.
@@ -377,10 +382,10 @@ export declare interface TracerOptions {
     runtimeId?: boolean
 
     /**
-     * Whether to write traces to log output, rather than send to an agent
+     * Whether to write traces to log output or agentless, rather than send to an agent
      * @default false
      */
-    exporter?: 'log' | 'agent'
+    exporter?: 'log' | 'agent' | 'datadog'
 
     /**
      * Whether to enable the experimental `getRumData` method.
@@ -391,7 +396,7 @@ export declare interface TracerOptions {
     /**
      * Configuration of the IAST. Can be a boolean as an alias to `iast.enabled`.
      */
-    iast?: boolean  | {
+    iast?: boolean | {
       /**
        * Whether to enable IAST.
        * @default false
@@ -463,6 +468,12 @@ export declare interface TracerOptions {
    */
   orphanable?: boolean
 
+  /**
+   * Enables DBM to APM link using tag injection.
+   * @default 'disabled'
+   */
+  dbmPropagationMode?: 'disabled' | 'service' | 'full'
+
   /**
    * Configuration of the AppSec protection. Can be a boolean as an alias to `appsec.enabled`.
    */
@@ -505,7 +516,7 @@ export declare interface TracerOptions {
 /**
  * User object that can be passed to `tracer.setUser()`.
  */
- export declare interface User {
+export declare interface User {
   /**
    * Unique identifier of the user.
    * Mandatory.
@@ -568,7 +579,7 @@ export declare interface Scope {
    *
    * @returns {Span} The active span.
    */
-  active(): Span | null;
+  active (): Span | null;
 
   /**
    * Activate a span in the scope of a function.
@@ -577,7 +588,7 @@ export declare interface Scope {
    * @param {Function} fn Function that will have the span activated on its scope.
    * @returns The return value of the provided function.
    */
-  activate<T>(span: Span, fn: ((...args: any[]) => T)): T;
+  activate<T> (span: Span, fn: ((...args: any[]) => T)): T;
 
   /**
    * Binds a target to the provided span, or the active span if omitted.
@@ -586,9 +597,9 @@ export declare interface Scope {
    * @param {Span} [span=scope.active()] The span to activate.
    * @returns The bound target.
    */
-  bind<T extends (...args: any[]) => void>(fn: T, span?: Span | null): T;
-  bind<V, T extends (...args: any[]) => V>(fn: T, span?: Span | null): T;
-  bind<T>(fn: Promise<T>, span?: Span | null): Promise<T>;
+  bind<T extends (...args: any[]) => void> (fn: T, span?: Span | null): T;
+  bind<V, T extends (...args: any[]) => V> (fn: T, span?: Span | null): T;
+  bind<T> (fn: Promise<T>, span?: Span | null): Promise<T>;
 }
 
 /** @hidden */
@@ -1201,7 +1212,7 @@ declare namespace plugins {
    * This plugin automatically instruments the
    * [mariadb](https://github.com/mariadb-corporation/mariadb-connector-nodejs) module.
    */
-   interface mariadb extends mysql {}
+  interface mariadb extends mysql {}
 
   /**
    * This plugin automatically instruments the
@@ -1225,7 +1236,7 @@ declare namespace plugins {
    * This plugin automatically instruments the
    * [moleculer](https://moleculer.services/) module.
    */
-   interface moleculer extends Moleculer {
+  interface moleculer extends Moleculer {
     /**
      * Configuration for Moleculer clients. Set to false to disable client
      * instrumentation.
@@ -1279,7 +1290,7 @@ declare namespace plugins {
     /**
      * Hooks to run before spans are finished.
      */
-     hooks?: {
+    hooks?: {
       /**
        * Hook to execute just before the request span finishes.
        */
@@ -1308,7 +1319,7 @@ declare namespace plugins {
    * This plugin automatically instruments the
    * [paperplane](https://github.com/articulate/paperplane) module.
    */
-   interface paperplane extends HttpServer {}
+  interface paperplane extends HttpServer {}
 
   /**
    * This plugin automatically instruments the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "3.8.0",
+  "version": "3.9.1",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -58,7 +58,9 @@
     "node": ">=14"
   },
   "dependencies": {
-    "@datadog/native-appsec": "1.3.0",
+    "@datadog/native-appsec": "2.0.0",
+    "@datadog/native-iast-rewriter": "1.0.0",
+    "@datadog/native-iast-taint-tracking": "1.0.0",
     "@datadog/native-metrics": "^1.5.0",
     "@datadog/pprof": "^1.1.1",
     "@datadog/sketches-js": "^2.1.0",

package/packages/datadog-instrumentations/src/body-parser.js

@@ -0,0 +1,26 @@
+'use strict'
+
+const { channel, addHook, AsyncResource } = require('./helpers/instrument')
+
+const bodyParserReadCh = channel('datadog:body-parser:read:finish')
+
+function publishRequestBodyAndNext (request, next) {
+  return function () {
+    if (bodyParserReadCh.hasSubscribers && request) {
+      bodyParserReadCh.publish({ request })
+    }
+    next.apply(this, arguments)
+  }
+}
+
+addHook({
+  name: 'body-parser',
+  file: 'lib/read.js',
+  versions: ['>=1']
+}, read => {
+  return function (req, res, next) {
+    const nextResource = new AsyncResource('bound-anonymous-fn')
+    arguments[2] = nextResource.bind(publishRequestBodyAndNext(req, next))
+    read.apply(this, arguments)
+  }
+})

package/packages/datadog-instrumentations/src/child-process.js

@@ -0,0 +1,30 @@
+'use strict'
+
+const {
+  channel,
+  addHook
+} = require('./helpers/instrument')
+const shimmer = require('../../datadog-shimmer')
+
+const childProcessChannel = channel('datadog:child_process:execution:start')
+const execMethods = ['exec', 'execFile', 'fork', 'spawn', 'execFileSync', 'execSync', 'spawnSync']
+const names = ['child_process', 'node:child_process']
+names.forEach(name => {
+  addHook({ name }, childProcess => {
+    shimmer.massWrap(childProcess, execMethods, wrapChildProcessMethod())
+    return childProcess
+  })
+})
+
+function wrapChildProcessMethod () {
+  function wrapMethod (childProcessMethod) {
+    return function () {
+      if (childProcessChannel.hasSubscribers && arguments.length > 0) {
+        const command = arguments[0]
+        childProcessChannel.publish({ command })
+      }
+      return childProcessMethod.apply(this, arguments)
+    }
+  }
+  return wrapMethod
+}

package/packages/datadog-instrumentations/src/connect.js

@@ -1,12 +1,13 @@
 'use strict'
 
 const shimmer = require('../../datadog-shimmer')
-const { addHook, channel, AsyncResource } = require('./helpers/instrument')
+const { addHook, channel } = require('./helpers/instrument')
 
 const enterChannel = channel('apm:connect:middleware:enter')
 const exitChannel = channel('apm:connect:middleware:exit')
 const errorChannel = channel('apm:connect:middleware:error')
 const nextChannel = channel('apm:connect:middleware:next')
+const finishChannel = channel('apm:connect:middleware:finish')
 const handleChannel = channel('apm:connect:request:handle')
 
 function wrapConnect (connect) {
@@ -61,7 +62,6 @@ function wrapLayerHandle (layer) {
   return shimmer.wrap(original, function () {
     if (!enterChannel.hasSubscribers) return original.apply(this, arguments)
 
-    const middlewareResource = new AsyncResource('bound-anonymous-fn')
     const lastIndex = arguments.length - 1
     const name = original._name || original.name
     const req = arguments[arguments.length > 3 ? 1 : 0]
@@ -71,21 +71,21 @@ function wrapLayerHandle (layer) {
       arguments[lastIndex] = wrapNext(req, next)
     }
 
-    return middlewareResource.runInAsyncScope(() => {
-      const route = layer.route
+    const route = layer.route
 
-      enterChannel.publish({ name, req, route })
+    enterChannel.publish({ name, req, route })
 
-      try {
-        return original.apply(this, arguments)
-      } catch (error) {
-        errorChannel.publish({ req, error })
-        nextChannel.publish({ req })
-        exitChannel.publish({ req })
+    try {
+      return original.apply(this, arguments)
+    } catch (error) {
+      errorChannel.publish({ req, error })
+      nextChannel.publish({ req })
+      finishChannel.publish({ req })
 
-        throw error
-      }
-    })
+      throw error
+    } finally {
+      exitChannel.publish({ req })
+    }
   })
 }
 
@@ -96,7 +96,7 @@ function wrapNext (req, next) {
     }
 
     nextChannel.publish({ req })
-    exitChannel.publish({ req })
+    finishChannel.publish({ req })
 
     next.apply(this, arguments)
   }

package/packages/datadog-instrumentations/src/cucumber.js

@@ -50,7 +50,7 @@ function wrapRun (pl, isLatestVersion) {
 
     const asyncResource = new AsyncResource('bound-anonymous-fn')
     return asyncResource.runInAsyncScope(() => {
-      runStartCh.publish({ pickleName: this.pickle.name, pickleUri: this.pickle.uri })
+      runStartCh.publish({ testName: this.pickle.name, fullTestSuite: this.pickle.uri })
       try {
         const promise = run.apply(this, arguments)
         promise.finally(() => {

package/packages/datadog-instrumentations/src/helpers/hooks.js

@@ -8,6 +8,7 @@ module.exports = {
   '@grpc/grpc-js': () => require('../grpc'),
   '@hapi/hapi': () => require('../hapi'),
   '@jest/core': () => require('../jest'),
+  '@jest/reporters': () => require('../jest'),
   '@koa/router': () => require('../koa'),
   '@node-redis/client': () => require('../redis'),
   '@opensearch-project/opensearch': () => require('../opensearch'),
@@ -16,8 +17,11 @@ module.exports = {
   'amqplib': () => require('../amqplib'),
   'aws-sdk': () => require('../aws-sdk'),
   'bluebird': () => require('../bluebird'),
+  'body-parser': () => require('../body-parser'),
   'bunyan': () => require('../bunyan'),
   'cassandra-driver': () => require('../cassandra-driver'),
+  'child_process': () => require('../child-process'),
+  'node:child_process': () => require('../child-process'),
   'connect': () => require('../connect'),
   'couchbase': () => require('../couchbase'),
   'crypto': () => require('../crypto'),
@@ -64,6 +68,7 @@ module.exports = {
   'promise-js': () => require('../promise-js'),
   'promise': () => require('../promise'),
   'q': () => require('../q'),
+  'qs': () => require('../qs'),
   'redis': () => require('../redis'),
   'restify': () => require('../restify'),
   'rhea': () => require('../rhea'),

package/packages/datadog-instrumentations/src/http/server.js

@@ -2,12 +2,12 @@
 
 const {
   channel,
-  addHook,
-  AsyncResource
+  addHook
 } = require('../helpers/instrument')
 const shimmer = require('../../../datadog-shimmer')
 
 const startServerCh = channel('apm:http:server:request:start')
+const exitServerCh = channel('apm:http:server:request:exit')
 const errorServerCh = channel('apm:http:server:request:error')
 const finishServerCh = channel('apm:http:server:request:finish')
 
@@ -45,18 +45,17 @@ function wrapEmit (emit) {
     if (eventName === 'request') {
       res.req = req
 
-      const asyncResource = new AsyncResource('bound-anonymous-fn')
-      return asyncResource.runInAsyncScope(() => {
-        startServerCh.publish({ req, res })
+      startServerCh.publish({ req, res })
 
-        try {
-          return emit.apply(this, arguments)
-        } catch (err) {
-          errorServerCh.publish(err)
+      try {
+        return emit.apply(this, arguments)
+      } catch (err) {
+        errorServerCh.publish(err)
 
-          throw err
-        }
-      })
+        throw err
+      } finally {
+        exitServerCh.publish({ req })
+      }
     }
     return emit.apply(this, arguments)
   }