npm - dd-trace - Versions diffs - 4.18.0 → 4.22.0 - Mend

dd-trace 4.18.0 → 4.22.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (110) hide show

package/packages/dd-trace/src/appsec/activation.js ADDED Viewed

@@ -0,0 +1,29 @@
+'use strict'
+const Activation = {
+  ONECLICK: 'OneClick',
+  ENABLED: 'Enabled',
+  DISABLED: 'Disabled',
+  fromConfig (config) {
+    switch (config.appsec.enabled) {
+      // ASM is activated by an env var DD_APPSEC_ENABLED=true
+      case true:
+        return Activation.ENABLED
+      // ASM is disabled by an env var DD_APPSEC_ENABLED=false
+      case false:
+        return Activation.DISABLED
+      // ASM is activated by one click remote config
+      case undefined:
+        return Activation.ONECLICK
+      // Any other value should never occur
+      default:
+        return Activation.DISABLED
+    }
+  }
+}
+module.exports = Activation

package/packages/dd-trace/src/appsec/addresses.js CHANGED Viewed

@@ -13,8 +13,10 @@ module.exports = {
   HTTP_INCOMING_RESPONSE_HEADERS: 'server.response.headers.no_cookies',
   // TODO: 'server.response.trailers',
   HTTP_INCOMING_GRAPHQL_RESOLVERS: 'graphql.server.all_resolvers',
+  HTTP_INCOMING_GRAPHQL_RESOLVER: 'graphql.server.resolver',
   HTTP_CLIENT_IP: 'http.client_ip',
-  USER_ID: 'usr.id'
+  USER_ID: 'usr.id',
+  WAF_CONTEXT_PROCESSOR: 'waf.context.processor'
 }

package/packages/dd-trace/src/appsec/api_security_sampler.js ADDED Viewed

@@ -0,0 +1,48 @@
+'use strict'
+const log = require('../log')
+let enabled
+let requestSampling
+function configure ({ apiSecurity }) {
+  enabled = apiSecurity.enabled
+  setRequestSampling(apiSecurity.requestSampling)
+}
+function disable () {
+  enabled = false
+}
+function setRequestSampling (sampling) {
+  requestSampling = parseRequestSampling(sampling)
+}
+function parseRequestSampling (requestSampling) {
+  let parsed = parseFloat(requestSampling)
+  if (isNaN(parsed)) {
+    log.warn(`Incorrect API Security request sampling value: ${requestSampling}`)
+    parsed = 0
+  } else {
+    parsed = Math.min(1, Math.max(0, parsed))
+  }
+  return parsed
+}
+function sampleRequest () {
+  if (!enabled || !requestSampling) {
+    return false
+  }
+  return Math.random() <= requestSampling
+}
+module.exports = {
+  configure,
+  disable,
+  setRequestSampling,
+  sampleRequest
+}

package/packages/dd-trace/src/appsec/blocked_templates.js CHANGED Viewed

@@ -5,7 +5,10 @@ const html = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta n
 const json = `{"errors":[{"title":"You've been blocked","detail":"Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}`
+const graphqlJson = `{"errors":[{"message":"You've been blocked","extensions":{"detail":"Sorry, you cannot perform this operation. Please contact the customer service team. Security provided by Datadog."}}]}`
 module.exports = {
   html,
-  json
+  json,
+  graphqlJson
 }

package/packages/dd-trace/src/appsec/blocking.js CHANGED Viewed

@@ -3,93 +3,142 @@
 const log = require('../log')
 const blockedTemplates = require('./blocked_templates')
+const detectedSpecificEndpoints = {}
 let templateHtml = blockedTemplates.html
 let templateJson = blockedTemplates.json
+let templateGraphqlJson = blockedTemplates.graphqlJson
 let blockingConfiguration
-function blockWithRedirect (res, rootSpan, abortController) {
-  rootSpan.addTags({
-    'appsec.blocked': 'true'
-  })
+const specificBlockingTypes = {
+  GRAPHQL: 'graphql'
+}
+function getSpecificKey (method, url) {
+  return `${method}+${url}`
+}
+function addSpecificEndpoint (method, url, type) {
+  detectedSpecificEndpoints[getSpecificKey(method, url)] = type
+}
+function getBlockWithRedirectData (rootSpan) {
   let statusCode = blockingConfiguration.parameters.status_code
   if (!statusCode || statusCode < 300 || statusCode >= 400) {
     statusCode = 303
   }
-  res.writeHead(statusCode, {
+  const headers = {
     'Location': blockingConfiguration.parameters.location
-  }).end()
+  }
+  rootSpan.addTags({
+    'appsec.blocked': 'true'
+  })
-  if (abortController) {
-    abortController.abort()
+  return { headers, statusCode }
+}
+function getSpecificBlockingData (type) {
+  switch (type) {
+    case specificBlockingTypes.GRAPHQL:
+      return {
+        type: 'application/json',
+        body: templateGraphqlJson
+      }
   }
 }
-function blockWithContent (req, res, rootSpan, abortController) {
+function getBlockWithContentData (req, specificType, rootSpan) {
   let type
   let body
+  let statusCode
-  // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
-  const accept = req.headers.accept && req.headers.accept.split(',').map((str) => str.split(';', 1)[0].trim())
+  const specificBlockingType = specificType || detectedSpecificEndpoints[getSpecificKey(req.method, req.url)]
+  if (specificBlockingType) {
+    const specificBlockingContent = getSpecificBlockingData(specificBlockingType)
+    type = specificBlockingContent?.type
+    body = specificBlockingContent?.body
+  }
-  if (!blockingConfiguration || blockingConfiguration.parameters.type === 'auto') {
-    if (accept && accept.includes('text/html') && !accept.includes('application/json')) {
-      type = 'text/html; charset=utf-8'
-      body = templateHtml
+  if (!type) {
+    // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
+    const accept = req.headers.accept?.split(',').map((str) => str.split(';', 1)[0].trim())
+    if (!blockingConfiguration || blockingConfiguration.parameters.type === 'auto') {
+      if (accept?.includes('text/html') && !accept.includes('application/json')) {
+        type = 'text/html; charset=utf-8'
+        body = templateHtml
+      } else {
+        type = 'application/json'
+        body = templateJson
+      }
     } else {
-      type = 'application/json'
-      body = templateJson
+      if (blockingConfiguration.parameters.type === 'html') {
+        type = 'text/html; charset=utf-8'
+        body = templateHtml
+      } else {
+        type = 'application/json'
+        body = templateJson
+      }
     }
+  }
+  if (blockingConfiguration?.type === 'block_request' && blockingConfiguration.parameters.status_code) {
+    statusCode = blockingConfiguration.parameters.status_code
   } else {
-    if (blockingConfiguration.parameters.type === 'html') {
-      type = 'text/html; charset=utf-8'
-      body = templateHtml
-    } else {
-      type = 'application/json'
-      body = templateJson
-    }
+    statusCode = 403
+  }
+  const headers = {
+    'Content-Type': type,
+    'Content-Length': Buffer.byteLength(body)
   }
   rootSpan.addTags({
     'appsec.blocked': 'true'
   })
-  if (blockingConfiguration && blockingConfiguration.type === 'block_request' &&
-    blockingConfiguration.parameters.status_code) {
-    res.statusCode = blockingConfiguration.parameters.status_code
-  } else {
-    res.statusCode = 403
-  }
-  res.setHeader('Content-Type', type)
-  res.setHeader('Content-Length', Buffer.byteLength(body))
-  res.end(body)
+  return { body, statusCode, headers }
+}
-  if (abortController) {
-    abortController.abort()
+function getBlockingData (req, specificType, rootSpan) {
+  if (blockingConfiguration?.type === 'redirect_request' && blockingConfiguration.parameters.location) {
+    return getBlockWithRedirectData(rootSpan)
+  } else {
+    return getBlockWithContentData(req, specificType, rootSpan)
   }
 }
-function block (req, res, rootSpan, abortController) {
+function block (req, res, rootSpan, abortController, type) {
   if (res.headersSent) {
     log.warn('Cannot send blocking response when headers have already been sent')
     return
   }
-  if (blockingConfiguration && blockingConfiguration.type === 'redirect_request' &&
-      blockingConfiguration.parameters.location) {
-    blockWithRedirect(res, rootSpan, abortController)
-  } else {
-    blockWithContent(req, res, rootSpan, abortController)
-  }
+  const { body, headers, statusCode } = getBlockingData(req, type, rootSpan)
+  res.writeHead(statusCode, headers).end(body)
+  abortController?.abort()
 }
 function setTemplates (config) {
   if (config.appsec.blockedTemplateHtml) {
     templateHtml = config.appsec.blockedTemplateHtml
+  } else {
+    templateHtml = blockedTemplates.html
   }
   if (config.appsec.blockedTemplateJson) {
     templateJson = config.appsec.blockedTemplateJson
+  } else {
+    templateJson = blockedTemplates.json
+  }
+  if (config.appsec.blockedTemplateGraphql) {
+    templateGraphqlJson = config.appsec.blockedTemplateGraphql
+  } else {
+    templateGraphqlJson = blockedTemplates.graphqlJson
   }
 }
@@ -98,7 +147,10 @@ function updateBlockingConfiguration (newBlockingConfiguration) {
 }
 module.exports = {
+  addSpecificEndpoint,
   block,
+  specificBlockingTypes,
+  getBlockingData,
   setTemplates,
   updateBlockingConfiguration
 }

package/packages/dd-trace/src/appsec/channels.js CHANGED Viewed

@@ -1,12 +1,15 @@
 'use strict'
-const dc = require('../../../diagnostics_channel')
+const dc = require('dc-polyfill')
 // TODO: use TBD naming convention
 module.exports = {
   bodyParser: dc.channel('datadog:body-parser:read:finish'),
   cookieParser: dc.channel('datadog:cookie-parser:read:finish'),
-  graphqlFinishExecute: dc.channel('apm:graphql:execute:finish'),
+  startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
+  graphqlMiddlewareChannel: dc.tracingChannel('datadog:apollo:middleware'),
+  apolloChannel: dc.tracingChannel('datadog:apollo:request'),
+  apolloServerCoreChannel: dc.tracingChannel('datadog:apollo-server-core:request'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
   passportVerify: dc.channel('datadog:passport:verify:finish'),

package/packages/dd-trace/src/appsec/graphql.js ADDED Viewed

@@ -0,0 +1,146 @@
+'use strict'
+const { storage } = require('../../../datadog-core')
+const { addSpecificEndpoint, specificBlockingTypes, getBlockingData } = require('./blocking')
+const waf = require('./waf')
+const addresses = require('./addresses')
+const web = require('../plugins/util/web')
+const {
+  startGraphqlResolve,
+  graphqlMiddlewareChannel,
+  apolloChannel,
+  apolloServerCoreChannel
+} = require('./channels')
+const graphqlRequestData = new WeakMap()
+function enable () {
+  enableApollo()
+  enableGraphql()
+}
+function disable () {
+  disableApollo()
+  disableGraphql()
+}
+function onGraphqlStartResolve ({ context, resolverInfo }) {
+  const req = storage.getStore()?.req
+  if (!req) return
+  if (!resolverInfo || typeof resolverInfo !== 'object') return
+  const actions = waf.run({ ephemeral: { [addresses.HTTP_INCOMING_GRAPHQL_RESOLVER]: resolverInfo } }, req)
+  if (actions?.includes('block')) {
+    const requestData = graphqlRequestData.get(req)
+    if (requestData?.isInGraphqlRequest) {
+      requestData.blocked = true
+      context?.abortController?.abort()
+    }
+  }
+}
+function enterInApolloMiddleware (data) {
+  const req = data?.req || storage.getStore()?.req
+  if (!req) return
+  graphqlRequestData.set(req, {
+    inApolloMiddleware: true,
+    blocked: false
+  })
+}
+function enterInApolloServerCoreRequest () {
+  const req = storage.getStore()?.req
+  if (!req) return
+  graphqlRequestData.set(req, {
+    isInGraphqlRequest: true,
+    blocked: false
+  })
+}
+function exitFromApolloMiddleware (data) {
+  const req = data?.req || storage.getStore()?.req
+  const requestData = graphqlRequestData.get(req)
+  if (requestData) requestData.inApolloMiddleware = false
+}
+function enterInApolloRequest () {
+  const req = storage.getStore()?.req
+  const requestData = graphqlRequestData.get(req)
+  if (requestData?.inApolloMiddleware) {
+    requestData.isInGraphqlRequest = true
+    addSpecificEndpoint(req.method, req.originalUrl || req.url, specificBlockingTypes.GRAPHQL)
+  }
+}
+function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {
+  const req = storage.getStore()?.req
+  if (!req) return
+  const requestData = graphqlRequestData.get(req)
+  if (requestData?.blocked) {
+    const rootSpan = web.root(req)
+    if (!rootSpan) return
+    const blockingData = getBlockingData(req, specificBlockingTypes.GRAPHQL, rootSpan)
+    abortData.statusCode = blockingData.statusCode
+    abortData.headers = blockingData.headers
+    abortData.message = blockingData.body
+    abortController?.abort()
+  }
+  graphqlRequestData.delete(req)
+}
+function enableApollo () {
+  graphqlMiddlewareChannel.subscribe({
+    start: enterInApolloMiddleware,
+    end: exitFromApolloMiddleware
+  })
+  apolloServerCoreChannel.subscribe({
+    start: enterInApolloServerCoreRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+  apolloChannel.subscribe({
+    start: enterInApolloRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+}
+function disableApollo () {
+  graphqlMiddlewareChannel.unsubscribe({
+    start: enterInApolloMiddleware,
+    end: exitFromApolloMiddleware
+  })
+  apolloServerCoreChannel.unsubscribe({
+    start: enterInApolloServerCoreRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+  apolloChannel.unsubscribe({
+    start: enterInApolloRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+}
+function enableGraphql () {
+  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+}
+function disableGraphql () {
+  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+}
+module.exports = {
+  enable,
+  disable
+}

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js CHANGED Viewed

@@ -3,6 +3,7 @@
 module.exports = {
   'COMMAND_INJECTION_ANALYZER': require('./command-injection-analyzer'),
   'HARCODED_SECRET_ANALYZER': require('./hardcoded-secret-analyzer'),
+  'HEADER_INJECTION_ANALYZER': require('./header-injection-analyzer'),
   'HSTS_HEADER_MISSING_ANALYZER': require('./hsts-header-missing-analyzer'),
   'INSECURE_COOKIE_ANALYZER': require('./insecure-cookie-analyzer'),
   'LDAP_ANALYZER': require('./ldap-injection-analyzer'),

package/packages/dd-trace/src/appsec/iast/analyzers/header-injection-analyzer.js ADDED Viewed

@@ -0,0 +1,105 @@
+'use strict'
+const InjectionAnalyzer = require('./injection-analyzer')
+const { HEADER_INJECTION } = require('../vulnerabilities')
+const { getNodeModulesPaths } = require('../path-line')
+const { HEADER_NAME_VALUE_SEPARATOR } = require('../vulnerabilities-formatter/constants')
+const { getRanges } = require('../taint-tracking/operations')
+const {
+  HTTP_REQUEST_COOKIE_NAME,
+  HTTP_REQUEST_COOKIE_VALUE,
+  HTTP_REQUEST_HEADER_VALUE
+} = require('../taint-tracking/source-types')
+const EXCLUDED_PATHS = getNodeModulesPaths('express')
+const EXCLUDED_HEADER_NAMES = [
+  'location',
+  'sec-websocket-location',
+  'sec-websocket-accept',
+  'upgrade',
+  'connection'
+]
+class HeaderInjectionAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super(HEADER_INJECTION)
+  }
+  onConfigure () {
+    this.addSub('datadog:http:server:response:set-header:finish', ({ name, value }) => {
+      if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          const headerValue = value[i]
+          this.analyze({ name, value: headerValue })
+        }
+      } else {
+        this.analyze({ name, value })
+      }
+    })
+  }
+  _isVulnerable ({ name, value }, iastContext) {
+    const lowerCasedHeaderName = name?.trim().toLowerCase()
+    if (this.isExcludedHeaderName(lowerCasedHeaderName) || typeof value !== 'string') return
+    const ranges = getRanges(iastContext, value)
+    if (ranges?.length > 0) {
+      return !(this.isCookieExclusion(lowerCasedHeaderName, ranges) ||
+        this.isSameHeaderExclusion(lowerCasedHeaderName, ranges) ||
+        this.isAccessControlAllowOriginExclusion(lowerCasedHeaderName, ranges))
+    }
+    return false
+  }
+  _getEvidence (headerInfo, iastContext) {
+    const prefix = headerInfo.name + HEADER_NAME_VALUE_SEPARATOR
+    const prefixLength = prefix.length
+    const evidence = super._getEvidence(headerInfo.value, iastContext)
+    evidence.value = prefix + evidence.value
+    evidence.ranges = evidence.ranges.map(range => {
+      return {
+        ...range,
+        start: range.start + prefixLength,
+        end: range.end + prefixLength
+      }
+    })
+    return evidence
+  }
+  isExcludedHeaderName (name) {
+    return EXCLUDED_HEADER_NAMES.includes(name)
+  }
+  isCookieExclusion (name, ranges) {
+    if (name === 'set-cookie') {
+      return ranges
+        .every(range => range.iinfo.type === HTTP_REQUEST_COOKIE_VALUE || range.iinfo.type === HTTP_REQUEST_COOKIE_NAME)
+    }
+    return false
+  }
+  isAccessControlAllowOriginExclusion (name, ranges) {
+    if (name === 'access-control-allow-origin') {
+      return ranges
+        .every(range => range.iinfo.type === HTTP_REQUEST_HEADER_VALUE)
+    }
+    return false
+  }
+  isSameHeaderExclusion (name, ranges) {
+    return ranges.length === 1 && name === ranges[0].iinfo.parameterName?.toLowerCase()
+  }
+  _getExcludedPaths () {
+    return EXCLUDED_PATHS
+  }
+}
+module.exports = new HeaderInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/iast-log.js CHANGED Viewed

@@ -1,6 +1,6 @@
 'use strict'
-const dc = require('../../../../diagnostics_channel')
+const dc = require('dc-polyfill')
 const log = require('../../log')
 const { calculateDDBasePath } = require('../../util')

package/packages/dd-trace/src/appsec/iast/iast-plugin.js CHANGED Viewed

@@ -1,6 +1,6 @@
 'use strict'
-const { channel } = require('../../../../diagnostics_channel')
+const { channel } = require('dc-polyfill')
 const iastLog = require('./iast-log')
 const Plugin = require('../../plugins/plugin')

package/packages/dd-trace/src/appsec/iast/index.js CHANGED Viewed

@@ -3,7 +3,7 @@ const { enableAllAnalyzers, disableAllAnalyzers } = require('./analyzers')
 const web = require('../../plugins/util/web')
 const { storage } = require('../../../../datadog-core')
 const overheadController = require('./overhead-controller')
-const dc = require('../../../../diagnostics_channel')
+const dc = require('dc-polyfill')
 const iastContextFunctions = require('./iast-context')
 const {
   enableTaintTracking,

package/packages/dd-trace/src/appsec/iast/path-line.js CHANGED Viewed

@@ -13,7 +13,7 @@ const pathLine = {
 }
 const EXCLUDED_PATHS = [
-  path.join(path.sep, 'node_modules', 'diagnostics_channel')
+  path.join(path.sep, 'node_modules', 'dc-polyfill')
 ]
 const EXCLUDED_PATH_PREFIXES = [
   'node:diagnostics_channel',

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js CHANGED Viewed

@@ -7,7 +7,7 @@ const { isPrivateModule, isNotLibraryFile } = require('./filter')
 const { csiMethods } = require('./csi-methods')
 const { getName } = require('../telemetry/verbosity')
 const { getRewriteFunction } = require('./rewriter-telemetry')
-const dc = require('../../../../../diagnostics_channel')
+const dc = require('dc-polyfill')
 const hardcodedSecretCh = dc.channel('datadog:secrets:result')
 let rewriter

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/constants.js ADDED Viewed

@@ -0,0 +1,7 @@
+'use strict'
+const HEADER_NAME_VALUE_SEPARATOR = ': '
+module.exports = {
+  HEADER_NAME_VALUE_SEPARATOR
+}

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/command-sensitive-analyzer.js CHANGED Viewed

@@ -3,27 +3,20 @@
 const iastLog = require('../../../iast-log')
 const COMMAND_PATTERN = '^(?:\\s*(?:sudo|doas)\\s+)?\\b\\S+\\b\\s(.*)'
+const pattern = new RegExp(COMMAND_PATTERN, 'gmi')
-class CommandSensitiveAnalyzer {
-  constructor () {
-    this._pattern = new RegExp(COMMAND_PATTERN, 'gmi')
-  }
-  extractSensitiveRanges (evidence) {
-    try {
-      this._pattern.lastIndex = 0
+module.exports = function extractSensitiveRanges (evidence) {
+  try {
+    pattern.lastIndex = 0
-      const regexResult = this._pattern.exec(evidence.value)
-      if (regexResult && regexResult.length > 1) {
-        const start = regexResult.index + (regexResult[0].length - regexResult[1].length)
-        const end = start + regexResult[1].length
-        return [{ start, end }]
-      }
-    } catch (e) {
-      iastLog.debug(e)
+    const regexResult = pattern.exec(evidence.value)
+    if (regexResult && regexResult.length > 1) {
+      const start = regexResult.index + (regexResult[0].length - regexResult[1].length)
+      const end = start + regexResult[1].length
+      return [{ start, end }]
     }
-    return []
+  } catch (e) {
+    iastLog.debug(e)
   }
+  return []
 }
-module.exports = CommandSensitiveAnalyzer