dd-trace 4.18.0 → 4.23.0

package/packages/datadog-plugin-next/src/index.js

@@ -6,6 +6,8 @@ const analyticsSampler = require('../../dd-trace/src/analytics_sampler')
 const { COMPONENT } = require('../../dd-trace/src/constants')
 const web = require('../../dd-trace/src/plugins/util/web')
 
+const errorPages = ['/404', '/500', '/_error', '/_not-found']
+
 class NextPlugin extends ServerPlugin {
   static get id () {
     return 'next'
@@ -40,6 +42,13 @@ class NextPlugin extends ServerPlugin {
   }
 
   error ({ span, error }) {
+    if (!span) {
+      const store = storage.getStore()
+      if (!store) return
+
+      span = store.span
+    }
+
     this.addError(error, span)
   }
 
@@ -50,10 +59,20 @@ class NextPlugin extends ServerPlugin {
 
     const span = store.span
     const error = span.context()._tags['error']
-
-    if (!this.config.validateStatus(res.statusCode) && !error) {
-      span.setTag('error', req.error || nextRequest.error || true)
-      web.addError(req, req.error || nextRequest.error || true)
+    const requestError = req.error || nextRequest.error
+
+    if (requestError) {
+      // prioritize user-set errors from API routes
+      span.setTag('error', requestError)
+      web.addError(req, requestError)
+    } else if (error) {
+      // general error handling
+      span.setTag('error', error)
+      web.addError(req, requestError || error)
+    } else if (!this.config.validateStatus(res.statusCode)) {
+      // where there's no error, we still need to validate status
+      span.setTag('error', true)
+      web.addError(req, true)
     }
 
     span.addTags({
@@ -65,7 +84,7 @@ class NextPlugin extends ServerPlugin {
     span.finish()
   }
 
-  pageLoad ({ page, isAppPath = false }) {
+  pageLoad ({ page, isAppPath = false, isStatic = false }) {
     const store = storage.getStore()
 
     if (!store) return
@@ -73,21 +92,28 @@ class NextPlugin extends ServerPlugin {
     const span = store.span
     const req = this._requests.get(span)
 
+    // safeguard against missing req in complicated timeout scenarios
+    if (!req) return
+
     // Only use error page names if there's not already a name
     const current = span.context()._tags['next.page']
-    if (current && ['/404', '/500', '/_error', '/_not-found'].includes(page)) {
+    const isErrorPage = errorPages.includes(page)
+
+    if (current && isErrorPage) {
       return
     }
 
     // remove ending /route or /page for appDir projects
-    if (isAppPath) page = page.substring(0, page.lastIndexOf('/'))
-
-    // This is for static files whose 'page' includes the whole file path
-    // For normal page matches, like /api/hello/[name] and a req.url like /api/hello/world,
-    // nothing should happen
-    // For page matches like /User/something/public/text.txt and req.url like /text.txt,
-    // it should disregard the extra absolute path Next.js sometimes sets
-    if (page.includes(req.url)) page = req.url
+    // need to check if not an error page too, as those are marked as app directory
+    // in newer versions
+    if (isAppPath && !isErrorPage) page = page.substring(0, page.lastIndexOf('/'))
+
+    // handle static resource
+    if (isStatic) {
+      page = req.url.includes('_next/static')
+        ? '/_next/static/*'
+        : '/public/*'
+    }
 
     span.addTags({
       [COMPONENT]: this.constructor.id,

package/packages/datadog-plugin-playwright/src/index.js

@@ -8,10 +8,15 @@ const {
   finishAllTraceSpans,
   getTestSuitePath,
   getTestSuiteCommonTags,
-  TEST_SOURCE_START
+  TEST_SOURCE_START,
+  TEST_CODE_OWNERS
 } = require('../../dd-trace/src/plugins/util/test')
 const { RESOURCE_NAME } = require('../../../ext/tags')
 const { COMPONENT } = require('../../dd-trace/src/constants')
+const {
+  TELEMETRY_EVENT_CREATED,
+  TELEMETRY_EVENT_FINISHED
+} = require('../../dd-trace/src/ci-visibility/telemetry')
 
 class PlaywrightPlugin extends CiPlugin {
   static get id () {
@@ -28,7 +33,9 @@ class PlaywrightPlugin extends CiPlugin {
       this.testSessionSpan.setTag(TEST_STATUS, status)
 
       this.testModuleSpan.finish()
+      this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'module')
       this.testSessionSpan.finish()
+      this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'session')
       finishAllTraceSpans(this.testSessionSpan)
       this.tracer._exporter.flush(onDone)
     })
@@ -52,6 +59,7 @@ class PlaywrightPlugin extends CiPlugin {
           ...testSuiteMetadata
         }
       })
+      this.telemetry.ciVisEvent(TELEMETRY_EVENT_CREATED, 'suite')
       this.enter(testSuiteSpan, store)
 
       this._testSuites.set(testSuite, testSuiteSpan)
@@ -63,6 +71,7 @@ class PlaywrightPlugin extends CiPlugin {
       if (!span) return
       span.setTag(TEST_STATUS, status)
       span.finish()
+      this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'suite')
     })
 
     this.addSub('ci:playwright:test:start', ({ testName, testSuiteAbsolutePath, testSourceLine }) => {
@@ -104,6 +113,13 @@ class PlaywrightPlugin extends CiPlugin {
       })
 
       span.finish()
+
+      this.telemetry.ciVisEvent(
+        TELEMETRY_EVENT_FINISHED,
+        'test',
+        { hasCodeOwners: !!span.context()._tags[TEST_CODE_OWNERS] }
+      )
+
       finishAllTraceSpans(span)
     })
   }

package/packages/dd-trace/src/appsec/activation.js

@@ -0,0 +1,29 @@
+'use strict'
+
+const Activation = {
+  ONECLICK: 'OneClick',
+  ENABLED: 'Enabled',
+  DISABLED: 'Disabled',
+
+  fromConfig (config) {
+    switch (config.appsec.enabled) {
+      // ASM is activated by an env var DD_APPSEC_ENABLED=true
+      case true:
+        return Activation.ENABLED
+
+      // ASM is disabled by an env var DD_APPSEC_ENABLED=false
+      case false:
+        return Activation.DISABLED
+
+      // ASM is activated by one click remote config
+      case undefined:
+        return Activation.ONECLICK
+
+      // Any other value should never occur
+      default:
+        return Activation.DISABLED
+    }
+  }
+}
+
+module.exports = Activation

package/packages/dd-trace/src/appsec/addresses.js

@@ -13,8 +13,10 @@ module.exports = {
   HTTP_INCOMING_RESPONSE_HEADERS: 'server.response.headers.no_cookies',
   // TODO: 'server.response.trailers',
   HTTP_INCOMING_GRAPHQL_RESOLVERS: 'graphql.server.all_resolvers',
+  HTTP_INCOMING_GRAPHQL_RESOLVER: 'graphql.server.resolver',
 
   HTTP_CLIENT_IP: 'http.client_ip',
 
-  USER_ID: 'usr.id'
+  USER_ID: 'usr.id',
+  WAF_CONTEXT_PROCESSOR: 'waf.context.processor'
 }

package/packages/dd-trace/src/appsec/api_security_sampler.js

@@ -0,0 +1,48 @@
+'use strict'
+
+const log = require('../log')
+
+let enabled
+let requestSampling
+
+function configure ({ apiSecurity }) {
+  enabled = apiSecurity.enabled
+  setRequestSampling(apiSecurity.requestSampling)
+}
+
+function disable () {
+  enabled = false
+}
+
+function setRequestSampling (sampling) {
+  requestSampling = parseRequestSampling(sampling)
+}
+
+function parseRequestSampling (requestSampling) {
+  let parsed = parseFloat(requestSampling)
+
+  if (isNaN(parsed)) {
+    log.warn(`Incorrect API Security request sampling value: ${requestSampling}`)
+
+    parsed = 0
+  } else {
+    parsed = Math.min(1, Math.max(0, parsed))
+  }
+
+  return parsed
+}
+
+function sampleRequest () {
+  if (!enabled || !requestSampling) {
+    return false
+  }
+
+  return Math.random() <= requestSampling
+}
+
+module.exports = {
+  configure,
+  disable,
+  setRequestSampling,
+  sampleRequest
+}

package/packages/dd-trace/src/appsec/blocked_templates.js

@@ -5,7 +5,10 @@ const html = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta n
 
 const json = `{"errors":[{"title":"You've been blocked","detail":"Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}`
 
+const graphqlJson = `{"errors":[{"message":"You've been blocked","extensions":{"detail":"Sorry, you cannot perform this operation. Please contact the customer service team. Security provided by Datadog."}}]}`
+
 module.exports = {
   html,
-  json
+  json,
+  graphqlJson
 }

package/packages/dd-trace/src/appsec/blocking.js

@@ -3,93 +3,142 @@
 const log = require('../log')
 const blockedTemplates = require('./blocked_templates')
 
+const detectedSpecificEndpoints = {}
+
 let templateHtml = blockedTemplates.html
 let templateJson = blockedTemplates.json
+let templateGraphqlJson = blockedTemplates.graphqlJson
 let blockingConfiguration
 
-function blockWithRedirect (res, rootSpan, abortController) {
-  rootSpan.addTags({
-    'appsec.blocked': 'true'
-  })
+const specificBlockingTypes = {
+  GRAPHQL: 'graphql'
+}
 
+function getSpecificKey (method, url) {
+  return `${method}+${url}`
+}
+
+function addSpecificEndpoint (method, url, type) {
+  detectedSpecificEndpoints[getSpecificKey(method, url)] = type
+}
+
+function getBlockWithRedirectData (rootSpan) {
   let statusCode = blockingConfiguration.parameters.status_code
   if (!statusCode || statusCode < 300 || statusCode >= 400) {
     statusCode = 303
   }
-
-  res.writeHead(statusCode, {
+  const headers = {
     'Location': blockingConfiguration.parameters.location
-  }).end()
+  }
+
+  rootSpan.addTags({
+    'appsec.blocked': 'true'
+  })
 
-  if (abortController) {
-    abortController.abort()
+  return { headers, statusCode }
+}
+
+function getSpecificBlockingData (type) {
+  switch (type) {
+    case specificBlockingTypes.GRAPHQL:
+      return {
+        type: 'application/json',
+        body: templateGraphqlJson
+      }
   }
 }
 
-function blockWithContent (req, res, rootSpan, abortController) {
+function getBlockWithContentData (req, specificType, rootSpan) {
   let type
   let body
+  let statusCode
 
-  // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
-  const accept = req.headers.accept && req.headers.accept.split(',').map((str) => str.split(';', 1)[0].trim())
+  const specificBlockingType = specificType || detectedSpecificEndpoints[getSpecificKey(req.method, req.url)]
+  if (specificBlockingType) {
+    const specificBlockingContent = getSpecificBlockingData(specificBlockingType)
+    type = specificBlockingContent?.type
+    body = specificBlockingContent?.body
+  }
 
-  if (!blockingConfiguration || blockingConfiguration.parameters.type === 'auto') {
-    if (accept && accept.includes('text/html') && !accept.includes('application/json')) {
-      type = 'text/html; charset=utf-8'
-      body = templateHtml
+  if (!type) {
+    // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
+    const accept = req.headers.accept?.split(',').map((str) => str.split(';', 1)[0].trim())
+
+    if (!blockingConfiguration || blockingConfiguration.parameters.type === 'auto') {
+      if (accept?.includes('text/html') && !accept.includes('application/json')) {
+        type = 'text/html; charset=utf-8'
+        body = templateHtml
+      } else {
+        type = 'application/json'
+        body = templateJson
+      }
     } else {
-      type = 'application/json'
-      body = templateJson
+      if (blockingConfiguration.parameters.type === 'html') {
+        type = 'text/html; charset=utf-8'
+        body = templateHtml
+      } else {
+        type = 'application/json'
+        body = templateJson
+      }
     }
+  }
+
+  if (blockingConfiguration?.type === 'block_request' && blockingConfiguration.parameters.status_code) {
+    statusCode = blockingConfiguration.parameters.status_code
   } else {
-    if (blockingConfiguration.parameters.type === 'html') {
-      type = 'text/html; charset=utf-8'
-      body = templateHtml
-    } else {
-      type = 'application/json'
-      body = templateJson
-    }
+    statusCode = 403
+  }
+
+  const headers = {
+    'Content-Type': type,
+    'Content-Length': Buffer.byteLength(body)
   }
 
   rootSpan.addTags({
     'appsec.blocked': 'true'
   })
 
-  if (blockingConfiguration && blockingConfiguration.type === 'block_request' &&
-    blockingConfiguration.parameters.status_code) {
-    res.statusCode = blockingConfiguration.parameters.status_code
-  } else {
-    res.statusCode = 403
-  }
-  res.setHeader('Content-Type', type)
-  res.setHeader('Content-Length', Buffer.byteLength(body))
-  res.end(body)
+  return { body, statusCode, headers }
+}
 
-  if (abortController) {
-    abortController.abort()
+function getBlockingData (req, specificType, rootSpan) {
+  if (blockingConfiguration?.type === 'redirect_request' && blockingConfiguration.parameters.location) {
+    return getBlockWithRedirectData(rootSpan)
+  } else {
+    return getBlockWithContentData(req, specificType, rootSpan)
   }
 }
 
-function block (req, res, rootSpan, abortController) {
+function block (req, res, rootSpan, abortController, type) {
   if (res.headersSent) {
     log.warn('Cannot send blocking response when headers have already been sent')
     return
   }
 
-  if (blockingConfiguration && blockingConfiguration.type === 'redirect_request' &&
-      blockingConfiguration.parameters.location) {
-    blockWithRedirect(res, rootSpan, abortController)
-  } else {
-    blockWithContent(req, res, rootSpan, abortController)
-  }
+  const { body, headers, statusCode } = getBlockingData(req, type, rootSpan)
+
+  res.writeHead(statusCode, headers).end(body)
+
+  abortController?.abort()
 }
 
 function setTemplates (config) {
   if (config.appsec.blockedTemplateHtml) {
     templateHtml = config.appsec.blockedTemplateHtml
+  } else {
+    templateHtml = blockedTemplates.html
   }
+
   if (config.appsec.blockedTemplateJson) {
     templateJson = config.appsec.blockedTemplateJson
+  } else {
+    templateJson = blockedTemplates.json
+  }
+
+  if (config.appsec.blockedTemplateGraphql) {
+    templateGraphqlJson = config.appsec.blockedTemplateGraphql
+  } else {
+    templateGraphqlJson = blockedTemplates.graphqlJson
   }
 }
 
@@ -98,7 +147,10 @@ function updateBlockingConfiguration (newBlockingConfiguration) {
 }
 
 module.exports = {
+  addSpecificEndpoint,
   block,
+  specificBlockingTypes,
+  getBlockingData,
   setTemplates,
   updateBlockingConfiguration
 }

package/packages/dd-trace/src/appsec/channels.js

@@ -1,12 +1,15 @@
 'use strict'
 
-const dc = require('../../../diagnostics_channel')
+const dc = require('dc-polyfill')
 
 // TODO: use TBD naming convention
 module.exports = {
   bodyParser: dc.channel('datadog:body-parser:read:finish'),
   cookieParser: dc.channel('datadog:cookie-parser:read:finish'),
-  graphqlFinishExecute: dc.channel('apm:graphql:execute:finish'),
+  startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
+  graphqlMiddlewareChannel: dc.tracingChannel('datadog:apollo:middleware'),
+  apolloChannel: dc.tracingChannel('datadog:apollo:request'),
+  apolloServerCoreChannel: dc.tracingChannel('datadog:apollo-server-core:request'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
   passportVerify: dc.channel('datadog:passport:verify:finish'),

package/packages/dd-trace/src/appsec/graphql.js

@@ -0,0 +1,146 @@
+'use strict'
+
+const { storage } = require('../../../datadog-core')
+const { addSpecificEndpoint, specificBlockingTypes, getBlockingData } = require('./blocking')
+const waf = require('./waf')
+const addresses = require('./addresses')
+const web = require('../plugins/util/web')
+const {
+  startGraphqlResolve,
+  graphqlMiddlewareChannel,
+  apolloChannel,
+  apolloServerCoreChannel
+} = require('./channels')
+
+const graphqlRequestData = new WeakMap()
+
+function enable () {
+  enableApollo()
+  enableGraphql()
+}
+
+function disable () {
+  disableApollo()
+  disableGraphql()
+}
+
+function onGraphqlStartResolve ({ context, resolverInfo }) {
+  const req = storage.getStore()?.req
+
+  if (!req) return
+
+  if (!resolverInfo || typeof resolverInfo !== 'object') return
+
+  const actions = waf.run({ ephemeral: { [addresses.HTTP_INCOMING_GRAPHQL_RESOLVER]: resolverInfo } }, req)
+  if (actions?.includes('block')) {
+    const requestData = graphqlRequestData.get(req)
+    if (requestData?.isInGraphqlRequest) {
+      requestData.blocked = true
+      context?.abortController?.abort()
+    }
+  }
+}
+
+function enterInApolloMiddleware (data) {
+  const req = data?.req || storage.getStore()?.req
+  if (!req) return
+
+  graphqlRequestData.set(req, {
+    inApolloMiddleware: true,
+    blocked: false
+  })
+}
+
+function enterInApolloServerCoreRequest () {
+  const req = storage.getStore()?.req
+  if (!req) return
+
+  graphqlRequestData.set(req, {
+    isInGraphqlRequest: true,
+    blocked: false
+  })
+}
+
+function exitFromApolloMiddleware (data) {
+  const req = data?.req || storage.getStore()?.req
+  const requestData = graphqlRequestData.get(req)
+  if (requestData) requestData.inApolloMiddleware = false
+}
+
+function enterInApolloRequest () {
+  const req = storage.getStore()?.req
+
+  const requestData = graphqlRequestData.get(req)
+  if (requestData?.inApolloMiddleware) {
+    requestData.isInGraphqlRequest = true
+    addSpecificEndpoint(req.method, req.originalUrl || req.url, specificBlockingTypes.GRAPHQL)
+  }
+}
+
+function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {
+  const req = storage.getStore()?.req
+  if (!req) return
+
+  const requestData = graphqlRequestData.get(req)
+
+  if (requestData?.blocked) {
+    const rootSpan = web.root(req)
+    if (!rootSpan) return
+
+    const blockingData = getBlockingData(req, specificBlockingTypes.GRAPHQL, rootSpan)
+    abortData.statusCode = blockingData.statusCode
+    abortData.headers = blockingData.headers
+    abortData.message = blockingData.body
+
+    abortController?.abort()
+  }
+
+  graphqlRequestData.delete(req)
+}
+
+function enableApollo () {
+  graphqlMiddlewareChannel.subscribe({
+    start: enterInApolloMiddleware,
+    end: exitFromApolloMiddleware
+  })
+
+  apolloServerCoreChannel.subscribe({
+    start: enterInApolloServerCoreRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+
+  apolloChannel.subscribe({
+    start: enterInApolloRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+}
+
+function disableApollo () {
+  graphqlMiddlewareChannel.unsubscribe({
+    start: enterInApolloMiddleware,
+    end: exitFromApolloMiddleware
+  })
+
+  apolloServerCoreChannel.unsubscribe({
+    start: enterInApolloServerCoreRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+
+  apolloChannel.unsubscribe({
+    start: enterInApolloRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+}
+
+function enableGraphql () {
+  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+}
+
+function disableGraphql () {
+  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+}
+
+module.exports = {
+  enable,
+  disable
+}

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js

@@ -3,6 +3,7 @@
 module.exports = {
   'COMMAND_INJECTION_ANALYZER': require('./command-injection-analyzer'),
   'HARCODED_SECRET_ANALYZER': require('./hardcoded-secret-analyzer'),
+  'HEADER_INJECTION_ANALYZER': require('./header-injection-analyzer'),
   'HSTS_HEADER_MISSING_ANALYZER': require('./hsts-header-missing-analyzer'),
   'INSECURE_COOKIE_ANALYZER': require('./insecure-cookie-analyzer'),
   'LDAP_ANALYZER': require('./ldap-injection-analyzer'),