dd-trace 4.20.0 → 4.22.0

package/packages/dd-trace/src/appsec/blocking.js

@@ -3,93 +3,142 @@
 const log = require('../log')
 const blockedTemplates = require('./blocked_templates')
 
+const detectedSpecificEndpoints = {}
+
 let templateHtml = blockedTemplates.html
 let templateJson = blockedTemplates.json
+let templateGraphqlJson = blockedTemplates.graphqlJson
 let blockingConfiguration
 
-function blockWithRedirect (res, rootSpan, abortController) {
-  rootSpan.addTags({
-    'appsec.blocked': 'true'
-  })
+const specificBlockingTypes = {
+  GRAPHQL: 'graphql'
+}
 
+function getSpecificKey (method, url) {
+  return `${method}+${url}`
+}
+
+function addSpecificEndpoint (method, url, type) {
+  detectedSpecificEndpoints[getSpecificKey(method, url)] = type
+}
+
+function getBlockWithRedirectData (rootSpan) {
   let statusCode = blockingConfiguration.parameters.status_code
   if (!statusCode || statusCode < 300 || statusCode >= 400) {
     statusCode = 303
   }
-
-  res.writeHead(statusCode, {
+  const headers = {
     'Location': blockingConfiguration.parameters.location
-  }).end()
+  }
+
+  rootSpan.addTags({
+    'appsec.blocked': 'true'
+  })
 
-  if (abortController) {
-    abortController.abort()
+  return { headers, statusCode }
+}
+
+function getSpecificBlockingData (type) {
+  switch (type) {
+    case specificBlockingTypes.GRAPHQL:
+      return {
+        type: 'application/json',
+        body: templateGraphqlJson
+      }
   }
 }
 
-function blockWithContent (req, res, rootSpan, abortController) {
+function getBlockWithContentData (req, specificType, rootSpan) {
   let type
   let body
+  let statusCode
 
-  // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
-  const accept = req.headers.accept && req.headers.accept.split(',').map((str) => str.split(';', 1)[0].trim())
+  const specificBlockingType = specificType || detectedSpecificEndpoints[getSpecificKey(req.method, req.url)]
+  if (specificBlockingType) {
+    const specificBlockingContent = getSpecificBlockingData(specificBlockingType)
+    type = specificBlockingContent?.type
+    body = specificBlockingContent?.body
+  }
 
-  if (!blockingConfiguration || blockingConfiguration.parameters.type === 'auto') {
-    if (accept && accept.includes('text/html') && !accept.includes('application/json')) {
-      type = 'text/html; charset=utf-8'
-      body = templateHtml
+  if (!type) {
+    // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
+    const accept = req.headers.accept?.split(',').map((str) => str.split(';', 1)[0].trim())
+
+    if (!blockingConfiguration || blockingConfiguration.parameters.type === 'auto') {
+      if (accept?.includes('text/html') && !accept.includes('application/json')) {
+        type = 'text/html; charset=utf-8'
+        body = templateHtml
+      } else {
+        type = 'application/json'
+        body = templateJson
+      }
     } else {
-      type = 'application/json'
-      body = templateJson
+      if (blockingConfiguration.parameters.type === 'html') {
+        type = 'text/html; charset=utf-8'
+        body = templateHtml
+      } else {
+        type = 'application/json'
+        body = templateJson
+      }
     }
+  }
+
+  if (blockingConfiguration?.type === 'block_request' && blockingConfiguration.parameters.status_code) {
+    statusCode = blockingConfiguration.parameters.status_code
   } else {
-    if (blockingConfiguration.parameters.type === 'html') {
-      type = 'text/html; charset=utf-8'
-      body = templateHtml
-    } else {
-      type = 'application/json'
-      body = templateJson
-    }
+    statusCode = 403
+  }
+
+  const headers = {
+    'Content-Type': type,
+    'Content-Length': Buffer.byteLength(body)
   }
 
   rootSpan.addTags({
     'appsec.blocked': 'true'
   })
 
-  if (blockingConfiguration && blockingConfiguration.type === 'block_request' &&
-    blockingConfiguration.parameters.status_code) {
-    res.statusCode = blockingConfiguration.parameters.status_code
-  } else {
-    res.statusCode = 403
-  }
-  res.setHeader('Content-Type', type)
-  res.setHeader('Content-Length', Buffer.byteLength(body))
-  res.end(body)
+  return { body, statusCode, headers }
+}
 
-  if (abortController) {
-    abortController.abort()
+function getBlockingData (req, specificType, rootSpan) {
+  if (blockingConfiguration?.type === 'redirect_request' && blockingConfiguration.parameters.location) {
+    return getBlockWithRedirectData(rootSpan)
+  } else {
+    return getBlockWithContentData(req, specificType, rootSpan)
   }
 }
 
-function block (req, res, rootSpan, abortController) {
+function block (req, res, rootSpan, abortController, type) {
   if (res.headersSent) {
     log.warn('Cannot send blocking response when headers have already been sent')
     return
   }
 
-  if (blockingConfiguration && blockingConfiguration.type === 'redirect_request' &&
-      blockingConfiguration.parameters.location) {
-    blockWithRedirect(res, rootSpan, abortController)
-  } else {
-    blockWithContent(req, res, rootSpan, abortController)
-  }
+  const { body, headers, statusCode } = getBlockingData(req, type, rootSpan)
+
+  res.writeHead(statusCode, headers).end(body)
+
+  abortController?.abort()
 }
 
 function setTemplates (config) {
   if (config.appsec.blockedTemplateHtml) {
     templateHtml = config.appsec.blockedTemplateHtml
+  } else {
+    templateHtml = blockedTemplates.html
   }
+
   if (config.appsec.blockedTemplateJson) {
     templateJson = config.appsec.blockedTemplateJson
+  } else {
+    templateJson = blockedTemplates.json
+  }
+
+  if (config.appsec.blockedTemplateGraphql) {
+    templateGraphqlJson = config.appsec.blockedTemplateGraphql
+  } else {
+    templateGraphqlJson = blockedTemplates.graphqlJson
   }
 }
 
@@ -98,7 +147,10 @@ function updateBlockingConfiguration (newBlockingConfiguration) {
 }
 
 module.exports = {
+  addSpecificEndpoint,
   block,
+  specificBlockingTypes,
+  getBlockingData,
   setTemplates,
   updateBlockingConfiguration
 }

package/packages/dd-trace/src/appsec/channels.js

@@ -6,7 +6,10 @@ const dc = require('dc-polyfill')
 module.exports = {
   bodyParser: dc.channel('datadog:body-parser:read:finish'),
   cookieParser: dc.channel('datadog:cookie-parser:read:finish'),
-  graphqlFinishExecute: dc.channel('apm:graphql:execute:finish'),
+  startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
+  graphqlMiddlewareChannel: dc.tracingChannel('datadog:apollo:middleware'),
+  apolloChannel: dc.tracingChannel('datadog:apollo:request'),
+  apolloServerCoreChannel: dc.tracingChannel('datadog:apollo-server-core:request'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
   passportVerify: dc.channel('datadog:passport:verify:finish'),

package/packages/dd-trace/src/appsec/graphql.js

@@ -0,0 +1,146 @@
+'use strict'
+
+const { storage } = require('../../../datadog-core')
+const { addSpecificEndpoint, specificBlockingTypes, getBlockingData } = require('./blocking')
+const waf = require('./waf')
+const addresses = require('./addresses')
+const web = require('../plugins/util/web')
+const {
+  startGraphqlResolve,
+  graphqlMiddlewareChannel,
+  apolloChannel,
+  apolloServerCoreChannel
+} = require('./channels')
+
+const graphqlRequestData = new WeakMap()
+
+function enable () {
+  enableApollo()
+  enableGraphql()
+}
+
+function disable () {
+  disableApollo()
+  disableGraphql()
+}
+
+function onGraphqlStartResolve ({ context, resolverInfo }) {
+  const req = storage.getStore()?.req
+
+  if (!req) return
+
+  if (!resolverInfo || typeof resolverInfo !== 'object') return
+
+  const actions = waf.run({ ephemeral: { [addresses.HTTP_INCOMING_GRAPHQL_RESOLVER]: resolverInfo } }, req)
+  if (actions?.includes('block')) {
+    const requestData = graphqlRequestData.get(req)
+    if (requestData?.isInGraphqlRequest) {
+      requestData.blocked = true
+      context?.abortController?.abort()
+    }
+  }
+}
+
+function enterInApolloMiddleware (data) {
+  const req = data?.req || storage.getStore()?.req
+  if (!req) return
+
+  graphqlRequestData.set(req, {
+    inApolloMiddleware: true,
+    blocked: false
+  })
+}
+
+function enterInApolloServerCoreRequest () {
+  const req = storage.getStore()?.req
+  if (!req) return
+
+  graphqlRequestData.set(req, {
+    isInGraphqlRequest: true,
+    blocked: false
+  })
+}
+
+function exitFromApolloMiddleware (data) {
+  const req = data?.req || storage.getStore()?.req
+  const requestData = graphqlRequestData.get(req)
+  if (requestData) requestData.inApolloMiddleware = false
+}
+
+function enterInApolloRequest () {
+  const req = storage.getStore()?.req
+
+  const requestData = graphqlRequestData.get(req)
+  if (requestData?.inApolloMiddleware) {
+    requestData.isInGraphqlRequest = true
+    addSpecificEndpoint(req.method, req.originalUrl || req.url, specificBlockingTypes.GRAPHQL)
+  }
+}
+
+function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {
+  const req = storage.getStore()?.req
+  if (!req) return
+
+  const requestData = graphqlRequestData.get(req)
+
+  if (requestData?.blocked) {
+    const rootSpan = web.root(req)
+    if (!rootSpan) return
+
+    const blockingData = getBlockingData(req, specificBlockingTypes.GRAPHQL, rootSpan)
+    abortData.statusCode = blockingData.statusCode
+    abortData.headers = blockingData.headers
+    abortData.message = blockingData.body
+
+    abortController?.abort()
+  }
+
+  graphqlRequestData.delete(req)
+}
+
+function enableApollo () {
+  graphqlMiddlewareChannel.subscribe({
+    start: enterInApolloMiddleware,
+    end: exitFromApolloMiddleware
+  })
+
+  apolloServerCoreChannel.subscribe({
+    start: enterInApolloServerCoreRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+
+  apolloChannel.subscribe({
+    start: enterInApolloRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+}
+
+function disableApollo () {
+  graphqlMiddlewareChannel.unsubscribe({
+    start: enterInApolloMiddleware,
+    end: exitFromApolloMiddleware
+  })
+
+  apolloServerCoreChannel.unsubscribe({
+    start: enterInApolloServerCoreRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+
+  apolloChannel.unsubscribe({
+    start: enterInApolloRequest,
+    asyncEnd: beforeWriteApolloGraphqlResponse
+  })
+}
+
+function enableGraphql () {
+  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+}
+
+function disableGraphql () {
+  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+}
+
+module.exports = {
+  enable,
+  disable
+}

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js

@@ -3,6 +3,7 @@
 module.exports = {
   'COMMAND_INJECTION_ANALYZER': require('./command-injection-analyzer'),
   'HARCODED_SECRET_ANALYZER': require('./hardcoded-secret-analyzer'),
+  'HEADER_INJECTION_ANALYZER': require('./header-injection-analyzer'),
   'HSTS_HEADER_MISSING_ANALYZER': require('./hsts-header-missing-analyzer'),
   'INSECURE_COOKIE_ANALYZER': require('./insecure-cookie-analyzer'),
   'LDAP_ANALYZER': require('./ldap-injection-analyzer'),

package/packages/dd-trace/src/appsec/iast/analyzers/header-injection-analyzer.js

@@ -0,0 +1,105 @@
+'use strict'
+
+const InjectionAnalyzer = require('./injection-analyzer')
+const { HEADER_INJECTION } = require('../vulnerabilities')
+const { getNodeModulesPaths } = require('../path-line')
+const { HEADER_NAME_VALUE_SEPARATOR } = require('../vulnerabilities-formatter/constants')
+const { getRanges } = require('../taint-tracking/operations')
+const {
+  HTTP_REQUEST_COOKIE_NAME,
+  HTTP_REQUEST_COOKIE_VALUE,
+  HTTP_REQUEST_HEADER_VALUE
+} = require('../taint-tracking/source-types')
+
+const EXCLUDED_PATHS = getNodeModulesPaths('express')
+const EXCLUDED_HEADER_NAMES = [
+  'location',
+  'sec-websocket-location',
+  'sec-websocket-accept',
+  'upgrade',
+  'connection'
+]
+
+class HeaderInjectionAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super(HEADER_INJECTION)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:http:server:response:set-header:finish', ({ name, value }) => {
+      if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+          const headerValue = value[i]
+
+          this.analyze({ name, value: headerValue })
+        }
+      } else {
+        this.analyze({ name, value })
+      }
+    })
+  }
+
+  _isVulnerable ({ name, value }, iastContext) {
+    const lowerCasedHeaderName = name?.trim().toLowerCase()
+
+    if (this.isExcludedHeaderName(lowerCasedHeaderName) || typeof value !== 'string') return
+
+    const ranges = getRanges(iastContext, value)
+    if (ranges?.length > 0) {
+      return !(this.isCookieExclusion(lowerCasedHeaderName, ranges) ||
+        this.isSameHeaderExclusion(lowerCasedHeaderName, ranges) ||
+        this.isAccessControlAllowOriginExclusion(lowerCasedHeaderName, ranges))
+    }
+
+    return false
+  }
+
+  _getEvidence (headerInfo, iastContext) {
+    const prefix = headerInfo.name + HEADER_NAME_VALUE_SEPARATOR
+    const prefixLength = prefix.length
+
+    const evidence = super._getEvidence(headerInfo.value, iastContext)
+    evidence.value = prefix + evidence.value
+    evidence.ranges = evidence.ranges.map(range => {
+      return {
+        ...range,
+        start: range.start + prefixLength,
+        end: range.end + prefixLength
+      }
+    })
+
+    return evidence
+  }
+
+  isExcludedHeaderName (name) {
+    return EXCLUDED_HEADER_NAMES.includes(name)
+  }
+
+  isCookieExclusion (name, ranges) {
+    if (name === 'set-cookie') {
+      return ranges
+        .every(range => range.iinfo.type === HTTP_REQUEST_COOKIE_VALUE || range.iinfo.type === HTTP_REQUEST_COOKIE_NAME)
+    }
+
+    return false
+  }
+
+  isAccessControlAllowOriginExclusion (name, ranges) {
+    if (name === 'access-control-allow-origin') {
+      return ranges
+        .every(range => range.iinfo.type === HTTP_REQUEST_HEADER_VALUE)
+    }
+
+    return false
+  }
+
+  isSameHeaderExclusion (name, ranges) {
+    return ranges.length === 1 && name === ranges[0].iinfo.parameterName?.toLowerCase()
+  }
+
+  _getExcludedPaths () {
+    return EXCLUDED_PATHS
+  }
+}
+
+module.exports = new HeaderInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/constants.js

@@ -0,0 +1,7 @@
+'use strict'
+
+const HEADER_NAME_VALUE_SEPARATOR = ': '
+
+module.exports = {
+  HEADER_NAME_VALUE_SEPARATOR
+}

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/command-sensitive-analyzer.js

@@ -3,27 +3,20 @@
 const iastLog = require('../../../iast-log')
 
 const COMMAND_PATTERN = '^(?:\\s*(?:sudo|doas)\\s+)?\\b\\S+\\b\\s(.*)'
+const pattern = new RegExp(COMMAND_PATTERN, 'gmi')
 
-class CommandSensitiveAnalyzer {
-  constructor () {
-    this._pattern = new RegExp(COMMAND_PATTERN, 'gmi')
-  }
-
-  extractSensitiveRanges (evidence) {
-    try {
-      this._pattern.lastIndex = 0
+module.exports = function extractSensitiveRanges (evidence) {
+  try {
+    pattern.lastIndex = 0
 
-      const regexResult = this._pattern.exec(evidence.value)
-      if (regexResult && regexResult.length > 1) {
-        const start = regexResult.index + (regexResult[0].length - regexResult[1].length)
-        const end = start + regexResult[1].length
-        return [{ start, end }]
-      }
-    } catch (e) {
-      iastLog.debug(e)
+    const regexResult = pattern.exec(evidence.value)
+    if (regexResult && regexResult.length > 1) {
+      const start = regexResult.index + (regexResult[0].length - regexResult[1].length)
+      const end = start + regexResult[1].length
+      return [{ start, end }]
     }
-    return []
+  } catch (e) {
+    iastLog.debug(e)
   }
+  return []
 }
-
-module.exports = CommandSensitiveAnalyzer

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/header-sensitive-analyzer.js

@@ -0,0 +1,20 @@
+'use strict'
+
+const { HEADER_NAME_VALUE_SEPARATOR } = require('../../constants')
+
+module.exports = function extractSensitiveRanges (evidence, namePattern, valuePattern) {
+  const evidenceValue = evidence.value
+  const sections = evidenceValue.split(HEADER_NAME_VALUE_SEPARATOR)
+  const headerName = sections[0]
+  const headerValue = sections.slice(1).join(HEADER_NAME_VALUE_SEPARATOR)
+  namePattern.lastIndex = 0
+  valuePattern.lastIndex = 0
+  if (namePattern.test(headerName) || valuePattern.test(headerValue)) {
+    return [{
+      start: headerName.length + HEADER_NAME_VALUE_SEPARATOR.length,
+      end: evidenceValue.length
+    }]
+  }
+
+  return []
+}

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/json-sensitive-analyzer.js

@@ -2,15 +2,11 @@
 
 const { stringifyWithRanges } = require('../../utils')
 
-class JsonSensitiveAnalyzer {
-  extractSensitiveRanges (evidence) {
-    // expect object evidence
-    const { value, ranges, sensitiveRanges } = stringifyWithRanges(evidence.value, evidence.rangesToApply, true)
-    evidence.value = value
-    evidence.ranges = ranges
+module.exports = function extractSensitiveRanges (evidence) {
+  // expect object evidence
+  const { value, ranges, sensitiveRanges } = stringifyWithRanges(evidence.value, evidence.rangesToApply, true)
+  evidence.value = value
+  evidence.ranges = ranges
 
-    return sensitiveRanges
-  }
+  return sensitiveRanges
 }
-
-module.exports = JsonSensitiveAnalyzer

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/ldap-sensitive-analyzer.js

@@ -3,33 +3,26 @@
 const iastLog = require('../../../iast-log')
 
 const LDAP_PATTERN = '\\(.*?(?:~=|=|<=|>=)(?<LITERAL>[^)]+)\\)'
+const pattern = new RegExp(LDAP_PATTERN, 'gmi')
 
-class LdapSensitiveAnalyzer {
-  constructor () {
-    this._pattern = new RegExp(LDAP_PATTERN, 'gmi')
-  }
-
-  extractSensitiveRanges (evidence) {
-    try {
-      this._pattern.lastIndex = 0
-      const tokens = []
+module.exports = function extractSensitiveRanges (evidence) {
+  try {
+    pattern.lastIndex = 0
+    const tokens = []
 
-      let regexResult = this._pattern.exec(evidence.value)
-      while (regexResult != null) {
-        if (!regexResult.groups.LITERAL) continue
-        // Computing indices manually since NodeJs 12 does not support d flag on regular expressions
-        // TODO Get indices from group by adding d flag in regular expression
-        const start = regexResult.index + (regexResult[0].length - regexResult.groups.LITERAL.length - 1)
-        const end = start + regexResult.groups.LITERAL.length
-        tokens.push({ start, end })
-        regexResult = this._pattern.exec(evidence.value)
-      }
-      return tokens
-    } catch (e) {
-      iastLog.debug(e)
+    let regexResult = pattern.exec(evidence.value)
+    while (regexResult != null) {
+      if (!regexResult.groups.LITERAL) continue
+      // Computing indices manually since NodeJs 12 does not support d flag on regular expressions
+      // TODO Get indices from group by adding d flag in regular expression
+      const start = regexResult.index + (regexResult[0].length - regexResult.groups.LITERAL.length - 1)
+      const end = start + regexResult.groups.LITERAL.length
+      tokens.push({ start, end })
+      regexResult = pattern.exec(evidence.value)
     }
-    return []
+    return tokens
+  } catch (e) {
+    iastLog.debug(e)
   }
+  return []
 }
-
-module.exports = LdapSensitiveAnalyzer