dd-trace 5.0.0 → 5.1.0

package/MIGRATING.md

@@ -4,6 +4,21 @@ This guide describes the steps to upgrade dd-trace from a major version to the
 next. If you are having any issues related to migrating, please feel free to
 open an issue or contact our [support](https://www.datadoghq.com/support/) team.
 
+## 4.0 to 5.0
+
+### Node 16 is no longer supported
+
+Node.js 16 has reached EOL in September 2023 and is no longer supported. Generally
+speaking, we highly recommend always keeping Node.js up to date regardless of
+our support policy.
+
+### Update `trace<T>` TypeScript declaration
+
+The TypeScript declaration for `trace<T>` has been updated to enforce 
+that calls to `tracer.trace(name, fn)` must receive a function which takes at least 
+the span object. Previously the span was technically optional when it should not have 
+been as the span must be handled.
+
 ## 3.0 to 4.0
 
 ### Node 14 is no longer supported

package/README.md

@@ -1,7 +1,8 @@
 # `dd-trace`: Node.js APM Tracer Library
 
-[![npm v4](https://img.shields.io/npm/v/dd-trace/latest?color=blue&label=dd-trace%40v4&logo=npm)](https://www.npmjs.com/package/dd-trace)
-[![npm v3](https://img.shields.io/npm/v/dd-trace/latest-node14?color=blue&label=dd-trace%40v3&logo=npm)](https://www.npmjs.com/package/dd-trace/v/latest-node12)
+[![npm v5](https://img.shields.io/npm/v/dd-trace/latest?color=blue&label=dd-trace%40v5&logo=npm)](https://www.npmjs.com/package/dd-trace)
+[![npm v4](https://img.shields.io/npm/v/dd-trace/latest-node16?color=blue&label=dd-trace%40v4&logo=npm)](https://www.npmjs.com/package/dd-trace/v/latest-node16)
+[![npm v3](https://img.shields.io/npm/v/dd-trace/latest-node14?color=blue&label=dd-trace%40v3&logo=npm)](https://www.npmjs.com/package/dd-trace/v/latest-node14)
 [![codecov](https://codecov.io/gh/DataDog/dd-trace-js/branch/master/graph/badge.svg)](https://codecov.io/gh/DataDog/dd-trace-js)
 
 <img align="right" src="https://user-images.githubusercontent.com/551402/208212084-1d0c07e2-4135-4c61-b2da-8f2fddbc66ed.png" alt="Bits the dog  JavaScript" width="200px"/>
@@ -28,24 +29,25 @@ Most of the documentation for `dd-trace` is available on these webpages:
 | [`v1`](https://github.com/DataDog/dd-trace-js/tree/v1.x) | ![npm v1](https://img.shields.io/npm/v/dd-trace/legacy-v1?color=white&label=%20&style=flat-square)     | `>= v12` | **End of Life** | 2021-07-13     | 2022-02-25  |
 | [`v2`](https://github.com/DataDog/dd-trace-js/tree/v2.x) | ![npm v2](https://img.shields.io/npm/v/dd-trace/latest-node12?color=white&label=%20&style=flat-square) | `>= v12` | **End of Life** | 2022-01-28     | 2023-08-15  |
 | [`v3`](https://github.com/DataDog/dd-trace-js/tree/v3.x) | ![npm v3](https://img.shields.io/npm/v/dd-trace/latest-node14?color=white&label=%20&style=flat-square) | `>= v14` | **Maintenance** | 2022-08-15     | 2024-05-15  |
-| [`v4`](https://github.com/DataDog/dd-trace-js/tree/v4.x) | ![npm v4](https://img.shields.io/npm/v/dd-trace/latest?color=white&label=%20&style=flat-square)        | `>= v16` | **Current**     | 2023-05-12     | Unknown     |
+| [`v4`](https://github.com/DataDog/dd-trace-js/tree/v4.x) | ![npm v4](https://img.shields.io/npm/v/dd-trace/latest-node16?color=white&label=%20&style=flat-square)        | `>= v16` | **Maintenance**     | 2023-05-12     | 2025-01-11     |
+| [`v5`](https://github.com/DataDog/dd-trace-js/tree/v5.x) | ![npm v5](https://img.shields.io/npm/v/dd-trace/latest?color=white&label=%20&style=flat-square)        | `>= v18` | **Current**     | 2024-01-11     | Unknown     |
 
-We currently maintain two release lines, namely `v3` and `v4`.
-Features and bug fixes that are merged are released to the `v4` line and, if appropriate, also the `v3` line.
+We currently maintain three release lines, namely `v5`, `v4` and `v3`.
+Features and bug fixes that are merged are released to the `v5` line and, if appropriate, also the `v4` & `v3` line.
 
-For any new projects it is recommended to use the `v4` release line:
+For any new projects it is recommended to use the `v5` release line:
 
 ```sh
 $ npm install dd-trace
 $ yarn add dd-trace
 ```
 
-However, existing projects that already use the `v3` release line, or projects that need to support EOL versions of Node.js, may continue to use these release lines.
+However, existing projects that already use the `v4` & `v3` release line, or projects that need to support EOL versions of Node.js, may continue to use these release lines.
 This is done by specifying the version when installing the package.
 
 ```sh
-$ npm install dd-trace@3
-$ yarn add dd-trace@3
+$ npm install dd-trace@4
+$ yarn add dd-trace@4
 ```
 
 Any backwards-breaking functionality that is introduced into the library will result in an increase of the major version of the library and therefore a new release line.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -36,6 +36,7 @@
     "test:integration:cucumber": "mocha --colors --timeout 30000 \"integration-tests/cucumber/*.spec.js\"",
     "test:integration:cypress": "mocha --colors --timeout 30000 \"integration-tests/cypress/*.spec.js\"",
     "test:integration:playwright": "mocha --colors --timeout 30000 \"integration-tests/playwright/*.spec.js\"",
+    "test:integration:profiler": "mocha --colors --timeout 90000 \"integration-tests/profiler/*.spec.js\"",
     "test:integration:serverless": "mocha --colors --timeout 30000 \"integration-tests/serverless/*.spec.js\"",
     "test:integration:plugins": "mocha --colors --exit -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/datadog-plugin-@($(echo $PLUGINS))/test/integration-test/**/*.spec.js\"",
     "test:unit:plugins": "mocha --colors --exit -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/datadog-instrumentations/test/@($(echo $PLUGINS)).spec.js\" \"packages/datadog-plugin-@($(echo $PLUGINS))/test/**/*.spec.js\" --exclude \"packages/datadog-plugin-@($(echo $PLUGINS))/test/integration-test/**/*.spec.js\"",
@@ -68,7 +69,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@datadog/native-appsec": "6.0.0",
+    "@datadog/native-appsec": "7.0.0",
     "@datadog/native-iast-rewriter": "2.2.2",
     "@datadog/native-iast-taint-tracking": "1.6.4",
     "@datadog/native-metrics": "^2.0.0",
@@ -79,7 +80,7 @@
     "crypto-randomuuid": "^1.0.0",
     "dc-polyfill": "^0.1.2",
     "ignore": "^5.2.4",
-    "import-in-the-middle": "^1.7.1",
+    "import-in-the-middle": "^1.7.3",
     "int64-buffer": "^0.1.9",
     "ipaddr.js": "^2.1.0",
     "istanbul-lib-coverage": "3.2.0",

package/packages/datadog-instrumentations/src/cucumber.js

@@ -44,6 +44,7 @@ const patched = new WeakSet()
 let pickleByFile = {}
 const pickleResultByFile = {}
 let skippableSuites = []
+let itrCorrelationId = ''
 let isForcedToRun = false
 let isUnskippable = false
 
@@ -102,7 +103,7 @@ function wrapRun (pl, isLatestVersion) {
         const testSuitePath = getTestSuitePath(testSuiteFullPath, process.cwd())
         isForcedToRun = isUnskippable && skippableSuites.includes(testSuitePath)
 
-        testSuiteStartCh.publish({ testSuitePath, isUnskippable, isForcedToRun })
+        testSuiteStartCh.publish({ testSuitePath, isUnskippable, isForcedToRun, itrCorrelationId })
       }
 
       const testSourceLine = this.gherkinDocument &&
@@ -304,6 +305,7 @@ addHook({
       this.pickleIds = picklesToRun
 
       skippedSuites = Array.from(filteredPickles.skippedSuites)
+      itrCorrelationId = skippableResponse.itrCorrelationId
     }
 
     pickleByFile = getPickleByFile(this)

package/packages/datadog-instrumentations/src/jest.js

@@ -497,6 +497,7 @@ addHook({
       _ddTestCommand,
       _ddForcedToRun,
       _ddUnskippable,
+      _ddItrCorrelationId,
       ...restOfTestEnvironmentOptions
     } = testEnvironmentOptions
 

package/packages/datadog-instrumentations/src/mocha.js

@@ -53,6 +53,7 @@ let isSuitesSkipped = false
 let skippedSuites = []
 const unskippableSuites = []
 let isForcedToRun = false
+let itrCorrelationId = ''
 
 function getSuitesByTestFile (root) {
   const suitesByTestFile = {}
@@ -191,7 +192,12 @@ function mochaHook (Runner) {
         const isUnskippable = unskippableSuites.includes(suite.file)
         isForcedToRun = isUnskippable && suitesToSkip.includes(getTestSuitePath(suite.file, process.cwd()))
         asyncResource.runInAsyncScope(() => {
-          testSuiteStartCh.publish({ testSuite: suite.file, isUnskippable, isForcedToRun })
+          testSuiteStartCh.publish({
+            testSuite: suite.file,
+            isUnskippable,
+            isForcedToRun,
+            itrCorrelationId
+          })
         })
       }
     })
@@ -395,11 +401,12 @@ addHook({
       }
     })
 
-    const onReceivedSkippableSuites = ({ err, skippableSuites }) => {
+    const onReceivedSkippableSuites = ({ err, skippableSuites, itrCorrelationId: responseItrCorrelationId }) => {
       if (err) {
         suitesToSkip = []
       } else {
         suitesToSkip = skippableSuites
+        itrCorrelationId = responseItrCorrelationId
       }
       // We remove the suites that we skip through ITR
       const filteredSuites = getFilteredSuites(runner.suite.suites)

package/packages/datadog-plugin-cucumber/src/index.js

@@ -13,7 +13,8 @@ const {
   addIntelligentTestRunnerSpanTags,
   TEST_ITR_UNSKIPPABLE,
   TEST_ITR_FORCED_RUN,
-  TEST_CODE_OWNERS
+  TEST_CODE_OWNERS,
+  ITR_CORRELATION_ID
 } = require('../../dd-trace/src/plugins/util/test')
 const { RESOURCE_NAME } = require('../../../ext/tags')
 const { COMPONENT, ERROR_MESSAGE } = require('../../dd-trace/src/constants')
@@ -74,7 +75,7 @@ class CucumberPlugin extends CiPlugin {
       this.tracer._exporter.flush()
     })
 
-    this.addSub('ci:cucumber:test-suite:start', ({ testSuitePath, isUnskippable, isForcedToRun }) => {
+    this.addSub('ci:cucumber:test-suite:start', ({ testSuitePath, isUnskippable, isForcedToRun, itrCorrelationId }) => {
       const testSuiteMetadata = getTestSuiteCommonTags(
         this.command,
         this.frameworkVersion,
@@ -89,6 +90,9 @@ class CucumberPlugin extends CiPlugin {
         this.telemetry.count(TELEMETRY_ITR_FORCED_TO_RUN, { testLevel: 'suite' })
         testSuiteMetadata[TEST_ITR_FORCED_RUN] = 'true'
       }
+      if (itrCorrelationId) {
+        testSuiteMetadata[ITR_CORRELATION_ID] = itrCorrelationId
+      }
       this.testSuiteSpan = this.tracer.startSpan('cucumber.test_suite', {
         childOf: this.testModuleSpan,
         tags: {
@@ -169,12 +173,12 @@ class CucumberPlugin extends CiPlugin {
       }
 
       span.finish()
-      this.telemetry.ciVisEvent(
-        TELEMETRY_EVENT_FINISHED,
-        'test',
-        { hasCodeOwners: !!span.context()._tags[TEST_CODE_OWNERS] }
-      )
       if (!isStep) {
+        this.telemetry.ciVisEvent(
+          TELEMETRY_EVENT_FINISHED,
+          'test',
+          { hasCodeOwners: !!span.context()._tags[TEST_CODE_OWNERS] }
+        )
         finishAllTraceSpans(span)
       }
     })

package/packages/datadog-plugin-cypress/src/plugin.js

@@ -23,7 +23,8 @@ const {
   addIntelligentTestRunnerSpanTags,
   TEST_SKIPPED_BY_ITR,
   TEST_ITR_UNSKIPPABLE,
-  TEST_ITR_FORCED_RUN
+  TEST_ITR_FORCED_RUN,
+  ITR_CORRELATION_ID
 } = require('../../dd-trace/src/plugins/util/test')
 const { ORIGIN_KEY, COMPONENT } = require('../../dd-trace/src/constants')
 const log = require('../../dd-trace/src/log')
@@ -39,6 +40,7 @@ const {
   incrementCountMetric,
   distributionMetric
 } = require('../../dd-trace/src/ci-visibility/telemetry')
+const { appClosing: appClosingTelemetry } = require('../../dd-trace/src/telemetry')
 const {
   GIT_REPOSITORY_URL,
   GIT_COMMIT_SHA,
@@ -137,10 +139,11 @@ function getSkippableTests (isSuitesSkippingEnabled, tracer, testConfiguration)
     if (!tracer._tracer._exporter || !tracer._tracer._exporter.getItrConfiguration) {
       return resolve({ err: new Error('CI Visibility was not initialized correctly') })
     }
-    tracer._tracer._exporter.getSkippableSuites(testConfiguration, (err, skippableTests) => {
+    tracer._tracer._exporter.getSkippableSuites(testConfiguration, (err, skippableTests, correlationId) => {
       resolve({
         err,
-        skippableTests
+        skippableTests,
+        correlationId
       })
     })
   })
@@ -214,6 +217,7 @@ module.exports = (on, config) => {
   let isSuitesSkippingEnabled = false
   let isCodeCoverageEnabled = false
   let testsToSkip = []
+  let itrCorrelationId = ''
   const unskippableSuites = []
   let hasForcedToRunSuites = false
   let hasUnskippableSuites = false
@@ -288,52 +292,54 @@ module.exports = (on, config) => {
         isCodeCoverageEnabled = itrConfig.isCodeCoverageEnabled
       }
 
-      return getSkippableTests(isSuitesSkippingEnabled, tracer, testConfiguration).then(({ err, skippableTests }) => {
-        if (err) {
-          log.error(err)
-        } else {
-          testsToSkip = skippableTests || []
-        }
-
-        // `details.specs` are test files
-        details.specs.forEach(({ absolute, relative }) => {
-          const isUnskippableSuite = isMarkedAsUnskippable({ path: absolute })
-          if (isUnskippableSuite) {
-            unskippableSuites.push(relative)
+      return getSkippableTests(isSuitesSkippingEnabled, tracer, testConfiguration)
+        .then(({ err, skippableTests, correlationId }) => {
+          if (err) {
+            log.error(err)
+          } else {
+            testsToSkip = skippableTests || []
+            itrCorrelationId = correlationId
           }
-        })
-
-        const childOf = getTestParentSpan(tracer)
-        rootDir = getRootDir(details)
-
-        command = getCypressCommand(details)
-        frameworkVersion = getCypressVersion(details)
-
-        const testSessionSpanMetadata = getTestSessionCommonTags(command, frameworkVersion, TEST_FRAMEWORK_NAME)
-        const testModuleSpanMetadata = getTestModuleCommonTags(command, frameworkVersion, TEST_FRAMEWORK_NAME)
 
-        testSessionSpan = tracer.startSpan(`${TEST_FRAMEWORK_NAME}.test_session`, {
-          childOf,
-          tags: {
-            [COMPONENT]: TEST_FRAMEWORK_NAME,
-            ...testEnvironmentMetadata,
-            ...testSessionSpanMetadata
-          }
-        })
-        ciVisEvent(TELEMETRY_EVENT_CREATED, 'session')
-
-        testModuleSpan = tracer.startSpan(`${TEST_FRAMEWORK_NAME}.test_module`, {
-          childOf: testSessionSpan,
-          tags: {
-            [COMPONENT]: TEST_FRAMEWORK_NAME,
-            ...testEnvironmentMetadata,
-            ...testModuleSpanMetadata
-          }
+          // `details.specs` are test files
+          details.specs.forEach(({ absolute, relative }) => {
+            const isUnskippableSuite = isMarkedAsUnskippable({ path: absolute })
+            if (isUnskippableSuite) {
+              unskippableSuites.push(relative)
+            }
+          })
+
+          const childOf = getTestParentSpan(tracer)
+          rootDir = getRootDir(details)
+
+          command = getCypressCommand(details)
+          frameworkVersion = getCypressVersion(details)
+
+          const testSessionSpanMetadata = getTestSessionCommonTags(command, frameworkVersion, TEST_FRAMEWORK_NAME)
+          const testModuleSpanMetadata = getTestModuleCommonTags(command, frameworkVersion, TEST_FRAMEWORK_NAME)
+
+          testSessionSpan = tracer.startSpan(`${TEST_FRAMEWORK_NAME}.test_session`, {
+            childOf,
+            tags: {
+              [COMPONENT]: TEST_FRAMEWORK_NAME,
+              ...testEnvironmentMetadata,
+              ...testSessionSpanMetadata
+            }
+          })
+          ciVisEvent(TELEMETRY_EVENT_CREATED, 'session')
+
+          testModuleSpan = tracer.startSpan(`${TEST_FRAMEWORK_NAME}.test_module`, {
+            childOf: testSessionSpan,
+            tags: {
+              [COMPONENT]: TEST_FRAMEWORK_NAME,
+              ...testEnvironmentMetadata,
+              ...testModuleSpanMetadata
+            }
+          })
+          ciVisEvent(TELEMETRY_EVENT_CREATED, 'module')
+
+          return details
         })
-        ciVisEvent(TELEMETRY_EVENT_CREATED, 'module')
-
-        return details
-      })
     })
   })
   on('after:spec', (spec, { tests, stats }) => {
@@ -357,6 +363,9 @@ module.exports = (on, config) => {
       if (isSkippedByItr) {
         skippedTestSpan.setTag(TEST_SKIPPED_BY_ITR, 'true')
       }
+      if (itrCorrelationId) {
+        skippedTestSpan.setTag(ITR_CORRELATION_ID, itrCorrelationId)
+      }
       skippedTestSpan.finish()
     })
 
@@ -378,6 +387,9 @@ module.exports = (on, config) => {
         finishedTest.testSpan.setTag(TEST_STATUS, cypressTestStatus)
         finishedTest.testSpan.setTag('error', latestError)
       }
+      if (itrCorrelationId) {
+        finishedTest.testSpan.setTag(ITR_CORRELATION_ID, itrCorrelationId)
+      }
       finishedTest.testSpan.finish(finishedTest.finishTime)
     })
 
@@ -429,10 +441,12 @@ module.exports = (on, config) => {
       }
       if (exporter.flush) {
         exporter.flush(() => {
+          appClosingTelemetry()
           resolve(null)
         })
       } else if (exporter._writer) {
         exporter._writer.flush(() => {
+          appClosingTelemetry()
           resolve(null)
         })
       }

package/packages/datadog-plugin-jest/src/index.js

@@ -13,7 +13,8 @@ const {
   TEST_SOURCE_START,
   TEST_ITR_UNSKIPPABLE,
   TEST_ITR_FORCED_RUN,
-  TEST_CODE_OWNERS
+  TEST_CODE_OWNERS,
+  ITR_CORRELATION_ID
 } = require('../../dd-trace/src/plugins/util/test')
 const { COMPONENT } = require('../../dd-trace/src/constants')
 const id = require('../../dd-trace/src/id')
@@ -121,6 +122,7 @@ class JestPlugin extends CiPlugin {
         config._ddTestSessionId = this.testSessionSpan.context().toTraceId()
         config._ddTestModuleId = this.testModuleSpan.context().toSpanId()
         config._ddTestCommand = this.testSessionSpan.context()._tags[TEST_COMMAND]
+        config._ddItrCorrelationId = this.itrCorrelationId
       })
     })
 
@@ -129,6 +131,7 @@ class JestPlugin extends CiPlugin {
         _ddTestSessionId: testSessionId,
         _ddTestCommand: testCommand,
         _ddTestModuleId: testModuleId,
+        _ddItrCorrelationId: itrCorrelationId,
         _ddForcedToRun,
         _ddUnskippable,
         _ddTestCodeCoverageEnabled
@@ -155,6 +158,9 @@ class JestPlugin extends CiPlugin {
           }
         }
       }
+      if (itrCorrelationId) {
+        testSuiteMetadata[ITR_CORRELATION_ID] = itrCorrelationId
+      }
 
       this.testSuiteSpan = this.tracer.startSpan('jest.test_suite', {
         childOf: testSessionSpanContext,

package/packages/datadog-plugin-mocha/src/index.js

@@ -14,7 +14,8 @@ const {
   TEST_SOURCE_START,
   TEST_ITR_UNSKIPPABLE,
   TEST_ITR_FORCED_RUN,
-  TEST_CODE_OWNERS
+  TEST_CODE_OWNERS,
+  ITR_CORRELATION_ID
 } = require('../../dd-trace/src/plugins/util/test')
 const { COMPONENT } = require('../../dd-trace/src/constants')
 const {
@@ -66,7 +67,12 @@ class MochaPlugin extends CiPlugin {
       this.telemetry.distribution(TELEMETRY_CODE_COVERAGE_NUM_FILES, {}, relativeCoverageFiles.length)
     })
 
-    this.addSub('ci:mocha:test-suite:start', ({ testSuite, isUnskippable, isForcedToRun }) => {
+    this.addSub('ci:mocha:test-suite:start', ({
+      testSuite,
+      isUnskippable,
+      isForcedToRun,
+      itrCorrelationId
+    }) => {
       const store = storage.getStore()
       const testSuiteMetadata = getTestSuiteCommonTags(
         this.command,
@@ -95,6 +101,9 @@ class MochaPlugin extends CiPlugin {
       if (this.itrConfig?.isCodeCoverageEnabled) {
         this.telemetry.ciVisEvent(TELEMETRY_CODE_COVERAGE_STARTED, 'suite', { library: 'istanbul' })
       }
+      if (itrCorrelationId) {
+        testSuiteSpan.setTag(ITR_CORRELATION_ID, itrCorrelationId)
+      }
       this.enter(testSuiteSpan, store)
       this._testSuites.set(testSuite, testSuiteSpan)
     })

package/packages/datadog-plugin-playwright/src/index.js

@@ -17,6 +17,7 @@ const {
   TELEMETRY_EVENT_CREATED,
   TELEMETRY_EVENT_FINISHED
 } = require('../../dd-trace/src/ci-visibility/telemetry')
+const { appClosing: appClosingTelemetry } = require('../../dd-trace/src/telemetry')
 
 class PlaywrightPlugin extends CiPlugin {
   static get id () {
@@ -37,6 +38,7 @@ class PlaywrightPlugin extends CiPlugin {
       this.testSessionSpan.finish()
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'session')
       finishAllTraceSpans(this.testSessionSpan)
+      appClosingTelemetry()
       this.tracer._exporter.flush(onDone)
     })
 

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js

@@ -16,5 +16,6 @@ module.exports = {
   'UNVALIDATED_REDIRECT_ANALYZER': require('./unvalidated-redirect-analyzer'),
   'WEAK_CIPHER_ANALYZER': require('./weak-cipher-analyzer'),
   'WEAK_HASH_ANALYZER': require('./weak-hash-analyzer'),
+  'WEAK_RANDOMNESS_ANALYZER': require('./weak-randomness-analyzer'),
   'XCONTENTTYPE_HEADER_MISSING_ANALYZER': require('./xcontenttype-header-missing-analyzer')
 }

package/packages/dd-trace/src/appsec/iast/analyzers/header-injection-analyzer.js

@@ -48,7 +48,7 @@ class HeaderInjectionAnalyzer extends InjectionAnalyzer {
     if (ranges?.length > 0) {
       return !(this.isCookieExclusion(lowerCasedHeaderName, ranges) ||
         this.isSameHeaderExclusion(lowerCasedHeaderName, ranges) ||
-        this.isAccessControlAllowOriginExclusion(lowerCasedHeaderName, ranges))
+        this.isAccessControlAllowExclusion(lowerCasedHeaderName, ranges))
     }
 
     return false
@@ -84,8 +84,8 @@ class HeaderInjectionAnalyzer extends InjectionAnalyzer {
     return false
   }
 
-  isAccessControlAllowOriginExclusion (name, ranges) {
-    if (name === 'access-control-allow-origin') {
+  isAccessControlAllowExclusion (name, ranges) {
+    if (name?.startsWith('access-control-allow-')) {
       return ranges
         .every(range => range.iinfo.type === HTTP_REQUEST_HEADER_VALUE)
     }

package/packages/dd-trace/src/appsec/iast/analyzers/weak-randomness-analyzer.js

@@ -0,0 +1,19 @@
+'use strict'
+const Analyzer = require('./vulnerability-analyzer')
+const { WEAK_RANDOMNESS } = require('../vulnerabilities')
+
+class WeakRandomnessAnalyzer extends Analyzer {
+  constructor () {
+    super(WEAK_RANDOMNESS)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:random:call', ({ fn }) => this.analyze(fn))
+  }
+
+  _isVulnerable (fn) {
+    return fn === Math.random
+  }
+}
+
+module.exports = new WeakRandomnessAnalyzer()

package/packages/dd-trace/src/appsec/iast/taint-tracking/csi-methods.js

@@ -3,6 +3,7 @@
 const csiMethods = [
   { src: 'concat' },
   { src: 'plusOperator', operator: true },
+  { src: 'random' },
   { src: 'replace' },
   { src: 'slice' },
   { src: 'substr' },

package/packages/dd-trace/src/appsec/iast/taint-tracking/taint-tracking-impl.js

@@ -1,5 +1,6 @@
 'use strict'
 
+const dc = require('dc-polyfill')
 const TaintedUtils = require('@datadog/native-iast-taint-tracking')
 const { storage } = require('../../../../../datadog-core')
 const iastContextFunctions = require('../iast-context')
@@ -7,12 +8,15 @@ const iastLog = require('../iast-log')
 const { EXECUTED_PROPAGATION } = require('../telemetry/iast-metric')
 const { isDebugAllowed } = require('../telemetry/verbosity')
 
+const mathRandomCallCh = dc.channel('datadog:random:call')
+
 function noop (res) { return res }
 // NOTE: methods of this object must be synchronized with csi-methods.js file definitions!
 // Otherwise you may end up rewriting a method and not providing its rewritten implementation
 const TaintTrackingNoop = {
   plusOperator: noop,
   concat: noop,
+  random: noop,
   replace: noop,
   slice: noop,
   substr: noop,
@@ -110,7 +114,14 @@ function csiMethodsOverrides (getContext) {
       getContext,
       String.prototype.trim,
       String.prototype.trimStart
-    )
+    ),
+
+    random: function (res, fn) {
+      if (mathRandomCallCh.hasSubscribers) {
+        mathRandomCallCh.publish({ fn })
+      }
+      return res
+    }
   }
 }
 

package/packages/dd-trace/src/appsec/iast/vulnerabilities.js

@@ -14,5 +14,6 @@ module.exports = {
   UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT',
   WEAK_CIPHER: 'WEAK_CIPHER',
   WEAK_HASH: 'WEAK_HASH',
+  WEAK_RANDOMNESS: 'WEAK_RANDOMNESS',
   XCONTENTTYPE_HEADER_MISSING: 'XCONTENTTYPE_HEADER_MISSING'
 }

package/packages/dd-trace/src/appsec/remote_config/manager.js

@@ -25,7 +25,8 @@ class RemoteConfigManager extends EventEmitter {
     super()
 
     const pollInterval = Math.floor(config.remoteConfig.pollInterval * 1000)
-    const url = config.url || new URL(format({
+
+    this.url = config.url || new URL(format({
       protocol: 'http:',
       hostname: config.hostname || 'localhost',
       port: config.port
@@ -33,12 +34,6 @@ class RemoteConfigManager extends EventEmitter {
 
     this.scheduler = new Scheduler((cb) => this.poll(cb), pollInterval)
 
-    this.requestOptions = {
-      url,
-      method: 'POST',
-      path: '/v0.7/config'
-    }
-
     this.state = {
       client: {
         state: { // updated by `parseConfig()`
@@ -122,7 +117,13 @@ class RemoteConfigManager extends EventEmitter {
   }
 
   poll (cb) {
-    request(this.getPayload(), this.requestOptions, (err, data, statusCode) => {
+    const options = {
+      url: this.url,
+      method: 'POST',
+      path: '/v0.7/config'
+    }
+
+    request(this.getPayload(), options, (err, data, statusCode) => {
       // 404 means RC is disabled, ignore it
       if (statusCode === 404) return cb()
 

package/packages/dd-trace/src/appsec/reporter.js

@@ -29,9 +29,10 @@ const REQUEST_HEADERS_MAP = mapHeaderAndTags([
   'accept-encoding',
   'accept-language',
   'host',
-  'user-agent',
   'forwarded',
+  'user-agent',
   'via',
+  'x-amzn-trace-id',
 
   ...ipHeaderList,
   ...contentHeaderList

package/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js

@@ -83,7 +83,8 @@ function getSkippableSuites ({
     } else {
       let skippableSuites = []
       try {
-        skippableSuites = JSON.parse(res)
+        const parsedResponse = JSON.parse(res)
+        skippableSuites = parsedResponse
           .data
           .filter(({ type }) => type === testLevel)
           .map(({ attributes: { suite, name } }) => {
@@ -92,6 +93,7 @@ function getSkippableSuites ({
             }
             return { suite, name }
           })
+        const { meta: { correlation_id: correlationId } } = parsedResponse
         incrementCountMetric(
           testLevel === 'test'
             ? TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_TESTS : TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_SUITES,
@@ -100,7 +102,7 @@ function getSkippableSuites ({
         )
         distributionMetric(TELEMETRY_ITR_SKIPPABLE_TESTS_RESPONSE_BYTES, {}, res.length)
         log.debug(() => `Number of received skippable ${testLevel}s: ${skippableSuites.length}`)
-        done(null, skippableSuites)
+        done(null, skippableSuites, correlationId)
       } catch (err) {
         done(err)
       }

package/packages/dd-trace/src/config.js

@@ -795,9 +795,9 @@ ken|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)
     tagger.add(tags, DD_TRACE_TAGS)
     tagger.add(tags, DD_TRACE_GLOBAL_TAGS)
 
-    this._setValue(env, 'service', DD_SERVICE || DD_SERVICE_NAME || tags.service)
-    this._setValue(env, 'env', DD_ENV || tags.env)
-    this._setValue(env, 'version', DD_VERSION || tags.version)
+    this._setString(env, 'service', DD_SERVICE || DD_SERVICE_NAME || tags.service)
+    this._setString(env, 'env', DD_ENV || tags.env)
+    this._setString(env, 'version', DD_VERSION || tags.version)
     this._setUnit(env, 'sampleRate', DD_TRACE_SAMPLE_RATE)
     this._setBoolean(env, 'logInjection', DD_LOGS_INJECTION)
     this._setArray(env, 'headerTags', DD_TRACE_HEADER_TAGS)
@@ -812,9 +812,9 @@ ken|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)
 
     tagger.add(tags, options.tags)
 
-    this._setValue(opts, 'service', options.service || tags.service)
-    this._setValue(opts, 'env', options.env || tags.env)
-    this._setValue(opts, 'version', options.version || tags.version)
+    this._setString(opts, 'service', options.service || tags.service)
+    this._setString(opts, 'env', options.env || tags.env)
+    this._setString(opts, 'version', options.version || tags.version)
     this._setUnit(opts, 'sampleRate', coalesce(options.sampleRate, options.ingestion.sampleRate))
     this._setBoolean(opts, 'logInjection', options.logInjection)
     this._setArray(opts, 'headerTags', options.headerTags)
@@ -875,6 +875,10 @@ ken|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)
     }
   }
 
+  _setString (obj, name, value) {
+    obj[name] = value || undefined // unset for empty strings
+  }
+
   _setTags (obj, name, value) {
     if (!value || Object.keys(value).length === 0) {
       return this._setValue(obj, name, null)

package/packages/dd-trace/src/encode/agentless-ci-visibility.js

@@ -2,7 +2,8 @@
 const { truncateSpan, normalizeSpan } = require('./tags-processors')
 const { AgentEncoder } = require('./0.4')
 const { version: ddTraceVersion } = require('../../../../package.json')
-const id = require('../../../dd-trace/src/id')
+const { ITR_CORRELATION_ID } = require('../../src/plugins/util/test')
+const id = require('../../src/id')
 const {
   distributionMetric,
   TELEMETRY_ENDPOINT_PAYLOAD_SERIALIZATION_MS,
@@ -45,7 +46,13 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
   }
 
   _encodeTestSuite (bytes, content) {
-    this._encodeMapPrefix(bytes, TEST_SUITE_KEYS_LENGTH)
+    let keysLength = TEST_SUITE_KEYS_LENGTH
+    const itrCorrelationId = content.meta[ITR_CORRELATION_ID]
+    if (itrCorrelationId) {
+      keysLength++
+    }
+
+    this._encodeMapPrefix(bytes, keysLength)
     this._encodeString(bytes, 'type')
     this._encodeString(bytes, content.type)
 
@@ -58,6 +65,12 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
     this._encodeString(bytes, 'test_suite_id')
     this._encodeId(bytes, content.span_id)
 
+    if (itrCorrelationId) {
+      this._encodeString(bytes, ITR_CORRELATION_ID)
+      this._encodeString(bytes, itrCorrelationId)
+      delete content.meta[ITR_CORRELATION_ID]
+    }
+
     this._encodeString(bytes, 'error')
     this._encodeNumber(bytes, content.error)
     this._encodeString(bytes, 'name')
@@ -144,6 +157,10 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
     if (content.meta.test_suite_id) {
       totalKeysLength = totalKeysLength + 1
     }
+    const itrCorrelationId = content.meta[ITR_CORRELATION_ID]
+    if (itrCorrelationId) {
+      totalKeysLength = totalKeysLength + 1
+    }
     this._encodeMapPrefix(bytes, totalKeysLength)
     if (content.type) {
       this._encodeString(bytes, 'type')
@@ -194,6 +211,12 @@ class AgentlessCiVisibilityEncoder extends AgentEncoder {
       delete content.meta.test_suite_id
     }
 
+    if (itrCorrelationId) {
+      this._encodeString(bytes, ITR_CORRELATION_ID)
+      this._encodeString(bytes, itrCorrelationId)
+      delete content.meta[ITR_CORRELATION_ID]
+    }
+
     this._encodeString(bytes, 'meta')
     this._encodeMap(bytes, content.meta)
     this._encodeString(bytes, 'metrics')

package/packages/dd-trace/src/plugins/ci_plugin.js

@@ -15,7 +15,8 @@ const {
   TEST_MODULE,
   getTestSuiteCommonTags,
   TEST_STATUS,
-  TEST_SKIPPED_BY_ITR
+  TEST_SKIPPED_BY_ITR,
+  ITR_CORRELATION_ID
 } = require('./util/test')
 const Plugin = require('./plugin')
 const { COMPONENT } = require('../constants')
@@ -53,11 +54,13 @@ module.exports = class CiPlugin extends Plugin {
       if (!this.tracer._exporter || !this.tracer._exporter.getSkippableSuites) {
         return onDone({ err: new Error('CI Visibility was not initialized correctly') })
       }
-      this.tracer._exporter.getSkippableSuites(this.testConfiguration, (err, skippableSuites) => {
+      this.tracer._exporter.getSkippableSuites(this.testConfiguration, (err, skippableSuites, itrCorrelationId) => {
         if (err) {
           log.error(`Skippable suites could not be fetched. ${err.message}`)
+        } else {
+          this.itrCorrelationId = itrCorrelationId
         }
-        onDone({ err, skippableSuites })
+        onDone({ err, skippableSuites, itrCorrelationId })
       })
     })
 
@@ -95,6 +98,9 @@ module.exports = class CiPlugin extends Plugin {
       const testCommand = this.testSessionSpan.context()._tags[TEST_COMMAND]
       skippedSuites.forEach((testSuite) => {
         const testSuiteMetadata = getTestSuiteCommonTags(testCommand, frameworkVersion, testSuite, this.constructor.id)
+        if (this.itrCorrelationId) {
+          testSuiteMetadata[ITR_CORRELATION_ID] = this.itrCorrelationId
+        }
 
         this.tracer.startSpan(`${this.constructor.id}.test_suite`, {
           childOf: this.testModuleSpan,

package/packages/dd-trace/src/plugins/util/test.js

@@ -60,6 +60,7 @@ const TEST_ITR_SKIPPING_COUNT = 'test.itr.tests_skipping.count'
 const TEST_CODE_COVERAGE_ENABLED = 'test.code_coverage.enabled'
 const TEST_ITR_UNSKIPPABLE = 'test.itr.unskippable'
 const TEST_ITR_FORCED_RUN = 'test.itr.forced_run'
+const ITR_CORRELATION_ID = 'itr_correlation_id'
 
 const TEST_CODE_COVERAGE_LINES_PCT = 'test.code_coverage.lines_pct'
 
@@ -111,6 +112,7 @@ module.exports = {
   TEST_CODE_COVERAGE_LINES_PCT,
   TEST_ITR_UNSKIPPABLE,
   TEST_ITR_FORCED_RUN,
+  ITR_CORRELATION_ID,
   addIntelligentTestRunnerSpanTags,
   getCoveredFilenamesFromCoverage,
   resetCoverage,

package/packages/dd-trace/src/profiling/config.js

@@ -40,6 +40,7 @@ class Config {
       DD_PROFILING_EXPERIMENTAL_OOM_HEAP_LIMIT_EXTENSION_SIZE,
       DD_PROFILING_EXPERIMENTAL_OOM_MAX_HEAP_EXTENSION_COUNT,
       DD_PROFILING_EXPERIMENTAL_OOM_EXPORT_STRATEGIES,
+      DD_PROFILING_TIMELINE_ENABLED,
       DD_PROFILING_EXPERIMENTAL_TIMELINE_ENABLED,
       DD_PROFILING_CODEHOTSPOTS_ENABLED,
       DD_PROFILING_ENDPOINT_COLLECTION_ENABLED,
@@ -96,11 +97,15 @@ class Config {
     // depending on those (code hotspots and endpoint collection) need to default
     // to false on Windows.
     const samplingContextsAvailable = process.platform !== 'win32'
-    function checkOptionAllowed (option, description) {
-      if (option && !samplingContextsAvailable) {
+    function checkOptionAllowed (option, description, condition) {
+      if (option && !condition) {
         throw new Error(`${description} not supported on ${process.platform}.`)
       }
     }
+    function checkOptionWithSamplingContextAllowed (option, description) {
+      checkOptionAllowed(option, description, samplingContextsAvailable)
+    }
+
     this.flushInterval = flushInterval
     this.uploadTimeout = uploadTimeout
     this.sourceMap = sourceMap
@@ -109,7 +114,7 @@ class Config {
       DD_PROFILING_ENDPOINT_COLLECTION_ENABLED,
       DD_PROFILING_EXPERIMENTAL_ENDPOINT_COLLECTION_ENABLED, samplingContextsAvailable))
     logExperimentalVarDeprecation('ENDPOINT_COLLECTION_ENABLED')
-    checkOptionAllowed(this.endpointCollectionEnabled, 'Endpoint collection')
+    checkOptionWithSamplingContextAllowed(this.endpointCollectionEnabled, 'Endpoint collection')
 
     this.pprofPrefix = pprofPrefix
     this.v8ProfilerBugWorkaroundEnabled = isTrue(coalesce(options.v8ProfilerBugWorkaround,
@@ -126,8 +131,13 @@ class Config {
       new AgentExporter(this)
     ], this)
 
+    // OOM monitoring does not work well on Windows, so it is disabled by default.
+    const oomMonitoringSupported = process.platform !== 'win32'
+
     const oomMonitoringEnabled = isTrue(coalesce(options.oomMonitoring,
-      DD_PROFILING_EXPERIMENTAL_OOM_MONITORING_ENABLED, true))
+      DD_PROFILING_EXPERIMENTAL_OOM_MONITORING_ENABLED, oomMonitoringSupported))
+    checkOptionAllowed(oomMonitoringEnabled, 'OOM monitoring', oomMonitoringSupported)
+
     const heapLimitExtensionSize = coalesce(options.oomHeapLimitExtensionSize,
       Number(DD_PROFILING_EXPERIMENTAL_OOM_HEAP_LIMIT_EXTENSION_SIZE), 0)
     const maxHeapExtensionCount = coalesce(options.oomMaxHeapExtensionCount,
@@ -154,16 +164,20 @@ class Config {
       })
 
     this.timelineEnabled = isTrue(coalesce(options.timelineEnabled,
+      DD_PROFILING_TIMELINE_ENABLED,
       DD_PROFILING_EXPERIMENTAL_TIMELINE_ENABLED, false))
+    logExperimentalVarDeprecation('TIMELINE_ENABLED')
+    checkOptionWithSamplingContextAllowed(this.timelineEnabled, 'Timeline view')
 
     this.codeHotspotsEnabled = isTrue(coalesce(options.codeHotspotsEnabled,
       DD_PROFILING_CODEHOTSPOTS_ENABLED,
       DD_PROFILING_EXPERIMENTAL_CODEHOTSPOTS_ENABLED, samplingContextsAvailable))
     logExperimentalVarDeprecation('CODEHOTSPOTS_ENABLED')
-    checkOptionAllowed(this.codeHotspotsEnabled, 'Code hotspots')
+    checkOptionWithSamplingContextAllowed(this.codeHotspotsEnabled, 'Code hotspots')
 
     this.cpuProfilingEnabled = isTrue(coalesce(options.cpuProfilingEnabled,
       DD_PROFILING_EXPERIMENTAL_CPU_ENABLED, false))
+    checkOptionWithSamplingContextAllowed(this.cpuProfilingEnabled, 'CPU profiling')
 
     this.profilers = ensureProfilers(profilers, this)
   }

package/packages/dd-trace/src/telemetry/index.js

@@ -140,8 +140,7 @@ function appStarted (config) {
   return app
 }
 
-function onBeforeExit () {
-  process.removeListener('beforeExit', onBeforeExit)
+function appClosing () {
   const { reqType, payload } = createPayload('app-closing')
   sendData(config, application, host, reqType, payload)
   // we flush before shutting down. Only in CI Visibility
@@ -150,6 +149,11 @@ function onBeforeExit () {
   }
 }
 
+function onBeforeExit () {
+  process.removeListener('beforeExit', onBeforeExit)
+  appClosing()
+}
+
 function createAppObject (config) {
   return {
     service_name: config.service,
@@ -339,5 +343,6 @@ module.exports = {
   start,
   stop,
   updateIntegrations,
-  updateConfig
+  updateConfig,
+  appClosing
 }

package/packages/dd-trace/src/telemetry/send-data.js

@@ -1,6 +1,7 @@
 
 const request = require('../exporters/common/request')
 const log = require('../log')
+const { isTrue } = require('../util')
 
 let agentTelemetry = true
 
@@ -49,13 +50,12 @@ function sendData (config, application, host, reqType, payload = {}, cb = () =>
   const {
     hostname,
     port,
-    experimental,
     isCiVisibility
   } = config
 
   let url = config.url
 
-  const isCiVisibilityAgentlessMode = isCiVisibility && experimental?.exporter === 'datadog'
+  const isCiVisibilityAgentlessMode = isCiVisibility && isTrue(process.env.DD_CIVISIBILITY_AGENTLESS_ENABLED)
 
   if (isCiVisibilityAgentlessMode) {
     try {

package/scripts/st.js

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+/* eslint-disable no-console, no-fallthrough */
+'use strict'
+
+const path = require('path')
+const { writeFileSync } = require('fs')
+const { execSync } = require('child_process')
+
+const ddtracePath = path.join(__dirname, '..')
+const defaultTestPath = process.env.DD_ST_PATH || path.join(ddtracePath, '..', 'system-tests')
+
+const { buildAll, npm, testDir, testArgs } = parseArgs()
+
+const binariesPath = path.join(testDir, 'binaries')
+
+if (npm) {
+  console.log('Using NPM package:', npm)
+
+  writeFileSync(path.join(binariesPath, 'nodejs-load-from-npm'), npm)
+} else {
+  console.log('Using local repo')
+
+  const packName = execSync(`npm pack ${ddtracePath}`, {
+    cwd: binariesPath,
+    stdio: [null, null, 'inherit'],
+    encoding: 'utf8'
+  }).slice(0, -1) // remove trailing newline
+
+  writeFileSync(path.join(binariesPath, 'nodejs-load-from-npm'), `/binaries/${packName}`)
+}
+
+try {
+  execSync(`./build.sh ${buildAll ? '' : '-i weblog'} && ./run.sh ${testArgs}`, {
+    cwd: testDir,
+    stdio: [null, 'inherit', 'inherit']
+  })
+} catch (err) {
+  process.exit(err.status || 1)
+}
+
+function parseArgs () {
+  const args = {
+    buildAll: false,
+    npm: null,
+    testDir: defaultTestPath,
+    testArgs: ''
+  }
+
+  for (let i = 2; i < process.argv.length; i++) {
+    switch (process.argv[i]) {
+      case '-b':
+      case '--build-all':
+        args.buildAll = true
+        break
+
+      case '-h':
+      case '--help':
+        helpAndExit()
+        break
+
+      case '-n':
+      case '--npm': {
+        const arg = process.argv[i + 1]
+        if (!arg || arg[0] === '-') {
+          args.npm = 'dd-trace'
+        } else {
+          args.npm = arg
+          i++
+        }
+        break
+      }
+
+      case '-t':
+      case '--test-dir': {
+        const arg = process.argv[++i]
+        if (!arg || arg[0] === '-') helpAndExit()
+        args.testDir = arg
+        break
+      }
+
+      case '--':
+        args.testArgs = process.argv.slice(i + 1).join(' ')
+        return args
+
+      default:
+        console.log('Unknown option:', process.argv[i], '\n')
+        helpAndExit()
+    }
+  }
+
+  return args
+}
+
+function helpAndExit () {
+  console.log('Usage: node st.js [options...] [-- test-args]')
+  console.log('Options:')
+  console.log('  -b, --build-all       Rebuild all images (default: only build weblog)')
+  console.log('  -h, --help            Print this message')
+  console.log('  -n, --npm [package]   Build a remote package instead of the local repo (default: "dd-trace")')
+  console.log('                        Can be a package name (e.g. "dd-trace@4.2.0") or a git URL (e.g.')
+  console.log('                        "git+https://github.com/DataDog/dd-trace-js.git#mybranch")')
+  console.log('  -t, --test-dir <path> Specify the system-tests directory (default: "dd-trace/../system-tests/")')
+  console.log('  -- <test-args>        Passed to system-tests run.sh (e.g. "-- SCENARIO_NAME tests/path_to_test.py")')
+  process.exit()
+}