dd-trace 5.101.0 → 5.103.0

package/packages/datadog-plugin-openai/src/tracing.js

@@ -560,9 +560,8 @@ function createResponseResponseExtraction (tags, body, openaiStore) {
 
 // The server almost always responds with JSON
 function coerceResponseBody (body, methodName) {
-  switch (methodName) {
-    case 'downloadFile':
-      return { file: body }
+  if (methodName === 'downloadFile') {
+    return { file: body }
   }
 
   const type = typeof body
@@ -574,9 +573,8 @@ function coerceResponseBody (body, methodName) {
     }
   } else if (type === 'object') {
     return body
-  } else {
-    return {}
   }
+  return {}
 }
 
 // This method is used to replace a dynamic URL segment with an asterisk
@@ -594,28 +592,19 @@ function lookupOperationEndpoint (operationId, methodName, url) {
       return '/v1/files/*/content'
 
     case 'retrieveFineTune':
-      switch (methodName) {
-        case 'fine_tuning.jobs.retrieve':
-          return '/v1/fine_tuning/jobs/*'
-        default:
-          return '/v1/fine-tunes/*'
-      }
+      return methodName === 'fine_tuning.jobs.retrieve'
+        ? '/v1/fine_tuning/jobs/*'
+        : '/v1/fine-tunes/*'
 
     case 'listFineTuneEvents':
-      switch (methodName) {
-        case 'fine_tuning.jobs.listEvents':
-          return '/v1/fine_tuning/jobs/*/events'
-        default:
-          return '/v1/fine-tunes/*/events'
-      }
+      return methodName === 'fine_tuning.jobs.listEvents'
+        ? '/v1/fine_tuning/jobs/*/events'
+        : '/v1/fine-tunes/*/events'
 
     case 'cancelFineTune':
-      switch (methodName) {
-        case 'fine_tuning.jobs.cancel':
-          return '/v1/fine_tuning/jobs/*/cancel'
-        default:
-          return '/v1/fine-tunes/*/cancel'
-      }
+      return methodName === 'fine_tuning.jobs.cancel'
+        ? '/v1/fine_tuning/jobs/*/cancel'
+        : '/v1/fine-tunes/*/cancel'
   }
 
   return url

package/packages/datadog-plugin-pg/src/index.js

@@ -9,9 +9,9 @@ class PGPlugin extends DatabasePlugin {
   static system = 'postgres'
 
   bindStart (ctx) {
-    const { params = {}, query, processId, stream } = ctx
+    const { params = {}, query, originalText, processId, stream } = ctx
     const service = this.serviceName({ pluginConfig: this.config, params })
-    const originalStatement = this.maybeTruncate(query.text)
+    const originalStatement = this.maybeTruncate(originalText)
 
     const span = this.startSpan(this.operationName(), {
       service,
@@ -32,7 +32,7 @@ class PGPlugin extends DatabasePlugin {
       span.setTag('db.stream', 1)
     }
 
-    query.__ddInjectableQuery = this.injectDbmQuery(span, query.text, service.name, !!query.name)
+    ctx.injected = this.injectDbmQuery(span, originalText, service.name, !!query.name)
 
     return ctx.currentStore
   }

package/packages/datadog-plugin-playwright/src/index.js

@@ -321,6 +321,7 @@ class PlaywrightPlugin extends CiPlugin {
       isAtrRetry,
       isModified,
       finalStatus,
+      earlyFlakeAbortReason,
       onDone,
     }) => {
       if (!span) return
@@ -384,6 +385,9 @@ class PlaywrightPlugin extends CiPlugin {
       if (finalStatus) {
         span.setTag(TEST_FINAL_STATUS, finalStatus)
       }
+      if (earlyFlakeAbortReason) {
+        span.setTag(TEST_EARLY_FLAKE_ABORT_REASON, earlyFlakeAbortReason)
+      }
       for (const step of steps) {
         const stepStartTime = step.startTime.getTime()
         const stepSpan = this.tracer.startSpan('playwright.step', {
@@ -491,7 +495,7 @@ class PlaywrightPlugin extends CiPlugin {
       [TEST_SOURCE_START]: testSourceLine,
     }
     if (testSourceFile) {
-      extraTags[TEST_SOURCE_FILE] = testSourceFile || testSuite
+      extraTags[TEST_SOURCE_FILE] = testSourceFile
     }
     if (browserName) {
       // Added as parameter too because it should affect the test fingerprint

package/packages/datadog-plugin-redis/src/index.js

@@ -4,6 +4,9 @@ const { CLIENT_PORT_KEY } = require('../../dd-trace/src/constants')
 const CachePlugin = require('../../dd-trace/src/plugins/cache')
 const urlFilter = require('../../dd-trace/src/plugins/util/urlfilter')
 
+const MAX_ARG_LENGTH = 100
+const MAX_COMMAND_LENGTH = 1000
+
 class RedisPlugin extends CachePlugin {
   static id = 'redis'
   static system = 'redis'
@@ -14,7 +17,7 @@ class RedisPlugin extends CachePlugin {
   }
 
   bindStart (ctx) {
-    const { db, command, args, connectionOptions, connectionName } = ctx
+    const { db, command, args, argsStartIndex, connectionOptions, connectionName } = ctx
 
     const resource = command
     const normalizedCommand = command.toUpperCase()
@@ -29,7 +32,7 @@ class RedisPlugin extends CachePlugin {
       meta: {
         'db.type': this._spanType,
         'db.name': db || '0',
-        [`${this._spanType}.raw_command`]: formatCommand(normalizedCommand, args),
+        [`${this._spanType}.raw_command`]: formatCommand(normalizedCommand, args, argsStartIndex),
         'out.host': connectionOptions.host,
         [CLIENT_PORT_KEY]: connectionOptions.port,
       },
@@ -43,36 +46,28 @@ class RedisPlugin extends CachePlugin {
   }
 }
 
-function formatCommand (command, args) {
+function formatCommand (command, args, argsStartIndex = 0) {
   if (!args || command === 'AUTH') return command
 
-  for (let i = 0, l = args.length; i < l; i++) {
-    if (typeof args[i] === 'function') continue
-
-    command = `${command} ${formatArg(args[i])}`
+  let result = command
+  for (let i = argsStartIndex, l = args.length; i < l; i++) {
+    const arg = args[i]
+    if (typeof arg === 'function') continue
 
-    if (command.length > 1000) return trim(command, 1000)
+    result = `${result} ${formatArg(arg)}`
+    if (result.length > MAX_COMMAND_LENGTH) return result.slice(0, MAX_COMMAND_LENGTH - 3) + '...'
   }
 
-  return command
+  return result
 }
 
 function formatArg (arg) {
-  switch (typeof arg) {
-    case 'string':
-    case 'number':
-      return trim(String(arg), 100)
-    default:
-      return '?'
-  }
-}
-
-function trim (str, maxlen) {
-  if (str.length > maxlen) {
-    str = str.slice(0, maxlen - 3) + '...'
+  if (typeof arg === 'string') {
+    return arg.length > MAX_ARG_LENGTH ? arg.slice(0, MAX_ARG_LENGTH - 3) + '...' : arg
   }
-
-  return str
+  // Number stringification is bounded (~23 chars max), so it never hits MAX_ARG_LENGTH.
+  if (typeof arg === 'number') return String(arg)
+  return '?'
 }
 
 function normalizeConfig (config) {

package/packages/datadog-plugin-vitest/src/index.js

@@ -213,13 +213,16 @@ class VitestPlugin extends CiPlugin {
       return ctx.currentStore
     })
 
-    this.addSub('ci:vitest:test:pass', ({ span, task, finalStatus }) => {
+    this.addSub('ci:vitest:test:pass', ({ span, task, finalStatus, earlyFlakeAbortReason }) => {
       if (span) {
         this.telemetry.ciVisEvent(TELEMETRY_EVENT_FINISHED, 'test', this.getTestTelemetryTags(span))
         span.setTag(TEST_STATUS, 'pass')
         if (finalStatus) {
           span.setTag(TEST_FINAL_STATUS, finalStatus)
         }
+        if (earlyFlakeAbortReason) {
+          span.setTag(TEST_EARLY_FLAKE_ABORT_REASON, earlyFlakeAbortReason)
+        }
         span.finish(this.taskToFinishTime.get(task))
         finishAllTraceSpans(span)
       }
@@ -234,6 +237,7 @@ class VitestPlugin extends CiPlugin {
       hasFailedAllRetries,
       attemptToFixFailed,
       finalStatus,
+      earlyFlakeAbortReason,
     }) => {
       if (!span) {
         return
@@ -262,6 +266,9 @@ class VitestPlugin extends CiPlugin {
       if (finalStatus) {
         span.setTag(TEST_FINAL_STATUS, finalStatus)
       }
+      if (earlyFlakeAbortReason) {
+        span.setTag(TEST_EARLY_FLAKE_ABORT_REASON, earlyFlakeAbortReason)
+      }
       if (duration) {
         span.finish(span._startTime + duration - MILLISECONDS_TO_SUBTRACT_FROM_FAILED_TEST_DURATION) // milliseconds
       } else {

package/packages/datadog-shimmer/src/shimmer.js

@@ -267,7 +267,13 @@ function assertMethod (target, name, method) {
  * @throws {Error} If the target is a class constructor.
  */
 function assertNotClass (target) {
-  if (Function.prototype.toString.call(target).startsWith('class')) {
+  // Class constructors have a non-writable `prototype` property; functions have a
+  // writable one and arrows / async / method-shorthand have none at all. The
+  // `'prototype' in target` gate skips the descriptor lookup for the no-prototype
+  // shapes; the `in` operator is cheaper than reading `target.prototype` since
+  // it returns a boolean instead of materialising the prototype reference.
+  if ('prototype' in target &&
+      Object.getOwnPropertyDescriptor(target, 'prototype').writable === false) {
     throw new TypeError('Target is a native class constructor and cannot be wrapped.')
   }
 }

package/packages/dd-trace/src/aiguard/index.js

@@ -3,6 +3,7 @@
 const log = require('../log')
 const { incomingHttpRequestStart, aiguardChannel } = require('./channels')
 const AIGuard = require('./sdk')
+const { SOURCE_AUTO, INTEGRATION_NONE } = require('./tags')
 
 let isEnabled = false
 let aiguard
@@ -51,7 +52,8 @@ function onEvaluate (ctx) {
     return
   }
 
-  aiguard.evaluate(ctx.messages, { block })
+  const opts = { block, source: SOURCE_AUTO, integration: ctx.integration || INTEGRATION_NONE }
+  aiguard.evaluate(ctx.messages, opts)
     .then(() => {
       ctx.resolve()
     })

package/packages/dd-trace/src/aiguard/sdk.js

@@ -11,23 +11,23 @@ const { keepTrace } = require('../priority_sampler')
 const { AI_GUARD } = require('../standalone/product')
 const NoopAIGuard = require('./noop')
 const executeRequest = require('./client')
-const {
-  AI_GUARD_RESOURCE,
-  AI_GUARD_TARGET_TAG_KEY,
-  AI_GUARD_REASON_TAG_KEY,
-  AI_GUARD_ACTION_TAG_KEY,
-  AI_GUARD_EVENT_TAG_KEY,
-  AI_GUARD_BLOCKED_TAG_KEY,
-  AI_GUARD_META_STRUCT_KEY,
-  AI_GUARD_TOOL_NAME_TAG_KEY,
-  AI_GUARD_TELEMETRY_REQUESTS,
-  AI_GUARD_TELEMETRY_TRUNCATED,
-} = require('./tags')
+const TAGS = require('./tags')
 
-const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+const aiguardMetrics = telemetryMetrics.manager.namespace('ai_guard')
 
 const ALLOW = 'ALLOW'
 
+/**
+ * Reports a telemetry error
+ *
+ * @param {string} errorType - The error type constant (client_error, bad_status, bad_response)
+ * @param {{ source: string, integration: string }} telemetryTags - Source and integration tags
+ */
+function reportTelemetryError (errorType, telemetryTags) {
+  aiguardMetrics.count(TAGS.TELEMETRY_REQUESTS, { error: true, ...telemetryTags }).inc(1)
+  aiguardMetrics.count(TAGS.TELEMETRY_ERROR, { type: errorType, ...telemetryTags }).inc(1)
+}
+
 class AIGuardAbortError extends Error {
   constructor (reason, tags, tagProbs, sds) {
     super(reason)
@@ -99,10 +99,10 @@ class AIGuard extends NoopAIGuard {
    * - Clones each message so callers cannot mutate the data set in the meta struct.
    * - Truncates the list of messages and `content` fields emitting metrics accordingly.
    */
-  #buildMessagesForMetaStruct (messages) {
+  #buildMessagesForMetaStruct (messages, telemetryTags) {
     const size = Math.min(messages.length, this.#maxMessagesLength)
     if (messages.length > size) {
-      appsecMetrics.count(AI_GUARD_TELEMETRY_TRUNCATED, { type: 'messages' }).inc(1)
+      aiguardMetrics.count(TAGS.TELEMETRY_TRUNCATED, { type: 'messages', ...telemetryTags }).inc(1)
     }
     const result = []
     let contentTruncated = false
@@ -115,7 +115,7 @@ class AIGuard extends NoopAIGuard {
       result.push(message)
     }
     if (contentTruncated) {
-      appsecMetrics.count(AI_GUARD_TELEMETRY_TRUNCATED, { type: 'content' }).inc(1)
+      aiguardMetrics.count(TAGS.TELEMETRY_TRUNCATED, { type: 'content', ...telemetryTags }).inc(1)
     }
     return result
   }
@@ -185,22 +185,23 @@ class AIGuard extends NoopAIGuard {
     if (!this.#initialized) {
       return super.evaluate(messages, opts)
     }
-    const { block = true } = opts ?? {}
-    return this.#tracer.trace(AI_GUARD_RESOURCE, {}, async (span) => {
+    const { block = true, source = TAGS.SOURCE_SDK, integration = TAGS.INTEGRATION_NONE } = opts ?? {}
+    const telemetryTags = { source, integration }
+    return this.#tracer.trace(TAGS.RESOURCE, {}, async (span) => {
       const last = messages[messages.length - 1]
       const target = this.#isToolCall(last) ? 'tool' : 'prompt'
-      span.setTag(AI_GUARD_TARGET_TAG_KEY, target)
+      span.setTag(TAGS.TARGET_TAG_KEY, target)
       if (target === 'tool') {
         const name = this.#getToolName(last, messages)
         if (name) {
-          span.setTag(AI_GUARD_TOOL_NAME_TAG_KEY, name)
+          span.setTag(TAGS.TOOL_NAME_TAG_KEY, name)
         }
       }
       const metaStruct = {
-        messages: this.#buildMessagesForMetaStruct(messages),
+        messages: this.#buildMessagesForMetaStruct(messages, telemetryTags),
       }
       span.meta_struct = {
-        [AI_GUARD_META_STRUCT_KEY]: metaStruct,
+        [TAGS.META_STRUCT_KEY]: metaStruct,
       }
       const rootSpan = span.context()?._trace?.started?.[0]
       if (rootSpan) {
@@ -208,7 +209,7 @@ class AIGuard extends NoopAIGuard {
         // keepTrace must be called before executeRequest so the sampling decision
         // is propagated correctly to outgoing HTTP client calls.
         keepTrace(rootSpan, AI_GUARD)
-        rootSpan.setTag(AI_GUARD_EVENT_TAG_KEY, 'true')
+        rootSpan.setTag(TAGS.EVENT_TAG_KEY, 'true')
       }
       let response
       try {
@@ -224,18 +225,18 @@ class AIGuard extends NoopAIGuard {
           payload,
           { url: this.#evaluateUrl, headers: this.#headers, timeout: this.#timeout })
       } catch (e) {
-        appsecMetrics.count(AI_GUARD_TELEMETRY_REQUESTS, { error: true }).inc(1)
+        reportTelemetryError(TAGS.ERROR_TYPE_CLIENT, telemetryTags)
         throw new AIGuardClientError(`Unexpected error calling AI Guard service: ${e.message}`, { cause: e })
       }
       if (response.status !== 200) {
-        appsecMetrics.count(AI_GUARD_TELEMETRY_REQUESTS, { error: true }).inc(1)
+        reportTelemetryError(TAGS.ERROR_TYPE_STATUS, telemetryTags)
         throw new AIGuardClientError(
           `AI Guard service call failed, status ${response.status}`,
           { errors: response.body?.errors })
       }
       const attr = response.body?.data?.attributes
       if (!attr?.action) {
-        appsecMetrics.count(AI_GUARD_TELEMETRY_REQUESTS, { error: true }).inc(1)
+        reportTelemetryError(TAGS.ERROR_TYPE_RESPONSE, telemetryTags)
         throw new AIGuardClientError(`AI Guard service returned unexpected response : ${response.body}`)
       }
       const action = attr.action
@@ -254,13 +255,18 @@ class AIGuard extends NoopAIGuard {
       }
       const blockingEnabled = attr.is_blocking_enabled ?? false
       const shouldBlock = block && blockingEnabled && action !== ALLOW
-      appsecMetrics.count(AI_GUARD_TELEMETRY_REQUESTS, { action, error: false, block: shouldBlock }).inc(1)
-      span.setTag(AI_GUARD_ACTION_TAG_KEY, action)
+      aiguardMetrics.count(TAGS.TELEMETRY_REQUESTS, {
+        action,
+        error: false,
+        block: shouldBlock,
+        ...telemetryTags,
+      }).inc(1)
+      span.setTag(TAGS.ACTION_TAG_KEY, action)
       if (reason) {
-        span.setTag(AI_GUARD_REASON_TAG_KEY, reason)
+        span.setTag(TAGS.REASON_TAG_KEY, reason)
       }
       if (shouldBlock) {
-        span.setTag(AI_GUARD_BLOCKED_TAG_KEY, 'true')
+        span.setTag(TAGS.BLOCKED_TAG_KEY, 'true')
         throw new AIGuardAbortError(reason, tags, tagProbabilities, sdsFindings)
       }
       return { action, reason, tags, tagProbabilities, sds: sdsFindings }

package/packages/dd-trace/src/aiguard/tags.js

@@ -1,15 +1,24 @@
 'use strict'
 
 module.exports = {
-  AI_GUARD_RESOURCE: 'ai_guard',
-  AI_GUARD_TARGET_TAG_KEY: 'ai_guard.target',
-  AI_GUARD_TOOL_NAME_TAG_KEY: 'ai_guard.tool_name',
-  AI_GUARD_ACTION_TAG_KEY: 'ai_guard.action',
-  AI_GUARD_REASON_TAG_KEY: 'ai_guard.reason',
-  AI_GUARD_BLOCKED_TAG_KEY: 'ai_guard.blocked',
-  AI_GUARD_EVENT_TAG_KEY: 'ai_guard.event',
-  AI_GUARD_META_STRUCT_KEY: 'ai_guard',
-
-  AI_GUARD_TELEMETRY_REQUESTS: 'ai_guard.requests',
-  AI_GUARD_TELEMETRY_TRUNCATED: 'ai_guard.truncated',
+  RESOURCE: 'ai_guard',
+  TARGET_TAG_KEY: 'ai_guard.target',
+  TOOL_NAME_TAG_KEY: 'ai_guard.tool_name',
+  ACTION_TAG_KEY: 'ai_guard.action',
+  REASON_TAG_KEY: 'ai_guard.reason',
+  BLOCKED_TAG_KEY: 'ai_guard.blocked',
+  EVENT_TAG_KEY: 'ai_guard.event',
+  META_STRUCT_KEY: 'ai_guard',
+
+  TELEMETRY_REQUESTS: 'requests',
+  TELEMETRY_TRUNCATED: 'truncated',
+  TELEMETRY_ERROR: 'error',
+
+  SOURCE_SDK: 'sdk',
+  SOURCE_AUTO: 'auto',
+  INTEGRATION_NONE: 'none',
+
+  ERROR_TYPE_CLIENT: 'client_error',
+  ERROR_TYPE_STATUS: 'bad_status',
+  ERROR_TYPE_RESPONSE: 'bad_response',
 }

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-password-rules.js

@@ -5,7 +5,7 @@ const { NameAndValue } = require('./hardcoded-rule-type')
 module.exports = [
   {
     id: 'hardcoded-password',
-    regex: /(?:pwd|pswd|pass|secret)(?:[0-9a-z\-_\t.]{0,20})(?:[\s|']|[\s|""]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|""|\s|=|\x60){0,5}([0-9a-z\-_.=]{10,150})(?:['"\s\x60;]|$)/i,
+    regex: /(?:pwd|pswd|pass|secret)(?:[0-9a-z\-_\t.]{0,20})(?:[\s|']|[\s|"]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|""|\s|=|\x60){0,5}([0-9a-z\-_.=]{10,150})(?:['"\s\x60;]|$)/i,
     type: NameAndValue,
   },
 ]