dd-trace 5.108.0 → 5.110.0

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -0,0 +1,147 @@
+'use strict'
+
+const { TTLCache } = require('../../../../../vendor/dist/@isaacs/ttlcache')
+const web = require('../../plugins/util/web')
+const log = require('../../log')
+const { AUTO_REJECT, USER_REJECT } = require('../../../../../ext/priority')
+const { keepTrace } = require('../../priority_sampler')
+const { ASM } = require('../../standalone/product')
+const { isBlocked } = require('../blocking')
+
+const MAX_SIZE = 4096
+
+const SamplingDecision = Object.freeze({
+  SAMPLE: 'sample',
+  MISSING_ROUTE: 'missing_route',
+  SKIP: 'skip',
+})
+
+let enabled
+let asmStandaloneEnabled
+
+/**
+ * @type {TTLCache}
+ */
+let sampledRequests
+
+class NoopTTLCache {
+  clear () {}
+  set (_key, _value) {}
+  has (_key) { return false }
+}
+
+function configure ({ appsec, apmTracingEnabled }) {
+  enabled = appsec.apiSecurity.enabled
+  asmStandaloneEnabled = apmTracingEnabled === false
+  sampledRequests = appsec.apiSecurity.sampleDelay === 0
+    ? new NoopTTLCache()
+    : new TTLCache({ max: MAX_SIZE, ttl: appsec.apiSecurity.sampleDelay * 1000 })
+}
+
+function disable () {
+  enabled = false
+  sampledRequests?.clear()
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @param {boolean} record When true and the decision is SAMPLE, records the endpoint in the TTL cache
+ * @returns {'sample' | 'missing_route' | 'skip'}
+ */
+function sampleRequest (req, res, record = false) {
+  if (!enabled) return SamplingDecision.SKIP
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return SamplingDecision.SKIP
+
+  if (!asmStandaloneEnabled) {
+    let priority = getSpanPriority(rootSpan)
+    if (!priority) {
+      rootSpan._prioritySampler?.sample(rootSpan)
+      priority = getSpanPriority(rootSpan)
+    }
+
+    if (priority === AUTO_REJECT || priority === USER_REJECT) {
+      return SamplingDecision.SKIP
+    }
+  }
+
+  const resolved = resolveSamplingKey(req, res)
+  if (!resolved) return SamplingDecision.SKIP
+
+  if (record && resolved.route === null) {
+    if (resolved.status === 404 || isBlocked(res)) return SamplingDecision.SKIP
+    return SamplingDecision.MISSING_ROUTE
+  }
+
+  if (sampledRequests.has(resolved.key)) return SamplingDecision.SKIP
+
+  if (asmStandaloneEnabled) {
+    keepTrace(rootSpan, ASM)
+  }
+
+  if (record) {
+    sampledRequests.set(resolved.key, undefined)
+  }
+
+  return SamplingDecision.SAMPLE
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @returns {boolean} Whether this request's endpoint is currently recorded in the TTL cache.
+ */
+function wasSampled (req, res) {
+  const resolved = resolveSamplingKey(req, res)
+  return resolved !== null && sampledRequests.has(resolved.key)
+}
+
+function resolveSamplingKey (req, res) {
+  const method = req.method
+  const status = res.statusCode
+
+  if (!method || !status) {
+    log.warn('[ASM] Unsupported groupkey for API security')
+    return null
+  }
+
+  const context = web.getContext(req)
+  const route = getRouteOrEndpoint(context, status)
+
+  // route === null signals "no route information at all". An empty string is still a valid
+  // route (dd-trace-js represents the express root path '/' as an empty path segment).
+  return { method, status, route, key: method + (route ?? '') + status }
+}
+
+function getRouteOrEndpoint (context, statusCode) {
+  // The router plugin populates `context.paths` whenever the framework matched something.
+  // For express's root '/' route the matched path is normalized to '' (see datadog-plugin-router),
+  // so `paths.length > 0` is the signal that the framework provided route information — even when
+  // the joined string is empty. An empty `paths` array means no router involvement at all.
+  const paths = context?.paths
+  if (paths !== undefined && paths.length > 0) {
+    return paths.join('')
+  }
+
+  if (statusCode === 404) return null
+
+  const endpoint = context?.span?.context()?.getTag?.('http.endpoint')
+  if (endpoint) return endpoint
+
+  return null
+}
+
+function getSpanPriority (span) {
+  const spanContext = span.context?.()
+  return spanContext._sampling?.priority
+}
+
+module.exports = {
+  configure,
+  disable,
+  sampleRequest,
+  wasSampled,
+  SamplingDecision,
+}

package/packages/dd-trace/src/appsec/channels.js

@@ -23,6 +23,7 @@ module.exports = {
   fsOperationStart: dc.channel('apm:fs:operation:start'),
   graphqlMiddlewareChannel: dc.tracingChannel('datadog:apollo:middleware'),
   httpClientRequestStart: dc.channel('apm:http:client:request:start'),
+  httpClientResponseStart: dc.channel('apm:http:client:response:start'),
   httpClientResponseFinish: dc.channel('apm:http:client:response:finish'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -14,19 +14,32 @@ const {
 const KNUTH_FACTOR = 11400714819323199488n // eslint-disable-line unicorn/numeric-separators-style
 const UINT64_MAX = (1n << 64n) - 1n
 
+const SUPPORTED_RESPONSE_BODY_MIME_TYPES = new Set([
+  'application/json',
+  'text/json',
+  'application/x-www-form-urlencoded',
+])
+
+const RESPONSE_BODY_IGNORED_TAG_CONTENT_TYPE =
+  '_dd.appsec.downstream_request.response_body_ignored.content_type_invalid'
+const RESPONSE_BODY_IGNORED_TAG_CONTENT_LENGTH_MISSING =
+  '_dd.appsec.downstream_request.response_body_ignored.content_length_missing'
+const RESPONSE_BODY_IGNORED_TAG_CONTENT_LENGTH_TOO_BIG =
+  '_dd.appsec.downstream_request.response_body_ignored.content_length_too_big'
+
 let config
 let samplingRate
 let globalRequestCounter
 let bodyAnalysisCount
 let downstreamAnalysisCount
-let redirectBodyCollectionDecisions
+let responseBodyIgnoredCount
 
 function enable (_config) {
   config = _config
   globalRequestCounter = 0n
   bodyAnalysisCount = new WeakMap()
   downstreamAnalysisCount = new WeakMap()
-  redirectBodyCollectionDecisions = new WeakMap()
+  responseBodyIgnoredCount = new WeakMap()
 
   const bodyAnalysisSampleRate = config.appsec.apiSecurity?.downstreamBodyAnalysisSampleRate
   samplingRate = Math.min(Math.max(bodyAnalysisSampleRate, 0), 1)
@@ -43,49 +56,84 @@ function disable () {
   globalRequestCounter = null
   bodyAnalysisCount = null
   downstreamAnalysisCount = null
-  redirectBodyCollectionDecisions = null
+  responseBodyIgnoredCount = null
 }
 
 /**
- * Check we have a stored redirect body collection decision for a given URL.
- * @param {import('http').IncomingMessage} req outgoing request.
- * @param {string} outgoingUrl the URL being requested.
- * @returns {boolean} the stored decision
+ * @param {string|string[]|undefined} contentLength raw content-length header value.
+ * @returns {number|null} parsed content length or null when invalid.
  */
-function consumeRedirectBodyCollectionDecision (req, outgoingUrl) {
-  const decisions = redirectBodyCollectionDecisions.get(req)
-  if (!decisions) return false
+function parseContentLengthHeader (contentLength) {
+  if (contentLength == null) {
+    return null
+  }
+
+  const value = Array.isArray(contentLength) ? contentLength[0] : contentLength
+  const parsed = Number.parseInt(String(value), 10)
 
-  return decisions.delete(outgoingUrl)
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    return null
+  }
+
+  return parsed
 }
 
 /**
- * Stores a redirect body collection decision for a follow-up request.
- * @param {import('http').IncomingMessage} req outgoing request.
- * @param {string} redirectUrl the URL to redirect to.
+ * Increments a response-body-ignored counter on the service-entry span.
+ * @param {import('http').IncomingMessage} req originating request.
+ * @param {string} tag full `_dd.appsec.downstream_request.response_body_ignored.*` span tag.
  */
-function storeRedirectBodyCollectionDecision (req, redirectUrl) {
-  let decisions = redirectBodyCollectionDecisions.get(req)
+function recordResponseBodyIgnored (req, tag) {
+  const span = web.root(req)
+  if (!span) return
 
-  if (!decisions) {
-    decisions = new Set()
-    redirectBodyCollectionDecisions.set(req, decisions)
+  let counts = responseBodyIgnoredCount.get(req)
+  if (!counts) {
+    counts = {}
+    responseBodyIgnoredCount.set(req, counts)
   }
 
-  decisions.add(redirectUrl)
+  const current = counts[tag] || 0
+  const next = current + 1
+  counts[tag] = next
+  span.setTag(tag, next)
 }
 
 /**
- * Determines whether the current downstream request/responses bodies should be sampled for analysis.
- * @param {import('http').IncomingMessage} req outgoing request.
- * @param {string} outgoingUrl the URL being requested (to check for redirect decisions).
- * @returns {boolean} true when the downstream response body should be captured.
+ * @param {import('http').IncomingMessage} originatingReq inbound request (for metrics).
+ * @param {import('http').IncomingMessage} res downstream response.
+ * @returns {boolean} whether downstream response body should be collected for AppSec.
  */
-function shouldSampleBody (req, outgoingUrl) {
-  // Check if there's a stored decision from a previous redirect
-  const storedDecision = consumeRedirectBodyCollectionDecision(req, outgoingUrl)
-  if (storedDecision) return true
+function evaluateResponseBodyCollection (originatingReq, res) {
+  const maxBytes = config.appsec.apiSecurity.maxDownstreamBodyBytes
+
+  const mime = extractMimeType(res.headers?.['content-type'])
+  if (!mime || !SUPPORTED_RESPONSE_BODY_MIME_TYPES.has(mime)) {
+    recordResponseBodyIgnored(originatingReq, RESPONSE_BODY_IGNORED_TAG_CONTENT_TYPE)
+    return false
+  }
+
+  const declaredContentLength = parseContentLengthHeader(res.headers?.['content-length'])
+  if (declaredContentLength == null || declaredContentLength === 0) {
+    recordResponseBodyIgnored(originatingReq, RESPONSE_BODY_IGNORED_TAG_CONTENT_LENGTH_MISSING)
+    return false
+  }
+
+  if (declaredContentLength > maxBytes) {
+    recordResponseBodyIgnored(originatingReq, RESPONSE_BODY_IGNORED_TAG_CONTENT_LENGTH_TOO_BIG)
+    return false
+  }
+
+  return true
+}
 
+/**
+ * Probabilistic gate for downstream response body capture (rate + per-request cap).
+ * Only used from {@link planResponseBodyCollection}; does not increment {@link bodyAnalysisCount}.
+ * @param {import('http').IncomingMessage} req originating server request.
+ * @returns {boolean}
+ */
+function shouldSampleBody (req) {
   globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
 
   const currentCount = bodyAnalysisCount.get(req) || 0
@@ -97,14 +145,43 @@ function shouldSampleBody (req, outgoingUrl) {
   // Replace 1000n with the accuraccy that we want to maintain
   const threshold = (UINT64_MAX * BigInt(Math.round(samplingRate * 1000))) / 1000n
 
-  const shouldCollectBody = hashed <= threshold
+  return hashed <= threshold
+}
+
+/**
+ * @param {import('http').IncomingMessage} res downstream HTTP response.
+ * @returns {boolean}
+ */
+function isRedirectResponse (res) {
+  const location = res.headers?.location || ''
+  return res.statusCode >= 300 && res.statusCode < 400 && !!location
+}
+
+/**
+ * Plans downstream response body capture on the instrumentation ctx when response headers arrive.
+ * Redirect responses (3xx + Location) are ignored; each outbound hop is evaluated independently
+ * when its own non-redirect response arrives.
+ * @param {import('http').IncomingMessage} originatingReq incoming server request.
+ * @param {import('http').IncomingMessage} res downstream response.
+ * @param {object} ctx http client instrumentation context (mutated).
+ */
+function planResponseBodyCollection (originatingReq, res, ctx) {
+  if (!config?.appsec.apiSecurity) {
+    return
+  }
 
-  // Track body analysis count if we're sampling the response body
-  if (shouldCollectBody) {
-    incrementBodyAnalysisCount(req)
+  if (isRedirectResponse(res)) {
+    return
   }
 
-  return shouldCollectBody
+  if (!shouldSampleBody(originatingReq)) {
+    return
+  }
+
+  if (evaluateResponseBodyCollection(originatingReq, res)) {
+    ctx.shouldCollectBody = true
+    incrementBodyAnalysisCount(originatingReq)
+  }
 }
 
 /**
@@ -145,25 +222,6 @@ function extractRequestData (ctx) {
   return addresses
 }
 
-/**
- * Checks if a response is a redirect
- * @param {import('http').IncomingMessage} req incoming server request.
- * @param {import('http').IncomingMessage} res downstream response object.
- * @returns {boolean} is redirect.
- */
-function handleRedirectResponse (req, res) {
-  const isRedirect = res.statusCode >= 300 && res.statusCode < 400
-  const redirectLocation = res.headers?.location || ''
-
-  if (isRedirect && redirectLocation) {
-    // Store the body collection decision for the redirect target
-    storeRedirectBodyCollectionDecision(req, redirectLocation)
-    return true
-  }
-
-  return false
-}
-
 /**
  * Extracts response data for WAF analysis.
  * @param {import('http').IncomingMessage} res downstream response object.
@@ -291,13 +349,8 @@ function extractMimeType (contentType) {
 module.exports = {
   enable,
   disable,
-  shouldSampleBody,
-  handleRedirectResponse,
+  planResponseBodyCollection,
   incrementDownstreamAnalysisCount,
   extractRequestData,
   extractResponseData,
-  // exports for tests
-  parseBody,
-  getMethod,
-  storeRedirectBodyCollectionDecision,
 }

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/ldap-sensitive-analyzer.js

@@ -2,24 +2,66 @@
 
 const log = require('../../../../../log')
 
-const LDAP_PATTERN = String.raw`\(.*?(?:~=|=|<=|>=)(?<LITERAL>[^)]+)\)`
-const pattern = new RegExp(LDAP_PATTERN, 'gmi')
+const OPEN_PAREN = 0x28
+const CLOSE_PAREN = 0x29
+const EQUALS = 0x3D
+const TILDE = 0x7E
+const LESS = 0x3C
+const GREATER = 0x3E
 
+// Linear scanner for LDAP assertion-filter values. For each parenthesised group
+// "(attr <op> value)" where <op> is "=", "~=", "<=", or ">=" and no nested
+// parenthesis appears before the operator, report the value range [opEnd, ')').
+// The cursor only ever moves forward, so total work is O(input length).
 module.exports = function extractSensitiveRanges (evidence) {
   try {
-    pattern.lastIndex = 0
+    const value = evidence?.value
     const tokens = []
+    if (typeof value !== 'string') return tokens
 
-    let regexResult = pattern.exec(evidence.value)
-    while (regexResult != null) {
-      if (!regexResult.groups.LITERAL) continue
-      // Computing indices manually since Node.js 12 does not support d flag on regular expressions
-      // TODO Get indices from group by adding d flag in regular expression
-      const start = regexResult.index + (regexResult[0].length - regexResult.groups.LITERAL.length - 1)
-      const end = start + regexResult.groups.LITERAL.length
-      tokens.push({ start, end })
-      regexResult = pattern.exec(evidence.value)
+    const length = value.length
+    let cursor = 0
+
+    while (cursor < length) {
+      const open = value.indexOf('(', cursor)
+      if (open === -1) break
+
+      let scan = open + 1
+      let opStart = -1
+      let opLen = 0
+
+      while (scan < length) {
+        const code = value.charCodeAt(scan)
+        if (code === OPEN_PAREN || code === CLOSE_PAREN) break
+        if (code === EQUALS) {
+          opStart = scan
+          opLen = 1
+          break
+        }
+        if ((code === TILDE || code === LESS || code === GREATER) &&
+            scan + 1 < length && value.charCodeAt(scan + 1) === EQUALS) {
+          opStart = scan
+          opLen = 2
+          break
+        }
+        scan++
+      }
+
+      if (opStart === -1) {
+        cursor = open + 1
+        continue
+      }
+
+      const close = value.indexOf(')', opStart + opLen)
+      if (close === -1) break
+
+      const start = opStart + opLen
+      if (start < close) {
+        tokens.push({ start, end: close })
+      }
+      cursor = close + 1
     }
+
     return tokens
   } catch (e) {
     log.debug('[ASM] Error extracting sensitive ranges', e)

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/url-sensitive-analyzer.js

@@ -3,7 +3,11 @@
 const log = require('../../../../../log')
 
 const AUTHORITY = '^(?:[^:]+:)?//([^@]+)@'
-const QUERY_FRAGMENT = '[?#&]([^=&;]+)=([^?#&]+)'
+// The key class excludes `?` and `#` so the greedy quantifier is bounded per fragment.
+// Query keys cannot legitimately contain those characters (they delimit query/fragment
+// boundaries), so excluding them preserves match semantics for valid URLs while keeping
+// the regex linear on arbitrary input.
+const QUERY_FRAGMENT = '[?#&]([^=&;?#]+)=([^?#&]+)'
 const pattern = new RegExp([AUTHORITY, QUERY_FRAGMENT].join('|'), 'gmi')
 
 module.exports = function extractSensitiveRanges (evidence) {

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js

@@ -17,6 +17,11 @@ const urlSensitiveAnalyzer = require('./sensitive-analyzers/url-sensitive-analyz
 
 const REDACTED_SOURCE_BUFFER = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
 
+// Upper bound on the evidence-string length the redaction analyzers will scan. Oversized
+// values bypass the analyzer entirely and are emitted as a fully-redacted placeholder.
+// Counted in JS string characters (UTF-16 code units), not bytes.
+const MAX_EVIDENCE_LENGTH = 32_768
+
 class SensitiveHandler {
   constructor () {
     this._namePattern = new RegExp(/** @type {string} */ (defaults['iast.redactionNamePattern']), 'gmi')
@@ -53,11 +58,31 @@ class SensitiveHandler {
 
   scrubEvidence (vulnerabilityType, evidence, sourcesIndexes, sources) {
     const sensitiveAnalyzer = this._sensitiveAnalyzers.get(vulnerabilityType)
-    if (sensitiveAnalyzer) {
-      const sensitiveRanges = sensitiveAnalyzer(evidence)
-      if (evidence.ranges || sensitiveRanges?.length) {
-        return this.toRedactedJson(evidence, sensitiveRanges, sourcesIndexes, sources)
+    if (!sensitiveAnalyzer) {
+      return null
+    }
+
+    // Oversized evidence: skip the analyzer and emit a fully-redacted placeholder. Mark
+    // every source backing this vulnerability as redacted so the formatter strips their
+    // raw `value` before they leave the process.
+    if (typeof evidence.value === 'string' && evidence.value.length > MAX_EVIDENCE_LENGTH) {
+      const redactedSources = []
+      for (const sourceIndex of sourcesIndexes) {
+        const source = sources[sourceIndex]
+        if (source && !source.redacted) {
+          source.pattern = ''.padEnd(source.value.length, REDACTED_SOURCE_BUFFER)
+          source.redacted = true
+        }
+        if (!redactedSources.includes(sourceIndex)) {
+          redactedSources.push(sourceIndex)
+        }
       }
+      return { redactedValueParts: [{ redacted: true }], redactedSources }
+    }
+
+    const sensitiveRanges = sensitiveAnalyzer(evidence)
+    if (evidence.ranges || sensitiveRanges?.length) {
+      return this.toRedactedJson(evidence, sensitiveRanges, sourcesIndexes, sources)
     }
     return null
   }

package/packages/dd-trace/src/appsec/index.js

@@ -38,7 +38,7 @@ const waf = require('./waf')
 const addresses = require('./addresses')
 const Reporter = require('./reporter')
 const appsecTelemetry = require('./telemetry')
-const apiSecuritySampler = require('./api_security_sampler')
+const apiSecurity = require('./api_security')
 const { isBlocked, block, callBlockDelegation, setTemplates, getBlockingAction } = require('./blocking')
 const { getActiveRequest } = require('./store')
 const UserTracking = require('./user_tracking')
@@ -71,7 +71,7 @@ function enable (_config) {
 
     Reporter.init(_config.appsec, _config.inferredProxyServicesEnabled)
 
-    apiSecuritySampler.configure(_config)
+    apiSecurity.configure(_config)
 
     UserTracking.setCollectionMode(_config.appsec.eventTracking.mode, false)
 
@@ -233,14 +233,18 @@ function incomingHttpEndTranslator ({ req, res }) {
   // This hook runs before span finish, so ensure route/endpoint tags are available before API Security sampling runs.
   web.setRouteOrEndpointTag(req)
 
-  if (apiSecuritySampler.sampleRequest(req, res, true)) {
+  const apiSecSamplingDecision = apiSecurity.sampleRequest(req, res, true)
+  if (apiSecSamplingDecision === apiSecurity.SamplingDecision.SAMPLE) {
     persistent[addresses.WAF_CONTEXT_PROCESSOR] = { 'extract-schema': true }
   }
 
+  let wafResult
   if (!isEmpty(persistent)) {
-    waf.run({ persistent }, req)
+    wafResult = waf.run({ persistent }, req)
   }
 
+  apiSecurity.reportRequest(req, apiSecSamplingDecision, wafResult)
+
   waf.disposeContext(req)
 
   const storedHeaders = storedResponseHeaders.get(req) || {}
@@ -339,7 +343,7 @@ function onRequestProcessParams ({ req, res, abortController, params }) {
 
 function onResponseBody ({ req, res, body }) {
   if (!body || typeof body !== 'object') return
-  if (!apiSecuritySampler.sampleRequest(req, res)) return
+  if (apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE) return
 
   // we don't support blocking at this point, so no results needed
   waf.run({
@@ -513,7 +517,7 @@ function disable () {
 
   appsecRemoteConfig.disableWafUpdate()
 
-  apiSecuritySampler.disable()
+  apiSecurity.disable()
 
   // Channel#unsubscribe() is undefined for non active channels
   if (bodyParser.hasSubscribers) bodyParser.unsubscribe(onRequestBodyParsed)

package/packages/dd-trace/src/appsec/rasp/ssrf.js

@@ -3,6 +3,7 @@
 const { format } = require('url')
 const {
   httpClientRequestStart,
+  httpClientResponseStart,
   httpClientResponseFinish,
 } = require('../channels')
 const addresses = require('../addresses')
@@ -21,6 +22,7 @@ function enable (_config) {
   downstream.enable(_config)
 
   httpClientRequestStart.subscribe(analyzeSsrf)
+  httpClientResponseStart.subscribe(planResponseBodyCollection)
   httpClientResponseFinish.subscribe(handleResponseFinish)
 }
 
@@ -28,6 +30,7 @@ function disable () {
   downstream.disable()
 
   if (httpClientRequestStart.hasSubscribers) httpClientRequestStart.unsubscribe(analyzeSsrf)
+  if (httpClientResponseStart.hasSubscribers) httpClientResponseStart.unsubscribe(planResponseBodyCollection)
   if (httpClientResponseFinish.hasSubscribers) httpClientResponseFinish.unsubscribe(handleResponseFinish)
 }
 
@@ -37,9 +40,6 @@ function analyzeSsrf (ctx) {
 
   if (!req || !outgoingUrl) return
 
-  // Determine if we should collect the response body based on sampling rate and redirect URL
-  ctx.shouldCollectBody = downstream.shouldSampleBody(req, outgoingUrl)
-
   const requestAddresses = downstream.extractRequestData(ctx)
 
   const ephemeral = {
@@ -56,13 +56,23 @@ function analyzeSsrf (ctx) {
   downstream.incrementDownstreamAnalysisCount(req)
 }
 
+/**
+ * Channel handler: plans downstream response body capture once response headers are available.
+ * @param {{ ctx: object, res: import('http').IncomingMessage }} payload channel payload.
+ */
+function planResponseBodyCollection ({ ctx, res }) {
+  const originatingRequest = getActiveRequest()
+  if (!originatingRequest || !res) return
+
+  downstream.planResponseBodyCollection(originatingRequest, res, ctx)
+}
+
 /**
  * Finalizes body collection for the response and triggers RASP analysis.
- * @param {{
- *   ctx: object,
- *   res: import('http').IncomingMessage,
- *   body: string|Buffer|null
- * }} payload event payload from the channel.
+ * @param {object} params event payload from the channel.
+ * @param {object} params.ctx instrumentation context.
+ * @param {import('http').IncomingMessage} params.res downstream response.
+ * @param {string|Buffer|null} params.body collected body.
  */
 function handleResponseFinish ({ ctx, res, body }) {
   // downstream response object
@@ -71,9 +81,7 @@ function handleResponseFinish ({ ctx, res, body }) {
   const originatingRequest = getActiveRequest()
   if (!originatingRequest) return
 
-  // Skip body analysis for redirect responses
-  const evaluateBody = ctx.shouldCollectBody && !downstream.handleRedirectResponse(originatingRequest, res)
-  const responseBody = evaluateBody ? body : null
+  const responseBody = ctx.shouldCollectBody ? body : null
   runResponseEvaluation(res, originatingRequest, responseBody)
 }
 

package/packages/dd-trace/src/appsec/reporter.js

@@ -615,4 +615,5 @@ module.exports = {
   finishRequest,
   mapHeaderAndTags,
   truncateRequestBody,
+  isSchemaAttribute,
 }