dd-trace 5.109.0 → 5.110.0

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -0,0 +1,147 @@
+'use strict'
+
+const { TTLCache } = require('../../../../../vendor/dist/@isaacs/ttlcache')
+const web = require('../../plugins/util/web')
+const log = require('../../log')
+const { AUTO_REJECT, USER_REJECT } = require('../../../../../ext/priority')
+const { keepTrace } = require('../../priority_sampler')
+const { ASM } = require('../../standalone/product')
+const { isBlocked } = require('../blocking')
+
+const MAX_SIZE = 4096
+
+const SamplingDecision = Object.freeze({
+  SAMPLE: 'sample',
+  MISSING_ROUTE: 'missing_route',
+  SKIP: 'skip',
+})
+
+let enabled
+let asmStandaloneEnabled
+
+/**
+ * @type {TTLCache}
+ */
+let sampledRequests
+
+class NoopTTLCache {
+  clear () {}
+  set (_key, _value) {}
+  has (_key) { return false }
+}
+
+function configure ({ appsec, apmTracingEnabled }) {
+  enabled = appsec.apiSecurity.enabled
+  asmStandaloneEnabled = apmTracingEnabled === false
+  sampledRequests = appsec.apiSecurity.sampleDelay === 0
+    ? new NoopTTLCache()
+    : new TTLCache({ max: MAX_SIZE, ttl: appsec.apiSecurity.sampleDelay * 1000 })
+}
+
+function disable () {
+  enabled = false
+  sampledRequests?.clear()
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @param {boolean} record When true and the decision is SAMPLE, records the endpoint in the TTL cache
+ * @returns {'sample' | 'missing_route' | 'skip'}
+ */
+function sampleRequest (req, res, record = false) {
+  if (!enabled) return SamplingDecision.SKIP
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return SamplingDecision.SKIP
+
+  if (!asmStandaloneEnabled) {
+    let priority = getSpanPriority(rootSpan)
+    if (!priority) {
+      rootSpan._prioritySampler?.sample(rootSpan)
+      priority = getSpanPriority(rootSpan)
+    }
+
+    if (priority === AUTO_REJECT || priority === USER_REJECT) {
+      return SamplingDecision.SKIP
+    }
+  }
+
+  const resolved = resolveSamplingKey(req, res)
+  if (!resolved) return SamplingDecision.SKIP
+
+  if (record && resolved.route === null) {
+    if (resolved.status === 404 || isBlocked(res)) return SamplingDecision.SKIP
+    return SamplingDecision.MISSING_ROUTE
+  }
+
+  if (sampledRequests.has(resolved.key)) return SamplingDecision.SKIP
+
+  if (asmStandaloneEnabled) {
+    keepTrace(rootSpan, ASM)
+  }
+
+  if (record) {
+    sampledRequests.set(resolved.key, undefined)
+  }
+
+  return SamplingDecision.SAMPLE
+}
+
+/**
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @returns {boolean} Whether this request's endpoint is currently recorded in the TTL cache.
+ */
+function wasSampled (req, res) {
+  const resolved = resolveSamplingKey(req, res)
+  return resolved !== null && sampledRequests.has(resolved.key)
+}
+
+function resolveSamplingKey (req, res) {
+  const method = req.method
+  const status = res.statusCode
+
+  if (!method || !status) {
+    log.warn('[ASM] Unsupported groupkey for API security')
+    return null
+  }
+
+  const context = web.getContext(req)
+  const route = getRouteOrEndpoint(context, status)
+
+  // route === null signals "no route information at all". An empty string is still a valid
+  // route (dd-trace-js represents the express root path '/' as an empty path segment).
+  return { method, status, route, key: method + (route ?? '') + status }
+}
+
+function getRouteOrEndpoint (context, statusCode) {
+  // The router plugin populates `context.paths` whenever the framework matched something.
+  // For express's root '/' route the matched path is normalized to '' (see datadog-plugin-router),
+  // so `paths.length > 0` is the signal that the framework provided route information — even when
+  // the joined string is empty. An empty `paths` array means no router involvement at all.
+  const paths = context?.paths
+  if (paths !== undefined && paths.length > 0) {
+    return paths.join('')
+  }
+
+  if (statusCode === 404) return null
+
+  const endpoint = context?.span?.context()?.getTag?.('http.endpoint')
+  if (endpoint) return endpoint
+
+  return null
+}
+
+function getSpanPriority (span) {
+  const spanContext = span.context?.()
+  return spanContext._sampling?.priority
+}
+
+module.exports = {
+  configure,
+  disable,
+  sampleRequest,
+  wasSampled,
+  SamplingDecision,
+}

package/packages/dd-trace/src/appsec/index.js

@@ -38,7 +38,7 @@ const waf = require('./waf')
 const addresses = require('./addresses')
 const Reporter = require('./reporter')
 const appsecTelemetry = require('./telemetry')
-const apiSecuritySampler = require('./api_security_sampler')
+const apiSecurity = require('./api_security')
 const { isBlocked, block, callBlockDelegation, setTemplates, getBlockingAction } = require('./blocking')
 const { getActiveRequest } = require('./store')
 const UserTracking = require('./user_tracking')
@@ -71,7 +71,7 @@ function enable (_config) {
 
     Reporter.init(_config.appsec, _config.inferredProxyServicesEnabled)
 
-    apiSecuritySampler.configure(_config)
+    apiSecurity.configure(_config)
 
     UserTracking.setCollectionMode(_config.appsec.eventTracking.mode, false)
 
@@ -233,14 +233,18 @@ function incomingHttpEndTranslator ({ req, res }) {
   // This hook runs before span finish, so ensure route/endpoint tags are available before API Security sampling runs.
   web.setRouteOrEndpointTag(req)
 
-  if (apiSecuritySampler.sampleRequest(req, res, true)) {
+  const apiSecSamplingDecision = apiSecurity.sampleRequest(req, res, true)
+  if (apiSecSamplingDecision === apiSecurity.SamplingDecision.SAMPLE) {
     persistent[addresses.WAF_CONTEXT_PROCESSOR] = { 'extract-schema': true }
   }
 
+  let wafResult
   if (!isEmpty(persistent)) {
-    waf.run({ persistent }, req)
+    wafResult = waf.run({ persistent }, req)
   }
 
+  apiSecurity.reportRequest(req, apiSecSamplingDecision, wafResult)
+
   waf.disposeContext(req)
 
   const storedHeaders = storedResponseHeaders.get(req) || {}
@@ -339,7 +343,7 @@ function onRequestProcessParams ({ req, res, abortController, params }) {
 
 function onResponseBody ({ req, res, body }) {
   if (!body || typeof body !== 'object') return
-  if (!apiSecuritySampler.sampleRequest(req, res)) return
+  if (apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE) return
 
   // we don't support blocking at this point, so no results needed
   waf.run({
@@ -513,7 +517,7 @@ function disable () {
 
   appsecRemoteConfig.disableWafUpdate()
 
-  apiSecuritySampler.disable()
+  apiSecurity.disable()
 
   // Channel#unsubscribe() is undefined for non active channels
   if (bodyParser.hasSubscribers) bodyParser.unsubscribe(onRequestBodyParsed)

package/packages/dd-trace/src/appsec/reporter.js

@@ -615,4 +615,5 @@ module.exports = {
   finishRequest,
   mapHeaderAndTags,
   truncateRequestBody,
+  isSchemaAttribute,
 }

package/packages/dd-trace/src/appsec/telemetry/api_security.js

@@ -0,0 +1,34 @@
+'use strict'
+
+const telemetryMetrics = require('../../telemetry/metrics')
+
+const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+
+const normalizedFrameworkCache = new Map()
+
+function normalizeFramework (framework) {
+  let normalized = normalizedFrameworkCache.get(framework)
+  if (normalized === undefined) {
+    normalized = framework ? framework.toLowerCase().replaceAll(' ', '_') : 'unknown'
+    normalizedFrameworkCache.set(framework, normalized)
+  }
+  return normalized
+}
+
+function incrementApiSecRequestSchema (framework) {
+  appsecMetrics.count('api_security.request.schema', { framework: normalizeFramework(framework) }).inc()
+}
+
+function incrementApiSecRequestNoSchema (framework) {
+  appsecMetrics.count('api_security.request.no_schema', { framework: normalizeFramework(framework) }).inc()
+}
+
+function incrementApiSecMissingRoute (framework) {
+  appsecMetrics.count('api_security.missing_route', { framework: normalizeFramework(framework) }).inc()
+}
+
+module.exports = {
+  incrementApiSecRequestSchema,
+  incrementApiSecRequestNoSchema,
+  incrementApiSecMissingRoute,
+}

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -1,5 +1,10 @@
 'use strict'
 
+const {
+  incrementApiSecMissingRoute,
+  incrementApiSecRequestNoSchema,
+  incrementApiSecRequestSchema,
+} = require('./api_security')
 const { DD_TELEMETRY_REQUEST_METRICS } = require('./common')
 const { incrementMissingUserId, incrementMissingUserLogin, incrementSdkEvent } = require('./user')
 const {
@@ -155,6 +160,24 @@ function incrementSdkEventMetric (eventType, sdkVersion) {
   incrementSdkEvent(eventType, sdkVersion)
 }
 
+function incrementApiSecRequestSchemaMetric (framework) {
+  if (!enabled) return
+
+  incrementApiSecRequestSchema(framework)
+}
+
+function incrementApiSecRequestNoSchemaMetric (framework) {
+  if (!enabled) return
+
+  incrementApiSecRequestNoSchema(framework)
+}
+
+function incrementApiSecMissingRouteMetric (framework) {
+  if (!enabled) return
+
+  incrementApiSecMissingRoute(framework)
+}
+
 function getRequestMetrics (req) {
   if (req) {
     const store = getStore(req)
@@ -179,6 +202,9 @@ module.exports = {
   incrementMissingUserLoginMetric,
   incrementMissingUserIdMetric,
   incrementSdkEventMetric,
+  incrementApiSecRequestSchemaMetric,
+  incrementApiSecRequestNoSchemaMetric,
+  incrementApiSecMissingRouteMetric,
 
   getRequestMetrics,
 }

package/packages/dd-trace/src/ci-visibility/requests/request.js

@@ -12,26 +12,10 @@ const {
   isRetriableNetworkError,
   singleJitteredDelay,
 } = require('../../exporters/common/retry')
-const { urlToHttpOptions } = require('../../exporters/common/url-to-http-options-polyfill')
+const { parseUrl } = require('../../exporters/common/url')
 
 const legacyStorage = storage('legacy')
 
-function parseUrl (urlObjOrString) {
-  if (urlObjOrString !== null && typeof urlObjOrString === 'object') {
-    return urlToHttpOptions(urlObjOrString)
-  }
-
-  const url = urlToHttpOptions(new URL(urlObjOrString))
-
-  if (url.protocol === 'unix:' && url.hostname === '.') {
-    const udsPath = urlObjOrString.slice(5)
-    url.path = udsPath
-    url.pathname = udsPath
-  }
-
-  return url
-}
-
 /**
  * Simplified HTTP request for test optimization (library config). Uses common HTTP agents.
  * Retries: 429 (with X-ratelimit-reset, max 30s wait),

package/packages/dd-trace/src/config/defaults.js

@@ -1,6 +1,5 @@
 'use strict'
 
-const dns = require('dns')
 const util = require('util')
 
 const { DD_MAJOR } = require('../../../../version')
@@ -51,7 +50,6 @@ const defaults = {
   isServiceUserProvided: false,
   plugins: true,
   isCiVisibility: false,
-  lookup: dns.lookup,
   logger: undefined,
 }
 
@@ -218,6 +216,14 @@ for (const [canonicalName, entries] of Object.entries(supportedConfigurations))
     )
   }
   for (const entry of entries) {
+    // A deprecated entry that only aliases a canonical option must not surface as
+    // its own Config property/default: the canonical entry already owns the value
+    // and the alias is resolved by helper.js. helper.js drops these from the shared
+    // supported-configurations object (after registering the deprecation), but that
+    // mutation is order-dependent on which module loads first. Skip here too so
+    // `defaults` is identical regardless of load order (it differed in v5, where
+    // major-overrides keeps these entries instead of deleting them outright).
+    if (entry.deprecated && entry.aliases) continue
     if (entry.sensitive) {
       sensitiveConfigurations.add(canonicalName)
     }
@@ -285,7 +291,7 @@ for (const [canonicalName, entries] of Object.entries(supportedConfigurations))
 
 // Replace the alias with the canonical property name.
 for (const [fullPropertyName, alias] of fallbackConfigurations) {
-  if (configurationsTable[alias].property) {
+  if (configurationsTable[alias]?.property) {
     fallbackConfigurations.set(fullPropertyName, configurationsTable[alias].property)
   }
 }
@@ -347,3 +353,16 @@ module.exports = {
 
   generateTelemetry,
 }
+
+// `dns` is instrumented, so requiring it pulls in the dns plugin, which loads
+// `log`, whose bootstrap calls back into `require('./defaults')`. Resolve the
+// `lookup` default last — after the exports above are fully built — so that the
+// re-entrant require during that cascade sees the complete module instead of a
+// half-initialized one.
+defaults.lookup = require('dns').lookup
+configWithOrigin.set('lookupdefault', {
+  name: 'lookup',
+  value: defaults.lookup,
+  origin: 'default',
+  seq_id: seqId++,
+})