dd-trace 5.109.0 → 5.111.0

package/packages/dd-trace/src/appsec/channels.js

@@ -27,6 +27,8 @@ module.exports = {
   httpClientResponseFinish: dc.channel('apm:http:client:response:finish'),
   incomingHttpRequestEnd: dc.channel('dd-trace:incomingHttpRequestEnd'),
   incomingHttpRequestStart: dc.channel('dd-trace:incomingHttpRequestStart'),
+  lambdaStartInvocation: dc.channel('datadog:lambda:start-invocation'),
+  lambdaEndInvocation: dc.channel('datadog:lambda:end-invocation'),
   multerParser: dc.channel('datadog:multer:read:finish'),
   mysql2OuterQueryStart: dc.channel('datadog:mysql2:outerquery:start'),
   nextBodyParsed: dc.channel('apm:next:body-parsed'),
@@ -43,7 +45,7 @@ module.exports = {
   routerParam: dc.channel('datadog:router:param:start'),
   setCookieChannel: dc.channel('datadog:iast:set-cookie'),
   setUncaughtExceptionCaptureCallbackStart: dc.channel('datadog:process:setUncaughtExceptionCaptureCallback:start'),
-  startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
+  startGraphqlResolver: dc.channel('datadog:graphql:resolver:start'),
   stripeCheckoutSessionCreate: dc.channel('datadog:stripe:checkoutSession:create:finish'),
   stripeConstructEvent: dc.channel('datadog:stripe:constructEvent:finish'),
   stripePaymentIntentCreate: dc.channel('datadog:stripe:paymentIntent:create:finish'),

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -41,7 +41,7 @@ function enable (_config) {
   downstreamAnalysisCount = new WeakMap()
   responseBodyIgnoredCount = new WeakMap()
 
-  const bodyAnalysisSampleRate = config.appsec.apiSecurity?.downstreamBodyAnalysisSampleRate
+  const bodyAnalysisSampleRate = config.appsec.DD_API_SECURITY_DOWNSTREAM_BODY_ANALYSIS_SAMPLE_RATE
   samplingRate = Math.min(Math.max(bodyAnalysisSampleRate, 0), 1)
 
   if (samplingRate !== bodyAnalysisSampleRate) {
@@ -105,7 +105,7 @@ function recordResponseBodyIgnored (req, tag) {
  * @returns {boolean} whether downstream response body should be collected for AppSec.
  */
 function evaluateResponseBodyCollection (originatingReq, res) {
-  const maxBytes = config.appsec.apiSecurity.maxDownstreamBodyBytes
+  const maxBytes = config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES
 
   const mime = extractMimeType(res.headers?.['content-type'])
   if (!mime || !SUPPORTED_RESPONSE_BODY_MIME_TYPES.has(mime)) {
@@ -137,7 +137,7 @@ function shouldSampleBody (req) {
   globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
 
   const currentCount = bodyAnalysisCount.get(req) || 0
-  if (currentCount >= config.appsec.apiSecurity?.maxDownstreamRequestBodyAnalysis) {
+  if (currentCount >= config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_REQUEST_BODY_ANALYSIS) {
     return false
   }
 
@@ -166,7 +166,7 @@ function isRedirectResponse (res) {
  * @param {object} ctx http client instrumentation context (mutated).
  */
 function planResponseBodyCollection (originatingReq, res, ctx) {
-  if (!config?.appsec.apiSecurity) {
+  if (!config) {
     return
   }
 

package/packages/dd-trace/src/appsec/graphql.js

@@ -12,7 +12,7 @@ const {
 const waf = require('./waf')
 const addresses = require('./addresses')
 const {
-  startGraphqlResolve,
+  startGraphqlResolver,
   graphqlMiddlewareChannel,
   apolloHttpServerChannel,
   apolloChannel,
@@ -32,7 +32,7 @@ function disable () {
   disableGraphql()
 }
 
-function onGraphqlStartResolve ({ context, resolverInfo }) {
+function onGraphqlStartResolver ({ abortController, resolverInfo }) {
   const req = getActiveRequest()
 
   if (!req) return
@@ -46,7 +46,7 @@ function onGraphqlStartResolve ({ context, resolverInfo }) {
     if (requestData?.isInGraphqlRequest) {
       requestData.blocked = true
       requestData.wafAction = blockingAction
-      context?.abortController?.abort()
+      abortController?.abort()
     }
   }
 }
@@ -153,11 +153,11 @@ function disableApollo () {
 }
 
 function enableGraphql () {
-  startGraphqlResolve.subscribe(onGraphqlStartResolve)
+  startGraphqlResolver.subscribe(onGraphqlStartResolver)
 }
 
 function disableGraphql () {
-  if (startGraphqlResolve.hasSubscribers) startGraphqlResolve.unsubscribe(onGraphqlStartResolve)
+  if (startGraphqlResolver.hasSubscribers) startGraphqlResolver.unsubscribe(onGraphqlStartResolver)
 }
 
 module.exports = {

package/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js

@@ -15,6 +15,20 @@ const EXCLUDED_PATHS_FROM_STACK = getNodeModulesPaths('mongodb', 'mongoose', 'mq
 const SAFE_OPERATORS = new Set(['$eq', '$gt', '$gte', '$in', '$lt', '$lte', '$ne', '$nin',
   '$exists', '$type', '$mod', '$bitsAllClear', '$bitsAllSet', '$bitsAnyClear', '$bitsAnySet'])
 
+// Scope a marked child store for a query's deferred execution so the nested mongodb
+// driver query skips re-analysis. `bindStore` enters the child only for that async
+// scope and restores the parent on its own, so no marker can be stranded for a later
+// request to inherit, and two concurrent queries of the same request each branch from
+// the shared parent rather than from each other.
+function markExecStore () {
+  const store = storage('legacy').getStore()
+  if (store && !store.nosqlAnalyzed && getIastContext(store)) {
+    return { ...store, nosqlAnalyzed: true }
+  }
+
+  return store
+}
+
 class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
   constructor () {
     super(NOSQL_MONGODB_INJECTION)
@@ -27,7 +41,7 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
     // Anything that accesses the storage is context dependent
     const onStart = ({ filters }) => {
       const store = storage('legacy').getStore()
-      if (store && !store.nosqlAnalyzed && filters?.length) {
+      if (store && !store.nosqlAnalyzed && filters?.length && getIastContext(store)) {
         for (const filter of filters) {
           this.analyze({ filter }, store)
         }
@@ -36,30 +50,23 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
       return store
     }
 
-    const onStartAndEnterWithStore = (message) => {
-      const store = onStart(message || {})
-      if (store) {
-        storage('legacy').enterWith({ ...store, nosqlAnalyzed: true, nosqlParentStore: store })
-      }
-    }
-
-    // Anything that accesses the storage is context dependent
-    // eslint-disable-next-line unicorn/consistent-function-scoping
-    const onFinish = () => {
-      const store = storage('legacy').getStore()
-      if (store?.nosqlParentStore) {
-        storage('legacy').enterWith(store.nosqlParentStore)
-      }
+    // mquery analyzes and marks on the same channel: its tracing start both reaches
+    // the driver scope and is the first place the filters are available.
+    const onStartAndBind = (message) => {
+      onStart(message)
+      return markExecStore()
     }
 
     this.addSub('datadog:mongodb:collection:filter:start', onStart)
 
-    this.addSub('datadog:mongoose:model:filter:start', onStartAndEnterWithStore)
-    this.addSub('datadog:mongoose:model:filter:finish', onFinish)
+    // A mongoose query builds, executes, and reaches the driver in separate async
+    // steps. The filters are analyzed at the build, but the marker is bound around
+    // the execution channel, where the driver call still runs under the parent store.
+    this.addSub('datadog:mongoose:model:filter:start', onStart)
+    this.addBind('datadog:mongoose:model:filter:exec', markExecStore)
 
     this.addSub('datadog:mquery:filter:prepare', onStart)
-    this.addSub('tracing:datadog:mquery:filter:start', onStartAndEnterWithStore)
-    this.addSub('tracing:datadog:mquery:filter:asyncEnd', onFinish)
+    this.addBind('tracing:datadog:mquery:filter:start', onStartAndBind)
   }
 
   configureSanitizers () {

package/packages/dd-trace/src/appsec/iast/security-controls/index.js

@@ -21,10 +21,10 @@ let controlsKeys
 let hooks
 
 function configure (iastConfig) {
-  if (!iastConfig?.securityControlsConfiguration) return
+  if (!iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION) return
 
   try {
-    controls = parse(iastConfig.securityControlsConfiguration)
+    controls = parse(iastConfig.DD_IAST_SECURITY_CONTROLS_CONFIGURATION)
     if (controls?.size > 0) {
       hooks = new WeakSet()
       controlsKeys = [...controls.keys()]

package/packages/dd-trace/src/appsec/iast/telemetry/index.js

@@ -6,7 +6,8 @@ const { initRequestNamespace, finalizeRequestNamespace, globalNamespace } = requ
 
 class Telemetry {
   configure (config, verbosity) {
-    const telemetryAndMetricsEnabled = config?.telemetry?.enabled && config.telemetry.metrics
+    const telemetryAndMetricsEnabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED &&
+      config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 
     this.verbosity = telemetryAndMetricsEnabled ? getVerbosity(verbosity) : Verbosity.OFF
     this.enabled = this.verbosity !== Verbosity.OFF

package/packages/dd-trace/src/appsec/index.js

@@ -16,6 +16,8 @@ const {
   fastifyCookieParser,
   incomingHttpRequestStart,
   incomingHttpRequestEnd,
+  lambdaStartInvocation,
+  lambdaEndInvocation,
   passportVerify,
   passportUser,
   expressSession,
@@ -38,11 +40,12 @@ const waf = require('./waf')
 const addresses = require('./addresses')
 const Reporter = require('./reporter')
 const appsecTelemetry = require('./telemetry')
-const apiSecuritySampler = require('./api_security_sampler')
+const apiSecurity = require('./api_security')
 const { isBlocked, block, callBlockDelegation, setTemplates, getBlockingAction } = require('./blocking')
 const { getActiveRequest } = require('./store')
 const UserTracking = require('./user_tracking')
 const graphql = require('./graphql')
+const lambda = require('./lambda')
 const rasp = require('./rasp')
 
 const responseAnalyzedSet = new WeakSet()
@@ -71,7 +74,7 @@ function enable (_config) {
 
     Reporter.init(_config.appsec, _config.inferredProxyServicesEnabled)
 
-    apiSecuritySampler.configure(_config)
+    apiSecurity.configure(_config)
 
     UserTracking.setCollectionMode(_config.appsec.eventTracking.mode, false)
 
@@ -99,11 +102,15 @@ function enable (_config) {
     stripeCheckoutSessionCreate.subscribe(onStripeCheckoutSessionCreate)
     stripePaymentIntentCreate.subscribe(onStripePaymentIntentCreate)
     stripeConstructEvent.subscribe(onStripeConstructEvent)
+    lambdaStartInvocation.subscribe(lambda.onLambdaStartInvocation)
+    lambdaEndInvocation.subscribe(lambda.onLambdaEndInvocation)
 
     isEnabled = true
     config = _config
   } catch (err) {
-    if (!IS_SERVERLESS) {
+    if (IS_SERVERLESS) {
+      log.debug('[ASM] Serverless mode: suppressing error log, calling disable()')
+    } else {
       log.error('[ASM] Unable to start AppSec', err)
     }
 
@@ -233,14 +240,18 @@ function incomingHttpEndTranslator ({ req, res }) {
   // This hook runs before span finish, so ensure route/endpoint tags are available before API Security sampling runs.
   web.setRouteOrEndpointTag(req)
 
-  if (apiSecuritySampler.sampleRequest(req, res, true)) {
+  const apiSecSamplingDecision = apiSecurity.sampleRequest(req, res, true)
+  if (apiSecSamplingDecision === apiSecurity.SamplingDecision.SAMPLE) {
     persistent[addresses.WAF_CONTEXT_PROCESSOR] = { 'extract-schema': true }
   }
 
+  let wafResult
   if (!isEmpty(persistent)) {
-    waf.run({ persistent }, req)
+    wafResult = waf.run({ persistent }, req)
   }
 
+  apiSecurity.reportRequest(req, apiSecSamplingDecision, wafResult)
+
   waf.disposeContext(req)
 
   const storedHeaders = storedResponseHeaders.get(req) || {}
@@ -339,7 +350,7 @@ function onRequestProcessParams ({ req, res, abortController, params }) {
 
 function onResponseBody ({ req, res, body }) {
   if (!body || typeof body !== 'object') return
-  if (!apiSecuritySampler.sampleRequest(req, res)) return
+  if (apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE) return
 
   // we don't support blocking at this point, so no results needed
   waf.run({
@@ -513,7 +524,7 @@ function disable () {
 
   appsecRemoteConfig.disableWafUpdate()
 
-  apiSecuritySampler.disable()
+  apiSecurity.disable()
 
   // Channel#unsubscribe() is undefined for non active channels
   if (bodyParser.hasSubscribers) bodyParser.unsubscribe(onRequestBodyParsed)
@@ -540,6 +551,8 @@ function disable () {
   if (stripeCheckoutSessionCreate.hasSubscribers) stripeCheckoutSessionCreate.unsubscribe(onStripeCheckoutSessionCreate)
   if (stripePaymentIntentCreate.hasSubscribers) stripePaymentIntentCreate.unsubscribe(onStripePaymentIntentCreate)
   if (stripeConstructEvent.hasSubscribers) stripeConstructEvent.unsubscribe(onStripeConstructEvent)
+  if (lambdaStartInvocation.hasSubscribers) lambdaStartInvocation.unsubscribe(lambda.onLambdaStartInvocation)
+  if (lambdaEndInvocation.hasSubscribers) lambdaEndInvocation.unsubscribe(lambda.onLambdaEndInvocation)
 }
 
 /**

package/packages/dd-trace/src/appsec/lambda.js

@@ -0,0 +1,135 @@
+'use strict'
+
+const { HTTP_CLIENT_IP } = require('../../../../ext/tags')
+
+const log = require('../log')
+const addresses = require('./addresses')
+const Reporter = require('./reporter')
+const waf = require('./waf')
+
+// Tracks spans for which start-invocation has been processed, so that
+// end-invocation can gate correctly
+const activeInvocations = new WeakSet()
+
+/**
+ * Maps pre-extracted HTTP data from the Lambda event to WAF addresses,
+ * runs the WAF, and reports results on the span.
+ *
+ * @param {{ span: object, headers: Record<string, string>, method: string, path: string,
+ *           query: Record<string, string | string[]> | undefined, body: string | object | undefined,
+ *           isBase64Encoded: boolean, clientIp: string | undefined,
+ *           pathParams: Record<string, string> | undefined,
+ *           cookies: Record<string, string> | undefined,
+ *           route: string | undefined }} data
+ */
+function onLambdaStartInvocation (data) {
+  try {
+    const { span, headers, method, path, query, body, clientIp, pathParams, cookies } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda start invocation')
+      return
+    }
+
+    activeInvocations.add(span)
+
+    span.addTags({
+      '_dd.appsec.enabled': 1,
+      '_dd.runtime_family': 'nodejs',
+    })
+
+    const persistent = {}
+
+    if (path) {
+      persistent[addresses.HTTP_INCOMING_URL] = path
+    }
+
+    if (method) {
+      persistent[addresses.HTTP_INCOMING_METHOD] = method
+    }
+
+    if (headers) {
+      // Cookie header is already stripped by the Lambda layer's event-data-extractor
+      persistent[addresses.HTTP_INCOMING_HEADERS] = headers
+    }
+
+    if (clientIp) {
+      span.setTag(HTTP_CLIENT_IP, clientIp)
+      persistent[addresses.HTTP_CLIENT_IP] = clientIp
+    }
+
+    if (query) {
+      persistent[addresses.HTTP_INCOMING_QUERY] = query
+    }
+
+    if (body !== undefined && body !== null) {
+      persistent[addresses.HTTP_INCOMING_BODY] = body
+    }
+
+    if (pathParams) {
+      persistent[addresses.HTTP_INCOMING_PARAMS] = pathParams
+    }
+
+    if (cookies) {
+      persistent[addresses.HTTP_INCOMING_COOKIES] = cookies
+    }
+
+    waf.run({ persistent }, span, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda start-invocation handler', err)
+  }
+}
+
+/**
+ * Maps response data to WAF addresses, runs a final WAF pass,
+ * disposes the WAF context, and finishes the request report.
+ *
+ * @param {{ span: object, statusCode: string | undefined,
+ *           responseHeaders: Record<string, string> | undefined }} data
+ */
+function onLambdaEndInvocation (data) {
+  try {
+    const { span, statusCode, responseHeaders } = data
+
+    if (!span) {
+      log.warn('[ASM] No span provided in Lambda end invocation')
+      return
+    }
+
+    if (!activeInvocations.has(span)) {
+      return
+    }
+
+    activeInvocations.delete(span)
+
+    let hasPersistentData = false
+    const persistent = {}
+
+    if (statusCode) {
+      persistent[addresses.HTTP_INCOMING_RESPONSE_CODE] = String(statusCode)
+      hasPersistentData = true
+    }
+
+    if (responseHeaders) {
+      const filteredHeaders = { ...responseHeaders }
+      delete filteredHeaders['set-cookie']
+      persistent[addresses.HTTP_INCOMING_RESPONSE_HEADERS] = filteredHeaders
+      hasPersistentData = true
+    }
+
+    if (hasPersistentData) {
+      waf.run({ persistent }, span, undefined, span)
+    }
+
+    waf.disposeContext(span)
+
+    Reporter.finishRequest(span, null, {}, undefined, span)
+  } catch (err) {
+    log.error('[ASM] Error in Lambda end-invocation handler', err)
+  }
+}
+
+module.exports = {
+  onLambdaStartInvocation,
+  onLambdaEndInvocation,
+}

package/packages/dd-trace/src/appsec/reporter.js

@@ -318,13 +318,21 @@ function reportWafConfigUpdate (product, rcConfigId, diagnostics, wafVersion) {
   }
 }
 
-function reportMetrics (metrics, raspRule, req) {
+/**
+ * @param {object} metrics - WAF run metrics
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportMetrics (metrics, raspRule, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
-  const rootSpan = req && web.root(req)
+  if (!rootSpan) {
+    rootSpan = req && web.root(req)
+  }
 
-  if (!rootSpan) return
+  if (!req || !rootSpan) return
 
   if (metrics.rulesVersion) {
     rootSpan.setTag('_dd.appsec.event_rules.version', metrics.rulesVersion)
@@ -353,13 +361,26 @@ function reportTruncationMetrics (rootSpan, metrics) {
   }
 }
 
-function reportAttack ({ events: attackData, actions }, req) {
+// NOTE: `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage. In Lambda, it is a plain context key ({}) with no
+// HTTP properties. Always guard HTTP-specific property access
+// See tests in lambda.spec.js for enforcement.
+
+/**
+ * @param {{ events: Array, actions: object }} result - WAF result with attack data
+ * @param {object} [req] - Request key. May be an HTTP IncomingMessage or a plain object (Lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttack ({ events: attackData, actions }, req, rootSpan) {
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
-  if (!rootSpan) return
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
+
+  if (!req || !rootSpan) return
 
   const spanContext = rootSpan.context()
 
@@ -494,14 +515,21 @@ function isSchemaAttribute (attribute) {
   return attribute.startsWith('_dd.appsec.s.')
 }
 
-function reportAttributes (attributes, req) {
+/**
+ * @param {object} [attributes] - WAF result attributes
+ * @param {object} [req] - Request key (plain object for lambda)
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function reportAttributes (attributes, req, rootSpan) {
   if (!attributes) return
 
   if (!req) {
     req = getActiveRequest()
   }
 
-  const rootSpan = web.root(req)
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
 
   if (!rootSpan) return
 
@@ -517,8 +545,17 @@ function reportAttributes (attributes, req) {
   rootSpan.addTags(tags)
 }
 
-function finishRequest (req, res, storedResponseHeaders, requestBody) {
-  const rootSpan = web.root(req)
+/**
+ * @param {object} [req] - Request key (null for Lambda)
+ * @param {object} [res] - Response object (null for lambda)
+ * @param {object} storedResponseHeaders
+ * @param {object} [requestBody]
+ * @param {object} [rootSpan] - Root span (required for lambda)
+ */
+function finishRequest (req, res, storedResponseHeaders, requestBody, rootSpan) {
+  if (!rootSpan) {
+    rootSpan = web.root(req)
+  }
   if (!rootSpan) return
 
   if (metricsQueue.size) {
@@ -569,6 +606,8 @@ function finishRequest (req, res, storedResponseHeaders, requestBody) {
     rootSpan.setTag('_dd.appsec.rasp.rule.eval', metrics.raspEvalCount)
   }
 
+  if (!req) return
+
   incrementWafRequestsMetric(req)
 
   const tags = rootSpan.context().getTags()
@@ -615,4 +654,5 @@ module.exports = {
   finishRequest,
   mapHeaderAndTags,
   truncateRequestBody,
+  isSchemaAttribute,
 }

package/packages/dd-trace/src/appsec/telemetry/api_security.js

@@ -0,0 +1,34 @@
+'use strict'
+
+const telemetryMetrics = require('../../telemetry/metrics')
+
+const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+
+const normalizedFrameworkCache = new Map()
+
+function normalizeFramework (framework) {
+  let normalized = normalizedFrameworkCache.get(framework)
+  if (normalized === undefined) {
+    normalized = framework ? framework.toLowerCase().replaceAll(' ', '_') : 'unknown'
+    normalizedFrameworkCache.set(framework, normalized)
+  }
+  return normalized
+}
+
+function incrementApiSecRequestSchema (framework) {
+  appsecMetrics.count('api_security.request.schema', { framework: normalizeFramework(framework) }).inc()
+}
+
+function incrementApiSecRequestNoSchema (framework) {
+  appsecMetrics.count('api_security.request.no_schema', { framework: normalizeFramework(framework) }).inc()
+}
+
+function incrementApiSecMissingRoute (framework) {
+  appsecMetrics.count('api_security.missing_route', { framework: normalizeFramework(framework) }).inc()
+}
+
+module.exports = {
+  incrementApiSecRequestSchema,
+  incrementApiSecRequestNoSchema,
+  incrementApiSecMissingRoute,
+}

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -1,5 +1,10 @@
 'use strict'
 
+const {
+  incrementApiSecMissingRoute,
+  incrementApiSecRequestNoSchema,
+  incrementApiSecRequestSchema,
+} = require('./api_security')
 const { DD_TELEMETRY_REQUEST_METRICS } = require('./common')
 const { incrementMissingUserId, incrementMissingUserLogin, incrementSdkEvent } = require('./user')
 const {
@@ -22,7 +27,7 @@ const metricsStoreMap = new WeakMap()
 let enabled = false
 
 function enable (config) {
-  enabled = config.telemetry?.enabled && config.telemetry?.metrics
+  enabled = config.telemetry.DD_INSTRUMENTATION_TELEMETRY_ENABLED && config.telemetry.DD_TELEMETRY_METRICS_ENABLED
 }
 
 function disable () {
@@ -155,6 +160,24 @@ function incrementSdkEventMetric (eventType, sdkVersion) {
   incrementSdkEvent(eventType, sdkVersion)
 }
 
+function incrementApiSecRequestSchemaMetric (framework) {
+  if (!enabled) return
+
+  incrementApiSecRequestSchema(framework)
+}
+
+function incrementApiSecRequestNoSchemaMetric (framework) {
+  if (!enabled) return
+
+  incrementApiSecRequestNoSchema(framework)
+}
+
+function incrementApiSecMissingRouteMetric (framework) {
+  if (!enabled) return
+
+  incrementApiSecMissingRoute(framework)
+}
+
 function getRequestMetrics (req) {
   if (req) {
     const store = getStore(req)
@@ -179,6 +202,9 @@ module.exports = {
   incrementMissingUserLoginMetric,
   incrementMissingUserIdMetric,
   incrementSdkEventMetric,
+  incrementApiSecRequestSchemaMetric,
+  incrementApiSecRequestNoSchemaMetric,
+  incrementApiSecMissingRouteMetric,
 
   getRequestMetrics,
 }

package/packages/dd-trace/src/appsec/waf/index.js

@@ -110,7 +110,19 @@ function removeConfig (configPath) {
   }
 }
 
-function run (data, req, raspRule) {
+// `req` in the WAF execution path may be any object, not necessarily
+// an HTTP IncomingMessage (it is a plain object for lambda).
+// Always guard HTTP-specific property access.
+// @see packages/dd-trace/test/appsec/lambda.spec.js
+
+/**
+ * @param {object} data - WAF address data ({ persistent, ephemeral })
+ * @param {object} req - Request key for WAF context lookup. May be an HTTP
+ *   IncomingMessage or a plain object (Lambda invocation key).
+ * @param {string} [raspRule] - RASP rule identifier
+ * @param {object} [rootSpan] - Root span to tag (required for Lambda)
+ */
+function run (data, req, raspRule, rootSpan) {
   if (!req) {
     req = getActiveRequest()
     if (!req) {
@@ -120,12 +132,12 @@ function run (data, req, raspRule) {
   }
 
   const wafContext = waf.wafManager.getWAFContext(req)
-  const result = wafContext.run(data, raspRule, req)
+  const result = wafContext.run(data, raspRule, req, rootSpan)
 
   if (result?.keep) {
     if (limiter.isAllowed()) {
-      const rootSpan = web.root(req)
-      keepTrace(rootSpan, ASM)
+      const span = rootSpan || web.root(req)
+      keepTrace(span, ASM)
     } else {
       updateRateLimitedMetric(req)
     }