dd-trace 5.110.0 → 5.111.0

package/loader-hook.mjs

@@ -13,12 +13,37 @@ import { isRelativeRequire } from './packages/datadog-instrumentations/src/helpe
 
 // This file must support Node.js 12.0.0 syntax
 
+const { builtinModules } = Module
 const regexpEscape = regexpEscapeModule.default
 const require = Module.createRequire(import.meta.url)
 let syncImportInTheMiddleHook
 
-// For some reason `getEnvironmentVariable` is not otherwise available to ESM.
-const env = configHelper.getEnvironmentVariable
+// The config helper's named exports aren't visible to ESM; destructure the default.
+const { getValueFromEnvSources } = configHelper
+
+// Substrings of resolved URLs that import-in-the-middle must never wrap: re-export
+// shims and internal helper graphs that break when proxied, plus iitm's own files
+// (via `middle`). One alternation so a single test() covers every excluded load.
+export const iitmExclusionRegExp = /middle|langsmith|openai\/_shims|openai\/resources\/chat\/completions\/messages|openai\/agents-core\/dist\/shims|@anthropic-ai\/sdk\/_shims/
+
+// Instrumented bare specifiers (`import 'express'`, builtins, symlinked or
+// workspace packages) match against the specifier (the Set); their files inside
+// node_modules match against the URL (the alternation). regexpEscape guards
+// against a regex metacharacter entering a package name.
+const includeModuleNames = new Set()
+let moduleNameAlternation = ''
+for (const moduleName of Object.keys(hooks)) {
+  // Relative hooks resolve outside node_modules and are not instrumented here.
+  if (isRelativeRequire(moduleName)) continue
+  includeModuleNames.add(moduleName)
+  // iitm matches a built-in by its node: specifier too, so mirror that and
+  // wrap `import 'node:crypto'` as well as `import 'crypto'`.
+  if (builtinModules.includes(moduleName)) includeModuleNames.add(`node:${moduleName}`)
+  if (moduleNameAlternation !== '') moduleNameAlternation += '|'
+  moduleNameAlternation += regexpEscape(moduleName)
+}
+
+const nodeModulesIncludeSource = `node_modules/(?:${moduleNameAlternation})/(?!node_modules).+`
 
 function initialize (data = {}) {
   prepareImportInTheMiddleOptions(data)
@@ -26,16 +51,59 @@ function initialize (data = {}) {
 }
 
 function prepareImportInTheMiddleOptions (data = {}) {
-  if (data.include == null) data.include = []
-  if (data.exclude == null) data.exclude = []
-
-  addInstrumentations(data)
-  addSecurityControls(data)
-  addExclusions(data)
+  // A consumer-owned shouldInclude predicate takes over the wrapping decision, so
+  // iitm ignores the include/exclude arrays. Building the matcher here keeps the
+  // synchronous and asynchronous loaders on one matching implementation.
+  data.shouldInclude = createShouldInclude(getValueFromEnvSources('DD_IAST_SECURITY_CONTROLS_CONFIGURATION'))
 
   return data
 }
 
+/**
+ * Builds the import-in-the-middle `shouldInclude(url, specifier)` predicate. iitm
+ * calls it for every resolved module and wraps the module when the result is
+ * truthy; supplying it replaces iitm's include/exclude list scan.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`;
+ *   each entry's module path is instrumented in addition to the hook table.
+ */
+function createShouldInclude (securityControlsConfig) {
+  const includeRegExp = new RegExp(buildIncludeSource(securityControlsConfig))
+
+  /**
+   * @param {string} url Resolved module URL (`file:`, `node:`, ...).
+   * @param {string} specifier Original import specifier.
+   */
+  return function shouldInclude (url, specifier) {
+    return (includeModuleNames.has(specifier) || includeRegExp.test(url)) && !iitmExclusionRegExp.test(url)
+  }
+}
+
+/**
+ * Appends each `DD_IAST_SECURITY_CONTROLS_CONFIGURATION` module path — the third
+ * `:`-separated segment of every `;`-separated `<type>:<marks>:<module>:<...>` entry —
+ * to the include alternation, escaped.
+ *
+ * @param {string} [securityControlsConfig] Raw `DD_IAST_SECURITY_CONTROLS_CONFIGURATION`.
+ */
+function buildIncludeSource (securityControlsConfig) {
+  if (!securityControlsConfig) return nodeModulesIncludeSource
+
+  let includeSource = nodeModulesIncludeSource
+  for (const entry of securityControlsConfig.split(';')) {
+    if (!entry) continue
+    const first = entry.indexOf(':')
+    if (first === -1) continue
+    const second = entry.indexOf(':', first + 1)
+    if (second === -1) continue
+    const third = entry.indexOf(':', second + 1)
+
+    const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
+    if (subpath) includeSource += `|${regexpEscape(subpath)}`
+  }
+  return includeSource
+}
+
 function load (url, context, nextLoad) {
   return rewriterLoader.load(url, context, (url, context) => origLoad(url, context, nextLoad))
 }
@@ -113,51 +181,4 @@ function registerSyncLoaderHooks (data = {}) {
   return true
 }
 
-function addInstrumentations (data) {
-  const instrumentations = Object.keys(hooks)
-
-  for (const moduleName of instrumentations) {
-    // Skip instrumentation hooks with relative module names
-    // since there is no current business need of instrumenting imports outside of the node_modules folder
-    if (!isRelativeRequire(moduleName)) {
-      data.include.push(new RegExp(`node_modules/${moduleName}/(?!node_modules).+`), moduleName)
-    }
-  }
-}
-
-function addSecurityControls (data) {
-  const raw = env('DD_IAST_SECURITY_CONTROLS_CONFIGURATION')
-  if (!raw) return
-  // Parse `;`-separated entries and take the 3rd `:`-separated segment.
-  // Expected form (per entry): `<...>:<...>:<subpath>:<...>`
-  const entries = raw.split(';')
-  for (const entry of entries) {
-    if (entry) {
-      const first = entry.indexOf(':')
-      if (first === -1) continue
-      const second = entry.indexOf(':', first + 1)
-      if (second === -1) continue
-      const third = entry.indexOf(':', second + 1)
-
-      const subpath = entry.slice(second + 1, third === -1 ? undefined : third).trim()
-      if (subpath) {
-        data.include.push(new RegExp(regexpEscape(subpath)))
-      }
-    }
-  }
-}
-
-function addExclusions (data) {
-  data.exclude.push(...iitmExclusions)
-}
-
-export const iitmExclusions = [
-  /middle/,
-  /langsmith/,
-  /openai\/_shims/,
-  /openai\/resources\/chat\/completions\/messages/,
-  /openai\/agents-core\/dist\/shims/,
-  /@anthropic-ai\/sdk\/_shims/,
-]
-
 export { initialize, load, registerSyncLoaderHooks, resolve }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.110.0",
+  "version": "5.111.0",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -46,7 +46,7 @@
     "test:webpack:ci": "nyc --silent node init && nyc -- npm run test:webpack",
     "test:instrumentations": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\"",
     "test:instrumentations:ci": "yarn services && nyc --silent node init && nyc -- npm run test:instrumentations",
-    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.js\"",
+    "test:instrumentations:misc": "mocha \"packages/datadog-instrumentations/test/*/**/*.spec.{js,mjs}\"",
     "test:instrumentations:misc:ci": "nyc --silent node init && nyc -- npm run test:instrumentations:misc",
     "test:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/datadog-core/test/**/*.spec.js\"",
     "test:core:ci": "nyc --silent node init && nyc -- npm run test:core",
@@ -104,7 +104,7 @@
     "test:integration:plugins:coverage": "yarn services && node ./integration-tests/coverage/run-suite.js \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/${SPEC:-*}*.spec.js\"",
     "test:unit:plugins": "mocha \"packages/datadog-instrumentations/test/@(${PLUGINS}).spec.js\" \"packages/datadog-plugin-@(${PLUGINS})/test/**/*.spec.js\" --exclude \"packages/datadog-plugin-@(${PLUGINS})/test/integration-test/**/*.spec.js\"",
     "test:release": "mocha \"scripts/release/**/*.spec.js\"",
-    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\"",
+    "test:scripts": "mocha \"scripts/helpers/**/*.spec.js\" \"scripts/*.spec.mjs\"",
     "test:shimmer": "mocha \"packages/datadog-shimmer/test/**/*.spec.js\"",
     "test:shimmer:ci": "nyc --silent node init && nyc -- npm run test:shimmer",
     "verify:workflow-job-names": "node scripts/verify-workflow-job-names.js",
@@ -164,7 +164,7 @@
   ],
   "dependencies": {
     "dc-polyfill": "^0.1.11",
-    "import-in-the-middle": "^3.1.0",
+    "import-in-the-middle": "^3.2.0",
     "opentracing": ">=0.14.7"
   },
   "optionalDependencies": {
@@ -192,7 +192,7 @@
     "@types/mocha": "^10.0.10",
     "@types/node": "^18.19.106",
     "@types/sinon": "^21.0.1",
-    "axios": "^1.18.0",
+    "axios": "^1.18.1",
     "benchmark": "^2.1.4",
     "body-parser": "^2.3.0",
     "bun": "1.3.14",
@@ -201,15 +201,15 @@
     "eslint": "^9.39.2",
     "eslint-plugin-cypress": "^6.4.1",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-jsdoc": "^63.0.6",
+    "eslint-plugin-jsdoc": "^63.0.8",
     "eslint-plugin-mocha": "^11.3.0",
-    "eslint-plugin-n": "^18.1.0",
+    "eslint-plugin-n": "^18.2.0",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-sonarjs": "^4.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
     "express": "^5.1.0",
     "glob": "^10.4.5",
-    "globals": "^17.2.0",
+    "globals": "^17.7.0",
     "graphql": "*",
     "husky": "^9.1.7",
     "istanbul-lib-report": "^3.0.0",
@@ -227,7 +227,7 @@
     "proxyquire": "^2.1.3",
     "retry": "^0.13.1",
     "semifies": "^1.0.0",
-    "semver": "^7.8.4",
+    "semver": "^7.8.5",
     "sinon": "^22.0.0",
     "tiktoken": "^1.0.21",
     "typescript": "^6.0.3",

package/packages/datadog-instrumentations/src/fs.js

@@ -88,8 +88,10 @@ addHook({ name: 'fs' }, fs => {
   const asyncMethods = Object.keys(paramsByMethod)
   const syncMethods = asyncMethods.map(name => `${name}Sync`)
 
-  massWrap(fs, asyncMethods, createWrapFunction())
-  massWrap(fs, syncMethods, createWrapFunction())
+  // Node 20 defines `fs.opendir` / `fs.opendirSync` as lazy accessor properties;
+  // `replaceGetter` resolves the method so the call is wrapped, not the accessor.
+  massWrap(fs, asyncMethods, createWrapFunction(), { replaceGetter: true })
+  massWrap(fs, syncMethods, createWrapFunction(), { replaceGetter: true })
   massWrap(fs.promises, asyncMethods, createWrapFunction('promises.'))
 
   wrap(fs.realpath, 'native', createWrapFunction('', 'realpath.native'))
@@ -355,15 +357,15 @@ function getMessage (operation, params, args, self) {
   return { operation, ...metadata }
 }
 
-function massWrap (target, methods, wrapper) {
+function massWrap (target, methods, wrapper, options) {
   for (const method of methods) {
-    wrap(target, method, wrapper)
+    wrap(target, method, wrapper, options)
   }
 }
 
-function wrap (target, method, wrapper) {
+function wrap (target, method, wrapper, options) {
   try {
-    shimmer.wrap(target, method, wrapper)
+    shimmer.wrap(target, method, wrapper, options)
   } catch {
     // skip unavailable method
   }