dd-trace 5.131.0 → 5.131.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "5.131.0",
+  "version": "5.131.1",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -41,7 +41,7 @@
     "test:debugger": "mocha \"packages/dd-trace/test/debugger/**/*.spec.js\"",
     "test:debugger:ci": "node scripts/c8-ci.js test:debugger",
     "test:eslint-rules": "node scripts/run-eslint-rule-tests.mjs eslint-rules/*.test.mjs",
-    "test:trace:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/dd-trace/test/*.spec.js\" \"packages/dd-trace/test/{agent,ci-visibility,config,crashtracking,datastreams,encode,exporters,log-submission,msgpack,opentelemetry,opentracing,payload-tagging,plugins,remote_config,service-naming,standalone,telemetry,external-logger}/**/*.spec.js\"",
+    "test:trace:core": "node scripts/mocha-parallel-files.js --expose-gc --timeout 30000 -- \"packages/dd-trace/test/*.spec.js\" \"packages/dd-trace/test/{agent,ci-visibility,config,crashtracking,datastreams,encode,exporters,log-submission,msgpack,opentelemetry,opentracing,payload-tagging,plugins,remote_config,service-naming,setup,standalone,telemetry,external-logger}/**/*.spec.js\"",
     "test:trace:core:ci": "node scripts/c8-ci.js test:trace:core",
     "test:trace:guardrails": "mocha \"packages/dd-trace/test/guardrails/**/*.spec.js\"",
     "test:trace:guardrails:ci": "node scripts/c8-ci.js test:trace:guardrails",
@@ -216,7 +216,6 @@
     "@types/sinon": "^22.0.0",
     "@vercel/nft": "^1.11.0",
     "@yarnpkg/lockfile": "^1.1.0",
-    "axios": "^1.20.0",
     "benchmark": "^2.1.4",
     "body-parser": "^2.3.0",
     "bun": "1.4.2",
@@ -227,14 +226,14 @@
     "eslint-plugin-import-x": "^4.16.2",
     "eslint-plugin-jsdoc": "^64.5.4",
     "eslint-plugin-mocha": "^12.0.2",
-    "eslint-plugin-n": "^18.3.0",
+    "eslint-plugin-n": "^18.4.0",
     "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-regexp": "^3.3.1",
-    "eslint-plugin-sonarjs": "^4.2.1",
+    "eslint-plugin-sonarjs": "^4.2.2",
     "eslint-plugin-unicorn": "^74.0.0",
     "express": "^5.1.0",
     "glob": "^10.4.5",
-    "globals": "^17.12.0",
+    "globals": "^17.13.0",
     "graphql": "*",
     "husky": "^9.1.7",
     "istanbul-lib-coverage": "^3.2.2",

package/packages/dd-trace/src/config/supported-configurations.json

@@ -3655,9 +3655,9 @@
     ],
     "DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP": [
       {
-        "implementation": "F",
+        "implementation": "I",
         "type": "string",
-        "default": "(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}"
+        "default": "(?:(?:\"|%22)?)(?:(?:old[-_]?|new[-_]?)?p(?:ass)?w(?:or)?d(?:1|2)?|pass(?:[-_]?phrase)?|secret|(?:api[-_]?|private[-_]?|public[-_]?|access[-_]?|secret[-_]?|app(?:lication)?[-_]?)key(?:[-_]?id)?|token|consumer[-_]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:\"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:\"|%22)(?:%2[^2]|%[^2]|[^\"%])+(?:\"|%22))|(?:bearer(?:\\s|%20)+[a-z0-9._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|(^|[^\\w%-]|%[0-9a-f]{2})ey[I-L][\\w-]+(?:=|%3D)*\\.ey[I-L][\\w-]+(?:=|%3D)*(?:\\.(?:[\\w.+/=-]|%3D|%2F|%2B)+)?|-{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY-{5}[^\\-]+-{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY(?:-{5})?(?:\\n|%0A)?|(?:ssh-(?:rsa|dss)|ecdsa-[a-z0-9]+-[a-z0-9]+)(?:\\s|%20|%09)+(?:[a-z0-9/.+]|%2F|%5C|%2B){100,}(?:=|%3D)*(?:(?:\\s|%20|%09)+[a-z0-9._-]+)?)"
       }
     ],
     "DD_TRACE_OPENAI_ENABLED": [

package/packages/dd-trace/src/plugins/util/url.js

@@ -2,6 +2,7 @@
 
 const { URL } = require('url')
 
+const { defaults } = require('../../config/defaults')
 const log = require('../../log')
 
 const HTTP2_HEADER_AUTHORITY = ':authority'
@@ -55,12 +56,15 @@ function obfuscateQs (config, url) {
 
   let qs = url.slice(i + 1)
 
-  qs = qs.replace(queryStringObfuscation, '<redacted>')
+  // Group 1 of the default regex is the delimiter in front of a JWT. A user-provided regex may capture the secret.
+  const replacement = queryStringObfuscation === defaultQsObfuscator ? '$1<redacted>' : '<redacted>'
+  qs = qs.replace(queryStringObfuscation, replacement)
 
   return `${path}?${qs}`
 }
 
 const qsObfuscatorCache = new Map()
+let defaultQsObfuscator
 
 /**
  * Compile the configured query-string obfuscator (a regex string, or a boolean)
@@ -85,6 +89,7 @@ function getQsObfuscator (config) {
     } else if (obfuscator !== '.*') { // '.*' optimizes to a full redact (true)
       try {
         compiled = new RegExp(obfuscator, 'gi')
+        if (obfuscator === defaults.DD_TRACE_OBFUSCATION_QUERY_STRING_REGEXP) defaultQsObfuscator = compiled
       } catch (err) {
         log.error('Error getting qs obfuscator', err)
       }