dd-trace 5.17.0 → 5.19.0

package/packages/dd-trace/src/config.js

@@ -26,50 +26,104 @@ const telemetryCounters = {
   'otel.env.invalid': {}
 }
 
-function getCounter (event, ddVar, otelVar, otelTracesSamplerArg) {
+function getCounter (event, ddVar, otelVar) {
   const counters = telemetryCounters[event]
   const tags = []
+  const ddVarPrefix = 'config.datadog:'
+  const otelVarPrefix = 'config.opentelemetry:'
+  if (ddVar) {
+    ddVar = ddVarPrefix + ddVar
+    tags.push(ddVar)
+  }
+  if (otelVar) {
+    otelVar = otelVarPrefix + otelVar
+    tags.push(otelVar)
+  }
 
-  if (ddVar) tags.push(ddVar)
-  if (otelVar) tags.push(otelVar)
-  if (otelTracesSamplerArg) tags.push(otelTracesSamplerArg)
-
-  if (!(ddVar in counters)) counters[ddVar] = {}
+  if (!(otelVar in counters)) counters[otelVar] = {}
 
   const counter = tracerMetrics.count(event, tags)
-  counters[ddVar][otelVar] = counter
+  counters[otelVar][ddVar] = counter
   return counter
 }
 
 const otelDdEnvMapping = {
-  DD_TRACE_LOG_LEVEL: 'OTEL_LOG_LEVEL',
-  DD_TRACE_PROPAGATION_STYLE: 'OTEL_PROPAGATORS',
-  DD_SERVICE: 'OTEL_SERVICE_NAME',
-  DD_TRACE_SAMPLE_RATE: 'OTEL_TRACES_SAMPLER',
-  DD_TRACE_ENABLED: 'OTEL_TRACES_EXPORTER',
-  DD_RUNTIME_METRICS_ENABLED: 'OTEL_METRICS_EXPORTER',
-  DD_TAGS: 'OTEL_RESOURCE_ATTRIBUTES',
-  DD_TRACE_OTEL_ENABLED: 'OTEL_SDK_DISABLED'
+  OTEL_LOG_LEVEL: 'DD_TRACE_LOG_LEVEL',
+  OTEL_PROPAGATORS: 'DD_TRACE_PROPAGATION_STYLE',
+  OTEL_SERVICE_NAME: 'DD_SERVICE',
+  OTEL_TRACES_SAMPLER: 'DD_TRACE_SAMPLE_RATE',
+  OTEL_TRACES_SAMPLER_ARG: 'DD_TRACE_SAMPLE_RATE',
+  OTEL_TRACES_EXPORTER: 'DD_TRACE_ENABLED',
+  OTEL_METRICS_EXPORTER: 'DD_RUNTIME_METRICS_ENABLED',
+  OTEL_RESOURCE_ATTRIBUTES: 'DD_TAGS',
+  OTEL_SDK_DISABLED: 'DD_TRACE_OTEL_ENABLED',
+  OTEL_LOGS_EXPORTER: undefined
 }
 
-const otelInvalidEnv = ['OTEL_LOGS_EXPORTER']
+const VALID_PROPAGATION_STYLES = new Set(['datadog', 'tracecontext', 'b3', 'b3 single header', 'none'])
 
-function checkIfBothOtelAndDdEnvVarSet () {
-  for (const [ddVar, otelVar] of Object.entries(otelDdEnvMapping)) {
-    if (process.env[ddVar] && process.env[otelVar]) {
-      log.warn(`both ${ddVar} and ${otelVar} environment variables are set`)
-      getCounter('otel.env.hiding', ddVar, otelVar,
-        otelVar === 'OTEL_TRACES_SAMPLER' &&
-        process.env.OTEL_TRACES_SAMPLER_ARG
-          ? 'OTEL_TRACES_SAMPLER_ARG'
-          : undefined).inc()
+const VALID_LOG_LEVELS = new Set(['debug', 'info', 'warn', 'error'])
+
+function getFromOtelSamplerMap (otelTracesSampler, otelTracesSamplerArg) {
+  const OTEL_TRACES_SAMPLER_MAPPING = {
+    always_on: '1.0',
+    always_off: '0.0',
+    traceidratio: otelTracesSamplerArg,
+    parentbased_always_on: '1.0',
+    parentbased_always_off: '0.0',
+    parentbased_traceidratio: otelTracesSamplerArg
+  }
+  return OTEL_TRACES_SAMPLER_MAPPING[otelTracesSampler]
+}
+
+function validateOtelPropagators (propagators) {
+  if (!process.env.PROPAGATION_STYLE_EXTRACT &&
+    !process.env.PROPAGATION_STYLE_INJECT &&
+    !process.env.DD_TRACE_PROPAGATION_STYLE &&
+    process.env.OTEL_PROPAGATORS) {
+    for (const style in propagators) {
+      if (!VALID_PROPAGATION_STYLES.has(style)) {
+        log.warn('unexpected value for OTEL_PROPAGATORS environment variable')
+        getCounter('otel.env.invalid', 'DD_TRACE_PROPAGATION_STYLE', 'OTEL_PROPAGATORS').inc()
+      }
     }
   }
+}
+
+function validateEnvVarType (envVar) {
+  const value = process.env[envVar]
+  switch (envVar) {
+    case 'OTEL_LOG_LEVEL':
+      return VALID_LOG_LEVELS.has(value)
+    case 'OTEL_PROPAGATORS':
+    case 'OTEL_RESOURCE_ATTRIBUTES':
+    case 'OTEL_SERVICE_NAME':
+      return typeof value === 'string'
+    case 'OTEL_TRACES_SAMPLER':
+      return getFromOtelSamplerMap(value, process.env.OTEL_TRACES_SAMPLER_ARG) !== undefined
+    case 'OTEL_TRACES_SAMPLER_ARG':
+      return !isNaN(parseFloat(value))
+    case 'OTEL_SDK_DISABLED':
+      return value.toLowerCase() === 'true' || value.toLowerCase() === 'false'
+    case 'OTEL_TRACES_EXPORTER':
+    case 'OTEL_METRICS_EXPORTER':
+    case 'OTEL_LOGS_EXPORTER':
+      return value.toLowerCase() === 'none'
+    default:
+      return false
+  }
+}
+
+function checkIfBothOtelAndDdEnvVarSet () {
+  for (const [otelEnvVar, ddEnvVar] of Object.entries(otelDdEnvMapping)) {
+    if (ddEnvVar && process.env[ddEnvVar] && process.env[otelEnvVar]) {
+      log.warn(`both ${ddEnvVar} and ${otelEnvVar} environment variables are set`)
+      getCounter('otel.env.hiding', ddEnvVar, otelEnvVar).inc()
+    }
 
-  for (const otelVar of otelInvalidEnv) {
-    if (process.env[otelVar]) {
-      log.warn(`${otelVar} is not supported by the Datadog SDK`)
-      getCounter('otel.env.invalid', otelVar).inc()
+    if (process.env[otelEnvVar] && !validateEnvVarType(otelEnvVar)) {
+      log.warn(`unexpected value for ${otelEnvVar} environment variable`)
+      getCounter('otel.env.invalid', ddEnvVar, otelEnvVar).inc()
     }
   }
 }
@@ -80,9 +134,9 @@ const fromEntries = Object.fromEntries || (entries =>
 // eslint-disable-next-line max-len
 const qsRegex = '(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:(?:\\s|%20)*(?:=|%3D)[^&]+|(?:"|%22)(?:\\s|%20)*(?::|%3A)(?:\\s|%20)*(?:"|%22)(?:%2[^2]|%[^2]|[^"%])+(?:"|%22))|bearer(?:\\s|%20)+[a-z0-9\\._\\-]+|token(?::|%3A)[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L](?:[\\w=-]|%3D)+\\.ey[I-L](?:[\\w=-]|%3D)+(?:\\.(?:[\\w.+\\/=-]|%3D|%2F|%2B)+)?|[\\-]{5}BEGIN(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY[\\-]{5}[^\\-]+[\\-]{5}END(?:[a-z\\s]|%20)+PRIVATE(?:\\s|%20)KEY|ssh-rsa(?:\\s|%20)*(?:[a-z0-9\\/\\.+]|%2F|%5C|%2B){100,}'
 // eslint-disable-next-line max-len
-const defaultWafObfuscatorKeyRegex = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?)key)|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization'
+const defaultWafObfuscatorKeyRegex = '(?i)pass|pw(?:or)?d|secret|(?:api|private|public|access)[_-]?key|token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)|bearer|authorization|jsessionid|phpsessid|asp\\.net[_-]sessionid|sid|jwt'
 // eslint-disable-next-line max-len
-const defaultWafObfuscatorValueRegex = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:_?phrase)?|secret|(?:api_?|private_?|public_?|access_?|secret_?)key(?:_?id)?|token|consumer_?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?)(?:\\s*=[^;]|"\\s*:\\s*"[^"]+")|bearer\\s+[a-z0-9\\._\\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\\w=-]+\\.ey[I-L][\\w=-]+(?:\\.[\\w.+\\/=-]+)?|[\\-]{5}BEGIN[a-z\\s]+PRIVATE\\sKEY[\\-]{5}[^\\-]+[\\-]{5}END[a-z\\s]+PRIVATE\\sKEY|ssh-rsa\\s*[a-z0-9\\/\\.+]{100,}'
+const defaultWafObfuscatorValueRegex = '(?i)(?:p(?:ass)?w(?:or)?d|pass(?:[_-]?phrase)?|secret(?:[_-]?key)?|(?:(?:api|private|public|access)[_-]?)key(?:[_-]?id)?|(?:(?:auth|access|id|refresh)[_-]?)?token|consumer[_-]?(?:id|key|secret)|sign(?:ed|ature)?|auth(?:entication|orization)?|jsessionid|phpsessid|asp\\.net(?:[_-]|-)sessionid|sid|jwt)(?:\\s*=[^;]|"\\s*:\\s*"[^"]+")|bearer\\s+[a-z0-9\\._\\-]+|token:[a-z0-9]{13}|gh[opsu]_[0-9a-zA-Z]{36}|ey[I-L][\\w=-]+\\.ey[I-L][\\w=-]+(?:\\.[\\w.+\\/=-]+)?|[\\-]{5}BEGIN[a-z\\s]+PRIVATE\\sKEY[\\-]{5}[^\\-]+[\\-]{5}END[a-z\\s]+PRIVATE\\sKEY|ssh-rsa\\s*[a-z0-9\\/\\.+]{100,}'
 const runtimeId = uuid()
 
 function maybeFile (filepath) {
@@ -131,7 +185,7 @@ function remapify (input, mappings) {
 
 function propagationStyle (key, option, defaultValue) {
   // Extract by key if in object-form value
-  if (typeof option === 'object' && !Array.isArray(option)) {
+  if (option !== null && typeof option === 'object' && !Array.isArray(option)) {
     option = option[key]
   }
 
@@ -139,7 +193,7 @@ function propagationStyle (key, option, defaultValue) {
   if (Array.isArray(option)) return option.map(v => v.toLowerCase())
 
   // If it's not an array but not undefined there's something wrong with the input
-  if (typeof option !== 'undefined') {
+  if (option !== undefined) {
     log.warn('Unexpected input for config.tracePropagationStyle')
   }
 
@@ -147,7 +201,7 @@ function propagationStyle (key, option, defaultValue) {
   const envKey = `DD_TRACE_PROPAGATION_STYLE_${key.toUpperCase()}`
 
   const envVar = coalesce(process.env[envKey], process.env.DD_TRACE_PROPAGATION_STYLE, process.env.OTEL_PROPAGATORS)
-  if (typeof envVar !== 'undefined') {
+  if (envVar !== undefined) {
     return envVar.split(',')
       .filter(v => v !== '')
       .map(v => v.trim().toLowerCase())
@@ -162,7 +216,7 @@ class Config {
     options = this.options = {
       ...options,
       appsec: options.appsec != null ? options.appsec : options.experimental?.appsec,
-      iastOptions: options.experimental?.iast
+      iast: options.iast != null ? options.iast : options.experimental?.iast
     }
 
     checkIfBothOtelAndDdEnvVarSet()
@@ -235,6 +289,9 @@ class Config {
       options.tracePropagationStyle,
       defaultPropagationStyle
     )
+
+    validateOtelPropagators(PROPAGATION_STYLE_INJECT)
+
     const DD_TRACE_PROPAGATION_EXTRACT_FIRST = coalesce(
       process.env.DD_TRACE_PROPAGATION_EXTRACT_FIRST,
       false
@@ -440,6 +497,10 @@ class Config {
     this._setValue(defaults, 'appsec.rateLimit', 100)
     this._setValue(defaults, 'appsec.rules', undefined)
     this._setValue(defaults, 'appsec.sca.enabled', null)
+    this._setValue(defaults, 'appsec.standalone.enabled', undefined)
+    this._setValue(defaults, 'appsec.stackTrace.enabled', true)
+    this._setValue(defaults, 'appsec.stackTrace.maxDepth', 32)
+    this._setValue(defaults, 'appsec.stackTrace.maxStackTraces', 2)
     this._setValue(defaults, 'appsec.wafTimeout', 5e3) // µs
     this._setValue(defaults, 'clientIpEnabled', false)
     this._setValue(defaults, 'clientIpHeader', null)
@@ -524,10 +585,13 @@ class Config {
       DD_APPSEC_ENABLED,
       DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML,
       DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON,
+      DD_APPSEC_MAX_STACK_TRACES,
+      DD_APPSEC_MAX_STACK_TRACE_DEPTH,
       DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP,
       DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP,
       DD_APPSEC_RULES,
       DD_APPSEC_SCA_ENABLED,
+      DD_APPSEC_STACK_TRACE_ENABLED,
       DD_APPSEC_RASP_ENABLED,
       DD_APPSEC_TRACE_RATE_LIMIT,
       DD_APPSEC_WAF_TIMEOUT,
@@ -536,6 +600,7 @@ class Config {
       DD_DOGSTATSD_HOSTNAME,
       DD_DOGSTATSD_PORT,
       DD_ENV,
+      DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED,
       DD_EXPERIMENTAL_PROFILING_ENABLED,
       JEST_WORKER_ID,
       DD_IAST_DEDUPLICATION_ENABLED,
@@ -627,6 +692,12 @@ class Config {
     this._setString(env, 'appsec.rules', DD_APPSEC_RULES)
     // DD_APPSEC_SCA_ENABLED is never used locally, but only sent to the backend
     this._setBoolean(env, 'appsec.sca.enabled', DD_APPSEC_SCA_ENABLED)
+    this._setBoolean(env, 'appsec.standalone.enabled', DD_EXPERIMENTAL_APPSEC_STANDALONE_ENABLED)
+    this._setBoolean(env, 'appsec.stackTrace.enabled', DD_APPSEC_STACK_TRACE_ENABLED)
+    this._setValue(env, 'appsec.stackTrace.maxDepth', maybeInt(DD_APPSEC_MAX_STACK_TRACE_DEPTH))
+    this._envUnprocessed['appsec.stackTrace.maxDepth'] = DD_APPSEC_MAX_STACK_TRACE_DEPTH
+    this._setValue(env, 'appsec.stackTrace.maxStackTraces', maybeInt(DD_APPSEC_MAX_STACK_TRACES))
+    this._envUnprocessed['appsec.stackTrace.maxStackTraces'] = DD_APPSEC_MAX_STACK_TRACES
     this._setValue(env, 'appsec.wafTimeout', maybeInt(DD_APPSEC_WAF_TIMEOUT))
     this._envUnprocessed['appsec.wafTimeout'] = DD_APPSEC_WAF_TIMEOUT
     this._setBoolean(env, 'clientIpEnabled', DD_TRACE_CLIENT_IP_ENABLED)
@@ -701,15 +772,8 @@ class Config {
       : undefined
     this._setBoolean(env, 'runtimeMetrics', DD_RUNTIME_METRICS_ENABLED ||
     otelSetRuntimeMetrics)
-    const OTEL_TRACES_SAMPLER_MAPPING = {
-      always_on: '1.0',
-      always_off: '0.0',
-      traceidratio: OTEL_TRACES_SAMPLER_ARG,
-      parentbased_always_on: '1.0',
-      parentbased_always_off: '0.0',
-      parentbased_traceidratio: OTEL_TRACES_SAMPLER_ARG
-    }
-    this._setUnit(env, 'sampleRate', DD_TRACE_SAMPLE_RATE || OTEL_TRACES_SAMPLER_MAPPING[OTEL_TRACES_SAMPLER])
+    this._setUnit(env, 'sampleRate', DD_TRACE_SAMPLE_RATE ||
+    getFromOtelSamplerMap(OTEL_TRACES_SAMPLER, OTEL_TRACES_SAMPLER_ARG))
     this._setValue(env, 'sampler.rateLimit', DD_TRACE_RATE_LIMIT)
     this._setSamplingRule(env, 'sampler.rules', safeJsonParse(DD_TRACE_SAMPLING_RULES))
     this._envUnprocessed['sampler.rules'] = DD_TRACE_SAMPLING_RULES
@@ -767,6 +831,12 @@ class Config {
     this._setValue(opts, 'appsec.rateLimit', maybeInt(options.appsec.rateLimit))
     this._optsUnprocessed['appsec.rateLimit'] = options.appsec.rateLimit
     this._setString(opts, 'appsec.rules', options.appsec.rules)
+    this._setBoolean(opts, 'appsec.standalone.enabled', options.experimental?.appsec?.standalone?.enabled)
+    this._setBoolean(opts, 'appsec.stackTrace.enabled', options.appsec.stackTrace?.enabled)
+    this._setValue(opts, 'appsec.stackTrace.maxDepth', maybeInt(options.appsec.stackTrace?.maxDepth))
+    this._optsUnprocessed['appsec.stackTrace.maxDepth'] = options.appsec.stackTrace?.maxDepth
+    this._setValue(opts, 'appsec.stackTrace.maxStackTraces', maybeInt(options.appsec.stackTrace?.maxStackTraces))
+    this._optsUnprocessed['appsec.stackTrace.maxStackTraces'] = options.appsec.stackTrace?.maxStackTraces
     this._setValue(opts, 'appsec.wafTimeout', maybeInt(options.appsec.wafTimeout))
     this._optsUnprocessed['appsec.wafTimeout'] = options.appsec.wafTimeout
     this._setBoolean(opts, 'clientIpEnabled', options.clientIpEnabled)
@@ -788,23 +858,23 @@ class Config {
     this._optsUnprocessed.flushMinSpans = options.flushMinSpans
     this._setArray(opts, 'headerTags', options.headerTags)
     this._setString(opts, 'hostname', options.hostname)
-    this._setBoolean(opts, 'iast.deduplicationEnabled', options.iastOptions && options.iastOptions.deduplicationEnabled)
+    this._setBoolean(opts, 'iast.deduplicationEnabled', options.iast && options.iast.deduplicationEnabled)
     this._setBoolean(opts, 'iast.enabled',
-      options.iastOptions && (options.iastOptions === true || options.iastOptions.enabled === true))
+      options.iast && (options.iast === true || options.iast.enabled === true))
     this._setValue(opts, 'iast.maxConcurrentRequests',
-      maybeInt(options.iastOptions?.maxConcurrentRequests))
-    this._optsUnprocessed['iast.maxConcurrentRequests'] = options.iastOptions?.maxConcurrentRequests
-    this._setValue(opts, 'iast.maxContextOperations', maybeInt(options.iastOptions?.maxContextOperations))
-    this._optsUnprocessed['iast.maxContextOperations'] = options.iastOptions?.maxContextOperations
-    this._setBoolean(opts, 'iast.redactionEnabled', options.iastOptions?.redactionEnabled)
-    this._setString(opts, 'iast.redactionNamePattern', options.iastOptions?.redactionNamePattern)
-    this._setString(opts, 'iast.redactionValuePattern', options.iastOptions?.redactionValuePattern)
-    const iastRequestSampling = maybeInt(options.iastOptions?.requestSampling)
+      maybeInt(options.iast?.maxConcurrentRequests))
+    this._optsUnprocessed['iast.maxConcurrentRequests'] = options.iast?.maxConcurrentRequests
+    this._setValue(opts, 'iast.maxContextOperations', maybeInt(options.iast?.maxContextOperations))
+    this._optsUnprocessed['iast.maxContextOperations'] = options.iast?.maxContextOperations
+    this._setBoolean(opts, 'iast.redactionEnabled', options.iast?.redactionEnabled)
+    this._setString(opts, 'iast.redactionNamePattern', options.iast?.redactionNamePattern)
+    this._setString(opts, 'iast.redactionValuePattern', options.iast?.redactionValuePattern)
+    const iastRequestSampling = maybeInt(options.iast?.requestSampling)
     if (iastRequestSampling > -1 && iastRequestSampling < 101) {
       this._setValue(opts, 'iast.requestSampling', iastRequestSampling)
-      this._optsUnprocessed['iast.requestSampling'] = options.iastOptions?.requestSampling
+      this._optsUnprocessed['iast.requestSampling'] = options.iast?.requestSampling
     }
-    this._setString(opts, 'iast.telemetryVerbosity', options.iastOptions && options.iastOptions.telemetryVerbosity)
+    this._setString(opts, 'iast.telemetryVerbosity', options.iast && options.iast.telemetryVerbosity)
     this._setBoolean(opts, 'isCiVisibility', options.isCiVisibility)
     this._setBoolean(opts, 'logInjection', options.logInjection)
     this._setString(opts, 'lookup', options.lookup)
@@ -834,7 +904,7 @@ class Config {
     this._setBoolean(opts, 'startupLogs', options.startupLogs)
     this._setTags(opts, 'tags', tags)
     const hasTelemetryLogsUsingFeatures =
-      (options.iastOptions && (options.iastOptions === true || options.iastOptions?.enabled === true)) ||
+      (options.iast && (options.iast === true || options.iast?.enabled === true)) ||
       (options.profiling && options.profiling === true)
     this._setBoolean(opts, 'telemetry.logCollection', hasTelemetryLogsUsingFeatures)
     this._setBoolean(opts, 'traceId128BitGenerationEnabled', options.traceId128BitGenerationEnabled)
@@ -973,15 +1043,18 @@ class Config {
     this._setArray(opts, 'headerTags', headerTags)
     this._setTags(opts, 'tags', tags)
     this._setBoolean(opts, 'tracing', options.tracing_enabled)
-    // ignore tags for now since rc sampling rule tags format is not supported
-    this._setSamplingRule(opts, 'sampler.rules', this._ignoreTags(options.tracing_sampling_rules))
     this._remoteUnprocessed['sampler.rules'] = options.tracing_sampling_rules
+    this._setSamplingRule(opts, 'sampler.rules', this._reformatTags(options.tracing_sampling_rules))
   }
 
-  _ignoreTags (samplingRules) {
-    if (samplingRules) {
-      for (const rule of samplingRules) {
-        delete rule.tags
+  _reformatTags (samplingRules) {
+    for (const rule of (samplingRules || [])) {
+      const reformattedTags = {}
+      if (rule.tags) {
+        for (const tag of (rule.tags || {})) {
+          reformattedTags[tag.key] = tag.value_glob
+        }
+        rule.tags = reformattedTags
       }
     }
     return samplingRules

package/packages/dd-trace/src/constants.js

@@ -32,5 +32,7 @@ module.exports = {
   PEER_SERVICE_SOURCE_KEY: '_dd.peer.service.source',
   PEER_SERVICE_REMAP_KEY: '_dd.peer.service.remapped_from',
   SCI_REPOSITORY_URL: '_dd.git.repository_url',
-  SCI_COMMIT_SHA: '_dd.git.commit.sha'
+  SCI_COMMIT_SHA: '_dd.git.commit.sha',
+  APM_TRACING_ENABLED_KEY: '_dd.apm.enabled',
+  APPSEC_PROPAGATION_KEY: '_dd.p.appsec'
 }

package/packages/dd-trace/src/datastreams/processor.js

@@ -132,7 +132,7 @@ function getSizeOrZero (obj) {
     })
     return payloadSize
   }
-  if (typeof obj === 'object') {
+  if (obj !== null && typeof obj === 'object') {
     try {
       return getHeadersSize(obj)
     } catch {
@@ -211,7 +211,8 @@ class DataStreamsProcessor {
       Stats,
       TracerVersion: pkg.version,
       Version: this.version,
-      Lang: 'javascript'
+      Lang: 'javascript',
+      Tags: Object.entries(this.tags).map(([key, value]) => `${key}:${value}`)
     }
     this.writer.flush(payload)
   }

package/packages/dd-trace/src/exporters/agent/index.js

@@ -7,7 +7,7 @@ const Writer = require('./writer')
 class AgentExporter {
   constructor (config, prioritySampler) {
     this._config = config
-    const { url, hostname, port, lookup, protocolVersion, stats = {} } = config
+    const { url, hostname, port, lookup, protocolVersion, stats = {}, appsec } = config
     this._url = url || new URL(format({
       protocol: 'http:',
       hostname: hostname || 'localhost',
@@ -15,7 +15,7 @@ class AgentExporter {
     }))
 
     const headers = {}
-    if (stats.enabled) {
+    if (stats.enabled || appsec?.standalone?.enabled) {
       headers['Datadog-Client-Computed-Stats'] = 'yes'
     }
 

package/packages/dd-trace/src/format.js

@@ -53,6 +53,7 @@ function formatSpan (span) {
     resource: String(spanContext._name),
     error: 0,
     meta: {},
+    meta_struct: span.meta_struct,
     metrics: {},
     start: Math.round(span._startTime * 1e6),
     duration: Math.round(span._duration * 1e6),

package/packages/dd-trace/src/opentelemetry/span.js

@@ -283,7 +283,7 @@ class Span {
   }
 
   get ended () {
-    return typeof this.duration !== 'undefined'
+    return this.duration !== undefined
   }
 }
 

package/packages/dd-trace/src/opentelemetry/tracer.js

@@ -15,6 +15,7 @@ class Tracer {
     this._tracerProvider = tracerProvider
     // Is there a reason this is public?
     this.instrumentationLibrary = library
+    this._spanLimits = {}
   }
 
   get resource () {
@@ -118,6 +119,11 @@ class Tracer {
   getActiveSpanProcessor () {
     return this._tracerProvider.getActiveSpanProcessor()
   }
+
+  // not used in our codebase but needed for compatibility. See issue #1244
+  getSpanLimits () {
+    return this._spanLimits
+  }
 }
 
 module.exports = Tracer

package/packages/dd-trace/src/opentracing/propagation/text_map.js

@@ -6,9 +6,13 @@ const DatadogSpanContext = require('../span_context')
 const log = require('../../log')
 const TraceState = require('./tracestate')
 const tags = require('../../../../../ext/tags')
+const { channel } = require('dc-polyfill')
 
 const { AUTO_KEEP, AUTO_REJECT, USER_KEEP } = require('../../../../../ext/priority')
 
+const injectCh = channel('dd-trace:span:inject')
+const extractCh = channel('dd-trace:span:extract')
+
 const traceKey = 'x-datadog-trace-id'
 const spanKey = 'x-datadog-parent-id'
 const originKey = 'x-datadog-origin'
@@ -54,6 +58,10 @@ class TextMapPropagator {
     this._injectB3SingleHeader(spanContext, carrier)
     this._injectTraceparent(spanContext, carrier)
 
+    if (injectCh.hasSubscribers) {
+      injectCh.publish({ spanContext, carrier })
+    }
+
     log.debug(() => `Inject into carrier: ${JSON.stringify(pick(carrier, logKeys))}.`)
   }
 
@@ -62,6 +70,10 @@ class TextMapPropagator {
 
     if (!spanContext) return spanContext
 
+    if (extractCh.hasSubscribers) {
+      extractCh.publish({ spanContext, carrier })
+    }
+
     log.debug(() => `Extract from carrier: ${JSON.stringify(pick(carrier, logKeys))}.`)
 
     return spanContext

package/packages/dd-trace/src/opentracing/span.js

@@ -99,7 +99,10 @@ class DatadogSpan {
       unfinishedRegistry.register(this, operationName, this)
     }
     spanleak.addSpan(this, operationName)
-    startCh.publish(this)
+
+    if (startCh.hasSubscribers) {
+      startCh.publish({ span: this, fields })
+    }
   }
 
   toString () {

package/packages/dd-trace/src/opentracing/tracer.js

@@ -19,7 +19,7 @@ const REFERENCE_CHILD_OF = 'child_of'
 const REFERENCE_FOLLOWS_FROM = 'follows_from'
 
 class DatadogTracer {
-  constructor (config) {
+  constructor (config, prioritySampler) {
     const Exporter = getExporter(config.experimental.exporter)
 
     this._config = config
@@ -28,7 +28,7 @@ class DatadogTracer {
     this._env = config.env
     this._logInjection = config.logInjection
     this._debug = config.debug
-    this._prioritySampler = new PrioritySampler(config.env, config.sampler)
+    this._prioritySampler = prioritySampler ?? new PrioritySampler(config.env, config.sampler)
     this._exporter = new Exporter(config, this._prioritySampler)
     this._processor = new SpanProcessor(this._exporter, this._prioritySampler, config)
     this._url = this._exporter._url

package/packages/dd-trace/src/plugins/ci_plugin.js

@@ -91,6 +91,13 @@ module.exports = class CiPlugin extends Plugin {
           ...testModuleSpanMetadata
         }
       })
+      // only for vitest
+      // These are added for the worker threads to use
+      if (this.constructor.id === 'vitest') {
+        process.env.DD_CIVISIBILITY_TEST_SESSION_ID = this.testSessionSpan.context().toTraceId()
+        process.env.DD_CIVISIBILITY_TEST_MODULE_ID = this.testModuleSpan.context().toSpanId()
+      }
+
       this.telemetry.ciVisEvent(TELEMETRY_EVENT_CREATED, 'module')
     })
 

package/packages/dd-trace/src/plugins/index.js

@@ -18,6 +18,7 @@ module.exports = {
   get '@opensearch-project/opensearch' () { return require('../../../datadog-plugin-opensearch/src') },
   get '@redis/client' () { return require('../../../datadog-plugin-redis/src') },
   get '@smithy/smithy-client' () { return require('../../../datadog-plugin-aws-sdk/src') },
+  get '@vitest/runner' () { return require('../../../datadog-plugin-vitest/src') },
   get aerospike () { return require('../../../datadog-plugin-aerospike/src') },
   get amqp10 () { return require('../../../datadog-plugin-amqp10/src') },
   get amqplib () { return require('../../../datadog-plugin-amqplib/src') },
@@ -54,6 +55,7 @@ module.exports = {
   get 'microgateway-core' () { return require('../../../datadog-plugin-microgateway-core/src') },
   get mocha () { return require('../../../datadog-plugin-mocha/src') },
   get 'mocha-each' () { return require('../../../datadog-plugin-mocha/src') },
+  get vitest () { return require('../../../datadog-plugin-vitest/src') },
   get workerpool () { return require('../../../datadog-plugin-mocha/src') },
   get moleculer () { return require('../../../datadog-plugin-moleculer/src') },
   get mongodb () { return require('../../../datadog-plugin-mongodb-core/src') },

package/packages/dd-trace/src/plugins/util/test.js

@@ -95,6 +95,9 @@ const MOCHA_WORKER_TRACE_PAYLOAD_CODE = 80
 const EFD_STRING = "Retried by Datadog's Early Flake Detection"
 const EFD_TEST_NAME_REGEX = new RegExp(EFD_STRING + ' \\(#\\d+\\): ', 'g')
 
+// Flaky test retries
+const NUM_FAILED_TEST_RETRIES = 5
+
 module.exports = {
   TEST_CODE_OWNERS,
   TEST_FRAMEWORK,
@@ -167,7 +170,8 @@ module.exports = {
   TEST_BROWSER_DRIVER,
   TEST_BROWSER_DRIVER_VERSION,
   TEST_BROWSER_NAME,
-  TEST_BROWSER_VERSION
+  TEST_BROWSER_VERSION,
+  NUM_FAILED_TEST_RETRIES
 }
 
 // Returns pkg manager and its version, separated by '-', e.g. npm-8.15.0 or yarn-1.22.19

package/packages/dd-trace/src/priority_sampler.js

@@ -4,6 +4,7 @@ const RateLimiter = require('./rate_limiter')
 const Sampler = require('./sampler')
 const { setSamplingRules } = require('./startup-log')
 const SamplingRule = require('./sampling_rule')
+const { hasOwn } = require('./util')
 
 const {
   SAMPLING_MECHANISM_DEFAULT,
@@ -66,7 +67,7 @@ class PrioritySampler {
     if (context._sampling.priority !== undefined) return
     if (!root) return // noop span
 
-    const tag = this._getPriorityFromTags(context._tags)
+    const tag = this._getPriorityFromTags(context._tags, context)
 
     if (this.validate(tag)) {
       context._sampling.priority = tag
@@ -202,8 +203,4 @@ class PrioritySampler {
   }
 }
 
-function hasOwn (object, prop) {
-  return Object.prototype.hasOwnProperty.call(object, prop)
-}
-
 module.exports = PrioritySampler

package/packages/dd-trace/src/profiling/profiler.js

@@ -69,7 +69,7 @@ class Profiler extends EventEmitter {
       setLogger(config.logger)
 
       mapper = await maybeSourceMap(config.sourceMap, SourceMapper, config.debugSourceMaps)
-      if (config.SourceMap && config.debugSourceMaps) {
+      if (config.sourceMap && config.debugSourceMaps) {
         this._logger.debug(() => {
           return mapper.infoMap.size === 0
             ? 'Found no source maps'

package/packages/dd-trace/src/proxy.js

@@ -15,6 +15,7 @@ const NoopDogStatsDClient = require('./noop/dogstatsd')
 const spanleak = require('./spanleak')
 const { SSIHeuristics } = require('./profiling/ssi-heuristics')
 const telemetryLog = require('dc-polyfill').channel('datadog:telemetry:log')
+const appsecStandalone = require('./appsec/standalone')
 
 class LazyModule {
   constructor (provider) {
@@ -178,7 +179,8 @@ class Tracer extends NoopProxy {
         this._modules.appsec.enable(config)
       }
       if (!this._tracingInitialized) {
-        this._tracer = new DatadogTracer(config)
+        const prioritySampler = appsecStandalone.configure(config)
+        this._tracer = new DatadogTracer(config, prioritySampler)
         this.appsec = new AppsecSdk(this._tracer, config)
         this._tracingInitialized = true
       }

package/packages/dd-trace/src/rate_limiter.js

@@ -3,9 +3,9 @@
 const limiter = require('limiter')
 
 class RateLimiter {
-  constructor (rateLimit) {
+  constructor (rateLimit, interval = 'second') {
     this._rateLimit = parseInt(rateLimit)
-    this._limiter = new limiter.RateLimiter(this._rateLimit, 'second')
+    this._limiter = new limiter.RateLimiter(this._rateLimit, interval)
     this._tokensRequested = 0
     this._prevIntervalTokens = 0
     this._prevTokensRequested = 0

package/packages/dd-trace/src/span_stats.js

@@ -126,7 +126,8 @@ class SpanStatsProcessor {
     port,
     url,
     env,
-    tags
+    tags,
+    appsec
   } = {}) {
     this.exporter = new SpanStatsExporter({
       hostname,
@@ -138,12 +139,12 @@ class SpanStatsProcessor {
     this.bucketSizeNs = interval * 1e9
     this.buckets = new TimeBuckets()
     this.hostname = os.hostname()
-    this.enabled = enabled
+    this.enabled = enabled && !appsec?.standalone?.enabled
     this.env = env
     this.tags = tags || {}
     this.sequence = 0
 
-    if (enabled) {
+    if (this.enabled) {
       this.timer = setInterval(this.onInterval.bind(this), interval * 1e3)
       this.timer.unref()
     }