dd-trace 5.27.1 → 5.28.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/init.js +4 -2
- package/initialize.mjs +13 -10
- package/package.json +1 -1
- package/packages/datadog-instrumentations/src/azure-functions.js +1 -1
- package/packages/datadog-plugin-azure-functions/src/index.js +1 -1
- package/packages/datadog-plugin-langchain/src/handlers/language_models/chat_model.js +1 -1
- package/packages/datadog-plugin-langchain/src/handlers/language_models/llm.js +1 -1
- package/packages/dd-trace/src/appsec/api_security_sampler.js +1 -1
- package/packages/dd-trace/src/appsec/blocking.js +1 -1
- package/packages/dd-trace/src/appsec/iast/analyzers/cookie-analyzer.js +2 -2
- package/packages/dd-trace/src/appsec/iast/iast-plugin.js +4 -4
- package/packages/dd-trace/src/appsec/iast/taint-tracking/operations-taint-object.js +2 -2
- package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js +5 -8
- package/packages/dd-trace/src/appsec/iast/taint-tracking/taint-tracking-impl.js +7 -11
- package/packages/dd-trace/src/appsec/iast/telemetry/namespaces.js +2 -3
- package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/command-sensitive-analyzer.js +2 -2
- package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/ldap-sensitive-analyzer.js +2 -2
- package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/sql-sensitive-analyzer.js +2 -2
- package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/url-sensitive-analyzer.js +2 -2
- package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js +3 -3
- package/packages/dd-trace/src/appsec/index.js +2 -3
- package/packages/dd-trace/src/appsec/rasp/fs-plugin.js +2 -2
- package/packages/dd-trace/src/appsec/rasp/utils.js +1 -1
- package/packages/dd-trace/src/appsec/remote_config/manager.js +2 -2
- package/packages/dd-trace/src/appsec/sdk/set_user.js +2 -2
- package/packages/dd-trace/src/appsec/sdk/track_event.js +5 -5
- package/packages/dd-trace/src/appsec/sdk/user_blocking.js +4 -4
- package/packages/dd-trace/src/appsec/waf/index.js +2 -2
- package/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js +2 -3
- package/packages/dd-trace/src/appsec/waf/waf_manager.js +1 -1
- package/packages/dd-trace/src/service-naming/schemas/v0/serverless.js +1 -1
- package/packages/dd-trace/src/service-naming/schemas/v1/serverless.js +1 -1
- package/packages/dd-trace/src/appsec/iast/iast-log.js +0 -86
package/init.js
CHANGED
|
@@ -2,7 +2,9 @@
|
|
|
2
2
|
|
|
3
3
|
/* eslint-disable no-var */
|
|
4
4
|
|
|
5
|
-
var
|
|
5
|
+
var nodeVersion = require('./version')
|
|
6
|
+
var NODE_MAJOR = nodeVersion.NODE_MAJOR
|
|
7
|
+
var NODE_MINOR = nodeVersion.NODE_MINOR
|
|
6
8
|
|
|
7
9
|
// We use several things that are not supported by older versions of Node:
|
|
8
10
|
// - AsyncLocalStorage
|
|
@@ -11,7 +13,7 @@ var NODE_MAJOR = require('./version').NODE_MAJOR
|
|
|
11
13
|
// - Mocha (for testing)
|
|
12
14
|
// and probably others.
|
|
13
15
|
// TODO: Remove all these dependencies so that we can report telemetry.
|
|
14
|
-
if (NODE_MAJOR >= 12) {
|
|
16
|
+
if ((NODE_MAJOR === 12 && NODE_MINOR >= 17) || NODE_MAJOR > 12) {
|
|
15
17
|
var path = require('path')
|
|
16
18
|
var Module = require('module')
|
|
17
19
|
var semver = require('semver')
|
package/initialize.mjs
CHANGED
|
@@ -12,6 +12,7 @@
|
|
|
12
12
|
|
|
13
13
|
import { isMainThread } from 'worker_threads'
|
|
14
14
|
|
|
15
|
+
import * as Module from 'node:module'
|
|
15
16
|
import { fileURLToPath } from 'node:url'
|
|
16
17
|
import {
|
|
17
18
|
load as origLoad,
|
|
@@ -31,11 +32,16 @@ ${result.source}`
|
|
|
31
32
|
return result
|
|
32
33
|
}
|
|
33
34
|
|
|
35
|
+
const [NODE_MAJOR, NODE_MINOR] = process.versions.node.split('.').map(x => +x)
|
|
36
|
+
|
|
37
|
+
const brokenLoaders = NODE_MAJOR === 18 && NODE_MINOR === 0
|
|
38
|
+
|
|
34
39
|
export async function load (...args) {
|
|
35
|
-
|
|
40
|
+
const loadHook = brokenLoaders ? args[args.length - 1] : origLoad
|
|
41
|
+
return insertInit(await loadHook(...args))
|
|
36
42
|
}
|
|
37
43
|
|
|
38
|
-
export const resolve = origResolve
|
|
44
|
+
export const resolve = brokenLoaders ? undefined : origResolve
|
|
39
45
|
|
|
40
46
|
export const getFormat = origGetFormat
|
|
41
47
|
|
|
@@ -44,12 +50,9 @@ export async function getSource (...args) {
|
|
|
44
50
|
}
|
|
45
51
|
|
|
46
52
|
if (isMainThread) {
|
|
47
|
-
|
|
48
|
-
(
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
register('./loader-hook.mjs', import.meta.url)
|
|
53
|
-
}
|
|
54
|
-
})()
|
|
53
|
+
const require = Module.createRequire(import.meta.url)
|
|
54
|
+
require('./init.js')
|
|
55
|
+
if (Module.register) {
|
|
56
|
+
Module.register('./loader-hook.mjs', import.meta.url)
|
|
57
|
+
}
|
|
55
58
|
}
|
package/package.json
CHANGED
|
@@ -6,7 +6,7 @@ const {
|
|
|
6
6
|
const shimmer = require('../../datadog-shimmer')
|
|
7
7
|
const dc = require('dc-polyfill')
|
|
8
8
|
|
|
9
|
-
const azureFunctionsChannel = dc.tracingChannel('datadog:azure
|
|
9
|
+
const azureFunctionsChannel = dc.tracingChannel('datadog:azure:functions:invoke')
|
|
10
10
|
|
|
11
11
|
addHook({ name: '@azure/functions', versions: ['>=4'] }, azureFunction => {
|
|
12
12
|
const { app } = azureFunction
|
|
@@ -20,7 +20,7 @@ class AzureFunctionsPlugin extends TracingPlugin {
|
|
|
20
20
|
static get kind () { return 'server' }
|
|
21
21
|
static get type () { return 'serverless' }
|
|
22
22
|
|
|
23
|
-
static get prefix () { return 'tracing:datadog:azure
|
|
23
|
+
static get prefix () { return 'tracing:datadog:azure:functions:invoke' }
|
|
24
24
|
|
|
25
25
|
bindStart (ctx) {
|
|
26
26
|
const { functionName, methodName } = ctx
|
|
@@ -46,7 +46,7 @@ class LangChainChatModelHandler extends LangChainLanguageModelHandler {
|
|
|
46
46
|
|
|
47
47
|
this.extractTokenMetrics(ctx.currentStore?.span, result)
|
|
48
48
|
|
|
49
|
-
for (const messageSetIdx in result
|
|
49
|
+
for (const messageSetIdx in result?.generations) {
|
|
50
50
|
const messageSet = result.generations[messageSetIdx]
|
|
51
51
|
|
|
52
52
|
for (const chatCompletionIdx in messageSet) {
|
|
@@ -37,7 +37,7 @@ class LangChainLLMHandler extends LangChainLanguageModelHandler {
|
|
|
37
37
|
|
|
38
38
|
this.extractTokenMetrics(ctx.currentStore?.span, result)
|
|
39
39
|
|
|
40
|
-
for (const completionIdx in result
|
|
40
|
+
for (const completionIdx in result?.generations) {
|
|
41
41
|
const completion = result.generations[completionIdx]
|
|
42
42
|
if (this.isPromptCompletionSampled()) {
|
|
43
43
|
tags[`langchain.response.completions.${completionIdx}.text`] = this.normalize(completion[0].text) || ''
|
|
@@ -64,7 +64,7 @@ function computeKey (req, res) {
|
|
|
64
64
|
const status = res.statusCode
|
|
65
65
|
|
|
66
66
|
if (!method || !status) {
|
|
67
|
-
log.warn('Unsupported groupkey for API security')
|
|
67
|
+
log.warn('[ASM] Unsupported groupkey for API security')
|
|
68
68
|
return null
|
|
69
69
|
}
|
|
70
70
|
return method + route + status
|
|
@@ -101,7 +101,7 @@ function getBlockingData (req, specificType, actionParameters) {
|
|
|
101
101
|
|
|
102
102
|
function block (req, res, rootSpan, abortController, actionParameters = defaultBlockingActionParameters) {
|
|
103
103
|
if (res.headersSent) {
|
|
104
|
-
log.warn('Cannot send blocking response when headers have already been sent')
|
|
104
|
+
log.warn('[ASM] Cannot send blocking response when headers have already been sent')
|
|
105
105
|
return
|
|
106
106
|
}
|
|
107
107
|
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
const Analyzer = require('./vulnerability-analyzer')
|
|
4
4
|
const { getNodeModulesPaths } = require('../path-line')
|
|
5
|
-
const
|
|
5
|
+
const log = require('../../../log')
|
|
6
6
|
|
|
7
7
|
const EXCLUDED_PATHS = getNodeModulesPaths('express/lib/response.js')
|
|
8
8
|
|
|
@@ -16,7 +16,7 @@ class CookieAnalyzer extends Analyzer {
|
|
|
16
16
|
try {
|
|
17
17
|
this.cookieFilterRegExp = new RegExp(config.iast.cookieFilterPattern)
|
|
18
18
|
} catch {
|
|
19
|
-
|
|
19
|
+
log.error('[ASM] Invalid regex in cookieFilterPattern')
|
|
20
20
|
this.cookieFilterRegExp = /.{32,}/
|
|
21
21
|
}
|
|
22
22
|
|
|
@@ -2,7 +2,6 @@
|
|
|
2
2
|
|
|
3
3
|
const { channel } = require('dc-polyfill')
|
|
4
4
|
|
|
5
|
-
const iastLog = require('./iast-log')
|
|
6
5
|
const Plugin = require('../../plugins/plugin')
|
|
7
6
|
const iastTelemetry = require('./telemetry')
|
|
8
7
|
const { getInstrumentedMetric, getExecutedMetric, TagKey, EXECUTED_SOURCE, formatTags } =
|
|
@@ -10,6 +9,7 @@ const { getInstrumentedMetric, getExecutedMetric, TagKey, EXECUTED_SOURCE, forma
|
|
|
10
9
|
const { storage } = require('../../../../datadog-core')
|
|
11
10
|
const { getIastContext } = require('./iast-context')
|
|
12
11
|
const instrumentations = require('../../../../datadog-instrumentations/src/helpers/instrumentations')
|
|
12
|
+
const log = require('../../log')
|
|
13
13
|
|
|
14
14
|
/**
|
|
15
15
|
* Used by vulnerability sources and sinks to subscribe diagnostic channel events
|
|
@@ -65,7 +65,7 @@ class IastPlugin extends Plugin {
|
|
|
65
65
|
try {
|
|
66
66
|
handler(message, name)
|
|
67
67
|
} catch (e) {
|
|
68
|
-
|
|
68
|
+
log.error('[ASM] Error executing IAST plugin handler', e)
|
|
69
69
|
}
|
|
70
70
|
}
|
|
71
71
|
}
|
|
@@ -76,7 +76,7 @@ class IastPlugin extends Plugin {
|
|
|
76
76
|
const iastContext = getIastContext(storage.getStore())
|
|
77
77
|
iastSub.increaseExecuted(iastContext)
|
|
78
78
|
} catch (e) {
|
|
79
|
-
|
|
79
|
+
log.error('[ASM] Error increasing handler executed metrics', e)
|
|
80
80
|
}
|
|
81
81
|
}
|
|
82
82
|
}
|
|
@@ -93,7 +93,7 @@ class IastPlugin extends Plugin {
|
|
|
93
93
|
}
|
|
94
94
|
return result
|
|
95
95
|
} catch (e) {
|
|
96
|
-
|
|
96
|
+
log.error('[ASM] Error executing handler or increasing metrics', e)
|
|
97
97
|
}
|
|
98
98
|
}
|
|
99
99
|
|
|
@@ -2,7 +2,7 @@
|
|
|
2
2
|
|
|
3
3
|
const TaintedUtils = require('@datadog/native-iast-taint-tracking')
|
|
4
4
|
const { IAST_TRANSACTION_ID } = require('../iast-context')
|
|
5
|
-
const
|
|
5
|
+
const log = require('../../../log')
|
|
6
6
|
|
|
7
7
|
function taintObject (iastContext, object, type) {
|
|
8
8
|
let result = object
|
|
@@ -33,7 +33,7 @@ function taintObject (iastContext, object, type) {
|
|
|
33
33
|
}
|
|
34
34
|
}
|
|
35
35
|
} catch (e) {
|
|
36
|
-
|
|
36
|
+
log.error('[ASM] Error in taintObject when visiting property : %s', property, e)
|
|
37
37
|
}
|
|
38
38
|
}
|
|
39
39
|
}
|
|
@@ -2,12 +2,12 @@
|
|
|
2
2
|
|
|
3
3
|
const Module = require('module')
|
|
4
4
|
const shimmer = require('../../../../../datadog-shimmer')
|
|
5
|
-
const iastLog = require('../iast-log')
|
|
6
5
|
const { isPrivateModule, isNotLibraryFile } = require('./filter')
|
|
7
6
|
const { csiMethods } = require('./csi-methods')
|
|
8
7
|
const { getName } = require('../telemetry/verbosity')
|
|
9
8
|
const { getRewriteFunction } = require('./rewriter-telemetry')
|
|
10
9
|
const dc = require('dc-polyfill')
|
|
10
|
+
const log = require('../../../log')
|
|
11
11
|
|
|
12
12
|
const hardcodedSecretCh = dc.channel('datadog:secrets:result')
|
|
13
13
|
let rewriter
|
|
@@ -60,8 +60,7 @@ function getRewriter (telemetryVerbosity) {
|
|
|
60
60
|
chainSourceMap
|
|
61
61
|
})
|
|
62
62
|
} catch (e) {
|
|
63
|
-
|
|
64
|
-
.errorAndPublish(e)
|
|
63
|
+
log.error('[ASM] Unable to initialize TaintTracking Rewriter', e)
|
|
65
64
|
}
|
|
66
65
|
}
|
|
67
66
|
return rewriter
|
|
@@ -99,8 +98,7 @@ function getCompileMethodFn (compileMethod) {
|
|
|
99
98
|
}
|
|
100
99
|
}
|
|
101
100
|
} catch (e) {
|
|
102
|
-
|
|
103
|
-
.errorAndPublish(e)
|
|
101
|
+
log.error('[ASM] Error rewriting file %s', filename, e)
|
|
104
102
|
}
|
|
105
103
|
return compileMethod.apply(this, [content, filename])
|
|
106
104
|
}
|
|
@@ -117,8 +115,7 @@ function enableRewriter (telemetryVerbosity) {
|
|
|
117
115
|
shimmer.wrap(Module.prototype, '_compile', compileMethod => getCompileMethodFn(compileMethod))
|
|
118
116
|
}
|
|
119
117
|
} catch (e) {
|
|
120
|
-
|
|
121
|
-
.errorAndPublish(e)
|
|
118
|
+
log.error('[ASM] Error enabling TaintTracking Rewriter', e)
|
|
122
119
|
}
|
|
123
120
|
}
|
|
124
121
|
|
|
@@ -132,7 +129,7 @@ function disableRewriter () {
|
|
|
132
129
|
|
|
133
130
|
Error.prepareStackTrace = originalPrepareStackTrace
|
|
134
131
|
} catch (e) {
|
|
135
|
-
|
|
132
|
+
log.warn('[ASM] Error disabling TaintTracking rewriter', e)
|
|
136
133
|
}
|
|
137
134
|
}
|
|
138
135
|
|
|
@@ -4,10 +4,10 @@ const dc = require('dc-polyfill')
|
|
|
4
4
|
const TaintedUtils = require('@datadog/native-iast-taint-tracking')
|
|
5
5
|
const { storage } = require('../../../../../datadog-core')
|
|
6
6
|
const iastContextFunctions = require('../iast-context')
|
|
7
|
-
const iastLog = require('../iast-log')
|
|
8
7
|
const { EXECUTED_PROPAGATION } = require('../telemetry/iast-metric')
|
|
9
8
|
const { isDebugAllowed } = require('../telemetry/verbosity')
|
|
10
9
|
const { taintObject } = require('./operations-taint-object')
|
|
10
|
+
const log = require('../../../log')
|
|
11
11
|
|
|
12
12
|
const mathRandomCallCh = dc.channel('datadog:random:call')
|
|
13
13
|
const evalCallCh = dc.channel('datadog:eval:call')
|
|
@@ -60,8 +60,7 @@ function getFilteredCsiFn (cb, filter, getContext) {
|
|
|
60
60
|
return cb(transactionId, res, target, ...rest)
|
|
61
61
|
}
|
|
62
62
|
} catch (e) {
|
|
63
|
-
|
|
64
|
-
.errorAndPublish(e)
|
|
63
|
+
log.error('[ASM] Error invoking CSI %s', target, e)
|
|
65
64
|
}
|
|
66
65
|
return res
|
|
67
66
|
}
|
|
@@ -112,8 +111,7 @@ function csiMethodsOverrides (getContext) {
|
|
|
112
111
|
return TaintedUtils.concat(transactionId, res, op1, op2)
|
|
113
112
|
}
|
|
114
113
|
} catch (e) {
|
|
115
|
-
|
|
116
|
-
.errorAndPublish(e)
|
|
114
|
+
log.error('[ASM] Error invoking CSI plusOperator', e)
|
|
117
115
|
}
|
|
118
116
|
return res
|
|
119
117
|
},
|
|
@@ -126,8 +124,7 @@ function csiMethodsOverrides (getContext) {
|
|
|
126
124
|
return TaintedUtils.concat(transactionId, res, ...rest)
|
|
127
125
|
}
|
|
128
126
|
} catch (e) {
|
|
129
|
-
|
|
130
|
-
.errorAndPublish(e)
|
|
127
|
+
log.error('[ASM] Error invoking CSI tplOperator', e)
|
|
131
128
|
}
|
|
132
129
|
return res
|
|
133
130
|
},
|
|
@@ -178,7 +175,7 @@ function csiMethodsOverrides (getContext) {
|
|
|
178
175
|
}
|
|
179
176
|
}
|
|
180
177
|
} catch (e) {
|
|
181
|
-
|
|
178
|
+
log.error('[ASM] Error invoking CSI JSON.parse', e)
|
|
182
179
|
}
|
|
183
180
|
}
|
|
184
181
|
|
|
@@ -194,7 +191,7 @@ function csiMethodsOverrides (getContext) {
|
|
|
194
191
|
res = TaintedUtils.arrayJoin(transactionId, res, target, separator)
|
|
195
192
|
}
|
|
196
193
|
} catch (e) {
|
|
197
|
-
|
|
194
|
+
log.error('[ASM] Error invoking CSI join', e)
|
|
198
195
|
}
|
|
199
196
|
}
|
|
200
197
|
|
|
@@ -250,8 +247,7 @@ function lodashTaintTrackingHandler (message) {
|
|
|
250
247
|
message.result = getLodashTaintedUtilFn(message.operation)(transactionId, message.result, ...message.arguments)
|
|
251
248
|
}
|
|
252
249
|
} catch (e) {
|
|
253
|
-
|
|
254
|
-
.errorAndPublish(e)
|
|
250
|
+
log.error('[ASM] Error invoking CSI lodash %s', message.operation, e)
|
|
255
251
|
}
|
|
256
252
|
}
|
|
257
253
|
|
|
@@ -4,7 +4,6 @@ const log = require('../../../log')
|
|
|
4
4
|
const { Namespace } = require('../../../telemetry/metrics')
|
|
5
5
|
const { addMetricsToSpan } = require('./span-tags')
|
|
6
6
|
const { IAST_TRACE_METRIC_PREFIX } = require('../tags')
|
|
7
|
-
const iastLog = require('../iast-log')
|
|
8
7
|
|
|
9
8
|
const DD_IAST_METRICS_NAMESPACE = Symbol('_dd.iast.request.metrics.namespace')
|
|
10
9
|
|
|
@@ -31,7 +30,7 @@ function finalizeRequestNamespace (context, rootSpan) {
|
|
|
31
30
|
|
|
32
31
|
namespace.clear()
|
|
33
32
|
} catch (e) {
|
|
34
|
-
log.error(e)
|
|
33
|
+
log.error('[ASM] Error merging request metrics', e)
|
|
35
34
|
} finally {
|
|
36
35
|
if (context) {
|
|
37
36
|
delete context[DD_IAST_METRICS_NAMESPACE]
|
|
@@ -79,7 +78,7 @@ class IastNamespace extends Namespace {
|
|
|
79
78
|
|
|
80
79
|
if (metrics.size === this.maxMetricTagsSize) {
|
|
81
80
|
metrics.clear()
|
|
82
|
-
|
|
81
|
+
log.error('[ASM] Tags cache max size reached for metric %s', name)
|
|
83
82
|
}
|
|
84
83
|
|
|
85
84
|
metrics.set(tags, metric)
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
'use strict'
|
|
2
2
|
|
|
3
|
-
const
|
|
3
|
+
const log = require('../../../../../log')
|
|
4
4
|
|
|
5
5
|
const COMMAND_PATTERN = '^(?:\\s*(?:sudo|doas)\\s+)?\\b\\S+\\b\\s(.*)'
|
|
6
6
|
const pattern = new RegExp(COMMAND_PATTERN, 'gmi')
|
|
@@ -16,7 +16,7 @@ module.exports = function extractSensitiveRanges (evidence) {
|
|
|
16
16
|
return [{ start, end }]
|
|
17
17
|
}
|
|
18
18
|
} catch (e) {
|
|
19
|
-
|
|
19
|
+
log.debug('[ASM] Error extracting sensitive ranges', e)
|
|
20
20
|
}
|
|
21
21
|
return []
|
|
22
22
|
}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
'use strict'
|
|
2
2
|
|
|
3
|
-
const
|
|
3
|
+
const log = require('../../../../../log')
|
|
4
4
|
|
|
5
5
|
const LDAP_PATTERN = '\\(.*?(?:~=|=|<=|>=)(?<LITERAL>[^)]+)\\)'
|
|
6
6
|
const pattern = new RegExp(LDAP_PATTERN, 'gmi')
|
|
@@ -22,7 +22,7 @@ module.exports = function extractSensitiveRanges (evidence) {
|
|
|
22
22
|
}
|
|
23
23
|
return tokens
|
|
24
24
|
} catch (e) {
|
|
25
|
-
|
|
25
|
+
log.debug('[ASM] Error extracting sensitive ranges', e)
|
|
26
26
|
}
|
|
27
27
|
return []
|
|
28
28
|
}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
'use strict'
|
|
2
2
|
|
|
3
|
-
const
|
|
3
|
+
const log = require('../../../../../log')
|
|
4
4
|
|
|
5
5
|
const STRING_LITERAL = '\'(?:\'\'|[^\'])*\''
|
|
6
6
|
const POSTGRESQL_ESCAPED_LITERAL = '\\$([^$]*)\\$.*?\\$\\1\\$'
|
|
@@ -106,7 +106,7 @@ module.exports = function extractSensitiveRanges (evidence) {
|
|
|
106
106
|
}
|
|
107
107
|
return tokens
|
|
108
108
|
} catch (e) {
|
|
109
|
-
|
|
109
|
+
log.debug('[ASM] Error extracting sensitive ranges', e)
|
|
110
110
|
}
|
|
111
111
|
return []
|
|
112
112
|
}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
'use strict'
|
|
2
2
|
|
|
3
|
-
const
|
|
3
|
+
const log = require('../../../../../log')
|
|
4
4
|
|
|
5
5
|
const AUTHORITY = '^(?:[^:]+:)?//([^@]+)@'
|
|
6
6
|
const QUERY_FRAGMENT = '[?#&]([^=&;]+)=([^?#&]+)'
|
|
@@ -33,7 +33,7 @@ module.exports = function extractSensitiveRanges (evidence) {
|
|
|
33
33
|
|
|
34
34
|
return ranges
|
|
35
35
|
} catch (e) {
|
|
36
|
-
|
|
36
|
+
log.debug('[ASM] Error extracting sensitive ranges', e)
|
|
37
37
|
}
|
|
38
38
|
|
|
39
39
|
return []
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
'use strict'
|
|
2
2
|
|
|
3
|
-
const
|
|
3
|
+
const log = require('../../../../log')
|
|
4
4
|
const vulnerabilities = require('../../vulnerabilities')
|
|
5
5
|
|
|
6
6
|
const { contains, intersects, remove } = require('./range-utils')
|
|
@@ -282,7 +282,7 @@ class SensitiveHandler {
|
|
|
282
282
|
try {
|
|
283
283
|
this._namePattern = new RegExp(redactionNamePattern, 'gmi')
|
|
284
284
|
} catch (e) {
|
|
285
|
-
|
|
285
|
+
log.warn('[ASM] Redaction name pattern is not valid')
|
|
286
286
|
}
|
|
287
287
|
}
|
|
288
288
|
|
|
@@ -290,7 +290,7 @@ class SensitiveHandler {
|
|
|
290
290
|
try {
|
|
291
291
|
this._valuePattern = new RegExp(redactionValuePattern, 'gmi')
|
|
292
292
|
} catch (e) {
|
|
293
|
-
|
|
293
|
+
log.warn('[ASM] Redaction value pattern is not valid')
|
|
294
294
|
}
|
|
295
295
|
}
|
|
296
296
|
}
|
|
@@ -78,8 +78,7 @@ function enable (_config) {
|
|
|
78
78
|
isEnabled = true
|
|
79
79
|
config = _config
|
|
80
80
|
} catch (err) {
|
|
81
|
-
log.error('Unable to start AppSec')
|
|
82
|
-
log.error(err)
|
|
81
|
+
log.error('[ASM] Unable to start AppSec', err)
|
|
83
82
|
|
|
84
83
|
disable()
|
|
85
84
|
}
|
|
@@ -186,7 +185,7 @@ function onPassportVerify ({ credentials, user }) {
|
|
|
186
185
|
const rootSpan = store?.req && web.root(store.req)
|
|
187
186
|
|
|
188
187
|
if (!rootSpan) {
|
|
189
|
-
log.warn('No rootSpan found in onPassportVerify')
|
|
188
|
+
log.warn('[ASM] No rootSpan found in onPassportVerify')
|
|
190
189
|
return
|
|
191
190
|
}
|
|
192
191
|
|
|
@@ -70,7 +70,7 @@ function enable (mod) {
|
|
|
70
70
|
fsPlugin.enable()
|
|
71
71
|
}
|
|
72
72
|
|
|
73
|
-
log.info(
|
|
73
|
+
log.info('[ASM] Enabled AppsecFsPlugin for %s', mod)
|
|
74
74
|
}
|
|
75
75
|
|
|
76
76
|
function disable (mod) {
|
|
@@ -85,7 +85,7 @@ function disable (mod) {
|
|
|
85
85
|
fsPlugin = undefined
|
|
86
86
|
}
|
|
87
87
|
|
|
88
|
-
log.info(
|
|
88
|
+
log.info('[ASM] Disabled AppsecFsPlugin for %s', mod)
|
|
89
89
|
}
|
|
90
90
|
|
|
91
91
|
module.exports = {
|
|
@@ -8,7 +8,7 @@ const log = require('../../log')
|
|
|
8
8
|
const abortOnUncaughtException = process.execArgv?.includes('--abort-on-uncaught-exception')
|
|
9
9
|
|
|
10
10
|
if (abortOnUncaughtException) {
|
|
11
|
-
log.warn('The --abort-on-uncaught-exception flag is enabled. The RASP module will not block operations.')
|
|
11
|
+
log.warn('[ASM] The --abort-on-uncaught-exception flag is enabled. The RASP module will not block operations.')
|
|
12
12
|
}
|
|
13
13
|
|
|
14
14
|
const RULE_TYPES = {
|
|
@@ -134,7 +134,7 @@ class RemoteConfigManager extends EventEmitter {
|
|
|
134
134
|
if (statusCode === 404) return cb()
|
|
135
135
|
|
|
136
136
|
if (err) {
|
|
137
|
-
log.error(err)
|
|
137
|
+
log.error('[RC] Error in request', err)
|
|
138
138
|
return cb()
|
|
139
139
|
}
|
|
140
140
|
|
|
@@ -148,7 +148,7 @@ class RemoteConfigManager extends EventEmitter {
|
|
|
148
148
|
try {
|
|
149
149
|
this.parseConfig(JSON.parse(data))
|
|
150
150
|
} catch (err) {
|
|
151
|
-
log.error(
|
|
151
|
+
log.error('[RC] Could not parse remote config response', err)
|
|
152
152
|
|
|
153
153
|
this.state.client.state.has_error = true
|
|
154
154
|
this.state.client.state.error = err.toString()
|
|
@@ -11,13 +11,13 @@ function setUserTags (user, rootSpan) {
|
|
|
11
11
|
|
|
12
12
|
function setUser (tracer, user) {
|
|
13
13
|
if (!user || !user.id) {
|
|
14
|
-
log.warn('Invalid user provided to setUser')
|
|
14
|
+
log.warn('[ASM] Invalid user provided to setUser')
|
|
15
15
|
return
|
|
16
16
|
}
|
|
17
17
|
|
|
18
18
|
const rootSpan = getRootSpan(tracer)
|
|
19
19
|
if (!rootSpan) {
|
|
20
|
-
log.warn('Root span not available in setUser')
|
|
20
|
+
log.warn('[ASM] Root span not available in setUser')
|
|
21
21
|
return
|
|
22
22
|
}
|
|
23
23
|
|
|
@@ -11,13 +11,13 @@ const { keepTrace } = require('../../priority_sampler')
|
|
|
11
11
|
function trackUserLoginSuccessEvent (tracer, user, metadata) {
|
|
12
12
|
// TODO: better user check here and in _setUser() ?
|
|
13
13
|
if (!user || !user.id) {
|
|
14
|
-
log.warn('Invalid user provided to trackUserLoginSuccessEvent')
|
|
14
|
+
log.warn('[ASM] Invalid user provided to trackUserLoginSuccessEvent')
|
|
15
15
|
return
|
|
16
16
|
}
|
|
17
17
|
|
|
18
18
|
const rootSpan = getRootSpan(tracer)
|
|
19
19
|
if (!rootSpan) {
|
|
20
|
-
log.warn('Root span not available in trackUserLoginSuccessEvent')
|
|
20
|
+
log.warn('[ASM] Root span not available in trackUserLoginSuccessEvent')
|
|
21
21
|
return
|
|
22
22
|
}
|
|
23
23
|
|
|
@@ -28,7 +28,7 @@ function trackUserLoginSuccessEvent (tracer, user, metadata) {
|
|
|
28
28
|
|
|
29
29
|
function trackUserLoginFailureEvent (tracer, userId, exists, metadata) {
|
|
30
30
|
if (!userId || typeof userId !== 'string') {
|
|
31
|
-
log.warn('Invalid userId provided to trackUserLoginFailureEvent')
|
|
31
|
+
log.warn('[ASM] Invalid userId provided to trackUserLoginFailureEvent')
|
|
32
32
|
return
|
|
33
33
|
}
|
|
34
34
|
|
|
@@ -43,7 +43,7 @@ function trackUserLoginFailureEvent (tracer, userId, exists, metadata) {
|
|
|
43
43
|
|
|
44
44
|
function trackCustomEvent (tracer, eventName, metadata) {
|
|
45
45
|
if (!eventName || typeof eventName !== 'string') {
|
|
46
|
-
log.warn('Invalid eventName provided to trackCustomEvent')
|
|
46
|
+
log.warn('[ASM] Invalid eventName provided to trackCustomEvent')
|
|
47
47
|
return
|
|
48
48
|
}
|
|
49
49
|
|
|
@@ -52,7 +52,7 @@ function trackCustomEvent (tracer, eventName, metadata) {
|
|
|
52
52
|
|
|
53
53
|
function trackEvent (eventName, fields, sdkMethodName, rootSpan, mode) {
|
|
54
54
|
if (!rootSpan) {
|
|
55
|
-
log.warn(
|
|
55
|
+
log.warn('[ASM] Root span not available in %s', sdkMethodName)
|
|
56
56
|
return
|
|
57
57
|
}
|
|
58
58
|
|
|
@@ -15,7 +15,7 @@ function isUserBlocked (user) {
|
|
|
15
15
|
|
|
16
16
|
function checkUserAndSetUser (tracer, user) {
|
|
17
17
|
if (!user || !user.id) {
|
|
18
|
-
log.warn('Invalid user provided to isUserBlocked')
|
|
18
|
+
log.warn('[ASM] Invalid user provided to isUserBlocked')
|
|
19
19
|
return false
|
|
20
20
|
}
|
|
21
21
|
|
|
@@ -25,7 +25,7 @@ function checkUserAndSetUser (tracer, user) {
|
|
|
25
25
|
setUserTags(user, rootSpan)
|
|
26
26
|
}
|
|
27
27
|
} else {
|
|
28
|
-
log.warn('Root span not available in isUserBlocked')
|
|
28
|
+
log.warn('[ASM] Root span not available in isUserBlocked')
|
|
29
29
|
}
|
|
30
30
|
|
|
31
31
|
return isUserBlocked(user)
|
|
@@ -41,13 +41,13 @@ function blockRequest (tracer, req, res) {
|
|
|
41
41
|
}
|
|
42
42
|
|
|
43
43
|
if (!req || !res) {
|
|
44
|
-
log.warn('Requests or response object not available in blockRequest')
|
|
44
|
+
log.warn('[ASM] Requests or response object not available in blockRequest')
|
|
45
45
|
return false
|
|
46
46
|
}
|
|
47
47
|
|
|
48
48
|
const rootSpan = getRootSpan(tracer)
|
|
49
49
|
if (!rootSpan) {
|
|
50
|
-
log.warn('Root span not available in blockRequest')
|
|
50
|
+
log.warn('[ASM] Root span not available in blockRequest')
|
|
51
51
|
return false
|
|
52
52
|
}
|
|
53
53
|
|
|
@@ -41,7 +41,7 @@ function update (newRules) {
|
|
|
41
41
|
try {
|
|
42
42
|
waf.wafManager.update(newRules)
|
|
43
43
|
} catch (err) {
|
|
44
|
-
log.error('Could not apply rules from remote config')
|
|
44
|
+
log.error('[ASM] Could not apply rules from remote config')
|
|
45
45
|
throw err
|
|
46
46
|
}
|
|
47
47
|
}
|
|
@@ -50,7 +50,7 @@ function run (data, req, raspRuleType) {
|
|
|
50
50
|
if (!req) {
|
|
51
51
|
const store = storage.getStore()
|
|
52
52
|
if (!store || !store.req) {
|
|
53
|
-
log.warn('Request object not available in waf.run')
|
|
53
|
+
log.warn('[ASM] Request object not available in waf.run')
|
|
54
54
|
return
|
|
55
55
|
}
|
|
56
56
|
|
|
@@ -23,7 +23,7 @@ class WAFContextWrapper {
|
|
|
23
23
|
|
|
24
24
|
run ({ persistent, ephemeral }, raspRuleType) {
|
|
25
25
|
if (this.ddwafContext.disposed) {
|
|
26
|
-
log.warn('Calling run on a disposed context')
|
|
26
|
+
log.warn('[ASM] Calling run on a disposed context')
|
|
27
27
|
return
|
|
28
28
|
}
|
|
29
29
|
|
|
@@ -101,8 +101,7 @@ class WAFContextWrapper {
|
|
|
101
101
|
|
|
102
102
|
return result.actions
|
|
103
103
|
} catch (err) {
|
|
104
|
-
log.error('Error while running the AppSec WAF')
|
|
105
|
-
log.error(err)
|
|
104
|
+
log.error('[ASM] Error while running the AppSec WAF', err)
|
|
106
105
|
}
|
|
107
106
|
}
|
|
108
107
|
|
|
@@ -25,7 +25,7 @@ class WAFManager {
|
|
|
25
25
|
const { obfuscatorKeyRegex, obfuscatorValueRegex } = this.config
|
|
26
26
|
return new DDWAF(rules, { obfuscatorKeyRegex, obfuscatorValueRegex })
|
|
27
27
|
} catch (err) {
|
|
28
|
-
log.error('AppSec could not load native package. In-app WAF features will not be available.')
|
|
28
|
+
log.error('[ASM] AppSec could not load native package. In-app WAF features will not be available.')
|
|
29
29
|
|
|
30
30
|
throw err
|
|
31
31
|
}
|
|
@@ -1,86 +0,0 @@
|
|
|
1
|
-
'use strict'
|
|
2
|
-
|
|
3
|
-
const dc = require('dc-polyfill')
|
|
4
|
-
const log = require('../../log')
|
|
5
|
-
|
|
6
|
-
const telemetryLog = dc.channel('datadog:telemetry:log')
|
|
7
|
-
|
|
8
|
-
function getTelemetryLog (data, level) {
|
|
9
|
-
try {
|
|
10
|
-
data = typeof data === 'function' ? data() : data
|
|
11
|
-
|
|
12
|
-
let message
|
|
13
|
-
if (typeof data !== 'object' || !data) {
|
|
14
|
-
message = String(data)
|
|
15
|
-
} else {
|
|
16
|
-
message = String(data.message || data)
|
|
17
|
-
}
|
|
18
|
-
|
|
19
|
-
const logEntry = {
|
|
20
|
-
message,
|
|
21
|
-
level
|
|
22
|
-
}
|
|
23
|
-
if (data.stack) {
|
|
24
|
-
logEntry.stack_trace = data.stack
|
|
25
|
-
}
|
|
26
|
-
return logEntry
|
|
27
|
-
} catch (e) {
|
|
28
|
-
log.error(e)
|
|
29
|
-
}
|
|
30
|
-
}
|
|
31
|
-
|
|
32
|
-
const iastLog = {
|
|
33
|
-
debug (data) {
|
|
34
|
-
log.debug(data)
|
|
35
|
-
return this
|
|
36
|
-
},
|
|
37
|
-
|
|
38
|
-
info (data) {
|
|
39
|
-
log.info(data)
|
|
40
|
-
return this
|
|
41
|
-
},
|
|
42
|
-
|
|
43
|
-
warn (data) {
|
|
44
|
-
log.warn(data)
|
|
45
|
-
return this
|
|
46
|
-
},
|
|
47
|
-
|
|
48
|
-
error (data) {
|
|
49
|
-
log.error(data)
|
|
50
|
-
return this
|
|
51
|
-
},
|
|
52
|
-
|
|
53
|
-
publish (data, level) {
|
|
54
|
-
if (telemetryLog.hasSubscribers) {
|
|
55
|
-
telemetryLog.publish(getTelemetryLog(data, level))
|
|
56
|
-
}
|
|
57
|
-
return this
|
|
58
|
-
},
|
|
59
|
-
|
|
60
|
-
debugAndPublish (data) {
|
|
61
|
-
this.debug(data)
|
|
62
|
-
return this.publish(data, 'DEBUG')
|
|
63
|
-
},
|
|
64
|
-
|
|
65
|
-
/**
|
|
66
|
-
* forward 'INFO' log level to 'DEBUG' telemetry log level
|
|
67
|
-
* see also {@link ../../telemetry/logs#isLevelEnabled } method
|
|
68
|
-
*/
|
|
69
|
-
infoAndPublish (data) {
|
|
70
|
-
this.info(data)
|
|
71
|
-
return this.publish(data, 'DEBUG')
|
|
72
|
-
},
|
|
73
|
-
|
|
74
|
-
warnAndPublish (data) {
|
|
75
|
-
this.warn(data)
|
|
76
|
-
return this.publish(data, 'WARN')
|
|
77
|
-
},
|
|
78
|
-
|
|
79
|
-
errorAndPublish (data) {
|
|
80
|
-
this.error(data)
|
|
81
|
-
// publish is done automatically by log.error()
|
|
82
|
-
return this
|
|
83
|
-
}
|
|
84
|
-
}
|
|
85
|
-
|
|
86
|
-
module.exports = iastLog
|