dd-trace 5.52.0 → 5.54.0

package/packages/dd-trace/src/appsec/reporter.js

@@ -18,9 +18,23 @@ const zlib = require('zlib')
 const { keepTrace } = require('../priority_sampler')
 const { ASM } = require('../standalone/product')
 
+const REQUEST_HEADER_TAG_PREFIX = 'http.request.headers.'
+const RESPONSE_HEADER_TAG_PREFIX = 'http.response.headers.'
+
+const COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH = 4096
+const COLLECTED_REQUEST_BODY_MAX_DEPTH = 20
+const COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE = 256
+
 // default limiter, configurable with setRateLimit()
 let limiter = new Limiter(100)
 
+const config = {
+  headersExtendedCollectionEnabled: false,
+  maxHeadersCollected: 0,
+  headersRedaction: false,
+  raspBodyCollection: false
+}
+
 const metricsQueue = new Map()
 
 // following header lists are ordered in the same way the spec orders them, it doesn't matter but it's easier to compare
@@ -31,17 +45,6 @@ const contentHeaderList = [
   'content-language'
 ]
 
-const EVENT_HEADERS_MAP = mapHeaderAndTags([
-  ...ipHeaderList,
-  'x-forwarded',
-  'forwarded',
-  'via',
-  ...contentHeaderList,
-  'host',
-  'accept-encoding',
-  'accept-language'
-], 'http.request.headers.')
-
 const identificationHeaders = [
   'x-amzn-trace-id',
   'cloudfront-viewer-ja3-fingerprint',
@@ -53,18 +56,56 @@ const identificationHeaders = [
   'akamai-user-risk'
 ]
 
-// these request headers are always collected - it breaks the expected spec orders
-const REQUEST_HEADERS_MAP = mapHeaderAndTags([
+const eventHeadersList = [
+  ...ipHeaderList,
+  'x-forwarded',
+  'forwarded',
+  'via',
+  ...contentHeaderList,
+  'host',
+  'accept-encoding',
+  'accept-language'
+]
+
+const requestHeadersList = [
   'content-type',
   'user-agent',
   'accept',
   ...identificationHeaders
-], 'http.request.headers.')
+]
+
+// these request headers are always collected - it breaks the expected spec orders
+const REQUEST_HEADERS_MAP = mapHeaderAndTags(requestHeadersList, REQUEST_HEADER_TAG_PREFIX)
+
+const EVENT_HEADERS_MAP = mapHeaderAndTags(eventHeadersList, REQUEST_HEADER_TAG_PREFIX)
+
+const RESPONSE_HEADERS_MAP = mapHeaderAndTags(contentHeaderList, RESPONSE_HEADER_TAG_PREFIX)
+
+const NON_EXTENDED_REQUEST_HEADERS = new Set([...requestHeadersList, ...eventHeadersList])
+const NON_EXTENDED_RESPONSE_HEADERS = new Set(contentHeaderList)
+
+function init (_config) {
+  limiter = new Limiter(_config.rateLimit)
+  config.headersExtendedCollectionEnabled = _config.extendedHeadersCollection.enabled
+  config.maxHeadersCollected = _config.extendedHeadersCollection.maxHeaders
+  config.headersRedaction = _config.extendedHeadersCollection.redaction
+  config.raspBodyCollection = _config.rasp.bodyCollection
+}
+
+function formatHeaderName (name) {
+  return name
+    .trim()
+    .slice(0, 200)
+    .replace(/[^a-zA-Z0-9_\-:/]/g, '_')
+    .toLowerCase()
+}
 
-const RESPONSE_HEADERS_MAP = mapHeaderAndTags(contentHeaderList, 'http.response.headers.')
+function getHeaderTag (tagPrefix, headerName) {
+  return `${tagPrefix}${formatHeaderName(headerName)}`
+}
 
 function mapHeaderAndTags (headerList, tagPrefix) {
-  return new Map(headerList.map(headerName => [headerName, `${tagPrefix}${formatHeaderName(headerName)}`]))
+  return new Map(headerList.map(headerName => [headerName, getHeaderTag(tagPrefix, headerName)]))
 }
 
 function filterHeaders (headers, map) {
@@ -82,12 +123,92 @@ function filterHeaders (headers, map) {
   return result
 }
 
-function formatHeaderName (name) {
-  return name
-    .trim()
-    .slice(0, 200)
-    .replace(/[^a-zA-Z0-9_\-:/]/g, '_')
-    .toLowerCase()
+function filterExtendedHeaders (headers, excludedHeaderNames, tagPrefix, limit = 0) {
+  const result = {}
+
+  if (!headers) return result
+
+  let counter = 0
+  for (const [headerName, headerValue] of Object.entries(headers)) {
+    if (counter >= limit) break
+    if (!excludedHeaderNames.has(headerName)) {
+      result[getHeaderTag(tagPrefix, headerName)] = '' + headerValue
+      counter++
+    }
+  }
+
+  return result
+}
+
+function getCollectedHeaders (req, res, shouldCollectEventHeaders) {
+  // Mandatory
+  const mandatoryCollectedHeaders = filterHeaders(req.headers, REQUEST_HEADERS_MAP)
+
+  // Basic collection
+  if (!shouldCollectEventHeaders) return mandatoryCollectedHeaders
+
+  const responseHeaders = res.getHeaders()
+
+  const requestEventCollectedHeaders = filterHeaders(req.headers, EVENT_HEADERS_MAP)
+  const responseEventCollectedHeaders = filterHeaders(responseHeaders, RESPONSE_HEADERS_MAP)
+
+  if (!config.headersExtendedCollectionEnabled || config.headersRedaction) {
+    // Standard collection
+    return Object.assign(
+      mandatoryCollectedHeaders,
+      requestEventCollectedHeaders,
+      responseEventCollectedHeaders
+    )
+  }
+
+  // Extended collection
+  const requestExtendedHeadersAvailableCount =
+    config.maxHeadersCollected -
+    Object.keys(mandatoryCollectedHeaders).length -
+    Object.keys(requestEventCollectedHeaders).length
+
+  const requestEventExtendedCollectedHeaders =
+    filterExtendedHeaders(
+      req.headers,
+      NON_EXTENDED_REQUEST_HEADERS,
+      REQUEST_HEADER_TAG_PREFIX,
+      requestExtendedHeadersAvailableCount
+    )
+
+  const responseExtendedHeadersAvailableCount =
+    config.maxHeadersCollected -
+    Object.keys(responseEventCollectedHeaders).length
+
+  const responseEventExtendedCollectedHeaders =
+    filterExtendedHeaders(
+      responseHeaders,
+      NON_EXTENDED_RESPONSE_HEADERS,
+      RESPONSE_HEADER_TAG_PREFIX,
+      responseExtendedHeadersAvailableCount
+    )
+
+  const headersTags = Object.assign(
+    mandatoryCollectedHeaders,
+    requestEventCollectedHeaders,
+    requestEventExtendedCollectedHeaders,
+    responseEventCollectedHeaders,
+    responseEventExtendedCollectedHeaders
+  )
+
+  // Check discarded headers
+  const requestHeadersCount = Object.keys(req.headers).length
+  if (requestHeadersCount > config.maxHeadersCollected) {
+    headersTags['_dd.appsec.request.header_collection.discarded'] =
+      requestHeadersCount - config.maxHeadersCollected
+  }
+
+  const responseHeadersCount = Object.keys(responseHeaders).length
+  if (responseHeadersCount > config.maxHeadersCollected) {
+    headersTags['_dd.appsec.response.header_collection.discarded'] =
+      responseHeadersCount - config.maxHeadersCollected
+  }
+
+  return headersTags
 }
 
 function reportWafInit (wafVersion, rulesVersion, diagnosticsRules = {}, success = false) {
@@ -163,17 +284,97 @@ function reportAttack (attackData) {
   const currentJson = currentTags['_dd.appsec.json']
 
   // merge JSON arrays without parsing them
-  if (currentJson) {
-    newTags['_dd.appsec.json'] = currentJson.slice(0, -2) + ',' + attackData.slice(1) + '}'
-  } else {
-    newTags['_dd.appsec.json'] = '{"triggers":' + attackData + '}'
-  }
+  const attackDataStr = JSON.stringify(attackData)
+  newTags['_dd.appsec.json'] = currentJson
+    ? currentJson.slice(0, -2) + ',' + attackDataStr.slice(1) + '}'
+    : '{"triggers":' + attackDataStr + '}'
 
   if (req.socket) {
     newTags['network.client.ip'] = req.socket.remoteAddress
   }
 
   rootSpan.addTags(newTags)
+
+  if (config.raspBodyCollection && isRaspAttack(attackData)) {
+    reportRequestBody(rootSpan, req.body)
+  }
+}
+
+function truncateRequestBody (target, depth = 0) {
+  let wasTruncated = false
+
+  switch (typeof target) {
+    case 'string':
+      if (target.length > COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH) {
+        return { value: target.slice(0, COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH), truncated: true }
+      }
+      return { value: target, truncated: false }
+    case 'object': {
+      if (target === null) {
+        return { value: target, truncated: false }
+      }
+
+      if (depth >= COLLECTED_REQUEST_BODY_MAX_DEPTH) {
+        return { truncated: true }
+      }
+
+      if (typeof target.toJSON === 'function') {
+        try {
+          return truncateRequestBody(target.toJSON(), depth + 1)
+        } catch {
+          return { truncated: false }
+        }
+      }
+
+      if (Array.isArray(target)) {
+        const maxArrayLength = Math.min(target.length, COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE)
+        wasTruncated = target.length > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE
+        const truncatedArray = new Array(maxArrayLength)
+        for (let i = 0; i < maxArrayLength; i++) {
+          const { value, truncated } = truncateRequestBody(target[i], depth + 1)
+          if (truncated) wasTruncated = true
+          truncatedArray[i] = value
+        }
+
+        return { value: truncatedArray, truncated: wasTruncated }
+      }
+
+      const keys = Object.keys(target)
+      const maxKeysLength = Math.min(keys.length, COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE)
+      wasTruncated = keys.length > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE
+
+      const truncatedObject = {}
+      for (let i = 0; i < maxKeysLength; i++) {
+        const key = keys[i]
+        const { value, truncated } = truncateRequestBody(target[key], depth + 1)
+        if (truncated) wasTruncated = true
+        truncatedObject[key] = value
+      }
+      return { value: truncatedObject, truncated: wasTruncated }
+    }
+    default:
+      return { value: target, truncated: false }
+  }
+}
+
+function reportRequestBody (rootSpan, requestBody) {
+  if (!requestBody) return
+
+  if (!rootSpan.meta_struct) {
+    rootSpan.meta_struct = {}
+  }
+
+  if (!rootSpan.meta_struct['http.request.body']) {
+    const { truncated, value } = truncateRequestBody(requestBody)
+    rootSpan.meta_struct['http.request.body'] = value
+    if (truncated) {
+      rootSpan.setTag('_dd.appsec.rasp.request_body_size.exceeded', 'true')
+    }
+  }
+}
+
+function isRaspAttack (events) {
+  return events.some(e => e.rule?.tags?.module === 'rasp')
 }
 
 function isFingerprintDerivative (derivative) {
@@ -252,15 +453,9 @@ function finishRequest (req, res) {
 
   incrementWafRequestsMetric(req)
 
-  // collect some headers even when no attack is detected
-  const mandatoryTags = filterHeaders(req.headers, REQUEST_HEADERS_MAP)
-  rootSpan.addTags(mandatoryTags)
-
   const tags = rootSpan.context()._tags
-  if (!shouldCollectEventHeaders(tags)) return
 
-  const newTags = filterHeaders(res.getHeaders(), RESPONSE_HEADERS_MAP)
-  Object.assign(newTags, filterHeaders(req.headers, EVENT_HEADERS_MAP))
+  const newTags = getCollectedHeaders(req, res, shouldCollectEventHeaders(tags))
 
   if (tags['appsec.event'] === 'true' && typeof req.route?.path === 'string') {
     newTags['http.endpoint'] = req.route.path
@@ -283,13 +478,11 @@ function shouldCollectEventHeaders (tags = {}) {
   return false
 }
 
-function setRateLimit (rateLimit) {
-  limiter = new Limiter(rateLimit)
-}
-
 module.exports = {
   metricsQueue,
+  init,
   filterHeaders,
+  filterExtendedHeaders,
   formatHeaderName,
   reportWafInit,
   reportMetrics,
@@ -298,6 +491,6 @@ module.exports = {
   reportRaspRuleSkipped: updateRaspRuleSkippedMetricTags,
   reportDerivatives,
   finishRequest,
-  setRateLimit,
-  mapHeaderAndTags
+  mapHeaderAndTags,
+  truncateRequestBody
 }

package/packages/dd-trace/src/appsec/rule_manager.js

@@ -185,7 +185,7 @@ class SpyMap extends Map {
 }
 
 function concatArrays (files) {
-  return Array.from(files.values()).flat()
+  return [...files.values()].flat()
 }
 
 /*
@@ -209,7 +209,7 @@ function mergeRulesData (files) {
       }
     }
   }
-  return Array.from(mergedRulesData.values())
+  return [...mergedRulesData.values()]
 }
 
 function rulesReducer (existingEntries, rulesDataEntry) {

package/packages/dd-trace/src/appsec/sdk/user_blocking.js

@@ -9,8 +9,8 @@ const { setUserTags } = require('./set_user')
 const log = require('../../log')
 
 function isUserBlocked (user) {
-  const actions = waf.run({ persistent: { [USER_ID]: user.id } })
-  return !!getBlockingAction(actions)
+  const results = waf.run({ persistent: { [USER_ID]: user.id } })
+  return !!getBlockingAction(results?.actions)
 }
 
 function checkUserAndSetUser (tracer, user) {

package/packages/dd-trace/src/appsec/stack_trace.js

@@ -1,8 +1,6 @@
 'use strict'
 
-const { calculateDDBasePath } = require('../util')
-
-const ddBasePath = calculateDDBasePath(__dirname)
+const { ddBasePath } = require('../util')
 
 const LIBRARY_FRAMES_BUFFER = 20
 
@@ -23,7 +21,7 @@ function getCallSiteList (maxDepth = 100) {
     Error.prepareStackTrace = function (_, callsites) {
       callsiteList = callsites
     }
-    const e = new Error()
+    const e = new Error('message')
     e.stack
   } finally {
     Error.prepareStackTrace = previousPrepareStackTrace

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -41,8 +41,7 @@ function newStore () {
       wafErrorCode: null,
       raspErrorCode: null,
       wafVersion: null,
-      rulesVersion: null,
-      ruleTriggered: null
+      rulesVersion: null
     }
   }
 }

package/packages/dd-trace/src/appsec/telemetry/rasp.js

@@ -21,14 +21,12 @@ function addRaspRequestMetrics (store, { duration, durationExt, wafTimeout, erro
   }
 
   if (errorCode) {
-    if (store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode) {
-      store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode = Math.max(
+    store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode = store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode
+      ? Math.max(
         errorCode,
         store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode
       )
-    } else {
-      store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode = errorCode
-    }
+      : errorCode
   }
 }
 
@@ -49,10 +47,6 @@ function trackRaspMetrics (store, metrics, raspRule) {
     telemetryMetrics.rulesVersion = metrics.rulesVersion
   }
 
-  if (metrics.ruleTriggered) {
-    telemetryMetrics.ruleTriggered = true
-  }
-
   appsecMetrics.count('rasp.rule.eval', tags).inc(1)
 
   if (metrics.errorCode) {
@@ -68,7 +62,6 @@ function trackRaspMetrics (store, metrics, raspRule) {
 
 function trackRaspRuleMatch (store, raspRule, blockTriggered, blocked) {
   const telemetryMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
-  if (!telemetryMetrics.ruleTriggered) return
 
   const tags = {
     waf_version: telemetryMetrics.wafVersion,
@@ -82,10 +75,6 @@ function trackRaspRuleMatch (store, raspRule, blockTriggered, blocked) {
   }
 
   appsecMetrics.count('rasp.rule.match', tags).inc(1)
-
-  // this is needed to not count it twice for the same match
-  // but it also means it can only be called once per waf call even if there are multiple rasp match
-  telemetryMetrics.ruleTriggered = null
 }
 
 function trackRaspRuleSkipped (raspRule, reason) {

package/packages/dd-trace/src/appsec/telemetry/waf.js

@@ -22,14 +22,12 @@ function addWafRequestMetrics (store, { duration, durationExt, wafTimeout, error
   }
 
   if (errorCode) {
-    if (store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode) {
-      store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode = Math.max(
+    store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode = store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode
+      ? Math.max(
         errorCode,
         store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode
       )
-    } else {
-      store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode = errorCode
-    }
+      : errorCode
   }
 }
 

package/packages/dd-trace/src/appsec/user_tracking.js

@@ -40,12 +40,10 @@ function setCollectionMode (mode, overwrite = true) {
 }
 
 function obfuscateIfNeeded (str) {
-  if (collectionMode === 'anonymization') {
+  return collectionMode === 'anonymization'
     // get first 16 bytes of sha256 hash in lowercase hex
-    return 'anon_' + crypto.createHash('sha256').update(str).digest().toString('hex', 0, 16).toLowerCase()
-  } else {
-    return str
-  }
+    ? 'anon_' + crypto.createHash('sha256').update(str).digest().toString('hex', 0, 16).toLowerCase()
+    : str
 }
 
 // TODO: should we find other ways to get the user ID ?

package/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js

@@ -19,7 +19,7 @@ class WAFContextWrapper {
     this.rulesVersion = rulesVersion
     this.knownAddresses = knownAddresses
     this.addressesToSkip = new Set()
-    this.cachedUserIdActions = new Map()
+    this.cachedUserIdResults = new Map()
   }
 
   run ({ persistent, ephemeral }, raspRule) {
@@ -36,9 +36,9 @@ class WAFContextWrapper {
     // TODO: make this universal
     const userId = persistent?.[addresses.USER_ID] || ephemeral?.[addresses.USER_ID]
     if (userId) {
-      const cachedAction = this.cachedUserIdActions.get(userId)
-      if (cachedAction) {
-        return cachedAction
+      const cachedResults = this.cachedUserIdResults.get(userId)
+      if (cachedResults) {
+        return cachedResults
       }
     }
 
@@ -102,7 +102,7 @@ class WAFContextWrapper {
 
       const end = process.hrtime.bigint()
 
-      metrics.durationExt = parseInt(end - start) / 1e3
+      metrics.durationExt = Number.parseInt(end - start) / 1e3
 
       if (typeof result.errorCode === 'number' && result.errorCode < 0) {
         const error = new Error('WAF code error')
@@ -137,12 +137,12 @@ class WAFContextWrapper {
       metrics.wafTimeout = result.timeout
 
       if (ruleTriggered) {
-        Reporter.reportAttack(JSON.stringify(result.events))
+        Reporter.reportAttack(result.events)
       }
 
       Reporter.reportDerivatives(result.derivatives)
 
-      return result.actions
+      return result
     } catch (err) {
       log.error('[ASM] Error while running the AppSec WAF', err)
 
@@ -168,7 +168,7 @@ class WAFContextWrapper {
           const parameter = match.parameters[k]
 
           if (parameter?.address === addresses.USER_ID) {
-            this.cachedUserIdActions.set(userId, result.actions)
+            this.cachedUserIdResults.set(userId, result)
             return
           }
         }

package/packages/dd-trace/src/azure_metadata.js

@@ -1,6 +1,5 @@
 'use strict'
 
-// eslint-disable-next-line @stylistic/js/max-len
 // Modeled after https://github.com/DataDog/libdatadog/blob/f3994857a59bb5679a65967138c5a3aec418a65f/ddcommon/src/azure_app_services.rs
 
 const os = require('os')
@@ -13,7 +12,6 @@ function extractSubscriptionID (ownerName) {
       return subId
     }
   }
-  return undefined
 }
 
 function extractResourceGroup (ownerName) {
@@ -22,7 +20,7 @@ function extractResourceGroup (ownerName) {
 
 function buildResourceID (subscriptionID, siteName, resourceGroup) {
   if (subscriptionID === undefined || siteName === undefined || resourceGroup === undefined) {
-    return undefined
+    return
   }
   return `/subscriptions/${subscriptionID}/resourcegroups/${resourceGroup}/providers/microsoft.web/sites/${siteName}`
     .toLowerCase()
@@ -79,18 +77,15 @@ function buildMetadata () {
 function getAzureAppMetadata () {
   // DD_AZURE_APP_SERVICES is an environment variable introduced by the .NET APM team and is set automatically for
   // anyone using the Datadog APM Extensions (.NET, Java, or Node) for Windows Azure App Services
-  // eslint-disable-next-line @stylistic/js/max-len
   // See: https://github.com/DataDog/datadog-aas-extension/blob/01f94b5c28b7fa7a9ab264ca28bd4e03be603900/node/src/applicationHost.xdt#L20-L21
-  return process.env.DD_AZURE_APP_SERVICES !== undefined ? buildMetadata() : undefined
+  return process.env.DD_AZURE_APP_SERVICES === undefined ? undefined : buildMetadata()
 }
 
 function getAzureFunctionMetadata () {
   return getIsAzureFunction() ? buildMetadata() : undefined
 }
 
-// eslint-disable-next-line @stylistic/js/max-len
 // Modeled after https://github.com/DataDog/libdatadog/blob/92272e90a7919f07178f3246ef8f82295513cfed/profiling/src/exporter/mod.rs#L187
-// eslint-disable-next-line @stylistic/js/max-len
 // and https://github.com/DataDog/libdatadog/blob/f3994857a59bb5679a65967138c5a3aec418a65f/trace-utils/src/trace_utils.rs#L533
 function getAzureTagsFromMetadata (metadata) {
   if (metadata === undefined) {

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/index.js

@@ -144,7 +144,7 @@ class TestVisDynamicInstrumentation {
 
 let dynamicInstrumentation
 
-module.exports = (config) => {
+module.exports = function createAndGetTestVisDynamicInstrumentation (config) {
   if (dynamicInstrumentation) {
     return dynamicInstrumentation
   }

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/worker/index.js

@@ -75,12 +75,12 @@ breakpointSetChannel.on('message', async (probe) => {
 async function removeBreakpoint (probeId) {
   if (!sessionStarted) {
     // We should not get in this state, but abort if we do, so the code doesn't fail unexpected
-    throw Error(`Cannot remove probe ${probeId}: Debugger not started`)
+    throw new Error(`Cannot remove probe ${probeId}: Debugger not started`)
   }
 
   const breakpointId = probeIdToBreakpointId.get(probeId)
   if (!breakpointId) {
-    throw Error(`Unknown probe id: ${probeId}`)
+    throw new Error(`Unknown probe id: ${probeId}`)
   }
   await session.post('Debugger.removeBreakpoint', { breakpointId })
   probeIdToBreakpointId.delete(probeId)

package/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js

@@ -36,7 +36,7 @@ function getKnownTests ({
     headers: {
       'Content-Type': 'application/json'
     },
-    timeout: 20000,
+    timeout: 20_000,
     url
   }
 

package/packages/dd-trace/src/ci-visibility/exporters/agent-proxy/index.js

@@ -16,17 +16,17 @@ function getLatestEvpProxyVersion (err, agentInfo) {
   return agentInfo.endpoints.reduce((acc, endpoint) => {
     if (endpoint.includes(AGENT_EVP_PROXY_PATH_PREFIX)) {
       const version = Number(endpoint.replace(AGENT_EVP_PROXY_PATH_REGEX, '$1'))
-      if (isNaN(version)) {
+      if (Number.isNaN(version)) {
         return acc
       }
-      return version > acc ? version : acc
+      return Math.max(version, acc)
     }
     return acc
   }, 0)
 }
 
 function getCanForwardDebuggerLogs (err, agentInfo) {
-  return !err && agentInfo.endpoints.some(endpoint => endpoint === AGENT_DEBUGGER_INPUT)
+  return !err && agentInfo.endpoints.includes(AGENT_DEBUGGER_INPUT)
 }
 
 class AgentProxyCiVisibilityExporter extends CiVisibilityExporter {

package/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js

@@ -31,7 +31,7 @@ class Writer extends BaseWriter {
         'dd-api-key': process.env.DATADOG_API_KEY || process.env.DD_API_KEY,
         ...form.getHeaders()
       },
-      timeout: 15000,
+      timeout: 15_000,
       url: this._url
     }
 

package/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js

@@ -27,7 +27,7 @@ class DynamicInstrumentationLogsWriter extends BaseWriter {
         'Content-Type': 'application/json'
       },
       // TODO: what's a good value for timeout for the logs intake?
-      timeout: this.timeout || 15000,
+      timeout: this.timeout || 15_000,
       url: this._url
     }
 

package/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js

@@ -32,7 +32,7 @@ class Writer extends BaseWriter {
         'dd-api-key': process.env.DATADOG_API_KEY || process.env.DD_API_KEY,
         'Content-Type': 'application/msgpack'
       },
-      timeout: 15000,
+      timeout: 15_000,
       url: this._url
     }