dd-trace 5.53.0 → 5.55.0

package/packages/dd-trace/src/appsec/reporter.js

@@ -18,9 +18,23 @@ const zlib = require('zlib')
 const { keepTrace } = require('../priority_sampler')
 const { ASM } = require('../standalone/product')
 
+const REQUEST_HEADER_TAG_PREFIX = 'http.request.headers.'
+const RESPONSE_HEADER_TAG_PREFIX = 'http.response.headers.'
+
+const COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH = 4096
+const COLLECTED_REQUEST_BODY_MAX_DEPTH = 20
+const COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE = 256
+
 // default limiter, configurable with setRateLimit()
 let limiter = new Limiter(100)
 
+const config = {
+  headersExtendedCollectionEnabled: false,
+  maxHeadersCollected: 0,
+  headersRedaction: false,
+  raspBodyCollection: false
+}
+
 const metricsQueue = new Map()
 
 // following header lists are ordered in the same way the spec orders them, it doesn't matter but it's easier to compare
@@ -31,17 +45,6 @@ const contentHeaderList = [
   'content-language'
 ]
 
-const EVENT_HEADERS_MAP = mapHeaderAndTags([
-  ...ipHeaderList,
-  'x-forwarded',
-  'forwarded',
-  'via',
-  ...contentHeaderList,
-  'host',
-  'accept-encoding',
-  'accept-language'
-], 'http.request.headers.')
-
 const identificationHeaders = [
   'x-amzn-trace-id',
   'cloudfront-viewer-ja3-fingerprint',
@@ -53,18 +56,56 @@ const identificationHeaders = [
   'akamai-user-risk'
 ]
 
-// these request headers are always collected - it breaks the expected spec orders
-const REQUEST_HEADERS_MAP = mapHeaderAndTags([
+const eventHeadersList = [
+  ...ipHeaderList,
+  'x-forwarded',
+  'forwarded',
+  'via',
+  ...contentHeaderList,
+  'host',
+  'accept-encoding',
+  'accept-language'
+]
+
+const requestHeadersList = [
   'content-type',
   'user-agent',
   'accept',
   ...identificationHeaders
-], 'http.request.headers.')
+]
+
+// these request headers are always collected - it breaks the expected spec orders
+const REQUEST_HEADERS_MAP = mapHeaderAndTags(requestHeadersList, REQUEST_HEADER_TAG_PREFIX)
+
+const EVENT_HEADERS_MAP = mapHeaderAndTags(eventHeadersList, REQUEST_HEADER_TAG_PREFIX)
 
-const RESPONSE_HEADERS_MAP = mapHeaderAndTags(contentHeaderList, 'http.response.headers.')
+const RESPONSE_HEADERS_MAP = mapHeaderAndTags(contentHeaderList, RESPONSE_HEADER_TAG_PREFIX)
+
+const NON_EXTENDED_REQUEST_HEADERS = new Set([...requestHeadersList, ...eventHeadersList])
+const NON_EXTENDED_RESPONSE_HEADERS = new Set(contentHeaderList)
+
+function init (_config) {
+  limiter = new Limiter(_config.rateLimit)
+  config.headersExtendedCollectionEnabled = _config.extendedHeadersCollection.enabled
+  config.maxHeadersCollected = _config.extendedHeadersCollection.maxHeaders
+  config.headersRedaction = _config.extendedHeadersCollection.redaction
+  config.raspBodyCollection = _config.rasp.bodyCollection
+}
+
+function formatHeaderName (name) {
+  return name
+    .trim()
+    .slice(0, 200)
+    .replaceAll(/[^a-zA-Z0-9_\-:/]/g, '_')
+    .toLowerCase()
+}
+
+function getHeaderTag (tagPrefix, headerName) {
+  return `${tagPrefix}${formatHeaderName(headerName)}`
+}
 
 function mapHeaderAndTags (headerList, tagPrefix) {
-  return new Map(headerList.map(headerName => [headerName, `${tagPrefix}${formatHeaderName(headerName)}`]))
+  return new Map(headerList.map(headerName => [headerName, getHeaderTag(tagPrefix, headerName)]))
 }
 
 function filterHeaders (headers, map) {
@@ -75,19 +116,99 @@ function filterHeaders (headers, map) {
   for (const [headerName, tagName] of map) {
     const headerValue = headers[headerName]
     if (headerValue) {
-      result[tagName] = '' + headerValue
+      result[tagName] = String(headerValue)
     }
   }
 
   return result
 }
 
-function formatHeaderName (name) {
-  return name
-    .trim()
-    .slice(0, 200)
-    .replace(/[^a-zA-Z0-9_\-:/]/g, '_')
-    .toLowerCase()
+function filterExtendedHeaders (headers, excludedHeaderNames, tagPrefix, limit = 0) {
+  const result = {}
+
+  if (!headers) return result
+
+  let counter = 0
+  for (const [headerName, headerValue] of Object.entries(headers)) {
+    if (counter >= limit) break
+    if (!excludedHeaderNames.has(headerName)) {
+      result[getHeaderTag(tagPrefix, headerName)] = String(headerValue)
+      counter++
+    }
+  }
+
+  return result
+}
+
+function getCollectedHeaders (req, res, shouldCollectEventHeaders) {
+  // Mandatory
+  const mandatoryCollectedHeaders = filterHeaders(req.headers, REQUEST_HEADERS_MAP)
+
+  // Basic collection
+  if (!shouldCollectEventHeaders) return mandatoryCollectedHeaders
+
+  const responseHeaders = res.getHeaders()
+
+  const requestEventCollectedHeaders = filterHeaders(req.headers, EVENT_HEADERS_MAP)
+  const responseEventCollectedHeaders = filterHeaders(responseHeaders, RESPONSE_HEADERS_MAP)
+
+  if (!config.headersExtendedCollectionEnabled || config.headersRedaction) {
+    // Standard collection
+    return Object.assign(
+      mandatoryCollectedHeaders,
+      requestEventCollectedHeaders,
+      responseEventCollectedHeaders
+    )
+  }
+
+  // Extended collection
+  const requestExtendedHeadersAvailableCount =
+    config.maxHeadersCollected -
+    Object.keys(mandatoryCollectedHeaders).length -
+    Object.keys(requestEventCollectedHeaders).length
+
+  const requestEventExtendedCollectedHeaders =
+    filterExtendedHeaders(
+      req.headers,
+      NON_EXTENDED_REQUEST_HEADERS,
+      REQUEST_HEADER_TAG_PREFIX,
+      requestExtendedHeadersAvailableCount
+    )
+
+  const responseExtendedHeadersAvailableCount =
+    config.maxHeadersCollected -
+    Object.keys(responseEventCollectedHeaders).length
+
+  const responseEventExtendedCollectedHeaders =
+    filterExtendedHeaders(
+      responseHeaders,
+      NON_EXTENDED_RESPONSE_HEADERS,
+      RESPONSE_HEADER_TAG_PREFIX,
+      responseExtendedHeadersAvailableCount
+    )
+
+  const headersTags = Object.assign(
+    mandatoryCollectedHeaders,
+    requestEventCollectedHeaders,
+    requestEventExtendedCollectedHeaders,
+    responseEventCollectedHeaders,
+    responseEventExtendedCollectedHeaders
+  )
+
+  // Check discarded headers
+  const requestHeadersCount = Object.keys(req.headers).length
+  if (requestHeadersCount > config.maxHeadersCollected) {
+    headersTags['_dd.appsec.request.header_collection.discarded'] =
+      requestHeadersCount - config.maxHeadersCollected
+  }
+
+  const responseHeadersCount = Object.keys(responseHeaders).length
+  if (responseHeadersCount > config.maxHeadersCollected) {
+    headersTags['_dd.appsec.response.header_collection.discarded'] =
+      responseHeadersCount - config.maxHeadersCollected
+  }
+
+  return headersTags
 }
 
 function reportWafInit (wafVersion, rulesVersion, diagnosticsRules = {}, success = false) {
@@ -163,17 +284,95 @@ function reportAttack (attackData) {
   const currentJson = currentTags['_dd.appsec.json']
 
   // merge JSON arrays without parsing them
-  if (currentJson) {
-    newTags['_dd.appsec.json'] = currentJson.slice(0, -2) + ',' + attackData.slice(1) + '}'
-  } else {
-    newTags['_dd.appsec.json'] = '{"triggers":' + attackData + '}'
-  }
+  const attackDataStr = JSON.stringify(attackData)
+  newTags['_dd.appsec.json'] = currentJson
+    ? currentJson.slice(0, -2) + ',' + attackDataStr.slice(1) + '}'
+    : '{"triggers":' + attackDataStr + '}'
 
   if (req.socket) {
     newTags['network.client.ip'] = req.socket.remoteAddress
   }
 
   rootSpan.addTags(newTags)
+
+  if (config.raspBodyCollection && isRaspAttack(attackData)) {
+    reportRequestBody(rootSpan, req.body)
+  }
+}
+
+function truncateRequestBody (target, depth = 0) {
+  switch (typeof target) {
+    case 'string':
+      if (target.length > COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH) {
+        return { value: target.slice(0, COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH), truncated: true }
+      }
+      return { value: target, truncated: false }
+    case 'object': {
+      if (target === null) {
+        return { value: target, truncated: false }
+      }
+
+      if (depth >= COLLECTED_REQUEST_BODY_MAX_DEPTH) {
+        return { truncated: true }
+      }
+
+      if (typeof target.toJSON === 'function') {
+        try {
+          return truncateRequestBody(target.toJSON(), depth + 1)
+        } catch {
+          return { truncated: false }
+        }
+      }
+
+      if (Array.isArray(target)) {
+        const maxArrayLength = Math.min(target.length, COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE)
+        let wasTruncated = target.length > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE
+        const truncatedArray = new Array(maxArrayLength)
+        for (let i = 0; i < maxArrayLength; i++) {
+          const { value, truncated } = truncateRequestBody(target[i], depth + 1)
+          if (truncated) wasTruncated = true
+          truncatedArray[i] = value
+        }
+
+        return { value: truncatedArray, truncated: wasTruncated }
+      }
+
+      const keys = Object.keys(target)
+      const maxKeysLength = Math.min(keys.length, COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE)
+      let wasTruncated = keys.length > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE
+
+      const truncatedObject = {}
+      for (let i = 0; i < maxKeysLength; i++) {
+        const key = keys[i]
+        const { value, truncated } = truncateRequestBody(target[key], depth + 1)
+        if (truncated) wasTruncated = true
+        truncatedObject[key] = value
+      }
+      return { value: truncatedObject, truncated: wasTruncated }
+    }
+    default:
+      return { value: target, truncated: false }
+  }
+}
+
+function reportRequestBody (rootSpan, requestBody) {
+  if (!requestBody) return
+
+  if (!rootSpan.meta_struct) {
+    rootSpan.meta_struct = {}
+  }
+
+  if (!rootSpan.meta_struct['http.request.body']) {
+    const { truncated, value } = truncateRequestBody(requestBody)
+    rootSpan.meta_struct['http.request.body'] = value
+    if (truncated) {
+      rootSpan.setTag('_dd.appsec.rasp.request_body_size.exceeded', 'true')
+    }
+  }
+}
+
+function isRaspAttack (events) {
+  return events.some(e => e.rule?.tags?.module === 'rasp')
 }
 
 function isFingerprintDerivative (derivative) {
@@ -252,15 +451,9 @@ function finishRequest (req, res) {
 
   incrementWafRequestsMetric(req)
 
-  // collect some headers even when no attack is detected
-  const mandatoryTags = filterHeaders(req.headers, REQUEST_HEADERS_MAP)
-  rootSpan.addTags(mandatoryTags)
-
   const tags = rootSpan.context()._tags
-  if (!shouldCollectEventHeaders(tags)) return
 
-  const newTags = filterHeaders(res.getHeaders(), RESPONSE_HEADERS_MAP)
-  Object.assign(newTags, filterHeaders(req.headers, EVENT_HEADERS_MAP))
+  const newTags = getCollectedHeaders(req, res, shouldCollectEventHeaders(tags))
 
   if (tags['appsec.event'] === 'true' && typeof req.route?.path === 'string') {
     newTags['http.endpoint'] = req.route.path
@@ -283,13 +476,11 @@ function shouldCollectEventHeaders (tags = {}) {
   return false
 }
 
-function setRateLimit (rateLimit) {
-  limiter = new Limiter(rateLimit)
-}
-
 module.exports = {
   metricsQueue,
+  init,
   filterHeaders,
+  filterExtendedHeaders,
   formatHeaderName,
   reportWafInit,
   reportMetrics,
@@ -298,6 +489,6 @@ module.exports = {
   reportRaspRuleSkipped: updateRaspRuleSkippedMetricTags,
   reportDerivatives,
   finishRequest,
-  setRateLimit,
-  mapHeaderAndTags
+  mapHeaderAndTags,
+  truncateRequestBody
 }

package/packages/dd-trace/src/appsec/rule_manager.js

@@ -185,7 +185,7 @@ class SpyMap extends Map {
 }
 
 function concatArrays (files) {
-  return Array.from(files.values()).flat()
+  return [...files.values()].flat()
 }
 
 /*
@@ -209,7 +209,7 @@ function mergeRulesData (files) {
       }
     }
   }
-  return Array.from(mergedRulesData.values())
+  return [...mergedRulesData.values()]
 }
 
 function rulesReducer (existingEntries, rulesDataEntry) {

package/packages/dd-trace/src/appsec/sdk/set_user.js

@@ -7,7 +7,7 @@ const addresses = require('../addresses')
 
 function setUserTags (user, rootSpan) {
   for (const k of Object.keys(user)) {
-    rootSpan.setTag(`usr.${k}`, '' + user[k])
+    rootSpan.setTag(`usr.${k}`, String(user[k]))
   }
 
   rootSpan.setTag('_dd.appsec.user.collection_mode', 'sdk')
@@ -28,7 +28,7 @@ function setUser (tracer, user) {
   setUserTags(user, rootSpan)
 
   const persistent = {
-    [addresses.USER_ID]: '' + user.id
+    [addresses.USER_ID]: String(user.id)
   }
 
   if (user.session_id && typeof user.session_id === 'string') {

package/packages/dd-trace/src/appsec/sdk/track_event.js

@@ -196,7 +196,7 @@ function trackEvent (eventName, fields, sdkMethodName, rootSpan) {
     }
 
     for (const metadataKey of Object.keys(flatFields)) {
-      tags[`appsec.events.${eventName}.${metadataKey}`] = '' + flatFields[metadataKey]
+      tags[`appsec.events.${eventName}.${metadataKey}`] = String(flatFields[metadataKey])
     }
   }
 
@@ -211,11 +211,11 @@ function runWaf (eventName, user) {
   }
 
   if (user?.id) {
-    persistent[addresses.USER_ID] = '' + user.id
+    persistent[addresses.USER_ID] = String(user.id)
   }
 
   if (user?.login) {
-    persistent[addresses.USER_LOGIN] = '' + user.login
+    persistent[addresses.USER_LOGIN] = String(user.login)
   }
 
   waf.run({ persistent })

package/packages/dd-trace/src/appsec/stack_trace.js

@@ -1,8 +1,6 @@
 'use strict'
 
-const { calculateDDBasePath } = require('../util')
-
-const ddBasePath = calculateDDBasePath(__dirname)
+const { ddBasePath } = require('../util')
 
 const LIBRARY_FRAMES_BUFFER = 20
 
@@ -23,7 +21,7 @@ function getCallSiteList (maxDepth = 100) {
     Error.prepareStackTrace = function (_, callsites) {
       callsiteList = callsites
     }
-    const e = new Error()
+    const e = new Error('message')
     e.stack
   } finally {
     Error.prepareStackTrace = previousPrepareStackTrace

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -15,17 +15,47 @@ const {
   incrementWafUpdates,
   incrementWafRequests
 } = require('./waf')
+const telemetryMetrics = require('../../telemetry/metrics')
 
 const metricsStoreMap = new WeakMap()
 
+const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+
 let enabled = false
+let interval
+const SUPPORTED_ORIGINS = new Set(['env_var', 'code', 'remote_config', 'unknown'])
 
-function enable (telemetryConfig) {
+function enable (config) {
+  const telemetryConfig = config.telemetry
   enabled = telemetryConfig?.enabled && telemetryConfig.metrics
+
+  if (enabled) {
+    let origin = 'remote_config'
+
+    if (config.appsec.enabled) {
+      origin = config.getOrigin('appsec.enabled')
+
+      if (!SUPPORTED_ORIGINS.has(origin)) {
+        origin = 'unknown'
+      }
+    }
+
+    const gauge = appsecMetrics.gauge('enabled', { origin })
+    gauge.track()
+
+    interval = setInterval(() => {
+      gauge.track()
+    }, telemetryConfig.heartbeatInterval)
+    interval.unref?.()
+  }
 }
 
 function disable () {
   enabled = false
+  if (interval) {
+    clearInterval(interval)
+    interval = undefined
+  }
 }
 
 function newStore () {

package/packages/dd-trace/src/appsec/telemetry/rasp.js

@@ -21,14 +21,12 @@ function addRaspRequestMetrics (store, { duration, durationExt, wafTimeout, erro
   }
 
   if (errorCode) {
-    if (store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode) {
-      store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode = Math.max(
+    store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode = store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode
+      ? Math.max(
         errorCode,
         store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode
       )
-    } else {
-      store[DD_TELEMETRY_REQUEST_METRICS].raspErrorCode = errorCode
-    }
+      : errorCode
   }
 }
 

package/packages/dd-trace/src/appsec/telemetry/waf.js

@@ -22,14 +22,12 @@ function addWafRequestMetrics (store, { duration, durationExt, wafTimeout, error
   }
 
   if (errorCode) {
-    if (store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode) {
-      store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode = Math.max(
+    store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode = store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode
+      ? Math.max(
         errorCode,
         store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode
       )
-    } else {
-      store[DD_TELEMETRY_REQUEST_METRICS].wafErrorCode = errorCode
-    }
+      : errorCode
   }
 }
 

package/packages/dd-trace/src/appsec/user_tracking.js

@@ -40,12 +40,10 @@ function setCollectionMode (mode, overwrite = true) {
 }
 
 function obfuscateIfNeeded (str) {
-  if (collectionMode === 'anonymization') {
+  return collectionMode === 'anonymization'
     // get first 16 bytes of sha256 hash in lowercase hex
-    return 'anon_' + crypto.createHash('sha256').update(str).digest().toString('hex', 0, 16).toLowerCase()
-  } else {
-    return str
-  }
+    ? 'anon_' + crypto.createHash('sha256').update(str).digest().toString('hex', 0, 16).toLowerCase()
+    : str
 }
 
 // TODO: should we find other ways to get the user ID ?

package/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js

@@ -49,8 +49,10 @@ class WAFContextWrapper {
     if (persistent !== null && typeof persistent === 'object') {
       const persistentInputs = {}
 
+      let hasPersistentInputs = false
       for (const key of Object.keys(persistent)) {
         if (!this.addressesToSkip.has(key) && this.knownAddresses.has(key)) {
+          hasPersistentInputs = true
           persistentInputs[key] = persistent[key]
           if (preventDuplicateAddresses.has(key)) {
             newAddressesToSkip.add(key)
@@ -58,7 +60,7 @@ class WAFContextWrapper {
         }
       }
 
-      if (Object.keys(persistentInputs).length) {
+      if (hasPersistentInputs) {
         payload.persistent = persistentInputs
         payloadHasData = true
       }
@@ -67,13 +69,15 @@ class WAFContextWrapper {
     if (ephemeral !== null && typeof ephemeral === 'object') {
       const ephemeralInputs = {}
 
+      let hasEphemeral = false
       for (const key of Object.keys(ephemeral)) {
         if (this.knownAddresses.has(key)) {
+          hasEphemeral = true
           ephemeralInputs[key] = ephemeral[key]
         }
       }
 
-      if (Object.keys(ephemeralInputs).length) {
+      if (hasEphemeral) {
         payload.ephemeral = ephemeralInputs
         payloadHasData = true
       }
@@ -102,7 +106,7 @@ class WAFContextWrapper {
 
       const end = process.hrtime.bigint()
 
-      metrics.durationExt = parseInt(end - start) / 1e3
+      metrics.durationExt = Number.parseInt(end - start) / 1e3
 
       if (typeof result.errorCode === 'number' && result.errorCode < 0) {
         const error = new Error('WAF code error')
@@ -137,7 +141,7 @@ class WAFContextWrapper {
       metrics.wafTimeout = result.timeout
 
       if (ruleTriggered) {
-        Reporter.reportAttack(JSON.stringify(result.events))
+        Reporter.reportAttack(result.events)
       }
 
       Reporter.reportDerivatives(result.derivatives)

package/packages/dd-trace/src/azure_metadata.js

@@ -1,10 +1,10 @@
 'use strict'
 
-// eslint-disable-next-line @stylistic/js/max-len
 // Modeled after https://github.com/DataDog/libdatadog/blob/f3994857a59bb5679a65967138c5a3aec418a65f/ddcommon/src/azure_app_services.rs
 
 const os = require('os')
 const { getIsAzureFunction } = require('./serverless')
+const { getEnvironmentVariable, getEnvironmentVariables } = require('../../dd-trace/src/config-helper')
 
 function extractSubscriptionID (ownerName) {
   if (ownerName !== undefined) {
@@ -13,7 +13,6 @@ function extractSubscriptionID (ownerName) {
       return subId
     }
   }
-  return undefined
 }
 
 function extractResourceGroup (ownerName) {
@@ -22,7 +21,7 @@ function extractResourceGroup (ownerName) {
 
 function buildResourceID (subscriptionID, siteName, resourceGroup) {
   if (subscriptionID === undefined || siteName === undefined || resourceGroup === undefined) {
-    return undefined
+    return
   }
   return `/subscriptions/${subscriptionID}/resourcegroups/${resourceGroup}/providers/microsoft.web/sites/${siteName}`
     .toLowerCase()
@@ -47,7 +46,7 @@ function buildMetadata () {
     WEBSITE_OS,
     WEBSITE_RESOURCE_GROUP,
     WEBSITE_SITE_NAME
-  } = process.env
+  } = getEnvironmentVariables()
 
   const subscriptionID = extractSubscriptionID(WEBSITE_OWNER_NAME)
 
@@ -79,18 +78,19 @@ function buildMetadata () {
 function getAzureAppMetadata () {
   // DD_AZURE_APP_SERVICES is an environment variable introduced by the .NET APM team and is set automatically for
   // anyone using the Datadog APM Extensions (.NET, Java, or Node) for Windows Azure App Services
-  // eslint-disable-next-line @stylistic/js/max-len
   // See: https://github.com/DataDog/datadog-aas-extension/blob/01f94b5c28b7fa7a9ab264ca28bd4e03be603900/node/src/applicationHost.xdt#L20-L21
-  return process.env.DD_AZURE_APP_SERVICES !== undefined ? buildMetadata() : undefined
+  if (getEnvironmentVariable('DD_AZURE_APP_SERVICES') !== undefined) {
+    return buildMetadata()
+  }
 }
 
 function getAzureFunctionMetadata () {
-  return getIsAzureFunction() ? buildMetadata() : undefined
+  if (getIsAzureFunction()) {
+    return buildMetadata()
+  }
 }
 
-// eslint-disable-next-line @stylistic/js/max-len
 // Modeled after https://github.com/DataDog/libdatadog/blob/92272e90a7919f07178f3246ef8f82295513cfed/profiling/src/exporter/mod.rs#L187
-// eslint-disable-next-line @stylistic/js/max-len
 // and https://github.com/DataDog/libdatadog/blob/f3994857a59bb5679a65967138c5a3aec418a65f/trace-utils/src/trace_utils.rs#L533
 function getAzureTagsFromMetadata (metadata) {
   if (metadata === undefined) {

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/index.js

@@ -4,6 +4,7 @@ const { join } = require('path')
 const { Worker, threadId: parentThreadId } = require('worker_threads')
 const { randomUUID } = require('crypto')
 const log = require('../../log')
+const { getEnvironmentVariables } = require('../../config-helper')
 
 const probeIdToResolveBreakpointSet = new Map()
 const probeIdToResolveBreakpointRemove = new Map()
@@ -72,13 +73,13 @@ class TestVisDynamicInstrumentation {
         // for PnP support, hence why we deviate from the DI pattern here.
         // To avoid infinite initialization loops, we're disabling DI and tracing in the worker.
         env: {
-          ...process.env,
-          DD_CIVISIBILITY_ENABLED: 0,
-          DD_TRACE_ENABLED: 0,
-          DD_TEST_FAILED_TEST_REPLAY_ENABLED: 0,
-          DD_CIVISIBILITY_MANUAL_API_ENABLED: 0,
-          DD_TRACING_ENABLED: 0,
-          DD_TRACE_TELEMETRY_ENABLED: 0
+          ...getEnvironmentVariables(),
+          DD_CIVISIBILITY_ENABLED: 'false',
+          DD_TRACE_ENABLED: 'false',
+          DD_TEST_FAILED_TEST_REPLAY_ENABLED: 'false',
+          DD_CIVISIBILITY_MANUAL_API_ENABLED: 'false',
+          DD_TRACING_ENABLED: 'false',
+          DD_INSTRUMENTATION_TELEMETRY_ENABLED: 'false'
         },
         workerData: {
           config: this._config.serialize(),
@@ -144,7 +145,7 @@ class TestVisDynamicInstrumentation {
 
 let dynamicInstrumentation
 
-module.exports = (config) => {
+module.exports = function createAndGetTestVisDynamicInstrumentation (config) {
   if (dynamicInstrumentation) {
     return dynamicInstrumentation
   }