dd-trace 5.54.0 → 5.55.0

package/packages/dd-trace/src/telemetry/telemetry.js

@@ -22,7 +22,7 @@ let heartbeatTimeout
 let heartbeatInterval
 let extendedInterval
 let integrations
-let configWithOrigin = []
+const configWithOrigin = new Map()
 let retryData = null
 const extendedHeartbeatPayload = {}
 
@@ -113,7 +113,7 @@ function getInstallSignature (config) {
 function appStarted (config) {
   const app = {
     products: getProducts(config),
-    configuration: configWithOrigin
+    configuration: [...configWithOrigin.values()]
   }
   const installSignature = getInstallSignature(config)
   if (installSignature) {
@@ -282,7 +282,7 @@ function stop () {
 }
 
 function updateIntegrations () {
-  if (!config || !config.telemetry.enabled) {
+  if (!config?.telemetry.enabled) {
     return
   }
   const integrations = getIntegrations()
@@ -322,6 +322,8 @@ const nameMapping = {
   traceId128BitLoggingEnabled: 'DD_TRACE_128_BIT_TRACEID_LOGGING_ENABLED'
 }
 
+const namesNeedFormatting = new Set(['DD_TAGS', 'peerServiceMapping', 'serviceMapping'])
+
 function updateConfig (changes, config) {
   if (!config.telemetry.enabled) return
   if (changes.length === 0) return
@@ -331,15 +333,11 @@ function updateConfig (changes, config) {
   const application = createAppObject(config)
   const host = createHostObject()
 
-  const namesNeedFormatting = new Set(['DD_TAGS', 'peerServiceMapping', 'serviceMapping'])
-
-  const configuration = []
-  const names = [] // list of config names whose values have been changed
+  const changed = configWithOrigin.size > 0
 
   for (const change of changes) {
     const name = nameMapping[change.name] || change.name
 
-    names.push(name)
     const { origin, value } = change
     const entry = { name, value, origin }
 
@@ -354,21 +352,15 @@ function updateConfig (changes, config) {
     } else if (Array.isArray(entry.value)) {
       entry.value = value.join(',')
     }
-    configuration.push(entry)
-  }
-
-  function isNotModified (entry) {
-    return !names.includes(entry.name)
+    configWithOrigin.set(name, entry)
   }
 
-  if (configWithOrigin.length) {
+  if (changed) {
     // update configWithOrigin to contain up-to-date full list of config values for app-extended-heartbeat
-    configWithOrigin = configWithOrigin.filter(isNotModified)
-    configWithOrigin = [...configWithOrigin, ...configuration]
-    const { reqType, payload } = createPayload('app-client-configuration-change', { configuration })
+    const { reqType, payload } = createPayload('app-client-configuration-change', {
+      configuration: [...configWithOrigin.values()]
+    })
     sendData(config, application, host, reqType, payload, updateRetryData)
-  } else {
-    configWithOrigin = configuration
   }
 }
 
@@ -376,12 +368,7 @@ function profilingEnabledToBoolean (profilingEnabled) {
   if (typeof profilingEnabled === 'boolean') {
     return profilingEnabled
   }
-  if (['auto', 'true'].includes(profilingEnabled)) {
-    return true
-  }
-  if (profilingEnabled === 'false') {
-    return false
-  }
+  return profilingEnabled === 'true' || profilingEnabled === 'auto'
 }
 
 module.exports = {

package/packages/dd-trace/src/tracer.js

@@ -46,9 +46,7 @@ class DatadogTracer extends Tracer {
   }
 
   trace (name, options, fn) {
-    options = Object.assign({
-      childOf: this.scope().active()
-    }, options)
+    options = { childOf: this.scope().active(), ...options }
 
     const span = this.startSpan(name, options)
 
@@ -76,9 +74,8 @@ class DatadogTracer extends Tracer {
             throw err
           }
         )
-      } else {
-        span.finish()
       }
+      span.finish()
 
       return result
     } catch (e) {
@@ -110,9 +107,8 @@ class DatadogTracer extends Tracer {
 
           return fn.apply(this, arguments)
         })
-      } else {
-        return tracer.trace(name, optionsObj, () => fn.apply(this, arguments))
       }
+      return tracer.trace(name, optionsObj, () => fn.apply(this, arguments))
     }
   }
 

package/packages/dd-trace/src/util.js

@@ -69,10 +69,6 @@ function calculateDDBasePath (dirname) {
   return dirSteps.slice(0, packagesIndex + 1).join(path.sep) + path.sep
 }
 
-function hasOwn (object, prop) {
-  return Object.prototype.hasOwnProperty.call(object, prop)
-}
-
 function normalizeProfilingEnabledValue (configValue) {
   return isTrue(configValue)
     ? 'true'
@@ -87,6 +83,5 @@ module.exports = {
   isError,
   globMatch,
   ddBasePath: calculateDDBasePath(__dirname),
-  hasOwn,
   normalizeProfilingEnabledValue
 }

package/packages/dd-trace/src/appsec/iast/analyzers/header-injection-analyzer.js

@@ -1,120 +0,0 @@
-'use strict'
-
-const InjectionAnalyzer = require('./injection-analyzer')
-const { HEADER_INJECTION } = require('../vulnerabilities')
-const { getNodeModulesPaths } = require('../path-line')
-const { HEADER_NAME_VALUE_SEPARATOR } = require('../vulnerabilities-formatter/constants')
-const { getRanges } = require('../taint-tracking/operations')
-const {
-  HTTP_REQUEST_COOKIE_VALUE,
-  HTTP_REQUEST_HEADER_VALUE
-} = require('../taint-tracking/source-types')
-
-const EXCLUDED_PATHS = getNodeModulesPaths('express')
-const EXCLUDED_HEADER_NAMES = new Set([
-  'location',
-  'sec-websocket-location',
-  'sec-websocket-accept',
-  'upgrade',
-  'connection'
-])
-
-class HeaderInjectionAnalyzer extends InjectionAnalyzer {
-  constructor () {
-    super(HEADER_INJECTION)
-  }
-
-  onConfigure () {
-    this.addSub('datadog:http:server:response:set-header:finish', ({ name, value }) => {
-      if (Array.isArray(value)) {
-        for (const headerValue of value) {
-          this.analyze({ name, value: headerValue })
-        }
-      } else {
-        this.analyze({ name, value })
-      }
-    })
-  }
-
-  _isVulnerable ({ name, value }, iastContext) {
-    const lowerCasedHeaderName = name?.trim().toLowerCase()
-
-    if (this.isExcludedHeaderName(lowerCasedHeaderName) || typeof value !== 'string') return
-
-    const ranges = getRanges(iastContext, value)
-    return ranges?.length > 0 && !this.shouldIgnoreHeader(lowerCasedHeaderName, ranges)
-  }
-
-  _getEvidence (headerInfo, iastContext) {
-    const prefix = headerInfo.name + HEADER_NAME_VALUE_SEPARATOR
-    const prefixLength = prefix.length
-
-    const evidence = super._getEvidence(headerInfo.value, iastContext)
-    evidence.value = prefix + evidence.value
-    evidence.ranges = evidence.ranges.map(range => {
-      return {
-        ...range,
-        start: range.start + prefixLength,
-        end: range.end + prefixLength
-      }
-    })
-
-    return evidence
-  }
-
-  isExcludedHeaderName (name) {
-    return EXCLUDED_HEADER_NAMES.has(name)
-  }
-
-  isAllRangesFromHeader (ranges, headerName) {
-    return ranges
-      .every(range =>
-        range.iinfo.type === HTTP_REQUEST_HEADER_VALUE && range.iinfo.parameterName?.toLowerCase() === headerName
-      )
-  }
-
-  isAllRangesFromSource (ranges, source) {
-    return ranges
-      .every(range => range.iinfo.type === source)
-  }
-
-  /**
-   * Exclude access-control-allow-*: when the header starts with access-control-allow- and the
-   * source of the tainted range is a request header
-   */
-  isAccessControlAllowExclusion (name, ranges) {
-    if (name?.startsWith('access-control-allow-')) {
-      return this.isAllRangesFromSource(ranges, HTTP_REQUEST_HEADER_VALUE)
-    }
-
-    return false
-  }
-
-  /** Exclude when the header is reflected from the request */
-  isSameHeaderExclusion (name, ranges) {
-    return ranges.length === 1 && name === ranges[0].iinfo.parameterName?.toLowerCase()
-  }
-
-  shouldIgnoreHeader (headerName, ranges) {
-    switch (headerName) {
-      case 'set-cookie':
-        /** Exclude set-cookie header if the source of all the tainted ranges are cookies */
-        return this.isAllRangesFromSource(ranges, HTTP_REQUEST_COOKIE_VALUE)
-      case 'pragma':
-        /** Ignore pragma headers when the source is the cache control header. */
-        return this.isAllRangesFromHeader(ranges, 'cache-control')
-      case 'transfer-encoding':
-      case 'content-encoding':
-        /** Ignore transfer and content encoding headers when the source is the accept encoding header. */
-        return this.isAllRangesFromHeader(ranges, 'accept-encoding')
-    }
-
-    return this.isAccessControlAllowExclusion(headerName, ranges) || this.isSameHeaderExclusion(headerName, ranges)
-  }
-
-  _getExcludedPaths () {
-    return EXCLUDED_PATHS
-  }
-}
-
-module.exports = new HeaderInjectionAnalyzer()

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/header-sensitive-analyzer.js

@@ -1,20 +0,0 @@
-'use strict'
-
-const { HEADER_NAME_VALUE_SEPARATOR } = require('../../constants')
-
-module.exports = function extractSensitiveRanges (evidence, namePattern, valuePattern) {
-  const evidenceValue = evidence.value
-  const sections = evidenceValue.split(HEADER_NAME_VALUE_SEPARATOR)
-  const headerName = sections[0]
-  const headerValue = sections.slice(1).join(HEADER_NAME_VALUE_SEPARATOR)
-  namePattern.lastIndex = 0
-  valuePattern.lastIndex = 0
-  if (namePattern.test(headerName) || valuePattern.test(headerValue)) {
-    return [{
-      start: headerName.length + HEADER_NAME_VALUE_SEPARATOR.length,
-      end: evidenceValue.length
-    }]
-  }
-
-  return []
-}