dd-trace 5.54.0 → 5.55.0

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js

@@ -8,7 +8,6 @@ const { contains, intersects, remove } = require('./range-utils')
 
 const commandSensitiveAnalyzer = require('./sensitive-analyzers/command-sensitive-analyzer')
 const hardcodedPasswordAnalyzer = require('./sensitive-analyzers/hardcoded-password-analyzer')
-const headerSensitiveAnalyzer = require('./sensitive-analyzers/header-sensitive-analyzer')
 const jsonSensitiveAnalyzer = require('./sensitive-analyzers/json-sensitive-analyzer')
 const ldapSensitiveAnalyzer = require('./sensitive-analyzers/ldap-sensitive-analyzer')
 const sqlSensitiveAnalyzer = require('./sensitive-analyzers/sql-sensitive-analyzer')
@@ -30,9 +29,6 @@ class SensitiveHandler {
     this._sensitiveAnalyzers.set(vulnerabilities.HARDCODED_PASSWORD, (evidence) => {
       return hardcodedPasswordAnalyzer(evidence, this._valuePattern)
     })
-    this._sensitiveAnalyzers.set(vulnerabilities.HEADER_INJECTION, (evidence) => {
-      return headerSensitiveAnalyzer(evidence, this._namePattern, this._valuePattern)
-    })
     this._sensitiveAnalyzers.set(vulnerabilities.LDAP_INJECTION, ldapSensitiveAnalyzer)
     this._sensitiveAnalyzers.set(vulnerabilities.NOSQL_MONGODB_INJECTION, jsonSensitiveAnalyzer)
     this._sensitiveAnalyzers.set(vulnerabilities.SQL_INJECTION, sqlSensitiveAnalyzer)

package/packages/dd-trace/src/appsec/iast/vulnerabilities.js

@@ -3,7 +3,6 @@ module.exports = {
   CODE_INJECTION: 'CODE_INJECTION',
   HARDCODED_PASSWORD: 'HARDCODED_PASSWORD',
   HARDCODED_SECRET: 'HARDCODED_SECRET',
-  HEADER_INJECTION: 'HEADER_INJECTION',
   HSTS_HEADER_MISSING: 'HSTS_HEADER_MISSING',
   INSECURE_COOKIE: 'INSECURE_COOKIE',
   LDAP_INJECTION: 'LDAP_INJECTION',

package/packages/dd-trace/src/appsec/index.js

@@ -45,7 +45,7 @@ function enable (_config) {
   if (isEnabled) return
 
   try {
-    appsecTelemetry.enable(_config.telemetry)
+    appsecTelemetry.enable(_config)
     graphql.enable()
 
     if (_config.appsec.rasp.enabled) {
@@ -139,7 +139,7 @@ function incomingHttpStartTranslator ({ req, res, abortController }) {
     [HTTP_CLIENT_IP]: clientIp
   })
 
-  const requestHeaders = Object.assign({}, req.headers)
+  const requestHeaders = { ...req.headers }
   delete requestHeaders.cookie
 
   const persistent = {
@@ -299,12 +299,12 @@ function onResponseWriteHead ({ req, res, abortController, statusCode, responseH
   const rootSpan = web.root(req)
   if (!rootSpan) return
 
-  responseHeaders = Object.assign({}, responseHeaders)
+  responseHeaders = { ...responseHeaders }
   delete responseHeaders['set-cookie']
 
   const results = waf.run({
     persistent: {
-      [addresses.HTTP_INCOMING_RESPONSE_CODE]: '' + statusCode,
+      [addresses.HTTP_INCOMING_RESPONSE_CODE]: String(statusCode),
       [addresses.HTTP_INCOMING_RESPONSE_HEADERS]: responseHeaders
     }
   }, req)

package/packages/dd-trace/src/appsec/reporter.js

@@ -96,7 +96,7 @@ function formatHeaderName (name) {
   return name
     .trim()
     .slice(0, 200)
-    .replace(/[^a-zA-Z0-9_\-:/]/g, '_')
+    .replaceAll(/[^a-zA-Z0-9_\-:/]/g, '_')
     .toLowerCase()
 }
 
@@ -116,7 +116,7 @@ function filterHeaders (headers, map) {
   for (const [headerName, tagName] of map) {
     const headerValue = headers[headerName]
     if (headerValue) {
-      result[tagName] = '' + headerValue
+      result[tagName] = String(headerValue)
     }
   }
 
@@ -132,7 +132,7 @@ function filterExtendedHeaders (headers, excludedHeaderNames, tagPrefix, limit =
   for (const [headerName, headerValue] of Object.entries(headers)) {
     if (counter >= limit) break
     if (!excludedHeaderNames.has(headerName)) {
-      result[getHeaderTag(tagPrefix, headerName)] = '' + headerValue
+      result[getHeaderTag(tagPrefix, headerName)] = String(headerValue)
       counter++
     }
   }
@@ -301,8 +301,6 @@ function reportAttack (attackData) {
 }
 
 function truncateRequestBody (target, depth = 0) {
-  let wasTruncated = false
-
   switch (typeof target) {
     case 'string':
       if (target.length > COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH) {
@@ -328,7 +326,7 @@ function truncateRequestBody (target, depth = 0) {
 
       if (Array.isArray(target)) {
         const maxArrayLength = Math.min(target.length, COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE)
-        wasTruncated = target.length > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE
+        let wasTruncated = target.length > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE
         const truncatedArray = new Array(maxArrayLength)
         for (let i = 0; i < maxArrayLength; i++) {
           const { value, truncated } = truncateRequestBody(target[i], depth + 1)
@@ -341,7 +339,7 @@ function truncateRequestBody (target, depth = 0) {
 
       const keys = Object.keys(target)
       const maxKeysLength = Math.min(keys.length, COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE)
-      wasTruncated = keys.length > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE
+      let wasTruncated = keys.length > COLLECTED_REQUEST_BODY_MAX_ELEMENTS_PER_NODE
 
       const truncatedObject = {}
       for (let i = 0; i < maxKeysLength; i++) {

package/packages/dd-trace/src/appsec/sdk/set_user.js

@@ -7,7 +7,7 @@ const addresses = require('../addresses')
 
 function setUserTags (user, rootSpan) {
   for (const k of Object.keys(user)) {
-    rootSpan.setTag(`usr.${k}`, '' + user[k])
+    rootSpan.setTag(`usr.${k}`, String(user[k]))
   }
 
   rootSpan.setTag('_dd.appsec.user.collection_mode', 'sdk')
@@ -28,7 +28,7 @@ function setUser (tracer, user) {
   setUserTags(user, rootSpan)
 
   const persistent = {
-    [addresses.USER_ID]: '' + user.id
+    [addresses.USER_ID]: String(user.id)
   }
 
   if (user.session_id && typeof user.session_id === 'string') {

package/packages/dd-trace/src/appsec/sdk/track_event.js

@@ -196,7 +196,7 @@ function trackEvent (eventName, fields, sdkMethodName, rootSpan) {
     }
 
     for (const metadataKey of Object.keys(flatFields)) {
-      tags[`appsec.events.${eventName}.${metadataKey}`] = '' + flatFields[metadataKey]
+      tags[`appsec.events.${eventName}.${metadataKey}`] = String(flatFields[metadataKey])
     }
   }
 
@@ -211,11 +211,11 @@ function runWaf (eventName, user) {
   }
 
   if (user?.id) {
-    persistent[addresses.USER_ID] = '' + user.id
+    persistent[addresses.USER_ID] = String(user.id)
   }
 
   if (user?.login) {
-    persistent[addresses.USER_LOGIN] = '' + user.login
+    persistent[addresses.USER_LOGIN] = String(user.login)
   }
 
   waf.run({ persistent })

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -15,17 +15,47 @@ const {
   incrementWafUpdates,
   incrementWafRequests
 } = require('./waf')
+const telemetryMetrics = require('../../telemetry/metrics')
 
 const metricsStoreMap = new WeakMap()
 
+const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+
 let enabled = false
+let interval
+const SUPPORTED_ORIGINS = new Set(['env_var', 'code', 'remote_config', 'unknown'])
 
-function enable (telemetryConfig) {
+function enable (config) {
+  const telemetryConfig = config.telemetry
   enabled = telemetryConfig?.enabled && telemetryConfig.metrics
+
+  if (enabled) {
+    let origin = 'remote_config'
+
+    if (config.appsec.enabled) {
+      origin = config.getOrigin('appsec.enabled')
+
+      if (!SUPPORTED_ORIGINS.has(origin)) {
+        origin = 'unknown'
+      }
+    }
+
+    const gauge = appsecMetrics.gauge('enabled', { origin })
+    gauge.track()
+
+    interval = setInterval(() => {
+      gauge.track()
+    }, telemetryConfig.heartbeatInterval)
+    interval.unref?.()
+  }
 }
 
 function disable () {
   enabled = false
+  if (interval) {
+    clearInterval(interval)
+    interval = undefined
+  }
 }
 
 function newStore () {

package/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js

@@ -49,8 +49,10 @@ class WAFContextWrapper {
     if (persistent !== null && typeof persistent === 'object') {
       const persistentInputs = {}
 
+      let hasPersistentInputs = false
       for (const key of Object.keys(persistent)) {
         if (!this.addressesToSkip.has(key) && this.knownAddresses.has(key)) {
+          hasPersistentInputs = true
           persistentInputs[key] = persistent[key]
           if (preventDuplicateAddresses.has(key)) {
             newAddressesToSkip.add(key)
@@ -58,7 +60,7 @@ class WAFContextWrapper {
         }
       }
 
-      if (Object.keys(persistentInputs).length) {
+      if (hasPersistentInputs) {
         payload.persistent = persistentInputs
         payloadHasData = true
       }
@@ -67,13 +69,15 @@ class WAFContextWrapper {
     if (ephemeral !== null && typeof ephemeral === 'object') {
       const ephemeralInputs = {}
 
+      let hasEphemeral = false
       for (const key of Object.keys(ephemeral)) {
         if (this.knownAddresses.has(key)) {
+          hasEphemeral = true
           ephemeralInputs[key] = ephemeral[key]
         }
       }
 
-      if (Object.keys(ephemeralInputs).length) {
+      if (hasEphemeral) {
         payload.ephemeral = ephemeralInputs
         payloadHasData = true
       }

package/packages/dd-trace/src/azure_metadata.js

@@ -4,6 +4,7 @@
 
 const os = require('os')
 const { getIsAzureFunction } = require('./serverless')
+const { getEnvironmentVariable, getEnvironmentVariables } = require('../../dd-trace/src/config-helper')
 
 function extractSubscriptionID (ownerName) {
   if (ownerName !== undefined) {
@@ -45,7 +46,7 @@ function buildMetadata () {
     WEBSITE_OS,
     WEBSITE_RESOURCE_GROUP,
     WEBSITE_SITE_NAME
-  } = process.env
+  } = getEnvironmentVariables()
 
   const subscriptionID = extractSubscriptionID(WEBSITE_OWNER_NAME)
 
@@ -78,11 +79,15 @@ function getAzureAppMetadata () {
   // DD_AZURE_APP_SERVICES is an environment variable introduced by the .NET APM team and is set automatically for
   // anyone using the Datadog APM Extensions (.NET, Java, or Node) for Windows Azure App Services
   // See: https://github.com/DataDog/datadog-aas-extension/blob/01f94b5c28b7fa7a9ab264ca28bd4e03be603900/node/src/applicationHost.xdt#L20-L21
-  return process.env.DD_AZURE_APP_SERVICES === undefined ? undefined : buildMetadata()
+  if (getEnvironmentVariable('DD_AZURE_APP_SERVICES') !== undefined) {
+    return buildMetadata()
+  }
 }
 
 function getAzureFunctionMetadata () {
-  return getIsAzureFunction() ? buildMetadata() : undefined
+  if (getIsAzureFunction()) {
+    return buildMetadata()
+  }
 }
 
 // Modeled after https://github.com/DataDog/libdatadog/blob/92272e90a7919f07178f3246ef8f82295513cfed/profiling/src/exporter/mod.rs#L187

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/index.js

@@ -4,6 +4,7 @@ const { join } = require('path')
 const { Worker, threadId: parentThreadId } = require('worker_threads')
 const { randomUUID } = require('crypto')
 const log = require('../../log')
+const { getEnvironmentVariables } = require('../../config-helper')
 
 const probeIdToResolveBreakpointSet = new Map()
 const probeIdToResolveBreakpointRemove = new Map()
@@ -72,13 +73,13 @@ class TestVisDynamicInstrumentation {
         // for PnP support, hence why we deviate from the DI pattern here.
         // To avoid infinite initialization loops, we're disabling DI and tracing in the worker.
         env: {
-          ...process.env,
-          DD_CIVISIBILITY_ENABLED: 0,
-          DD_TRACE_ENABLED: 0,
-          DD_TEST_FAILED_TEST_REPLAY_ENABLED: 0,
-          DD_CIVISIBILITY_MANUAL_API_ENABLED: 0,
-          DD_TRACING_ENABLED: 0,
-          DD_TRACE_TELEMETRY_ENABLED: 0
+          ...getEnvironmentVariables(),
+          DD_CIVISIBILITY_ENABLED: 'false',
+          DD_TRACE_ENABLED: 'false',
+          DD_TEST_FAILED_TEST_REPLAY_ENABLED: 'false',
+          DD_CIVISIBILITY_MANUAL_API_ENABLED: 'false',
+          DD_TRACING_ENABLED: 'false',
+          DD_INSTRUMENTATION_TELEMETRY_ENABLED: 'false'
         },
         workerData: {
           config: this._config.serialize(),

package/packages/dd-trace/src/ci-visibility/early-flake-detection/get-known-tests.js

@@ -1,6 +1,7 @@
 const request = require('../../exporters/common/request')
 const id = require('../../id')
 const log = require('../../log')
+const { getEnvironmentVariable } = require('../../config-helper')
 
 const {
   incrementCountMetric,
@@ -48,7 +49,7 @@ function getKnownTests ({
     options.path = `${evpProxyPrefix}/api/v2/ci/libraries/tests`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const apiKey = process.env.DATADOG_API_KEY || process.env.DD_API_KEY
+    const apiKey = getEnvironmentVariable('DD_API_KEY')
     if (!apiKey) {
       return done(new Error('Known tests were not fetched because Datadog API key is not defined.'))
     }

package/packages/dd-trace/src/ci-visibility/exporters/agentless/coverage-writer.js

@@ -2,6 +2,7 @@
 const request = require('../../../exporters/common/request')
 const log = require('../../../log')
 const { safeJSONStringify } = require('../../../exporters/common/util')
+const { getEnvironmentVariable } = require('../../../config-helper')
 
 const { CoverageCIVisibilityEncoder } = require('../../../encode/coverage-ci-visibility')
 const BaseWriter = require('../../../exporters/common/writer')
@@ -28,7 +29,7 @@ class Writer extends BaseWriter {
       path: '/api/v2/citestcov',
       method: 'POST',
       headers: {
-        'dd-api-key': process.env.DATADOG_API_KEY || process.env.DD_API_KEY,
+        'dd-api-key': getEnvironmentVariable('DD_API_KEY'),
         ...form.getHeaders()
       },
       timeout: 15_000,

package/packages/dd-trace/src/ci-visibility/exporters/agentless/di-logs-writer.js

@@ -3,6 +3,7 @@ const request = require('../../../exporters/common/request')
 const log = require('../../../log')
 const { safeJSONStringify } = require('../../../exporters/common/util')
 const { JSONEncoder } = require('../../encode/json-encoder')
+const { getEnvironmentVariable } = require('../../../config-helper')
 
 const BaseWriter = require('../../../exporters/common/writer')
 
@@ -23,7 +24,7 @@ class DynamicInstrumentationLogsWriter extends BaseWriter {
       path: '/api/v2/logs',
       method: 'POST',
       headers: {
-        'dd-api-key': process.env.DATADOG_API_KEY || process.env.DD_API_KEY,
+        'dd-api-key': getEnvironmentVariable('DD_API_KEY'),
         'Content-Type': 'application/json'
       },
       // TODO: what's a good value for timeout for the logs intake?

package/packages/dd-trace/src/ci-visibility/exporters/agentless/writer.js

@@ -2,6 +2,7 @@
 const request = require('../../../exporters/common/request')
 const { safeJSONStringify } = require('../../../exporters/common/util')
 const log = require('../../../log')
+const { getEnvironmentVariable } = require('../../../config-helper')
 
 const { AgentlessCiVisibilityEncoder } = require('../../../encode/agentless-ci-visibility')
 const BaseWriter = require('../../../exporters/common/writer')
@@ -29,7 +30,7 @@ class Writer extends BaseWriter {
       path: '/api/v2/citestcycle',
       method: 'POST',
       headers: {
-        'dd-api-key': process.env.DATADOG_API_KEY || process.env.DD_API_KEY,
+        'dd-api-key': getEnvironmentVariable('DD_API_KEY'),
         'Content-Type': 'application/msgpack'
       },
       timeout: 15_000,

package/packages/dd-trace/src/ci-visibility/exporters/git/git_metadata.js

@@ -3,6 +3,7 @@ const path = require('path')
 
 const FormData = require('../../../exporters/common/form-data')
 const request = require('../../../exporters/common/request')
+const { getEnvironmentVariable } = require('../../../config-helper')
 
 const log = require('../../../log')
 const { isFalse } = require('../../../util')
@@ -38,7 +39,7 @@ function validateCommits (commits) {
       throw new Error('Invalid commit type response')
     }
     if (isValidSha1(commitSha) || isValidSha256(commitSha)) {
-      return commitSha.replace(/[^0-9a-f]+/g, '')
+      return commitSha.replaceAll(/[^0-9a-f]+/g, '')
     }
     throw new Error('Invalid commit format')
   })
@@ -48,7 +49,7 @@ function getCommonRequestOptions (url) {
   return {
     method: 'POST',
     headers: {
-      'dd-api-key': process.env.DATADOG_API_KEY || process.env.DD_API_KEY
+      'dd-api-key': getEnvironmentVariable('DD_API_KEY')
     },
     timeout: 15_000,
     url
@@ -285,7 +286,7 @@ function sendGitMetadata (url, { isEvpProxy, evpProxyPrefix }, configRepositoryU
     }
     // Otherwise we unshallow and get commits to upload again
     log.debug('It is shallow clone, unshallowing...')
-    if (!isFalse(process.env.DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED)) {
+    if (!isFalse(getEnvironmentVariable('DD_CIVISIBILITY_GIT_UNSHALLOW_ENABLED'))) {
       unshallowRepository()
     }
 

package/packages/dd-trace/src/ci-visibility/exporters/test-worker/index.js

@@ -9,18 +9,19 @@ const {
   JEST_WORKER_LOGS_PAYLOAD_CODE,
   PLAYWRIGHT_WORKER_TRACE_PAYLOAD_CODE
 } = require('../../../plugins/util/test')
+const { getEnvironmentVariable } = require('../../../config-helper')
 
 function getInterprocessTraceCode () {
-  if (process.env.JEST_WORKER_ID) {
+  if (getEnvironmentVariable('JEST_WORKER_ID')) {
     return JEST_WORKER_TRACE_PAYLOAD_CODE
   }
-  if (process.env.CUCUMBER_WORKER_ID) {
+  if (getEnvironmentVariable('CUCUMBER_WORKER_ID')) {
     return CUCUMBER_WORKER_TRACE_PAYLOAD_CODE
   }
-  if (process.env.MOCHA_WORKER_ID) {
+  if (getEnvironmentVariable('MOCHA_WORKER_ID')) {
     return MOCHA_WORKER_TRACE_PAYLOAD_CODE
   }
-  if (process.env.DD_PLAYWRIGHT_WORKER) {
+  if (getEnvironmentVariable('DD_PLAYWRIGHT_WORKER')) {
     return PLAYWRIGHT_WORKER_TRACE_PAYLOAD_CODE
   }
   return null
@@ -28,14 +29,14 @@ function getInterprocessTraceCode () {
 
 // TODO: make it available with cucumber
 function getInterprocessCoverageCode () {
-  if (process.env.JEST_WORKER_ID) {
+  if (getEnvironmentVariable('JEST_WORKER_ID')) {
     return JEST_WORKER_COVERAGE_PAYLOAD_CODE
   }
   return null
 }
 
 function getInterprocessLogsCode () {
-  if (process.env.JEST_WORKER_ID) {
+  if (getEnvironmentVariable('JEST_WORKER_ID')) {
     return JEST_WORKER_LOGS_PAYLOAD_CODE
   }
   return null

package/packages/dd-trace/src/ci-visibility/intelligent-test-runner/get-skippable-suites.js

@@ -1,5 +1,6 @@
 const request = require('../../exporters/common/request')
 const log = require('../../log')
+const { getEnvironmentVariable } = require('../../config-helper')
 const {
   incrementCountMetric,
   distributionMetric,
@@ -46,7 +47,7 @@ function getSkippableSuites ({
     options.path = `${evpProxyPrefix}/api/v2/ci/tests/skippable`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const apiKey = process.env.DATADOG_API_KEY || process.env.DD_API_KEY
+    const apiKey = getEnvironmentVariable('DD_API_KEY')
     if (!apiKey) {
       return done(new Error('Skippable suites were not fetched because Datadog API key is not defined.'))
     }

package/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js

@@ -1,5 +1,6 @@
 const Plugin = require('../../plugins/plugin')
 const log = require('../../log')
+const { getEnvironmentVariable } = require('../../config-helper')
 
 function getWinstonLogSubmissionParameters (config) {
   const { site, service } = config
@@ -9,16 +10,16 @@ function getWinstonLogSubmissionParameters (config) {
     path: `/api/v2/logs?ddsource=winston&service=${service}`,
     ssl: true,
     headers: {
-      'DD-API-KEY': process.env.DD_API_KEY
+      'DD-API-KEY': getEnvironmentVariable('DD_API_KEY')
     }
   }
 
-  if (!process.env.DD_AGENTLESS_LOG_SUBMISSION_URL) {
+  if (!getEnvironmentVariable('DD_AGENTLESS_LOG_SUBMISSION_URL')) {
     return defaultParameters
   }
 
   try {
-    const url = new URL(process.env.DD_AGENTLESS_LOG_SUBMISSION_URL)
+    const url = new URL(getEnvironmentVariable('DD_AGENTLESS_LOG_SUBMISSION_URL'))
     return {
       host: url.hostname,
       port: url.port,

package/packages/dd-trace/src/ci-visibility/requests/get-library-configuration.js

@@ -1,6 +1,7 @@
 const request = require('../../exporters/common/request')
 const id = require('../../id')
 const log = require('../../log')
+const { getEnvironmentVariable } = require('../../config-helper')
 const {
   incrementCountMetric,
   distributionMetric,
@@ -45,7 +46,7 @@ function getLibraryConfiguration ({
     options.path = `${evpProxyPrefix}/api/v2/libraries/tests/services/setting`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const apiKey = process.env.DATADOG_API_KEY || process.env.DD_API_KEY
+    const apiKey = getEnvironmentVariable('DD_API_KEY')
     if (!apiKey) {
       return done(new Error('Request to settings endpoint was not done because Datadog API key is not defined.'))
     }
@@ -123,11 +124,11 @@ function getLibraryConfiguration ({
 
         log.debug(() => `Remote settings: ${JSON.stringify(settings)}`)
 
-        if (process.env.DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE) {
+        if (getEnvironmentVariable('DD_CIVISIBILITY_DANGEROUSLY_FORCE_COVERAGE')) {
           settings.isCodeCoverageEnabled = true
           log.debug(() => 'Dangerously set code coverage to true')
         }
-        if (process.env.DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING) {
+        if (getEnvironmentVariable('DD_CIVISIBILITY_DANGEROUSLY_FORCE_TEST_SKIPPING')) {
           settings.isSuitesSkippingEnabled = true
           log.debug(() => 'Dangerously set test skipping to true')
         }

package/packages/dd-trace/src/ci-visibility/test-management/get-test-management-tests.js

@@ -1,5 +1,6 @@
 const request = require('../../exporters/common/request')
 const id = require('../../id')
+const { getEnvironmentVariable } = require('../../config-helper')
 
 function getTestManagementTests ({
   url,
@@ -28,7 +29,7 @@ function getTestManagementTests ({
     options.path = `${evpProxyPrefix}/api/v2/test/libraries/test-management/tests`
     options.headers['X-Datadog-EVP-Subdomain'] = 'api'
   } else {
-    const apiKey = process.env.DATADOG_API_KEY || process.env.DD_API_KEY
+    const apiKey = getEnvironmentVariable('DD_API_KEY')
     if (!apiKey) {
       return done(new Error('Test management tests were not fetched because Datadog API key is not defined.'))
     }

package/packages/dd-trace/src/config-helper.js

@@ -0,0 +1,89 @@
+'use strict'
+
+/* eslint-disable eslint-rules/eslint-process-env */
+
+const { deprecate } = require('util')
+const { supportedConfigurations, aliases, deprecations } = require('./supported-configurations.json')
+
+const aliasToCanonical = {}
+for (const canonical of Object.keys(aliases)) {
+  for (const alias of aliases[canonical]) {
+    if (aliasToCanonical[alias]) {
+      throw new Error(`The alias ${alias} is already used for ${aliasToCanonical[alias]}.`)
+    }
+    aliasToCanonical[alias] = canonical
+  }
+}
+
+const deprecationMethods = {}
+for (const deprecation of Object.keys(deprecations)) {
+  deprecationMethods[deprecation] = deprecate(
+    () => {},
+    `The environment variable ${deprecation} is deprecated.` +
+    (aliasToCanonical[deprecation]
+      ? ` Please use ${aliasToCanonical[deprecation]} instead.`
+      : ` ${deprecations[deprecation]}`),
+    `DATADOG_${deprecation}`
+  )
+}
+
+module.exports = {
+  /**
+   * Returns the environment variables that are supported by the tracer
+   * (including all non-Datadog/OTEL specific environment variables)
+   *
+   * @returns {Partial<process.env>} The environment variables
+   */
+  getEnvironmentVariables () {
+    const configs = {}
+    for (const [key, value] of Object.entries(process.env)) {
+      if (key.startsWith('DD_') || key.startsWith('OTEL_') || aliasToCanonical[key]) {
+        if (supportedConfigurations[key]) {
+          configs[key] = value
+        } else if (aliasToCanonical[key] && configs[aliasToCanonical[key]] === undefined) {
+          // The alias should only be used if the actual configuration is not set
+          // In case that more than a single alias exist, use the one defined first in our own order
+          for (const alias of aliases[aliasToCanonical[key]]) {
+            if (process.env[alias] !== undefined) {
+              configs[aliasToCanonical[key]] = value
+              break
+            }
+          }
+        // TODO(BridgeAR) Implement logging. It would have to use a timeout to
+        // lazily log the message after all loading being done otherwise.
+        //   debug(
+        //     `Missing configuration ${env} in supported-configurations file. The environment variable is ignored.`
+        //   )
+        }
+        deprecationMethods[key]?.()
+      } else {
+        configs[key] = value
+      }
+    }
+    return configs
+  },
+
+  /**
+   * Returns the environment variable, if it's supported or a non Datadog
+   * configuration. Otherwise, it throws an error.
+   *
+   * @param {string} name Environment variable name
+   * @returns {string|undefined}
+   * @throws {Error} if the configuration is not supported
+   */
+  getEnvironmentVariable (name) {
+    if ((name.startsWith('DD_') || name.startsWith('OTEL_') || aliasToCanonical[name]) &&
+        !supportedConfigurations[name]) {
+      throw new Error(`Missing ${name} env/configuration in "supported-configurations.json" file.`)
+    }
+    const config = process.env[name]
+    if (config === undefined && aliases[name]) {
+      for (const alias of aliases[name]) {
+        if (process.env[alias] !== undefined) {
+          return process.env[alias]
+        }
+      }
+    }
+    return config
+  }
+}