dd-trace 5.61.1 → 5.63.0

package/packages/dd-trace/src/appsec/recommended.json

@@ -1,7 +1,7 @@
 {
   "version": "2.2",
   "metadata": {
-    "rules_version": "1.15.0"
+    "rules_version": "1.15.1"
   },
   "rules": [
     {
@@ -5539,6 +5539,7 @@
         "confidence": "0",
         "module": "waf"
       },
+      "max_version": "1.24.9",
       "conditions": [
         {
           "parameters": {
@@ -6671,7 +6672,10 @@
               {
                 "address": "graphql.server.resolver"
               }
-            ]
+            ],
+            "options": {
+              "path-inspection": true
+            }
           },
           "operator": "ssrf_detector"
         }
@@ -8916,6 +8920,271 @@
       "transformers": []
     }
   ],
+  "rules_compat": [
+    {
+      "id": "api-001-100",
+      "name": "JWT: No expiry is present",
+      "tags": {
+        "type": "jwt",
+        "category": "api_security",
+        "confidence": "0",
+        "module": "business-logic"
+      },
+      "min_version": "1.25.0",
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.jwt",
+                "key_path": [
+                  "payload",
+                  "exp"
+                ]
+              }
+            ]
+          },
+          "operator": "!exists"
+        }
+      ],
+      "transformers": [],
+      "output": {
+        "event": false,
+        "keep": false,
+        "attributes": {
+          "_dd.appsec.api.jwt.no_expiry": {
+            "value": 1
+          }
+        }
+      }
+    },
+    {
+      "id": "api-001-110",
+      "name": "JWT: Collect algorithm used",
+      "tags": {
+        "type": "jwt",
+        "category": "api_security",
+        "confidence": "0",
+        "module": "business-logic"
+      },
+      "min_version": "1.25.0",
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.jwt",
+                "key_path": [
+                  "header",
+                  "alg"
+                ]
+              }
+            ]
+          },
+          "operator": "exists"
+        }
+      ],
+      "transformers": [],
+      "output": {
+        "event": false,
+        "keep": false,
+        "attributes": {
+          "_dd.appsec.api.jwt_alg": {
+            "address": "server.request.jwt",
+            "key_path": [
+              "header",
+              "alg"
+            ]
+          }
+        }
+      }
+    },
+    {
+      "id": "api-001-120",
+      "name": "JWT: No audience is specified",
+      "tags": {
+        "type": "jwt",
+        "category": "api_security",
+        "confidence": "0",
+        "module": "business-logic"
+      },
+      "min_version": "1.25.0",
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.jwt",
+                "key_path": [
+                  "payload",
+                  "aud"
+                ]
+              }
+            ]
+          },
+          "operator": "!exists"
+        }
+      ],
+      "transformers": [],
+      "output": {
+        "event": false,
+        "keep": false,
+        "attributes": {
+          "_dd.appsec.api.jwt.no_audience": {
+            "value": 1
+          }
+        }
+      }
+    },
+    {
+      "id": "api-001-130",
+      "name": "JWT: None algorithm used",
+      "tags": {
+        "type": "jwt",
+        "category": "api_security",
+        "confidence": "0",
+        "module": "business-logic"
+      },
+      "min_version": "1.25.0",
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.jwt",
+                "key_path": [
+                  "header",
+                  "alg"
+                ]
+              }
+            ],
+            "list": [
+              "none",
+              "nonE",
+              "noNe",
+              "noNE",
+              "nOne",
+              "nOnE",
+              "nONe",
+              "nONE",
+              "None",
+              "NonE",
+              "NoNe",
+              "NoNE",
+              "NOne",
+              "NOnE",
+              "NONe",
+              "NONE"
+            ]
+          },
+          "operator": "exact_match"
+        }
+      ],
+      "transformers": [],
+      "output": {
+        "event": false,
+        "keep": true,
+        "attributes": {
+          "_dd.appsec.api.jwt.none_alg": {
+            "value": 1
+          }
+        }
+      }
+    },
+    {
+      "id": "ua0-600-551",
+      "name": "Datadog test scanner - scalar trace-tagging version: user-agent",
+      "tags": {
+        "type": "security_scanner",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "tool_name": "Datadog Canary Test",
+        "confidence": "1",
+        "module": "waf"
+      },
+      "min_version": "1.25.0",
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "user-agent"
+                ]
+              },
+              {
+                "address": "grpc.server.request.metadata",
+                "key_path": [
+                  "dd-canary"
+                ]
+              }
+            ],
+            "regex": "^dd-test-scanner-tag-scalar(?:$|/|\\s)"
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": [],
+      "output": {
+        "event": false,
+        "attributes": {
+          "_dd.appsec.test.scanner.scalar": {
+            "value": 1
+          }
+        }
+      }
+    },
+    {
+      "id": "ua0-600-552",
+      "name": "Datadog test scanner - reference trace-tagging version: user-agent",
+      "tags": {
+        "type": "security_scanner",
+        "category": "attack_attempt",
+        "cwe": "200",
+        "capec": "1000/118/169",
+        "tool_name": "Datadog Canary Test",
+        "confidence": "1",
+        "module": "waf"
+      },
+      "min_version": "1.25.0",
+      "conditions": [
+        {
+          "parameters": {
+            "inputs": [
+              {
+                "address": "server.request.headers.no_cookies",
+                "key_path": [
+                  "user-agent"
+                ]
+              },
+              {
+                "address": "grpc.server.request.metadata",
+                "key_path": [
+                  "dd-canary"
+                ]
+              }
+            ],
+            "regex": "^dd-test-scanner-tag-ref(?:$|/|\\s)"
+          },
+          "operator": "match_regex"
+        }
+      ],
+      "transformers": [],
+      "output": {
+        "event": false,
+        "attributes": {
+          "_dd.appsec.test.scanner.reference": {
+            "address": "server.request.headers.no_cookies",
+            "key_path": [
+              "user-agent"
+            ]
+          }
+        }
+      }
+    }
+  ],
   "processors": [
     {
       "id": "http-endpoint-fingerprint",

package/packages/dd-trace/src/appsec/waf/waf_manager.js

@@ -7,7 +7,7 @@ const WAFContextWrapper = require('./waf_context_wrapper')
 const contexts = new WeakMap()
 
 class WAFManager {
-  static get defaultWafConfigPath () { return 'datadog/00/ASM_DD/default/config' }
+  static defaultWafConfigPath = 'datadog/00/ASM_DD/default/config'
 
   constructor (rules, config) {
     this.config = config

package/packages/dd-trace/src/ci-visibility/log-submission/log-submission-plugin.js

@@ -36,9 +36,7 @@ function getWinstonLogSubmissionParameters (config) {
 }
 
 class LogSubmissionPlugin extends Plugin {
-  static get id () {
-    return 'log-submission'
-  }
+  static id = 'log-submission'
 
   constructor (...args) {
     super(...args)

package/packages/dd-trace/src/ci-visibility/test-api-manual/test-api-manual-plugin.js

@@ -9,9 +9,7 @@ const {
 const { storage } = require('../../../../datadog-core')
 
 class TestApiManualPlugin extends CiPlugin {
-  static get id () {
-    return 'test-api-manual'
-  }
+  static id = 'test-api-manual'
 
   constructor (...args) {
     super(...args)

package/packages/dd-trace/src/config.js

@@ -571,7 +571,7 @@ class Config {
     defaults.testManagementAttemptToFixRetries = 20
     defaults.isTestManagementEnabled = false
     defaults.isImpactedTestsEnabled = false
-    defaults.logInjection = 'structured'
+    defaults.logInjection = true
     defaults.lookup = undefined
     defaults.inferredProxyServicesEnabled = false
     defaults.memcachedCommandEnabled = false

package/packages/dd-trace/src/datastreams/checkpointer.js

@@ -9,6 +9,12 @@ class DataStreamsCheckpointer {
     this.dsmProcessor = tracer._dataStreamsProcessor
   }
 
+  /**
+   * @param {string} type - The type of the checkpoint, usually the streaming technology being used.
+   *                       Examples include kafka, kinesis, sns etc.
+   * @param {string} target - The target of data. This can be a topic, exchange or stream name.
+   * @param {Object} carrier - The carrier object to inject context into.
+   */
   setProduceCheckpoint (type, target, carrier) {
     if (!this.config.dsmEnabled) return
 
@@ -23,14 +29,29 @@ class DataStreamsCheckpointer {
     this.tracer.inject(ctx, 'text_map_dsm', carrier)
   }
 
-  setConsumeCheckpoint (type, source, carrier) {
+  /**
+   * @param {string} type - The type of the checkpoint, usually the streaming technology being used.
+   *                       Examples include kafka, kinesis, sns etc.
+   * @param {string} source - The source of data. This can be a topic, exchange or stream name.
+   * @param {Object} carrier - The carrier object to extract context from.
+   * @param {boolean} [manualCheckpoint=true] - Whether this checkpoint was manually set. Keep true if manually
+   *                                           instrumenting. Manual instrumentation always overrides automatic
+   *                                           instrumentation in the case a call is both manually and automatically
+   *                                           instrumented.
+   */
+  setConsumeCheckpoint (type, source, carrier, manualCheckpoint = true) {
     if (!this.config.dsmEnabled) return
 
     const parentCtx = this.tracer.extract('text_map_dsm', carrier)
     DataStreamsContext.setDataStreamsContext(parentCtx)
 
+    const tags = ['type:' + type, 'topic:' + source, 'direction:in']
+    if (manualCheckpoint) {
+      tags.push('manual_checkpoint:true')
+    }
+
     const ctx = this.dsmProcessor.setCheckpoint(
-      ['type:' + type, 'topic:' + source, 'direction:in', 'manual_checkpoint:true'],
+      tags,
       null,
       parentCtx,
       null

package/packages/dd-trace/src/datastreams/processor.js

@@ -17,8 +17,9 @@ const ENTRY_PARENT_HASH = Buffer.from('0000000000000000', 'hex')
 
 class StatsPoint {
   constructor (hash, parentHash, edgeTags) {
-    this.hash = hash.readBigUInt64BE()
-    this.parentHash = parentHash.readBigUInt64BE()
+    this.hash = hash.readBigUInt64LE()
+    this.parentHash = parentHash.readBigUInt64LE()
+
     this.edgeTags = edgeTags
     this.edgeLatency = new LogCollapsingLowestDenseDDSketch()
     this.pathwayLatency = new LogCollapsingLowestDenseDDSketch()
@@ -191,7 +192,7 @@ class DataStreamsProcessor {
       .addLatencies(checkpoint)
     // set DSM pathway hash on span to enable related traces feature on DSM tab, convert from buffer to uint64
     if (span) {
-      span.setTag(PATHWAY_HASH, checkpoint.hash.readBigUInt64BE(0).toString())
+      span.setTag(PATHWAY_HASH, checkpoint.hash.readBigUInt64LE(0).toString())
     }
   }
 

package/packages/dd-trace/src/guardrails/telemetry.js

@@ -22,7 +22,10 @@ var metadata = {
   runtime_name: 'nodejs',
   runtime_version: process.versions.node,
   tracer_version: tracerVersion,
-  pid: process.pid
+  pid: process.pid,
+  result: 'unknown',
+  result_reason: 'unknown',
+  result_class: 'unknown'
 }
 
 var seen = {}
@@ -64,14 +67,27 @@ function sendTelemetry (name, tags) {
   })
   proc.on('error', function () {
     log.error('Failed to spawn telemetry forwarder')
+    metadata.result = 'error'
+    metadata.result_class = 'internal_error'
+    metadata.result_reason = 'Failed to spawn telemetry forwarder'
   })
   proc.on('exit', function (code) {
-    if (code !== 0) {
+    if (code === 0) {
+      metadata.result = 'success'
+      metadata.result_class = 'success'
+      metadata.result_reason = 'Successfully configured ddtrace package'
+    } else {
       log.error('Telemetry forwarder exited with code', code)
+      metadata.result = 'error'
+      metadata.result_class = 'internal_error'
+      metadata.result_reason = 'Telemetry forwarder exited with code ' + code
     }
   })
   proc.stdin.on('error', function () {
     log.error('Failed to write telemetry data to telemetry forwarder')
+    metadata.result = 'error'
+    metadata.result_class = 'internal_error'
+    metadata.result_reason = 'Failed to write telemetry data to telemetry forwarder'
   })
   proc.stdin.end(JSON.stringify({ metadata: metadata, points: points }))
 }