dd-trace 5.83.0 → 5.85.0

package/packages/datadog-plugin-ws/src/util.js

@@ -1,8 +1,46 @@
 'use strict'
 
+const DatadogSpanContext = require('../../dd-trace/src/opentracing/span_context')
+
+const TRACE_ID_UPPER_TAG = '_dd.p.tid'
+
 // WeakMap to store message counters per socket without mutating the socket object
 const socketCounters = new WeakMap()
 
+/**
+ * Creates a minimal span context for span links without retaining the full trace.
+ * @param {DatadogSpanContext} spanContext
+ * @returns {DatadogSpanContext | undefined}
+ */
+function createWebSocketSpanContext (spanContext) {
+  if (!spanContext) return
+
+  const traceIdUpper = spanContext._trace?.tags?.[TRACE_ID_UPPER_TAG]
+  const trace = traceIdUpper
+    ? { started: [], finished: [], tags: { [TRACE_ID_UPPER_TAG]: traceIdUpper } }
+    : undefined
+
+  return new DatadogSpanContext({
+    traceId: spanContext._traceId,
+    spanId: spanContext._spanId,
+    parentId: spanContext._parentId,
+    sampling: spanContext._sampling,
+    traceparent: spanContext._traceparent,
+    tracestate: spanContext._tracestate,
+    isRemote: spanContext._isRemote,
+    trace,
+  })
+}
+
+/**
+ * Returns whether distributed trace headers are present.
+ * @param {Record<string, string | string[] | undefined>} headers
+ * @returns {boolean}
+ */
+function hasTraceHeaders (headers) {
+  return !!(headers && (headers['x-datadog-trace-id'] || headers.traceparent))
+}
+
 /**
  * Initializes WebSocket message counters for a socket.
  * @param {object} socket - The WebSocket socket object
@@ -11,7 +49,7 @@ function initWebSocketMessageCounters (socket) {
   if (!socketCounters.has(socket)) {
     socketCounters.set(socket, {
       receiveCounter: 0,
-      sendCounter: 0
+      sendCounter: 0,
     })
   }
 }
@@ -69,14 +107,12 @@ function buildWebSocketSpanPointerHash (handshakeTraceId, handshakeSpanId, count
  * A span has distributed tracing context if it has a parent context that was
  * extracted from headers (remote parent).
  *
- * @param {object} span - The handshake span
- * @param {object} socket - The WebSocket socket object
+ * @param {DatadogSpanContext} spanContext - The handshake span context
+ * @param {{ hasTraceHeaders?: boolean } | undefined} socket - The WebSocket socket object
  * @returns {boolean} True if the span has distributed tracing context
  */
-function hasDistributedTracingContext (span, socket) {
-  if (!span) return false
-  const context = span.context()
-  if (!context) return false
+function hasDistributedTracingContext (spanContext, socket) {
+  if (!spanContext) return false
 
   // Check if this span has a parent. If the parent was extracted from remote headers,
   // then this span is part of a distributed trace.
@@ -86,22 +122,18 @@ function hasDistributedTracingContext (span, socket) {
   //
   // For testing purposes, we also check if Datadog trace headers are present in the socket's
   // upgrade request, which indicates distributed tracing context was sent by the client.
-  if (context._parentId !== null) {
+  if (spanContext._parentId !== null) {
     return true
   }
 
-  // Fallback check: look for distributed tracing headers in the stored request headers
-  if (socket && socket.requestHeaders) {
-    const headers = socket.requestHeaders
-    return !!(headers['x-datadog-trace-id'] || headers.traceparent)
-  }
-
-  return false
+  return !!socket?.hasTraceHeaders
 }
 
 module.exports = {
+  createWebSocketSpanContext,
+  hasTraceHeaders,
   initWebSocketMessageCounters,
   incrementWebSocketCounter,
   buildWebSocketSpanPointerHash,
-  hasDistributedTracingContext
+  hasDistributedTracingContext,
 }

package/packages/datadog-shimmer/src/shimmer.js

@@ -7,7 +7,7 @@ const skipMethods = new Set([
   'caller',
   'arguments',
   'name',
-  'length'
+  'length',
 ])
 const skipMethodSize = skipMethods.size
 
@@ -76,11 +76,8 @@ function wrapFunction (original, wrapper) {
   if (typeof original !== 'function') return original
 
   const wrapped = wrapper(original)
-
-  if (typeof original === 'function') {
-    assertNotClass(original)
-    copyProperties(original, wrapped)
-  }
+  assertNotClass(original)
+  copyProperties(original, wrapped)
 
   return wrapped
 }
@@ -121,7 +118,7 @@ function wrap (target, name, wrapper, options) {
     value: target[name],
     writable: true,
     configurable: true,
-    enumerable: false
+    enumerable: false,
   }
 
   if (descriptor.set && (!descriptor.get || options?.replaceGetter)) {
@@ -278,5 +275,5 @@ function assertNotClass (target) {
 module.exports = {
   wrap,
   wrapFunction,
-  massWrap
+  massWrap,
 }

package/packages/dd-trace/index.js

@@ -7,7 +7,7 @@ if (!global._ddtrace) {
     value: new TracerProxy(),
     enumerable: false,
     configurable: true,
-    writable: true
+    writable: true,
   })
 
   const ddTraceSymbol = Symbol.for('dd-trace')
@@ -18,7 +18,7 @@ if (!global._ddtrace) {
     },
     enumerable: false,
     configurable: true, // Allow this to be overridden by loading the tracer
-    writable: false
+    writable: false,
   })
 
   process.once('beforeExit', function mainBeforeExit () {

package/packages/dd-trace/src/agent/info.js

@@ -0,0 +1,57 @@
+'use strict'
+
+const request = require('../exporters/common/request')
+
+const CACHE_TTL_MS = 60_000 // 1 minute
+
+let cachedUrl = null
+let cachedData = null
+let cachedTimestamp = 0
+
+module.exports = {
+  fetchAgentInfo,
+  clearCache, // For testing purposes only
+}
+
+/**
+ * Fetches agent information from the /info endpoint
+ * @param {URL} url - The agent URL
+ * @param {Function} callback - Callback function with signature (err, agentInfo)
+ */
+function fetchAgentInfo (url, callback) {
+  const urlKey = url.href
+
+  if (cachedUrl !== null && cachedUrl !== urlKey) {
+    // Clear cache if URL changes
+    clearCache()
+  } else if (cachedData !== null && (Date.now() - cachedTimestamp) < CACHE_TTL_MS) {
+    // Return cached result if still valid
+    return process.nextTick(callback, null, cachedData)
+  }
+
+  request('', {
+    path: '/info',
+    url,
+  }, (err, res) => {
+    if (err) {
+      return callback(err)
+    }
+
+    try {
+      cachedData = JSON.parse(res)
+    } catch (e) {
+      return callback(e)
+    }
+
+    cachedUrl = urlKey
+    cachedTimestamp = Date.now()
+
+    callback(null, cachedData)
+  })
+}
+
+function clearCache () {
+  cachedUrl = null
+  cachedData = null
+  cachedTimestamp = 0
+}

package/packages/dd-trace/src/agent/url.js

@@ -0,0 +1,28 @@
+'use strict'
+
+const { URL, format } = require('url')
+const defaults = require('../config/defaults')
+
+module.exports = { getAgentUrl }
+
+// TODO: Investigate merging with the getAgentUrl function in config/index.js which has
+// additional logic for unix socket auto-detection on Linux. The config version is only used
+// during config initialization, while this one is used throughout the codebase. Consider if
+// the unix socket detection should be part of this general helper or remain config-specific.
+
+/**
+ * Gets the agent URL from config, constructing it from hostname/port if needed
+ * @param {ReturnType<import('../config')>} config - Tracer configuration object
+ * @returns {URL} The agent URL
+ */
+function getAgentUrl (config) {
+  const { url, hostname, port } = config
+  if (url) {
+    return url instanceof URL ? url : new URL(url)
+  }
+  return new URL(format({
+    protocol: 'http:',
+    hostname: hostname || defaults.hostname,
+    port: port || defaults.port,
+  }))
+}

package/packages/dd-trace/src/aiguard/client.js

@@ -5,20 +5,20 @@ async function executeRequest (body, opts) {
   const headers = {
     'Content-Type': 'application/json',
     'Content-Length': Buffer.byteLength(postData),
-    ...opts.headers
+    ...opts.headers,
   }
 
   const response = await fetch(opts.url, {
     method: 'POST',
     headers,
     body: postData,
-    signal: AbortSignal.timeout(opts.timeout)
+    signal: AbortSignal.timeout(opts.timeout),
   })
 
   const responseBody = await response.json()
   return {
     status: response.status,
-    body: responseBody
+    body: responseBody,
   }
 }
 

package/packages/dd-trace/src/aiguard/sdk.js

@@ -15,7 +15,7 @@ const {
   AI_GUARD_META_STRUCT_KEY,
   AI_GUARD_TOOL_NAME_TAG_KEY,
   AI_GUARD_TELEMETRY_REQUESTS,
-  AI_GUARD_TELEMETRY_TRUNCATED
+  AI_GUARD_TELEMETRY_TRUNCATED,
 } = require('./tags')
 
 const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
@@ -68,7 +68,7 @@ class AIGuard extends NoopAIGuard {
       'DD-APPLICATION-KEY': config.appKey,
       'DD-AI-GUARD-VERSION': tracerVersion,
       'DD-AI-GUARD-SOURCE': 'SDK',
-      'DD-AI-GUARD-LANGUAGE': 'nodejs'
+      'DD-AI-GUARD-LANGUAGE': 'nodejs',
     }
     const endpoint = config.experimental.aiguard.endpoint || `https://app.${config.site}/api/v2/ai-guard`
     this.#evaluateUrl = `${endpoint}/evaluate`
@@ -147,10 +147,10 @@ class AIGuard extends NoopAIGuard {
         }
       }
       const metaStruct = {
-        messages: this.#buildMessagesForMetaStruct(messages)
+        messages: this.#buildMessagesForMetaStruct(messages),
       }
       span.meta_struct = {
-        [AI_GUARD_META_STRUCT_KEY]: metaStruct
+        [AI_GUARD_META_STRUCT_KEY]: metaStruct,
       }
       let response
       try {
@@ -159,8 +159,8 @@ class AIGuard extends NoopAIGuard {
             attributes: {
               messages,
               meta: this.#meta,
-            }
-          }
+            },
+          },
         }
         response = await executeRequest(
           payload,

package/packages/dd-trace/src/aiguard/tags.js

@@ -10,5 +10,5 @@ module.exports = {
   AI_GUARD_META_STRUCT_KEY: 'ai_guard',
 
   AI_GUARD_TELEMETRY_REQUESTS: 'ai_guard.requests',
-  AI_GUARD_TELEMETRY_TRUNCATED: 'ai_guard.truncated'
+  AI_GUARD_TELEMETRY_TRUNCATED: 'ai_guard.truncated',
 }

package/packages/dd-trace/src/analytics_sampler.js

@@ -11,5 +11,5 @@ module.exports = {
     } else if (measuredByDefault) {
       span.setTag(MEASURED, true)
     }
-  }
+  },
 }

package/packages/dd-trace/src/appsec/activation.js

@@ -23,7 +23,7 @@ const Activation = {
       default:
         return Activation.DISABLED
     }
-  }
+  },
 }
 
 module.exports = Activation

package/packages/dd-trace/src/appsec/addresses.js

@@ -36,5 +36,5 @@ module.exports = {
   SHELL_COMMAND: 'server.sys.shell.cmd',
 
   LOGIN_SUCCESS: 'server.business_logic.users.login.success',
-  LOGIN_FAILURE: 'server.business_logic.users.login.failure'
+  LOGIN_FAILURE: 'server.business_logic.users.login.failure',
 }

package/packages/dd-trace/src/appsec/api_security_sampler.js

@@ -92,5 +92,5 @@ module.exports = {
   disable,
   sampleRequest,
   isSampled,
-  computeKey
+  computeKey,
 }

package/packages/dd-trace/src/appsec/blocked_templates.js

@@ -10,5 +10,5 @@ const graphqlJson = '{"errors":[{"message":"You\'ve been blocked","extensions":{
 module.exports = {
   html,
   json,
-  graphqlJson
+  graphqlJson,
 }

package/packages/dd-trace/src/appsec/blocking.js

@@ -17,7 +17,7 @@ const responseBlockedSet = new WeakSet()
 const blockDelegations = new WeakMap()
 
 const specificBlockingTypes = {
-  GRAPHQL: 'graphql'
+  GRAPHQL: 'graphql',
 }
 
 function getSpecificKey (method, url) {
@@ -34,7 +34,7 @@ function getBlockWithRedirectData (actionParameters) {
     statusCode = 303
   }
   const headers = {
-    Location: actionParameters.location
+    Location: actionParameters.location,
   }
 
   return { headers, statusCode }
@@ -45,7 +45,7 @@ function getSpecificBlockingData (type) {
     case specificBlockingTypes.GRAPHQL:
       return {
         type: 'application/json',
-        body: templateGraphqlJson
+        body: templateGraphqlJson,
       }
   }
 }
@@ -88,7 +88,7 @@ function getBlockWithContentData (req, specificType, actionParameters) {
 
   const headers = {
     'Content-Type': type,
-    'Content-Length': Buffer.byteLength(body)
+    'Content-Length': Buffer.byteLength(body),
   }
 
   return { body, statusCode, headers }
@@ -192,5 +192,5 @@ module.exports = {
   getBlockingAction,
   setTemplates,
   isBlocked,
-  setDefaultBlockingActionParameters
+  setDefaultBlockingActionParameters,
 }

package/packages/dd-trace/src/appsec/channels.js

@@ -42,5 +42,5 @@ module.exports = {
   setCookieChannel: dc.channel('datadog:iast:set-cookie'),
   setUncaughtExceptionCaptureCallbackStart: dc.channel('datadog:process:setUncaughtExceptionCaptureCallback:start'),
   startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
-  wafRunFinished: dc.channel('datadog:waf:run:finish')
+  wafRunFinished: dc.channel('datadog:waf:run:finish'),
 }

package/packages/dd-trace/src/appsec/graphql.js

@@ -7,7 +7,7 @@ const {
   addSpecificEndpoint,
   specificBlockingTypes,
   getBlockingData,
-  getBlockingAction
+  getBlockingAction,
 } = require('./blocking')
 const waf = require('./waf')
 const addresses = require('./addresses')
@@ -16,7 +16,7 @@ const {
   graphqlMiddlewareChannel,
   apolloHttpServerChannel,
   apolloChannel,
-  apolloServerCoreChannel
+  apolloServerCoreChannel,
 } = require('./channels')
 const { updateBlockFailureMetric } = require('./telemetry')
 
@@ -56,7 +56,7 @@ function enterInApolloMiddleware (data) {
   if (!req) return
 
   graphqlRequestData.set(req, {
-    blocked: false
+    blocked: false,
   })
 }
 
@@ -66,7 +66,7 @@ function enterInApolloServerCoreRequest () {
 
   graphqlRequestData.set(req, {
     isInGraphqlRequest: true,
-    blocked: false
+    blocked: false,
   })
 }
 
@@ -114,41 +114,41 @@ function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {
 
 function enableApollo () {
   graphqlMiddlewareChannel.subscribe({
-    start: enterInApolloMiddleware
+    start: enterInApolloMiddleware,
   })
 
   apolloServerCoreChannel.subscribe({
     start: enterInApolloServerCoreRequest,
-    asyncEnd: beforeWriteApolloGraphqlResponse
+    asyncEnd: beforeWriteApolloGraphqlResponse,
   })
 
   apolloChannel.subscribe({
     start: enterInApolloRequest,
-    asyncEnd: beforeWriteApolloGraphqlResponse
+    asyncEnd: beforeWriteApolloGraphqlResponse,
   })
 
   apolloHttpServerChannel.subscribe({
-    start: enterInApolloMiddleware
+    start: enterInApolloMiddleware,
   })
 }
 
 function disableApollo () {
   graphqlMiddlewareChannel.unsubscribe({
-    start: enterInApolloMiddleware
+    start: enterInApolloMiddleware,
   })
 
   apolloServerCoreChannel.unsubscribe({
     start: enterInApolloServerCoreRequest,
-    asyncEnd: beforeWriteApolloGraphqlResponse
+    asyncEnd: beforeWriteApolloGraphqlResponse,
   })
 
   apolloChannel.unsubscribe({
     start: enterInApolloRequest,
-    asyncEnd: beforeWriteApolloGraphqlResponse
+    asyncEnd: beforeWriteApolloGraphqlResponse,
   })
 
   apolloHttpServerChannel.unsubscribe({
-    start: enterInApolloMiddleware
+    start: enterInApolloMiddleware,
   })
 }
 
@@ -162,5 +162,5 @@ function disableGraphql () {
 
 module.exports = {
   enable,
-  disable
+  disable,
 }

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js

@@ -20,5 +20,5 @@ module.exports = {
   WEAK_CIPHER_ANALYZER: require('./weak-cipher-analyzer'),
   WEAK_HASH_ANALYZER: require('./weak-hash-analyzer'),
   WEAK_RANDOMNESS_ANALYZER: require('./weak-randomness-analyzer'),
-  XCONTENTTYPE_HEADER_MISSING_ANALYZER: require('./xcontenttype-header-missing-analyzer')
+  XCONTENTTYPE_HEADER_MISSING_ANALYZER: require('./xcontenttype-header-missing-analyzer'),
 }

package/packages/dd-trace/src/appsec/iast/analyzers/cookie-analyzer.js

@@ -9,7 +9,7 @@ const EXCLUDED_PATHS = [
   // Fastify
   getNodeModulesPaths('fastify/lib/reply.js'),
   getNodeModulesPaths('fastify/lib/hooks.js'),
-  getNodeModulesPaths('@fastify/cookie/plugin.js')
+  getNodeModulesPaths('@fastify/cookie/plugin.js'),
 ]
 
 class CookieAnalyzer extends Analyzer {

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-base-analyzer.js

@@ -43,14 +43,15 @@ class HardcodedBaseAnalyzer extends Analyzer {
     if (matches.length) {
       const file = getRelativePath(secrets.file)
 
-      matches
-        .forEach(match => this._report({
+      for (const match of matches) {
+        this._report({
           file,
           line: match.location.line,
           column: match.location.column,
           ident: match.location.ident,
-          data: match.ruleId
-        }))
+          data: match.ruleId,
+        })
+      }
     }
   }
 
@@ -63,7 +64,7 @@ class HardcodedBaseAnalyzer extends Analyzer {
       path: value.file,
       line: value.line,
       column: value.column,
-      isInternal: false
+      isInternal: false,
     }
   }
 }

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-password-rules.js

@@ -6,6 +6,6 @@ module.exports = [
   {
     id: 'hardcoded-password',
     regex: /(?:pwd|pswd|pass|secret)(?:[0-9a-z\-_\t.]{0,20})(?:[\s|']|[\s|""]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|""|\s|=|\x60){0,5}([0-9a-z\-_.=]{10,150})(?:['"\s\x60;]|$)/i,
-    type: NameAndValue
-  }
+    type: NameAndValue,
+  },
 ]

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-rule-type.js

@@ -2,5 +2,5 @@
 
 module.exports = {
   ValueOnly: 'ValueOnly',
-  NameAndValue: 'NameAndValue'
+  NameAndValue: 'NameAndValue',
 }