dd-trace 5.83.0 → 5.85.0

package/packages/dd-trace/src/appsec/iast/analyzers/index.js

@@ -19,5 +19,5 @@ function disableAllAnalyzers () {
 
 module.exports = {
   enableAllAnalyzers,
-  disableAllAnalyzers
+  disableAllAnalyzers,
 }

package/packages/dd-trace/src/appsec/iast/analyzers/missing-header-analyzer.js

@@ -24,7 +24,7 @@ class MissingHeaderAnalyzer extends Analyzer {
   onConfigure () {
     this.addSub({
       channelName: 'datadog:iast:response-end',
-      moduleName: 'http'
+      moduleName: 'http',
     }, (data) => this.analyze(data))
   }
 

package/packages/dd-trace/src/appsec/iast/analyzers/nosql-injection-mongodb-analyzer.js

@@ -25,13 +25,12 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
     this.configureSanitizers()
 
     // Anything that accesses the storage is context dependent
-    // eslint-disable-next-line unicorn/consistent-function-scoping
     const onStart = ({ filters }) => {
       const store = storage('legacy').getStore()
       if (store && !store.nosqlAnalyzed && filters?.length) {
-        filters.forEach(filter => {
+        for (const filter of filters) {
           this.analyze({ filter }, store)
-        })
+        }
       }
 
       return store
@@ -69,7 +68,7 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
       const iastContext = getIastContext(store)
 
       if (iastContext) { // do nothing if we are not in an iast request
-        sanitizedProperties.forEach(key => {
+        for (const key of sanitizedProperties) {
           iterateObjectStrings(req[key], function (value, levelKeys) {
             if (typeof value === 'string') {
               let parentObj = req[key]
@@ -86,7 +85,7 @@ class NosqlInjectionMongodbAnalyzer extends InjectionAnalyzer {
               }
             }
           })
-        })
+        }
       }
     })
 
@@ -175,8 +174,8 @@ function iterateMongodbQueryStrings (target, fn, levelKeys = [], depth = 10, vis
 
     visited.add(target)
 
-    Object.keys(target).forEach((key) => {
-      if (SAFE_OPERATORS.has(key)) return
+    for (const key of Object.keys(target)) {
+      if (SAFE_OPERATORS.has(key)) continue
 
       const nextLevelKeys = [...levelKeys, key]
       const val = target[key]
@@ -186,7 +185,7 @@ function iterateMongodbQueryStrings (target, fn, levelKeys = [], depth = 10, vis
       } else if (depth > 0) {
         iterateMongodbQueryStrings(val, fn, nextLevelKeys, depth - 1, visited)
       }
-    })
+    }
   }
 }
 

package/packages/dd-trace/src/appsec/iast/analyzers/path-traversal-analyzer.js

@@ -14,7 +14,7 @@ class PathTraversalAnalyzer extends InjectionAnalyzer {
     super(PATH_TRAVERSAL)
 
     this.exclusionList = [
-      path.join('node_modules', 'send') + path.sep
+      path.join('node_modules', 'send') + path.sep,
     ]
 
     this.internalExclusionList = [
@@ -23,7 +23,7 @@ class PathTraversalAnalyzer extends InjectionAnalyzer {
       String.raw`node:internal\fs`,
       'fs.js',
       'internal/fs',
-      String.raw`internal\fs`
+      String.raw`internal\fs`,
     ]
   }
 

package/packages/dd-trace/src/appsec/iast/analyzers/set-cookies-header-interceptor.js

@@ -24,14 +24,14 @@ class SetCookiesHeaderInterceptor extends Plugin {
       const alreadyCheckedCookies = this._getAlreadyCheckedCookiesInResponse(res)
 
       let location
-      allCookies.forEach(cookieString => {
+      for (const cookieString of allCookies) {
         if (!alreadyCheckedCookies.includes(cookieString)) {
           alreadyCheckedCookies.push(cookieString)
           const parsedCookie = this._parseCookie(cookieString, location)
           setCookieChannel.publish(parsedCookie)
           location = parsedCookie.location
         }
-      })
+      }
     }
   }
 

package/packages/dd-trace/src/appsec/iast/analyzers/unvalidated-redirect-analyzer.js

@@ -5,7 +5,7 @@ const { getNodeModulesPaths } = require('../path-line')
 const { getRanges } = require('../taint-tracking/operations')
 const {
   HTTP_REQUEST_BODY,
-  HTTP_REQUEST_PARAMETER
+  HTTP_REQUEST_PARAMETER,
 } = require('../taint-tracking/source-types')
 const InjectionAnalyzer = require('./injection-analyzer')
 
@@ -16,7 +16,7 @@ const EXCLUDED_PATHS = [
 
 const VULNERABLE_SOURCE_TYPES = new Set([
   HTTP_REQUEST_BODY,
-  HTTP_REQUEST_PARAMETER
+  HTTP_REQUEST_PARAMETER,
 ])
 
 class UnvalidatedRedirectAnalyzer extends InjectionAnalyzer {

package/packages/dd-trace/src/appsec/iast/analyzers/vulnerability-analyzer.js

@@ -8,7 +8,7 @@ const { SinkIastPlugin } = require('../iast-plugin')
 const {
   addVulnerability,
   getVulnerabilityCallSiteFrames,
-  replaceCallSiteFromSourceMap
+  replaceCallSiteFromSourceMap,
 } = require('../vulnerability-reporter')
 const { getMarkFromVulnerabilityType } = require('../taint-tracking/secure-marks')
 const { SUPPRESSED_VULNERABILITIES } = require('../telemetry/iast-metric')
@@ -137,9 +137,9 @@ class Analyzer extends SinkIastPlugin {
         location: {
           spanId: _spanId,
           stackId,
-          ...location
+          ...location,
         },
-        hash: this._createHash(this._createHashSource(type, evidence, location))
+        hash: this._createHash(this._createHashSource(type, evidence, location)),
       }
     }
     return null

package/packages/dd-trace/src/appsec/iast/analyzers/weak-cipher-analyzer.js

@@ -8,7 +8,7 @@ const INSECURE_CIPHERS = new Set([
   'des-ede3-ecb', 'des-ede3-ofb', 'des-ofb', 'des3', 'des3-wrap',
   'rc2', 'rc2-128', 'rc2-40', 'rc2-40-cbc', 'rc2-64', 'rc2-64-cbc', 'rc2-cbc', 'rc2-cfb', 'rc2-ecb', 'rc2-ofb',
   'blowfish',
-  'rc4', 'rc4-40', 'rc4-hmac-md5'
+  'rc4', 'rc4-40', 'rc4-hmac-md5',
 ].map(algorithm => algorithm.toLowerCase()))
 
 class WeakCipherAnalyzer extends Analyzer {

package/packages/dd-trace/src/appsec/iast/analyzers/weak-hash-analyzer.js

@@ -9,7 +9,7 @@ const Analyzer = require('./vulnerability-analyzer')
 const INSECURE_HASH_ALGORITHMS = new Set([
   'md4', 'md4WithRSAEncryption', 'RSA-MD4',
   'RSA-MD5', 'md5', 'md5-sha1', 'ssl3-md5', 'md5WithRSAEncryption',
-  'RSA-SHA1', 'RSA-SHA1-2', 'sha1', 'md5-sha1', 'sha1WithRSAEncryption', 'ssl3-sha1'
+  'RSA-SHA1', 'RSA-SHA1-2', 'sha1', 'md5-sha1', 'sha1WithRSAEncryption', 'ssl3-sha1',
 ].map(algorithm => algorithm.toLowerCase()))
 
 const EXCLUDED_LOCATIONS = getNodeModulesPaths(
@@ -30,7 +30,7 @@ const EXCLUDED_LOCATIONS = getNodeModulesPaths(
 const EXCLUDED_PATHS_FROM_STACK = [
   path.join('node_modules', 'object-hash', path.sep),
   path.join('node_modules', 'aws-sdk', 'lib', 'util.js'),
-  path.join('node_modules', 'keygrip', path.sep)
+  path.join('node_modules', 'keygrip', path.sep),
 ]
 class WeakHashAnalyzer extends Analyzer {
   constructor () {

package/packages/dd-trace/src/appsec/iast/context/context-plugin.js

@@ -16,7 +16,7 @@ class IastContextPlugin extends IastPlugin {
     this._getAndRegisterSubscription({
       channelName,
       tag,
-      tagKey: TagKey.SOURCE_TYPE
+      tagKey: TagKey.SOURCE_TYPE,
     })
   }
 
@@ -39,7 +39,7 @@ class IastContextPlugin extends IastPlugin {
   addIastEnabledTag (isRequestAcquired, rootSpan) {
     if (rootSpan?.addTags) {
       rootSpan.addTags({
-        [IAST_ENABLED_TAG_KEY]: isRequestAcquired ? 1 : 0
+        [IAST_ENABLED_TAG_KEY]: isRequestAcquired ? 1 : 0,
       })
     }
   }
@@ -64,7 +64,7 @@ class IastContextPlugin extends IastPlugin {
     return {
       isRequestAcquired,
       iastContext,
-      store
+      store,
     }
   }
 

package/packages/dd-trace/src/appsec/iast/iast-context.js

@@ -54,8 +54,11 @@ function cleanIastContext (store, context, iastContext) {
     context[IAST_CONTEXT_KEY] = null
   }
   if (iastContext) {
-    if (typeof iastContext === 'object') { // eslint-disable-line eslint-rules/eslint-safe-typeof-object
-      Object.keys(iastContext).forEach(key => delete iastContext[key])
+    if (typeof iastContext === 'object') {
+      for (const key of Object.keys(iastContext)) {
+        // TODO: Consider using a (weak)map instead of an object to avoid the need to delete the keys.
+        delete iastContext[key]
+      }
     }
     return true
   }
@@ -68,5 +71,5 @@ module.exports = {
   cleanIastContext,
   getIastStackTraceId,
   IAST_CONTEXT_KEY,
-  IAST_TRANSACTION_ID
+  IAST_TRANSACTION_ID,
 }

package/packages/dd-trace/src/appsec/iast/iast-plugin.js

@@ -38,12 +38,16 @@ class IastPluginSubscription {
     if (!this.moduleInstrumented) {
       this.moduleInstrumented = true
 
-      this.tags.forEach(tag => this.instrumentedMetric.inc(undefined, tag))
+      for (const tag of this.tags) {
+        this.instrumentedMetric.inc(undefined, tag)
+      }
     }
   }
 
   increaseExecuted (iastContext) {
-    this.tags.forEach(tag => this.executedMetric.inc(iastContext, tag))
+    for (const tag of this.tags) {
+      this.executedMetric.inc(iastContext, tag)
+    }
   }
 
   matchesModuleInstrumented (name) {
@@ -76,7 +80,9 @@ class IastPlugin extends Plugin {
       const result = handler()
       if (iastTelemetry.isEnabled()) {
         if (Array.isArray(tags)) {
-          tags.forEach(tag => metric.inc(iastContext, tag))
+          for (const tag of tags) {
+            metric.inc(iastContext, tag)
+          }
         } else {
           metric.inc(iastContext, tags)
         }
@@ -178,9 +184,11 @@ class IastPlugin extends Plugin {
   }
 
   _onInstrumentationLoaded (name) {
-    this.pluginSubs
-      .filter(sub => sub.matchesModuleInstrumented(name))
-      .forEach(sub => sub.increaseInstrumented())
+    for (const sub of this.pluginSubs) {
+      if (sub.matchesModuleInstrumented(name)) {
+        sub.increaseInstrumented()
+      }
+    }
   }
 }
 
@@ -193,14 +201,14 @@ class SourceIastPlugin extends IastPlugin {
     this._getAndRegisterSubscription({
       moduleName,
       tag,
-      tagKey: TagKey.SOURCE_TYPE
+      tagKey: TagKey.SOURCE_TYPE,
     })
   }
 
   execSource (sourceHandlerInfo) {
     this._execHandlerAndIncMetric({
       metric: EXECUTED_SOURCE,
-      ...sourceHandlerInfo
+      ...sourceHandlerInfo,
     })
   }
 }
@@ -218,5 +226,5 @@ class SinkIastPlugin extends IastPlugin {
 module.exports = {
   SourceIastPlugin,
   SinkIastPlugin,
-  IastPlugin
+  IastPlugin,
 }

package/packages/dd-trace/src/appsec/iast/index.js

@@ -14,7 +14,7 @@ const {
   disableTaintTracking,
   createTransaction,
   removeTransaction,
-  taintTrackingPlugin
+  taintTrackingPlugin,
 } = require('./taint-tracking')
 const { IAST_ENABLED_TAG_KEY } = require('./tags')
 const iastTelemetry = require('./telemetry')
@@ -78,7 +78,7 @@ function onIncomingHttpRequestStart (data) {
         }
         if (rootSpan.addTags) {
           rootSpan.addTags({
-            [IAST_ENABLED_TAG_KEY]: isRequestAcquired ? 1 : 0
+            [IAST_ENABLED_TAG_KEY]: isRequestAcquired ? 1 : 0,
           })
         }
       }

package/packages/dd-trace/src/appsec/iast/overhead-controller.js

@@ -77,13 +77,13 @@ const OPERATIONS = {
     },
     initContext: function (context) {
       context.tokens[REPORT_VULNERABILITY] = this.initialTokenBucketSize()
-    }
-  }
+    },
+  },
 }
 
 function _getNewContext () {
   const oceContext = {
-    tokens: {}
+    tokens: {},
   }
 
   for (const operation in OPERATIONS) {
@@ -119,16 +119,16 @@ function consolidateVulnerabilities (iastContext) {
   const reserved = context.tokens?.[REPORT_VULNERABILITY] > 0
 
   if (reserved) { // still a bit of budget available
-    Object.keys(context.localMaps).forEach(route => {
+    for (const route of Object.keys(context.localMaps)) {
       globalRouteMap.set(route, newCountersArray())
-    })
+    }
   } else {
-    Object.keys(context.localMaps).forEach(route => {
+    for (const route of Object.keys(context.localMaps)) {
       const localMap = context.localMaps[route]
       const globalMap = globalRouteMap.get(route)
       if (!globalMap) {
         globalRouteMap.set(route, localMap)
-        return
+        continue
       }
 
       for (let i = 0; i < vulnerabilitiesSize; i++) {
@@ -136,7 +136,7 @@ function consolidateVulnerabilities (iastContext) {
           globalMap[i] = localMap[i]
         }
       }
-    })
+    }
   }
 }
 
@@ -205,5 +205,5 @@ module.exports = {
   releaseRequest,
   configure,
   consolidateVulnerabilities,
-  clearGlobalRouteMap
+  clearGlobalRouteMap,
 }

package/packages/dd-trace/src/appsec/iast/path-line.js

@@ -9,11 +9,11 @@ const pathLine = {
   getNodeModulesPaths,
   getRelativePath,
   getNonDDCallSiteFrames,
-  ddBasePath // Exported only for test purposes
+  ddBasePath, // Exported only for test purposes
 }
 
 const EXCLUDED_PATHS = [
-  path.join(path.sep, 'node_modules', 'dc-polyfill')
+  path.join(path.sep, 'node_modules', 'dc-polyfill'),
 ]
 const EXCLUDED_PATH_PREFIXES = [
   'node:diagnostics_channel',
@@ -21,7 +21,7 @@ const EXCLUDED_PATH_PREFIXES = [
   'node:child_process',
   'child_process',
   'node:async_hooks',
-  'async_hooks'
+  'async_hooks',
 ]
 
 function getNonDDCallSiteFrames (callSiteFrames, externallyExcludedPaths) {
@@ -38,7 +38,7 @@ function getNonDDCallSiteFrames (callSiteFrames, externallyExcludedPaths) {
       const callsiteLocation = {
         path: filepath,
         line: callsite.line,
-        column: callsite.column
+        column: callsite.column,
       }
       const { path: originalPath, line, column } = getOriginalPathAndLineFromSourceMap(callsiteLocation)
       callsite.path = filepath = originalPath
@@ -93,10 +93,10 @@ function isExcluded (callsite, externallyExcludedPaths) {
 function getNodeModulesPaths (...paths) {
   const nodeModulesPaths = []
 
-  paths.forEach(p => {
+  for (const p of paths) {
     const pathParts = p.split('/')
     nodeModulesPaths.push(path.join('node_modules', ...pathParts))
-  })
+  }
 
   return nodeModulesPaths
 }

package/packages/dd-trace/src/appsec/iast/security-controls/index.js

@@ -67,11 +67,11 @@ function getControls (filename) {
 
 function hookModule (filename, module, controlsByFile) {
   try {
-    controlsByFile.forEach(({ type, method, parameters, secureMarks }) => {
+    for (const { type, method, parameters, secureMarks } of controlsByFile) {
       const { target, parent, methodName } = resolve(method, module)
       if (!target) {
         log.error('[ASM] Unable to resolve IAST security control %s:%s', filename, method)
-        return
+        continue
       }
 
       const wrapper = type === SANITIZER_TYPE
@@ -83,7 +83,7 @@ function hookModule (filename, module, controlsByFile) {
       } else {
         module = wrapper
       }
-    })
+    }
   } catch (e) {
     log.error('[ASM] Error initializing IAST security control for %s', filename, e)
   }
@@ -127,18 +127,18 @@ function wrapSanitizer (target, secureMarks) {
 function wrapInputValidator (target, parameters, secureMarks) {
   const allParameters = !parameters?.length
 
-  return shimmer.wrapFunction(target, orig => function () {
+  return shimmer.wrapFunction(target, orig => function (...args) {
     try {
-      [...arguments].forEach((arg, index) => {
+      for (let index = 0; index < args.length; index++) {
         if (allParameters || parameters.includes(index)) {
-          addSecureMarks(arg, secureMarks, false)
+          addSecureMarks(args[index], secureMarks, false)
         }
-      })
-    } catch (e) {
-      log.error('[ASM] Error adding Secure mark for input validator', e)
+      }
+    } catch (error) {
+      log.error('[ASM] Error adding Secure mark for input validator', error)
     }
 
-    return orig.apply(this, arguments)
+    return orig.apply(this, args)
   })
 }
 
@@ -175,5 +175,5 @@ function disable () {
 
 module.exports = {
   configure,
-  disable
+  disable,
 }

package/packages/dd-trace/src/appsec/iast/security-controls/parser.js

@@ -12,23 +12,48 @@ const SANITIZER_TYPE = 'SANITIZER'
 
 const validTypes = new Set([INPUT_VALIDATOR_TYPE, SANITIZER_TYPE])
 
+/**
+ * @param {string} securityControlsConfiguration
+ * @returns {Map<string, Array<{
+ *   type: string,
+ *   secureMarks: number,
+ *   file: string,
+ *   method: string,
+ *   parameters: number[] | undefined
+ * }>>}
+ */
 function parse (securityControlsConfiguration) {
   const controls = new Map()
 
-  securityControlsConfiguration?.replaceAll(/[\r\n\t\v\f]*/g, '')
+  const potentialControls = securityControlsConfiguration
+    .replaceAll(/[\r\n\t\v\f]*/g, '')
     .split(SECURITY_CONTROL_DELIMITER)
-    .map(parseControl)
-    .filter(control => !!control)
-    .forEach(control => {
-      if (!controls.has(control.file)) {
-        controls.set(control.file, [])
+
+  for (const potentialControl of potentialControls) {
+    const control = parseControl(potentialControl)
+    if (control) {
+      const fileControls = controls.get(control.file)
+      if (fileControls) {
+        fileControls.push(control)
+      } else {
+        controls.set(control.file, [control])
       }
-      controls.get(control.file).push(control)
-    })
+    }
+  }
 
   return controls
 }
 
+/**
+ * @param {string} control
+ * @returns {{
+ *   type: string,
+ *   secureMarks: number,
+ *   file: string,
+ *   method: string,
+ *   parameters: number[] | undefined
+ * } | undefined}
+ */
 function parseControl (control) {
   if (!control) return
 
@@ -48,32 +73,39 @@ function parseControl (control) {
   }
 
   let secureMarks = CUSTOM_SECURE_MARK
-  getSecureMarks(marks).forEach(mark => { secureMarks |= mark })
+  for (const mark of getSecureMarks(marks)) {
+    secureMarks |= mark
+  }
   if (secureMarks === CUSTOM_SECURE_MARK) {
     log.warn('[ASM] Invalid security control mark: %s', marks)
     return
   }
 
-  file = file?.trim()
+  file = file.trim()
 
   method = method?.trim()
 
   try {
-    parameters = getParameters(parameters)
+    const parsedParameters = getParameters(parameters)
+    return { type, secureMarks, file, method, parameters: parsedParameters }
   } catch {
     log.warn('[ASM] Invalid non-numeric security control parameter %s', parameters)
-    return
   }
-
-  return { type, secureMarks, file, method, parameters }
 }
 
+/**
+ * @param {string} marks
+ * @returns {number[]}
+ */
 function getSecureMarks (marks) {
-  return marks?.split(SECURITY_CONTROL_ELEMENT_DELIMITER)
+  return marks.split(SECURITY_CONTROL_ELEMENT_DELIMITER)
     .map(getMarkFromVulnerabilityType)
-    .filter(mark => !!mark)
+    .filter(Boolean)
 }
 
+/**
+ * @param {string | undefined} parameters
+ */
 function getParameters (parameters) {
   return parameters?.split(SECURITY_CONTROL_ELEMENT_DELIMITER)
     .map(param => {
@@ -92,5 +124,5 @@ module.exports = {
   parse,
 
   INPUT_VALIDATOR_TYPE,
-  SANITIZER_TYPE
+  SANITIZER_TYPE,
 }

package/packages/dd-trace/src/appsec/iast/tags.js

@@ -3,5 +3,5 @@
 module.exports = {
   IAST_ENABLED_TAG_KEY: '_dd.iast.enabled',
   IAST_JSON_TAG_KEY: '_dd.iast.json',
-  IAST_TRACE_METRIC_PREFIX: '_dd.iast.telemetry'
+  IAST_TRACE_METRIC_PREFIX: '_dd.iast.telemetry',
 }

package/packages/dd-trace/src/appsec/iast/taint-tracking/constants.js

@@ -2,5 +2,5 @@
 
 module.exports = {
   LOG_MESSAGE: 'LOG',
-  REWRITTEN_MESSAGE: 'REWRITTEN'
+  REWRITTEN_MESSAGE: 'REWRITTEN',
 }

package/packages/dd-trace/src/appsec/iast/taint-tracking/csi-methods.js

@@ -16,9 +16,9 @@ const csiMethods = [
   { src: 'trim' },
   { src: 'trimEnd' },
   { src: 'trimStart', dst: 'trim' },
-  { src: 'eval', allowedWithoutCallee: true }
+  { src: 'eval', allowedWithoutCallee: true },
 ]
 
 module.exports = {
-  csiMethods
+  csiMethods,
 }

package/packages/dd-trace/src/appsec/iast/taint-tracking/filter.js

@@ -12,5 +12,5 @@ const isDdTrace = function (file) {
 
 module.exports = {
   isPrivateModule,
-  isDdTrace
+  isDdTrace,
 }

package/packages/dd-trace/src/appsec/iast/taint-tracking/index.js

@@ -6,7 +6,7 @@ const {
   removeTransaction,
   setMaxTransactions,
   enableTaintOperations,
-  disableTaintOperations
+  disableTaintOperations,
 } = require('./operations')
 
 const taintTrackingPlugin = require('./plugin')
@@ -32,5 +32,5 @@ module.exports = {
   setMaxTransactions,
   createTransaction,
   removeTransaction,
-  taintTrackingPlugin
+  taintTrackingPlugin,
 }

package/packages/dd-trace/src/appsec/iast/taint-tracking/operations-taint-object.js

@@ -28,10 +28,7 @@ function taintObject (iastContext, object, type) {
           } else {
             result = tainted
           }
-        } else if (
-          // eslint-disable-next-line eslint-rules/eslint-safe-typeof-object
-          typeof value === 'object' && !visited.has(value)
-        ) {
+        } else if (typeof value === 'object' && !visited.has(value)) {
           visited.add(value)
 
           for (const key of Object.keys(value)) {
@@ -72,7 +69,7 @@ function traverseAndTaint (node, path, cache, transactionId) {
     return tainted
   }
 
-  if (typeof node === 'object') { // eslint-disable-line eslint-rules/eslint-safe-typeof-object
+  if (typeof node === 'object') {
     const keys = Array.isArray(node) ? node.keys() : Object.keys(node)
 
     for (const key of keys) {
@@ -87,5 +84,5 @@ function traverseAndTaint (node, path, cache, transactionId) {
 
 module.exports = {
   taintObject,
-  taintQueryWithCache
+  taintQueryWithCache,
 }