dd-trace 5.84.0 → 5.85.0

package/packages/datadog-plugin-ws/src/receiver.js

@@ -4,12 +4,12 @@ const TracingPlugin = require('../../dd-trace/src/plugins/tracing.js')
 const {
   WEBSOCKET_PTR_KIND,
   SPAN_POINTER_DIRECTION,
-  SPAN_POINTER_DIRECTION_NAME
+  SPAN_POINTER_DIRECTION_NAME,
 } = require('../../dd-trace/src/constants')
 const {
   incrementWebSocketCounter,
   buildWebSocketSpanPointerHash,
-  hasDistributedTracingContext
+  hasDistributedTracingContext,
 } = require('./util')
 
 class WSReceiverPlugin extends TracingPlugin {
@@ -21,13 +21,13 @@ class WSReceiverPlugin extends TracingPlugin {
   bindStart (ctx) {
     const {
       traceWebsocketMessagesInheritSampling,
-      traceWebsocketMessagesSeparateTraces
+      traceWebsocketMessagesSeparateTraces,
     } = this.config
 
     const { byteLength, socket, binary } = ctx
     if (!socket.spanContext) return
 
-    const spanTags = socket.spanContext.spanTags
+    const spanTags = socket.spanTags
     const path = spanTags['resource.name'].split(' ')[1]
     const opCode = binary ? 'binary' : 'text'
 
@@ -43,7 +43,7 @@ class WSReceiverPlugin extends TracingPlugin {
       },
       metrics: {
         'websocket.message.length': byteLength,
-      }
+      },
 
     }, ctx)
 
@@ -72,13 +72,12 @@ class WSReceiverPlugin extends TracingPlugin {
       const linkAttributes = { 'dd.kind': 'executed_by' }
 
       // Add span pointer for context propagation
-      if (this.config.traceWebsocketMessagesEnabled && ctx.socket.handshakeSpan) {
-        const handshakeSpan = ctx.socket.handshakeSpan
+      if (this.config.traceWebsocketMessagesEnabled && ctx.socket.spanContext) {
+        const handshakeContext = ctx.socket.spanContext
 
         // Only add span pointers if distributed tracing is enabled and handshake has distributed context
-        if (hasDistributedTracingContext(handshakeSpan, ctx.socket)) {
+        if (hasDistributedTracingContext(handshakeContext, ctx.socket)) {
           const counter = incrementWebSocketCounter(ctx.socket, 'receiveCounter')
-          const handshakeContext = handshakeSpan.context()
 
           const ptrHash = buildWebSocketSpanPointerHash(
             handshakeContext._traceId,

package/packages/datadog-plugin-ws/src/server.js

@@ -2,8 +2,12 @@
 
 const TracingPlugin = require('../../dd-trace/src/plugins/tracing.js')
 const tags = require('../../../ext/tags.js')
-const { FORMAT_HTTP_HEADERS } = require('../../../ext/formats')
-const { initWebSocketMessageCounters } = require('./util')
+const { HTTP_HEADERS } = require('../../../ext/formats')
+const {
+  createWebSocketSpanContext,
+  hasTraceHeaders,
+  initWebSocketMessageCounters,
+} = require('./util')
 
 const HTTP_STATUS_CODE = tags.HTTP_STATUS_CODE
 
@@ -27,11 +31,12 @@ class WSServerPlugin extends TracingPlugin {
     const indexOfParam = url.indexOf('?')
     const route = indexOfParam === -1 ? url : url.slice(0, indexOfParam)
     const uri = `${protocol}//${host}${route}`
+    const resourceName = `${options.method} ${route}`
 
     ctx.args = { options }
 
     // Extract distributed tracing context from request headers
-    const childOf = this.tracer.extract(FORMAT_HTTP_HEADERS, req.headers)
+    const childOf = this.tracer.extract(HTTP_HEADERS, req.headers)
 
     const service = this.serviceName({ pluginConfig: this.config })
     const span = this.startSpan(this.operationName(), {
@@ -42,19 +47,19 @@ class WSServerPlugin extends TracingPlugin {
         'http.upgraded': 'websocket',
         'http.method': options.method,
         'http.url': uri,
-        'resource.name': `${options.method} ${route}`,
-        'span.kind': 'server'
-      }
+        'resource.name': resourceName,
+        'span.kind': 'server',
+      },
 
     }, ctx)
     ctx.span = span
 
-    ctx.socket.spanContext = ctx.span._spanContext
-    ctx.socket.spanContext.spanTags = ctx.span._spanContext._tags
-    // Store the handshake span for use in message span pointers
-    ctx.socket.handshakeSpan = ctx.span
-    // Store the request headers for distributed tracing check
-    ctx.socket.requestHeaders = req.headers
+    ctx.socket.spanTags = {
+      'resource.name': resourceName,
+      'service.name': service,
+    }
+    ctx.socket.spanContext = createWebSocketSpanContext(ctx.span._spanContext)
+    ctx.socket.hasTraceHeaders = hasTraceHeaders(req.headers)
 
     // Initialize message counters for span pointers
     initWebSocketMessageCounters(ctx.socket)

package/packages/datadog-plugin-ws/src/util.js

@@ -1,8 +1,46 @@
 'use strict'
 
+const DatadogSpanContext = require('../../dd-trace/src/opentracing/span_context')
+
+const TRACE_ID_UPPER_TAG = '_dd.p.tid'
+
 // WeakMap to store message counters per socket without mutating the socket object
 const socketCounters = new WeakMap()
 
+/**
+ * Creates a minimal span context for span links without retaining the full trace.
+ * @param {DatadogSpanContext} spanContext
+ * @returns {DatadogSpanContext | undefined}
+ */
+function createWebSocketSpanContext (spanContext) {
+  if (!spanContext) return
+
+  const traceIdUpper = spanContext._trace?.tags?.[TRACE_ID_UPPER_TAG]
+  const trace = traceIdUpper
+    ? { started: [], finished: [], tags: { [TRACE_ID_UPPER_TAG]: traceIdUpper } }
+    : undefined
+
+  return new DatadogSpanContext({
+    traceId: spanContext._traceId,
+    spanId: spanContext._spanId,
+    parentId: spanContext._parentId,
+    sampling: spanContext._sampling,
+    traceparent: spanContext._traceparent,
+    tracestate: spanContext._tracestate,
+    isRemote: spanContext._isRemote,
+    trace,
+  })
+}
+
+/**
+ * Returns whether distributed trace headers are present.
+ * @param {Record<string, string | string[] | undefined>} headers
+ * @returns {boolean}
+ */
+function hasTraceHeaders (headers) {
+  return !!(headers && (headers['x-datadog-trace-id'] || headers.traceparent))
+}
+
 /**
  * Initializes WebSocket message counters for a socket.
  * @param {object} socket - The WebSocket socket object
@@ -11,7 +49,7 @@ function initWebSocketMessageCounters (socket) {
   if (!socketCounters.has(socket)) {
     socketCounters.set(socket, {
       receiveCounter: 0,
-      sendCounter: 0
+      sendCounter: 0,
     })
   }
 }
@@ -69,14 +107,12 @@ function buildWebSocketSpanPointerHash (handshakeTraceId, handshakeSpanId, count
  * A span has distributed tracing context if it has a parent context that was
  * extracted from headers (remote parent).
  *
- * @param {object} span - The handshake span
- * @param {object} socket - The WebSocket socket object
+ * @param {DatadogSpanContext} spanContext - The handshake span context
+ * @param {{ hasTraceHeaders?: boolean } | undefined} socket - The WebSocket socket object
  * @returns {boolean} True if the span has distributed tracing context
  */
-function hasDistributedTracingContext (span, socket) {
-  if (!span) return false
-  const context = span.context()
-  if (!context) return false
+function hasDistributedTracingContext (spanContext, socket) {
+  if (!spanContext) return false
 
   // Check if this span has a parent. If the parent was extracted from remote headers,
   // then this span is part of a distributed trace.
@@ -86,22 +122,18 @@ function hasDistributedTracingContext (span, socket) {
   //
   // For testing purposes, we also check if Datadog trace headers are present in the socket's
   // upgrade request, which indicates distributed tracing context was sent by the client.
-  if (context._parentId !== null) {
+  if (spanContext._parentId !== null) {
     return true
   }
 
-  // Fallback check: look for distributed tracing headers in the stored request headers
-  if (socket && socket.requestHeaders) {
-    const headers = socket.requestHeaders
-    return !!(headers['x-datadog-trace-id'] || headers.traceparent)
-  }
-
-  return false
+  return !!socket?.hasTraceHeaders
 }
 
 module.exports = {
+  createWebSocketSpanContext,
+  hasTraceHeaders,
   initWebSocketMessageCounters,
   incrementWebSocketCounter,
   buildWebSocketSpanPointerHash,
-  hasDistributedTracingContext
+  hasDistributedTracingContext,
 }

package/packages/datadog-shimmer/src/shimmer.js

@@ -7,7 +7,7 @@ const skipMethods = new Set([
   'caller',
   'arguments',
   'name',
-  'length'
+  'length',
 ])
 const skipMethodSize = skipMethods.size
 
@@ -118,7 +118,7 @@ function wrap (target, name, wrapper, options) {
     value: target[name],
     writable: true,
     configurable: true,
-    enumerable: false
+    enumerable: false,
   }
 
   if (descriptor.set && (!descriptor.get || options?.replaceGetter)) {
@@ -275,5 +275,5 @@ function assertNotClass (target) {
 module.exports = {
   wrap,
   wrapFunction,
-  massWrap
+  massWrap,
 }

package/packages/dd-trace/index.js

@@ -7,7 +7,7 @@ if (!global._ddtrace) {
     value: new TracerProxy(),
     enumerable: false,
     configurable: true,
-    writable: true
+    writable: true,
   })
 
   const ddTraceSymbol = Symbol.for('dd-trace')
@@ -18,7 +18,7 @@ if (!global._ddtrace) {
     },
     enumerable: false,
     configurable: true, // Allow this to be overridden by loading the tracer
-    writable: false
+    writable: false,
   })
 
   process.once('beforeExit', function mainBeforeExit () {

package/packages/dd-trace/src/agent/info.js

@@ -10,7 +10,7 @@ let cachedTimestamp = 0
 
 module.exports = {
   fetchAgentInfo,
-  clearCache // For testing purposes only
+  clearCache, // For testing purposes only
 }
 
 /**
@@ -31,7 +31,7 @@ function fetchAgentInfo (url, callback) {
 
   request('', {
     path: '/info',
-    url
+    url,
   }, (err, res) => {
     if (err) {
       return callback(err)

package/packages/dd-trace/src/agent/url.js

@@ -23,6 +23,6 @@ function getAgentUrl (config) {
   return new URL(format({
     protocol: 'http:',
     hostname: hostname || defaults.hostname,
-    port: port || defaults.port
+    port: port || defaults.port,
   }))
 }

package/packages/dd-trace/src/aiguard/client.js

@@ -5,20 +5,20 @@ async function executeRequest (body, opts) {
   const headers = {
     'Content-Type': 'application/json',
     'Content-Length': Buffer.byteLength(postData),
-    ...opts.headers
+    ...opts.headers,
   }
 
   const response = await fetch(opts.url, {
     method: 'POST',
     headers,
     body: postData,
-    signal: AbortSignal.timeout(opts.timeout)
+    signal: AbortSignal.timeout(opts.timeout),
   })
 
   const responseBody = await response.json()
   return {
     status: response.status,
-    body: responseBody
+    body: responseBody,
   }
 }
 

package/packages/dd-trace/src/aiguard/sdk.js

@@ -15,7 +15,7 @@ const {
   AI_GUARD_META_STRUCT_KEY,
   AI_GUARD_TOOL_NAME_TAG_KEY,
   AI_GUARD_TELEMETRY_REQUESTS,
-  AI_GUARD_TELEMETRY_TRUNCATED
+  AI_GUARD_TELEMETRY_TRUNCATED,
 } = require('./tags')
 
 const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
@@ -68,7 +68,7 @@ class AIGuard extends NoopAIGuard {
       'DD-APPLICATION-KEY': config.appKey,
       'DD-AI-GUARD-VERSION': tracerVersion,
       'DD-AI-GUARD-SOURCE': 'SDK',
-      'DD-AI-GUARD-LANGUAGE': 'nodejs'
+      'DD-AI-GUARD-LANGUAGE': 'nodejs',
     }
     const endpoint = config.experimental.aiguard.endpoint || `https://app.${config.site}/api/v2/ai-guard`
     this.#evaluateUrl = `${endpoint}/evaluate`
@@ -147,10 +147,10 @@ class AIGuard extends NoopAIGuard {
         }
       }
       const metaStruct = {
-        messages: this.#buildMessagesForMetaStruct(messages)
+        messages: this.#buildMessagesForMetaStruct(messages),
       }
       span.meta_struct = {
-        [AI_GUARD_META_STRUCT_KEY]: metaStruct
+        [AI_GUARD_META_STRUCT_KEY]: metaStruct,
       }
       let response
       try {
@@ -159,8 +159,8 @@ class AIGuard extends NoopAIGuard {
             attributes: {
               messages,
               meta: this.#meta,
-            }
-          }
+            },
+          },
         }
         response = await executeRequest(
           payload,

package/packages/dd-trace/src/aiguard/tags.js

@@ -10,5 +10,5 @@ module.exports = {
   AI_GUARD_META_STRUCT_KEY: 'ai_guard',
 
   AI_GUARD_TELEMETRY_REQUESTS: 'ai_guard.requests',
-  AI_GUARD_TELEMETRY_TRUNCATED: 'ai_guard.truncated'
+  AI_GUARD_TELEMETRY_TRUNCATED: 'ai_guard.truncated',
 }

package/packages/dd-trace/src/analytics_sampler.js

@@ -11,5 +11,5 @@ module.exports = {
     } else if (measuredByDefault) {
       span.setTag(MEASURED, true)
     }
-  }
+  },
 }

package/packages/dd-trace/src/appsec/activation.js

@@ -23,7 +23,7 @@ const Activation = {
       default:
         return Activation.DISABLED
     }
-  }
+  },
 }
 
 module.exports = Activation

package/packages/dd-trace/src/appsec/addresses.js

@@ -36,5 +36,5 @@ module.exports = {
   SHELL_COMMAND: 'server.sys.shell.cmd',
 
   LOGIN_SUCCESS: 'server.business_logic.users.login.success',
-  LOGIN_FAILURE: 'server.business_logic.users.login.failure'
+  LOGIN_FAILURE: 'server.business_logic.users.login.failure',
 }

package/packages/dd-trace/src/appsec/api_security_sampler.js

@@ -92,5 +92,5 @@ module.exports = {
   disable,
   sampleRequest,
   isSampled,
-  computeKey
+  computeKey,
 }

package/packages/dd-trace/src/appsec/blocked_templates.js

@@ -10,5 +10,5 @@ const graphqlJson = '{"errors":[{"message":"You\'ve been blocked","extensions":{
 module.exports = {
   html,
   json,
-  graphqlJson
+  graphqlJson,
 }

package/packages/dd-trace/src/appsec/blocking.js

@@ -17,7 +17,7 @@ const responseBlockedSet = new WeakSet()
 const blockDelegations = new WeakMap()
 
 const specificBlockingTypes = {
-  GRAPHQL: 'graphql'
+  GRAPHQL: 'graphql',
 }
 
 function getSpecificKey (method, url) {
@@ -34,7 +34,7 @@ function getBlockWithRedirectData (actionParameters) {
     statusCode = 303
   }
   const headers = {
-    Location: actionParameters.location
+    Location: actionParameters.location,
   }
 
   return { headers, statusCode }
@@ -45,7 +45,7 @@ function getSpecificBlockingData (type) {
     case specificBlockingTypes.GRAPHQL:
       return {
         type: 'application/json',
-        body: templateGraphqlJson
+        body: templateGraphqlJson,
       }
   }
 }
@@ -88,7 +88,7 @@ function getBlockWithContentData (req, specificType, actionParameters) {
 
   const headers = {
     'Content-Type': type,
-    'Content-Length': Buffer.byteLength(body)
+    'Content-Length': Buffer.byteLength(body),
   }
 
   return { body, statusCode, headers }
@@ -192,5 +192,5 @@ module.exports = {
   getBlockingAction,
   setTemplates,
   isBlocked,
-  setDefaultBlockingActionParameters
+  setDefaultBlockingActionParameters,
 }

package/packages/dd-trace/src/appsec/channels.js

@@ -42,5 +42,5 @@ module.exports = {
   setCookieChannel: dc.channel('datadog:iast:set-cookie'),
   setUncaughtExceptionCaptureCallbackStart: dc.channel('datadog:process:setUncaughtExceptionCaptureCallback:start'),
   startGraphqlResolve: dc.channel('datadog:graphql:resolver:start'),
-  wafRunFinished: dc.channel('datadog:waf:run:finish')
+  wafRunFinished: dc.channel('datadog:waf:run:finish'),
 }

package/packages/dd-trace/src/appsec/graphql.js

@@ -7,7 +7,7 @@ const {
   addSpecificEndpoint,
   specificBlockingTypes,
   getBlockingData,
-  getBlockingAction
+  getBlockingAction,
 } = require('./blocking')
 const waf = require('./waf')
 const addresses = require('./addresses')
@@ -16,7 +16,7 @@ const {
   graphqlMiddlewareChannel,
   apolloHttpServerChannel,
   apolloChannel,
-  apolloServerCoreChannel
+  apolloServerCoreChannel,
 } = require('./channels')
 const { updateBlockFailureMetric } = require('./telemetry')
 
@@ -56,7 +56,7 @@ function enterInApolloMiddleware (data) {
   if (!req) return
 
   graphqlRequestData.set(req, {
-    blocked: false
+    blocked: false,
   })
 }
 
@@ -66,7 +66,7 @@ function enterInApolloServerCoreRequest () {
 
   graphqlRequestData.set(req, {
     isInGraphqlRequest: true,
-    blocked: false
+    blocked: false,
   })
 }
 
@@ -114,41 +114,41 @@ function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {
 
 function enableApollo () {
   graphqlMiddlewareChannel.subscribe({
-    start: enterInApolloMiddleware
+    start: enterInApolloMiddleware,
   })
 
   apolloServerCoreChannel.subscribe({
     start: enterInApolloServerCoreRequest,
-    asyncEnd: beforeWriteApolloGraphqlResponse
+    asyncEnd: beforeWriteApolloGraphqlResponse,
   })
 
   apolloChannel.subscribe({
     start: enterInApolloRequest,
-    asyncEnd: beforeWriteApolloGraphqlResponse
+    asyncEnd: beforeWriteApolloGraphqlResponse,
   })
 
   apolloHttpServerChannel.subscribe({
-    start: enterInApolloMiddleware
+    start: enterInApolloMiddleware,
   })
 }
 
 function disableApollo () {
   graphqlMiddlewareChannel.unsubscribe({
-    start: enterInApolloMiddleware
+    start: enterInApolloMiddleware,
   })
 
   apolloServerCoreChannel.unsubscribe({
     start: enterInApolloServerCoreRequest,
-    asyncEnd: beforeWriteApolloGraphqlResponse
+    asyncEnd: beforeWriteApolloGraphqlResponse,
   })
 
   apolloChannel.unsubscribe({
     start: enterInApolloRequest,
-    asyncEnd: beforeWriteApolloGraphqlResponse
+    asyncEnd: beforeWriteApolloGraphqlResponse,
   })
 
   apolloHttpServerChannel.unsubscribe({
-    start: enterInApolloMiddleware
+    start: enterInApolloMiddleware,
   })
 }
 
@@ -162,5 +162,5 @@ function disableGraphql () {
 
 module.exports = {
   enable,
-  disable
+  disable,
 }

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js

@@ -20,5 +20,5 @@ module.exports = {
   WEAK_CIPHER_ANALYZER: require('./weak-cipher-analyzer'),
   WEAK_HASH_ANALYZER: require('./weak-hash-analyzer'),
   WEAK_RANDOMNESS_ANALYZER: require('./weak-randomness-analyzer'),
-  XCONTENTTYPE_HEADER_MISSING_ANALYZER: require('./xcontenttype-header-missing-analyzer')
+  XCONTENTTYPE_HEADER_MISSING_ANALYZER: require('./xcontenttype-header-missing-analyzer'),
 }

package/packages/dd-trace/src/appsec/iast/analyzers/cookie-analyzer.js

@@ -9,7 +9,7 @@ const EXCLUDED_PATHS = [
   // Fastify
   getNodeModulesPaths('fastify/lib/reply.js'),
   getNodeModulesPaths('fastify/lib/hooks.js'),
-  getNodeModulesPaths('@fastify/cookie/plugin.js')
+  getNodeModulesPaths('@fastify/cookie/plugin.js'),
 ]
 
 class CookieAnalyzer extends Analyzer {

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-base-analyzer.js

@@ -43,14 +43,15 @@ class HardcodedBaseAnalyzer extends Analyzer {
     if (matches.length) {
       const file = getRelativePath(secrets.file)
 
-      matches
-        .forEach(match => this._report({
+      for (const match of matches) {
+        this._report({
           file,
           line: match.location.line,
           column: match.location.column,
           ident: match.location.ident,
-          data: match.ruleId
-        }))
+          data: match.ruleId,
+        })
+      }
     }
   }
 
@@ -63,7 +64,7 @@ class HardcodedBaseAnalyzer extends Analyzer {
       path: value.file,
       line: value.line,
       column: value.column,
-      isInternal: false
+      isInternal: false,
     }
   }
 }

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-password-rules.js

@@ -6,6 +6,6 @@ module.exports = [
   {
     id: 'hardcoded-password',
     regex: /(?:pwd|pswd|pass|secret)(?:[0-9a-z\-_\t.]{0,20})(?:[\s|']|[\s|""]){0,3}(?:=|>|:{1,3}=|\|\|:|<=|=>|:|\?=)(?:'|""|\s|=|\x60){0,5}([0-9a-z\-_.=]{10,150})(?:['"\s\x60;]|$)/i,
-    type: NameAndValue
-  }
+    type: NameAndValue,
+  },
 ]

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-rule-type.js

@@ -2,5 +2,5 @@
 
 module.exports = {
   ValueOnly: 'ValueOnly',
-  NameAndValue: 'NameAndValue'
+  NameAndValue: 'NameAndValue',
 }