dd-trace 5.96.0 → 5.98.0

package/packages/datadog-plugin-pg/src/index.js

@@ -32,7 +32,7 @@ class PGPlugin extends DatabasePlugin {
       span.setTag('db.stream', 1)
     }
 
-    query.__ddInjectableQuery = this.injectDbmQuery(span, query.text, service, !!query.name)
+    query.__ddInjectableQuery = this.injectDbmQuery(span, query.text, service.name, !!query.name)
 
     return ctx.currentStore
   }

package/packages/datadog-plugin-tedious/src/index.js

@@ -28,7 +28,7 @@ class TediousPlugin extends DatabasePlugin {
 
     // SQL Server includes comments when caching queries
     // For that reason we allow service mode but not full mode
-    ctx.sql = this.injectDbmQuery(span, ctx.queryOrProcedure, service, true)
+    ctx.sql = this.injectDbmQuery(span, ctx.queryOrProcedure, service.name, true)
     return ctx.currentStore
   }
 }

package/packages/datadog-plugin-ws/src/close.js

@@ -47,7 +47,7 @@ class WSClosePlugin extends TracingPlugin {
     }
 
     if (isPeerClose && traceWebsocketMessagesInheritSampling && traceWebsocketMessagesSeparateTraces) {
-      span.setTag('_dd.dm.service', spanTags['service.name'] || service)
+      span.setTag('_dd.dm.service', spanTags['service.name'] || service.name)
       span.setTag('_dd.dm.resource', spanTags['resource.name'] || `websocket ${path}`)
       span.setTag('_dd.dm.inherited', 1)
     }

package/packages/datadog-plugin-ws/src/receiver.js

@@ -48,7 +48,7 @@ class WSReceiverPlugin extends TracingPlugin {
     }, ctx)
 
     if (traceWebsocketMessagesInheritSampling && traceWebsocketMessagesSeparateTraces) {
-      span.setTag('_dd.dm.service', spanTags['service.name'] || service)
+      span.setTag('_dd.dm.service', spanTags['service.name'] || service.name)
       span.setTag('_dd.dm.resource', spanTags['resource.name'] || `websocket ${path}`)
       span.setTag('_dd.dm.inherited', 1)
     }

package/packages/datadog-webpack/index.js

@@ -21,12 +21,12 @@ for (const hook of Object.values(hooks)) {
 
 const modulesOfInterest = new Set()
 
-for (const instrumentation of Object.values(instrumentations)) {
+for (const [name, instrumentation] of Object.entries(instrumentations)) {
   for (const entry of instrumentation) {
     if (entry.file) {
-      modulesOfInterest.add(`${entry.name}/${entry.file}`) // e.g. "redis/my/file.js"
+      modulesOfInterest.add(`${name}/${entry.file}`) // e.g. "redis/my/file.js"
     } else {
-      modulesOfInterest.add(entry.name) // e.g. "redis"
+      modulesOfInterest.add(name) // e.g. "redis"
     }
   }
 }

package/packages/dd-trace/index.js

@@ -1,23 +1,16 @@
 'use strict'
 
 if (!global._ddtrace) {
-  const TracerProxy = require('./src')
-
-  Object.defineProperty(global, '_ddtrace', {
-    value: new TracerProxy(),
-    enumerable: false,
-    configurable: true,
-    writable: true,
-  })
-
   const ddTraceSymbol = Symbol.for('dd-trace')
 
+  // Set up beforeExitHandlers before loading the tracer so that modules loaded
+  // during require('./src') can register handlers.
   Object.defineProperty(globalThis, ddTraceSymbol, {
     value: {
       beforeExitHandlers: new Set(),
     },
     enumerable: false,
-    configurable: true, // Allow this to be overridden by loading the tracer
+    configurable: true,
     writable: false,
   })
 
@@ -29,6 +22,15 @@ if (!global._ddtrace) {
     }
   })
 
+  const TracerProxy = require('./src')
+
+  Object.defineProperty(global, '_ddtrace', {
+    value: new TracerProxy(),
+    enumerable: false,
+    configurable: true,
+    writable: true,
+  })
+
   global._ddtrace.default = global._ddtrace
   global._ddtrace.tracer = global._ddtrace
 }

package/packages/dd-trace/src/agent/url.js

@@ -1,7 +1,7 @@
 'use strict'
 
 const { URL, format } = require('url')
-const defaults = require('../config/defaults')
+const { defaults } = require('../config/defaults')
 
 module.exports = { getAgentUrl }
 
@@ -12,7 +12,7 @@ module.exports = { getAgentUrl }
 
 /**
  * Gets the agent URL from config, constructing it from hostname/port if needed
- * @param {ReturnType<import('../config')>} config - Tracer configuration object
+ * @param {Partial<import('../config/config-base')>} config - Tracer configuration object
  * @returns {URL} The agent URL
  */
 function getAgentUrl (config) {

package/packages/dd-trace/src/aiguard/sdk.js

@@ -25,11 +25,12 @@ const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
 const ALLOW = 'ALLOW'
 
 class AIGuardAbortError extends Error {
-  constructor (reason, tags, sds) {
+  constructor (reason, tags, tagProbs, sds) {
     super(reason)
     this.name = 'AIGuardAbortError'
     this.reason = reason
     this.tags = tags
+    this.tagProbabilities = tagProbs
     this.sds = sds || []
   }
 }
@@ -57,6 +58,10 @@ class AIGuard extends NoopAIGuard {
   #maxContentSize
   #meta
 
+  /**
+   * @param {import('../tracer')} tracer - Tracer instance
+   * @param {import('../config/config-base')} config - Tracer configuration
+   */
   constructor (tracer, config) {
     super()
 
@@ -184,38 +189,37 @@ class AIGuard extends NoopAIGuard {
           `AI Guard service call failed, status ${response.status}`,
           { errors: response.body?.errors })
       }
-      let action, reason, tags, sdsFindings, blockingEnabled
-      try {
-        const attr = response.body.data.attributes
-        if (!attr.action) {
-          throw new Error('Action missing from response')
-        }
-        action = attr.action
-        reason = attr.reason
-        tags = attr.tags
-        sdsFindings = attr.sds_findings || []
-        blockingEnabled = attr.is_blocking_enabled ?? false
-      } catch (e) {
+      const attr = response.body?.data?.attributes
+      if (!attr?.action) {
         appsecMetrics.count(AI_GUARD_TELEMETRY_REQUESTS, { error: true }).inc(1)
-        throw new AIGuardClientError(`AI Guard service returned unexpected response : ${response.body}`, { cause: e })
+        throw new AIGuardClientError(`AI Guard service returned unexpected response : ${response.body}`)
+      }
+      const action = attr.action
+      const reason = attr.reason
+      const tags = attr.tags ?? []
+      if (tags.length > 0) {
+        metaStruct.attack_categories = tags
       }
+      const sdsFindings = attr.sds_findings ?? []
+      if (sdsFindings.length > 0) {
+        metaStruct.sds = sdsFindings
+      }
+      const tagProbabilities = attr.tag_probs ?? {}
+      if (attr.tag_probs) {
+        metaStruct.tag_probs = tagProbabilities
+      }
+      const blockingEnabled = attr.is_blocking_enabled ?? false
       const shouldBlock = block && blockingEnabled && action !== ALLOW
       appsecMetrics.count(AI_GUARD_TELEMETRY_REQUESTS, { action, error: false, block: shouldBlock }).inc(1)
       span.setTag(AI_GUARD_ACTION_TAG_KEY, action)
       if (reason) {
         span.setTag(AI_GUARD_REASON_TAG_KEY, reason)
       }
-      if (tags?.length > 0) {
-        metaStruct.attack_categories = tags
-      }
-      if (sdsFindings?.length > 0) {
-        metaStruct.sds = sdsFindings
-      }
       if (shouldBlock) {
         span.setTag(AI_GUARD_BLOCKED_TAG_KEY, 'true')
-        throw new AIGuardAbortError(reason, tags, sdsFindings)
+        throw new AIGuardAbortError(reason, tags, tagProbabilities, sdsFindings)
       }
-      return { action, reason, tags, sds: sdsFindings }
+      return { action, reason, tags, tagProbabilities, sds: sdsFindings }
     })
   }
 }

package/packages/dd-trace/src/appsec/blocked_templates.js

@@ -1,11 +1,12 @@
 /* eslint-disable @stylistic/max-len */
+/* eslint-disable @stylistic/quotes */
 'use strict'
 
-const html = '<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>You\'ve been blocked</title><style>a,body,div,html,span{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}body{background:-webkit-radial-gradient(26% 19%,circle,#fff,#f4f7f9);background:radial-gradient(circle at 26% 19%,#fff,#f4f7f9);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;width:100%;min-height:100vh;line-height:1;flex-direction:column}p{display:block}main{text-align:center;flex:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;flex-direction:column}p{font-size:18px;line-height:normal;color:#646464;font-family:sans-serif;font-weight:400}a{color:#4842b7}footer{width:100%;text-align:center}footer p{font-size:16px}</style></head><body><main><p>Sorry, you cannot access this page. Please contact the customer service team.</p></main><footer><p>Security provided by <a href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/" target="_blank">Datadog</a></p></footer></body></html>'
+const html = `<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>You've been blocked</title><style>a,body,div,html,span{margin:0;padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline}body{background:-webkit-radial-gradient(26% 19%,circle,#fff,#f4f7f9);background:radial-gradient(circle at 26% 19%,#fff,#f4f7f9);display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;width:100%;min-height:100vh;line-height:1;flex-direction:column}p{display:block}main{text-align:center;flex:1;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-ms-flex-line-pack:center;align-content:center;flex-direction:column}p{font-size:18px;line-height:normal;color:#646464;font-family:sans-serif;font-weight:400}a{color:#4842b7}footer{width:100%;text-align:center}footer p{font-size:16px}.security-response-id{font-size:14px;color:#999;margin-top:20px;font-family:monospace}</style></head><body><main><p>Sorry, you cannot access this page. Please contact the customer service team.</p><p class="security-response-id">Security Response ID: [security_response_id]</p></main><footer><p>Security provided by <a href="https://www.datadoghq.com/product/security-platform/application-security-monitoring/" target="_blank" rel="noopener noreferrer">Datadog</a></p></footer></body></html>`
 
-const json = '{"errors":[{"title":"You\'ve been blocked","detail":"Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}'
+const json = `{"errors":[{"title":"You've been blocked","detail":"Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}],"security_response_id":"[security_response_id]"}`
 
-const graphqlJson = '{"errors":[{"message":"You\'ve been blocked","extensions":{"detail":"Sorry, you cannot perform this operation. Please contact the customer service team. Security provided by Datadog."}}]}'
+const graphqlJson = `{"errors":[{"message":"You've been blocked","extensions":{"detail":"Sorry, you cannot perform this operation. Please contact the customer service team. Security provided by Datadog."}}],"security_response_id":"[security_response_id]"}`
 
 module.exports = {
   html,

package/packages/dd-trace/src/appsec/blocking.js

@@ -6,9 +6,27 @@ const { updateBlockFailureMetric } = require('./telemetry')
 
 const detectedSpecificEndpoints = {}
 
-let templateHtml = blockedTemplates.html
-let templateJson = blockedTemplates.json
-let templateGraphqlJson = blockedTemplates.graphqlJson
+const templateKeyword = '[security_response_id]'
+
+const templates = {
+  html: {
+    body: null,
+    idIndex: -1,
+    type: 'text/html; charset=utf-8',
+  },
+  json: {
+    body: null,
+    idIndex: -1,
+    type: 'application/json',
+  },
+  graphqlJson: {
+    body: null,
+    idIndex: -1,
+    type: 'application/json',
+  },
+}
+
+setTemplates()
 
 let defaultBlockingActionParameters
 
@@ -17,7 +35,7 @@ const responseBlockedSet = new WeakSet()
 const blockDelegations = new WeakMap()
 
 const specificBlockingTypes = {
-  GRAPHQL: 'graphql',
+  GRAPHQL: 'graphqlJson',
 }
 
 function getSpecificKey (method, url) {
@@ -33,21 +51,14 @@ function getBlockWithRedirectData (actionParameters) {
   if (!statusCode || statusCode < 300 || statusCode >= 400) {
     statusCode = 303
   }
-  const headers = {
-    Location: actionParameters.location,
-  }
 
-  return { headers, statusCode }
-}
+  const headers = { Location: actionParameters.location }
 
-function getSpecificBlockingData (type) {
-  switch (type) {
-    case specificBlockingTypes.GRAPHQL:
-      return {
-        type: 'application/json',
-        body: templateGraphqlJson,
-      }
+  if (headers.Location) {
+    headers.Location = headers.Location.replace(templateKeyword, actionParameters.security_response_id ?? '')
   }
+
+  return { headers, statusCode }
 }
 
 function getBlockWithContentData (req, specificType, actionParameters) {
@@ -56,7 +67,7 @@ function getBlockWithContentData (req, specificType, actionParameters) {
 
   const specificBlockingType = specificType || detectedSpecificEndpoints[getSpecificKey(req.method, req.url)]
   if (specificBlockingType) {
-    const specificBlockingContent = getSpecificBlockingData(specificBlockingType)
+    const specificBlockingContent = getTemplate(specificBlockingType, actionParameters)
     type = specificBlockingContent?.type
     body = specificBlockingContent?.body
   }
@@ -65,23 +76,17 @@ function getBlockWithContentData (req, specificType, actionParameters) {
     // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
     const accept = req.headers.accept?.split(',').map((str) => str.split(';', 1)[0].trim())
 
+    let templateName = 'json'
+
     if (!actionParameters || actionParameters.type === 'auto') {
       if (accept?.includes('text/html') && !accept.includes('application/json')) {
-        type = 'text/html; charset=utf-8'
-        body = templateHtml
-      } else {
-        type = 'application/json'
-        body = templateJson
-      }
-    } else {
-      if (actionParameters.type === 'html') {
-        type = 'text/html; charset=utf-8'
-        body = templateHtml
-      } else {
-        type = 'application/json'
-        body = templateJson
+        templateName = 'html'
       }
+    } else if (actionParameters.type === 'html') {
+      templateName = 'html'
     }
+
+    ({ type, body } = getTemplate(templateName, actionParameters))
   }
 
   const statusCode = actionParameters?.status_code || 403
@@ -164,12 +169,38 @@ function getBlockingAction (actions) {
   return actions?.redirect_request || actions?.block_request
 }
 
+/**
+ * @param {import('../config/config-base')} [config] - Tracer configuration
+ */
 function setTemplates (config) {
-  templateHtml = config.appsec.blockedTemplateHtml || blockedTemplates.html
+  templates.html.body = config?.appsec?.blockedTemplateHtml
+  templates.json.body = config?.appsec?.blockedTemplateJson
+  templates.graphqlJson.body = config?.appsec?.blockedTemplateGraphql
+
+  for (const type of Object.keys(templates)) {
+    const template = templates[type]
+
+    // set default template if not set by config
+    if (!template.body) template.body = blockedTemplates[type]
+
+    template.idIndex = template.body.indexOf(templateKeyword)
+
+    if (template.idIndex !== -1) {
+      template.body = [
+        template.body.slice(0, template.idIndex),
+        template.body.slice(template.idIndex + templateKeyword.length),
+      ]
+    }
+  }
+}
+
+function getTemplate (type, actionParameters) {
+  const template = templates[type]
+  if (template.idIndex === -1) return template
 
-  templateJson = config.appsec.blockedTemplateJson || blockedTemplates.json
+  const body = template.body[0] + (actionParameters?.security_response_id ?? '') + template.body[1]
 
-  templateGraphqlJson = config.appsec.blockedTemplateGraphql || blockedTemplates.graphqlJson
+  return { body, type: template.type }
 }
 
 function isBlocked (res) {

package/packages/dd-trace/src/appsec/iast/iast-plugin.js

@@ -168,7 +168,7 @@ class IastPlugin extends Plugin {
     loadChannel.subscribe(this.onInstrumentationLoadedListener)
 
     // check for already instrumented modules
-    for (const name in instrumentations) {
+    for (const name of Object.keys(instrumentations)) {
       this._onInstrumentationLoaded(name)
     }
   }

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js

@@ -3,7 +3,7 @@
 
 const log = require('../../../../log')
 const vulnerabilities = require('../../vulnerabilities')
-const defaults = require('../../../../config/defaults')
+const { defaults } = require('../../../../config/defaults')
 
 const { contains, intersects, remove } = require('./range-utils')
 

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/utils.js

@@ -2,7 +2,7 @@
 
 const crypto = require('crypto')
 
-const defaults = require('../../../config/defaults')
+const { defaults } = require('../../../config/defaults')
 
 const STRINGIFY_RANGE_KEY = 'DD_' + crypto.randomBytes(20).toString('hex')
 const STRINGIFY_SENSITIVE_KEY = STRINGIFY_RANGE_KEY + 'SENSITIVE'

package/packages/dd-trace/src/appsec/remote_config.js

@@ -76,6 +76,7 @@ function enableOrDisableAppsec (action, rcConfig, config, appsec) {
       appsec.disable()
     }
 
+    // TODO: Use configWithOrigin /generateTelemetry instead of manually constructing the change.
     updateConfig([
       {
         name: 'appsec.enabled',

package/packages/dd-trace/src/appsec/sdk/index.js

@@ -26,6 +26,10 @@ class EventTrackingV2 {
 }
 
 class AppsecSdk {
+  /**
+   * @param {import('../../tracer')} tracer - Tracer instance
+   * @param {import('../../config/config-base')} config - Tracer configuration
+   */
   constructor (tracer, config) {
     this._tracer = tracer
     if (config) {

package/packages/dd-trace/src/appsec/sdk/set_user.js

@@ -19,7 +19,7 @@ function setUser (tracer, user) {
     return
   }
 
-  const rootSpan = getRootSpan(tracer)
+  const rootSpan = getRootSpan()
   if (!rootSpan) {
     log.warn('[ASM] Root span not available in setUser')
     return

package/packages/dd-trace/src/appsec/sdk/track_event.js

@@ -21,7 +21,7 @@ function trackUserLoginSuccessEvent (tracer, user, metadata) {
 
   incrementSdkEventMetric('login_success', 'v1')
 
-  const rootSpan = getRootSpan(tracer)
+  const rootSpan = getRootSpan()
   if (!rootSpan) {
     log.warn('[ASM] Root span not available in trackUserLoginSuccessEvent')
     return
@@ -54,7 +54,7 @@ function trackUserLoginFailureEvent (tracer, userId, exists, metadata) {
     ...metadata,
   }
 
-  trackEvent('users.login.failure', fields, 'trackUserLoginFailureEvent', getRootSpan(tracer))
+  trackEvent('users.login.failure', fields, 'trackUserLoginFailureEvent', getRootSpan())
 
   runWaf('users.login.failure', { login: userId })
 
@@ -67,7 +67,7 @@ function trackCustomEvent (tracer, eventName, metadata) {
     return
   }
 
-  trackEvent(eventName, metadata, 'trackCustomEvent', getRootSpan(tracer))
+  trackEvent(eventName, metadata, 'trackCustomEvent', getRootSpan())
 
   incrementSdkEventMetric('custom', 'v1')
 
@@ -84,7 +84,7 @@ function trackUserLoginSuccessV2 (tracer, login, user, metadata) {
 
   incrementSdkEventMetric('login_success', 'v2')
 
-  const rootSpan = getRootSpan(tracer)
+  const rootSpan = getRootSpan()
   if (!rootSpan) {
     log.warn('[ASM] Root span not available in eventTrackingV2.trackUserLoginSuccess')
     return
@@ -122,7 +122,7 @@ function trackUserLoginFailureV2 (tracer, login, exists, metadata) {
 
   incrementSdkEventMetric('login_failure', 'v2')
 
-  const rootSpan = getRootSpan(tracer)
+  const rootSpan = getRootSpan()
   if (!rootSpan) {
     log.warn('[ASM] Root span not available in eventTrackingV2.trackUserLoginFailure')
     return

package/packages/dd-trace/src/appsec/sdk/user_blocking.js

@@ -19,7 +19,7 @@ function checkUserAndSetUser (tracer, user) {
     return false
   }
 
-  const rootSpan = getRootSpan(tracer)
+  const rootSpan = getRootSpan()
   if (rootSpan) {
     if (!rootSpan.context()._tags['usr.id']) {
       setUserTags(user, rootSpan)
@@ -45,7 +45,7 @@ function blockRequest (tracer, req, res) {
     return false
   }
 
-  const rootSpan = getRootSpan(tracer)
+  const rootSpan = getRootSpan()
   if (!rootSpan) {
     log.warn('[ASM] Root span not available in blockRequest')
     return false

package/packages/dd-trace/src/appsec/sdk/utils.js

@@ -1,7 +1,9 @@
 'use strict'
 
-function getRootSpan (tracer) {
-  let span = tracer.scope().active()
+const { storage } = require('../../../../datadog-core')
+
+function getRootSpan () {
+  let span = storage('legacy').getStore()?.span
   if (!span) return
 
   const context = span.context()

package/packages/dd-trace/src/ci-visibility/dynamic-instrumentation/index.js

@@ -11,6 +11,9 @@ const probeIdToResolveBreakpointSet = new Map()
 const probeIdToResolveBreakpointRemove = new Map()
 
 class TestVisDynamicInstrumentation {
+  /**
+   * @param {import('../../config/config-base')} config - Tracer configuration
+   */
   constructor (config) {
     this._config = config
     this.worker = null
@@ -83,7 +86,6 @@ class TestVisDynamicInstrumentation {
           DD_TRACE_ENABLED: 'false',
           DD_TEST_FAILED_TEST_REPLAY_ENABLED: 'false',
           DD_CIVISIBILITY_MANUAL_API_ENABLED: 'false',
-          DD_TRACING_ENABLED: 'false',
           DD_INSTRUMENTATION_TELEMETRY_ENABLED: 'false',
         },
         workerData: {
@@ -150,6 +152,9 @@ class TestVisDynamicInstrumentation {
 
 let dynamicInstrumentation
 
+/**
+ * @param {import('../../config/config-base')} config - Tracer configuration
+ */
 module.exports = function createAndGetTestVisDynamicInstrumentation (config) {
   if (dynamicInstrumentation) {
     return dynamicInstrumentation

package/packages/dd-trace/src/ci-visibility/test-api-manual/test-api-manual-plugin.js

@@ -54,6 +54,10 @@ class TestApiManualPlugin extends CiPlugin {
     })
   }
 
+  /**
+   * @param {import('../../config/config-base')} config - Tracer configuration
+   * @param {boolean} shouldGetEnvironmentData - Whether to get environment data
+   */
   configure (config, shouldGetEnvironmentData) {
     this._config = config
     super.configure(config, shouldGetEnvironmentData)