dd-trace 5.97.0 → 5.99.0

package/packages/dd-trace/src/appsec/blocking.js

@@ -6,9 +6,27 @@ const { updateBlockFailureMetric } = require('./telemetry')
 
 const detectedSpecificEndpoints = {}
 
-let templateHtml = blockedTemplates.html
-let templateJson = blockedTemplates.json
-let templateGraphqlJson = blockedTemplates.graphqlJson
+const templateKeyword = '[security_response_id]'
+
+const templates = {
+  html: {
+    body: null,
+    idIndex: -1,
+    type: 'text/html; charset=utf-8',
+  },
+  json: {
+    body: null,
+    idIndex: -1,
+    type: 'application/json',
+  },
+  graphqlJson: {
+    body: null,
+    idIndex: -1,
+    type: 'application/json',
+  },
+}
+
+setTemplates()
 
 let defaultBlockingActionParameters
 
@@ -17,7 +35,7 @@ const responseBlockedSet = new WeakSet()
 const blockDelegations = new WeakMap()
 
 const specificBlockingTypes = {
-  GRAPHQL: 'graphql',
+  GRAPHQL: 'graphqlJson',
 }
 
 function getSpecificKey (method, url) {
@@ -33,21 +51,14 @@ function getBlockWithRedirectData (actionParameters) {
   if (!statusCode || statusCode < 300 || statusCode >= 400) {
     statusCode = 303
   }
-  const headers = {
-    Location: actionParameters.location,
-  }
 
-  return { headers, statusCode }
-}
+  const headers = { Location: actionParameters.location }
 
-function getSpecificBlockingData (type) {
-  switch (type) {
-    case specificBlockingTypes.GRAPHQL:
-      return {
-        type: 'application/json',
-        body: templateGraphqlJson,
-      }
+  if (headers.Location) {
+    headers.Location = headers.Location.replace(templateKeyword, actionParameters.security_response_id ?? '')
   }
+
+  return { headers, statusCode }
 }
 
 function getBlockWithContentData (req, specificType, actionParameters) {
@@ -56,7 +67,7 @@ function getBlockWithContentData (req, specificType, actionParameters) {
 
   const specificBlockingType = specificType || detectedSpecificEndpoints[getSpecificKey(req.method, req.url)]
   if (specificBlockingType) {
-    const specificBlockingContent = getSpecificBlockingData(specificBlockingType)
+    const specificBlockingContent = getTemplate(specificBlockingType, actionParameters)
     type = specificBlockingContent?.type
     body = specificBlockingContent?.body
   }
@@ -65,23 +76,17 @@ function getBlockWithContentData (req, specificType, actionParameters) {
     // parse the Accept header, ex: Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8
     const accept = req.headers.accept?.split(',').map((str) => str.split(';', 1)[0].trim())
 
+    let templateName = 'json'
+
     if (!actionParameters || actionParameters.type === 'auto') {
       if (accept?.includes('text/html') && !accept.includes('application/json')) {
-        type = 'text/html; charset=utf-8'
-        body = templateHtml
-      } else {
-        type = 'application/json'
-        body = templateJson
-      }
-    } else {
-      if (actionParameters.type === 'html') {
-        type = 'text/html; charset=utf-8'
-        body = templateHtml
-      } else {
-        type = 'application/json'
-        body = templateJson
+        templateName = 'html'
       }
+    } else if (actionParameters.type === 'html') {
+      templateName = 'html'
     }
+
+    ({ type, body } = getTemplate(templateName, actionParameters))
   }
 
   const statusCode = actionParameters?.status_code || 403
@@ -165,14 +170,37 @@ function getBlockingAction (actions) {
 }
 
 /**
- * @param {import('../config/config-base')} config - Tracer configuration
+ * @param {import('../config/config-base')} [config] - Tracer configuration
  */
 function setTemplates (config) {
-  templateHtml = config.appsec.blockedTemplateHtml || blockedTemplates.html
+  templates.html.body = config?.appsec?.blockedTemplateHtml
+  templates.json.body = config?.appsec?.blockedTemplateJson
+  templates.graphqlJson.body = config?.appsec?.blockedTemplateGraphql
+
+  for (const type of Object.keys(templates)) {
+    const template = templates[type]
+
+    // set default template if not set by config
+    if (!template.body) template.body = blockedTemplates[type]
+
+    template.idIndex = template.body.indexOf(templateKeyword)
+
+    if (template.idIndex !== -1) {
+      template.body = [
+        template.body.slice(0, template.idIndex),
+        template.body.slice(template.idIndex + templateKeyword.length),
+      ]
+    }
+  }
+}
+
+function getTemplate (type, actionParameters) {
+  const template = templates[type]
+  if (template.idIndex === -1) return template
 
-  templateJson = config.appsec.blockedTemplateJson || blockedTemplates.json
+  const body = template.body[0] + (actionParameters?.security_response_id ?? '') + template.body[1]
 
-  templateGraphqlJson = config.appsec.blockedTemplateGraphql || blockedTemplates.graphqlJson
+  return { body, type: template.type }
 }
 
 function isBlocked (res) {

package/packages/dd-trace/src/appsec/graphql.js

@@ -1,8 +1,8 @@
 'use strict'
 
-const { storage } = require('../../../datadog-core')
 const log = require('../log')
 const web = require('../plugins/util/web')
+const { getActiveRequest } = require('./store')
 const {
   addSpecificEndpoint,
   specificBlockingTypes,
@@ -33,7 +33,7 @@ function disable () {
 }
 
 function onGraphqlStartResolve ({ context, resolverInfo }) {
-  const req = storage('legacy').getStore()?.req
+  const req = getActiveRequest()
 
   if (!req) return
 
@@ -52,7 +52,7 @@ function onGraphqlStartResolve ({ context, resolverInfo }) {
 }
 
 function enterInApolloMiddleware (data) {
-  const req = data?.req || storage('legacy').getStore()?.req
+  const req = data?.req || getActiveRequest()
   if (!req) return
 
   graphqlRequestData.set(req, {
@@ -61,7 +61,7 @@ function enterInApolloMiddleware (data) {
 }
 
 function enterInApolloServerCoreRequest () {
-  const req = storage('legacy').getStore()?.req
+  const req = getActiveRequest()
   if (!req) return
 
   graphqlRequestData.set(req, {
@@ -71,7 +71,7 @@ function enterInApolloServerCoreRequest () {
 }
 
 function enterInApolloRequest () {
-  const req = storage('legacy').getStore()?.req
+  const req = getActiveRequest()
 
   const requestData = graphqlRequestData.get(req)
   if (requestData) {
@@ -83,7 +83,7 @@ function enterInApolloRequest () {
 }
 
 function beforeWriteApolloGraphqlResponse ({ abortController, abortData }) {
-  const req = storage('legacy').getStore()?.req
+  const req = getActiveRequest()
   if (!req) return
 
   const requestData = graphqlRequestData.get(req)

package/packages/dd-trace/src/appsec/index.js

@@ -4,7 +4,6 @@ const log = require('../log')
 const web = require('../plugins/util/web')
 const { extractIp } = require('../plugins/util/ip_extractor')
 const { HTTP_CLIENT_IP } = require('../../../../ext/tags')
-const { storage } = require('../../../datadog-core')
 const { IS_SERVERLESS } = require('../serverless')
 const RuleManager = require('./rule_manager')
 const appsecRemoteConfig = require('./remote_config')
@@ -40,6 +39,7 @@ const Reporter = require('./reporter')
 const appsecTelemetry = require('./telemetry')
 const apiSecuritySampler = require('./api_security_sampler')
 const { isBlocked, block, callBlockDelegation, setTemplates, getBlockingAction } = require('./blocking')
+const { getActiveRequest } = require('./store')
 const UserTracking = require('./user_tracking')
 const graphql = require('./graphql')
 const rasp = require('./rasp')
@@ -116,8 +116,7 @@ function onRequestBodyParsed ({ req, res, body, abortController }) {
   if (body === undefined || body === null) return
 
   if (!req) {
-    const store = storage('legacy').getStore()
-    req = store?.req
+    req = getActiveRequest()
   }
 
   const rootSpan = web.root(req)
@@ -258,8 +257,8 @@ function incomingHttpEndTranslator ({ req, res }) {
 }
 
 function onPassportVerify ({ framework, login, user, success, abortController }) {
-  const store = storage('legacy').getStore()
-  const rootSpan = store?.req && web.root(store.req)
+  const req = getActiveRequest()
+  const rootSpan = req && web.root(req)
 
   if (!rootSpan) {
     log.warn('[ASM] No rootSpan found in onPassportVerify')
@@ -268,12 +267,12 @@ function onPassportVerify ({ framework, login, user, success, abortController })
 
   const results = UserTracking.trackLogin(framework, login, user, success, rootSpan)
 
-  handleResults(results?.actions, store.req, store.req.res, rootSpan, abortController)
+  handleResults(results?.actions, req, web.getContext(req)?.res, rootSpan, abortController)
 }
 
 function onPassportDeserializeUser ({ user, abortController }) {
-  const store = storage('legacy').getStore()
-  const rootSpan = store?.req && web.root(store.req)
+  const req = getActiveRequest()
+  const rootSpan = req && web.root(req)
 
   if (!rootSpan) {
     log.warn('[ASM] No rootSpan found in onPassportDeserializeUser')
@@ -282,7 +281,7 @@ function onPassportDeserializeUser ({ user, abortController }) {
 
   const results = UserTracking.trackUser(user, rootSpan)
 
-  handleResults(results?.actions, store.req, store.req.res, rootSpan, abortController)
+  handleResults(results?.actions, req, web.getContext(req)?.res, rootSpan, abortController)
 }
 
 function onExpressSession ({ req, res, sessionId, abortController }) {
@@ -308,8 +307,7 @@ function onRequestQueryParsed ({ req, res, query, abortController }) {
   if (!query || typeof query !== 'object') return
 
   if (!req) {
-    const store = storage('legacy').getStore()
-    req = store?.req
+    req = getActiveRequest()
   }
 
   const rootSpan = web.root(req)

package/packages/dd-trace/src/appsec/rasp/command_injection.js

@@ -1,8 +1,9 @@
 'use strict'
 
 const { childProcessExecutionTracingChannel } = require('../channels')
-const { storage } = require('../../../../datadog-core')
 const addresses = require('../addresses')
+const web = require('../../plugins/util/web')
+const { getActiveRequest } = require('../store')
 const waf = require('../waf')
 const { RULE_TYPES, handleResult } = require('./utils')
 
@@ -27,8 +28,7 @@ function disable () {
 function analyzeCommandInjection ({ file, fileArgs, shell, abortController }) {
   if (!file) return
 
-  const store = storage('legacy').getStore()
-  const req = store?.req
+  const req = getActiveRequest()
   if (!req) return
 
   const ephemeral = {}
@@ -46,8 +46,7 @@ function analyzeCommandInjection ({ file, fileArgs, shell, abortController }) {
 
   const result = waf.run({ ephemeral }, req, raspRule)
 
-  const res = store?.res
-  handleResult(result, req, res, abortController, config, raspRule)
+  handleResult(result, req, web.getContext(req)?.res, abortController, config, raspRule)
 }
 
 module.exports = {

package/packages/dd-trace/src/appsec/rasp/lfi.js

@@ -4,7 +4,9 @@ const { isAbsolute } = require('path')
 
 const { fsOperationStart, incomingHttpRequestStart, expressResponseRenderStart } = require('../channels')
 const { storage } = require('../../../../datadog-core')
+const web = require('../../plugins/util/web')
 const { FS_OPERATION_PATH } = require('../addresses')
+const { getRequest } = require('../store')
 const waf = require('../waf')
 const { enable: enableFsPlugin, disable: disableFsPlugin, RASP_MODULE } = require('./fs-plugin')
 const { RULE_TYPES, handleResult } = require('./utils')
@@ -53,16 +55,18 @@ function analyzeLfiInResponseRender (ctx) {
   const store = storage('legacy').getStore()
   if (!store) return
 
-  analyzeLfiPath(ctx.view, ctx.req, store.res, ctx.abortController)
+  analyzeLfiPath(ctx.view, ctx.req, web.getContext(ctx.req)?.res, ctx.abortController)
 }
 
 function analyzeLfi (ctx) {
   const store = storage('legacy').getStore()
-  if (!store) return
+  const fs = store?.fs
+  if (!fs) return
 
-  const { req, fs, res } = store
-  if (!req || !fs) return
+  const req = getRequest(store)
+  if (!req) return
 
+  const res = web.getContext(req)?.res
   for (const path of getPaths(ctx, fs)) {
     analyzeLfiPath(path, req, res, ctx.abortController)
   }

package/packages/dd-trace/src/appsec/rasp/sql_injection.js

@@ -6,8 +6,9 @@ const {
   wafRunFinished,
   mysql2OuterQueryStart,
 } = require('../channels')
-const { storage } = require('../../../../datadog-core')
 const addresses = require('../addresses')
+const web = require('../../plugins/util/web')
+const { getActiveRequest } = require('../store')
 const waf = require('../waf')
 const { RULE_TYPES, handleResult } = require('./utils')
 
@@ -49,10 +50,7 @@ function analyzePgSqlInjection (ctx) {
 }
 
 function analyzeSqlInjection (query, dbSystem, abortController) {
-  const store = storage('legacy').getStore()
-  if (!store) return
-
-  const { req, res } = store
+  const req = getActiveRequest()
 
   if (!req) return
 
@@ -76,7 +74,7 @@ function analyzeSqlInjection (query, dbSystem, abortController) {
 
   const result = waf.run({ ephemeral }, req, raspRule)
 
-  handleResult(result, req, res, abortController, config, raspRule)
+  handleResult(result, req, web.getContext(req)?.res, abortController, config, raspRule)
 }
 
 function hasInputAddress (payload) {
@@ -91,10 +89,7 @@ function hasAddressesObjectInputAddress (addressesObject) {
 function clearQuerySet ({ payload }) {
   if (!payload) return
 
-  const store = storage('legacy').getStore()
-  if (!store) return
-
-  const { req } = store
+  const req = getActiveRequest()
   if (!req) return
 
   const executedQueries = reqQueryMap.get(req)

package/packages/dd-trace/src/appsec/rasp/ssrf.js

@@ -5,8 +5,9 @@ const {
   httpClientRequestStart,
   httpClientResponseFinish,
 } = require('../channels')
-const { storage } = require('../../../../datadog-core')
 const addresses = require('../addresses')
+const web = require('../../plugins/util/web')
+const { getActiveRequest } = require('../store')
 const waf = require('../waf')
 const downstream = require('../downstream_requests')
 const { updateRaspRuleMatchMetricTags } = require('../telemetry')
@@ -30,8 +31,7 @@ function disable () {
 }
 
 function analyzeSsrf (ctx) {
-  const store = storage('legacy').getStore()
-  const req = store?.req
+  const req = getActiveRequest()
   const outgoingUrl = (ctx.args.options?.uri && format(ctx.args.options.uri)) ?? ctx.args.uri
 
   if (!req || !outgoingUrl) return
@@ -50,7 +50,7 @@ function analyzeSsrf (ctx) {
 
   const result = waf.run({ ephemeral }, req, raspRule)
 
-  handleResult(result, req, store?.res, ctx.abortController, config, raspRule)
+  handleResult(result, req, web.getContext(req)?.res, ctx.abortController, config, raspRule)
 
   downstream.incrementDownstreamAnalysisCount(req)
 }
@@ -67,8 +67,7 @@ function handleResponseFinish ({ ctx, res, body }) {
   // downstream response object
   if (!res) return
 
-  const store = storage('legacy').getStore()
-  const originatingRequest = store?.req
+  const originatingRequest = getActiveRequest()
   if (!originatingRequest) return
 
   // Skip body analysis for redirect responses