dd-trace 6.0.0-pre-71c4307 → 6.0.0-pre-0d49ecf

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dd-trace",
-  "version": "6.0.0-pre-71c4307",
+  "version": "6.0.0-pre-0d49ecf",
   "description": "Datadog APM tracing client for JavaScript",
   "main": "index.js",
   "typings": "index.d.ts",
@@ -33,7 +33,7 @@
     "test:lambda:ci": "nyc --no-clean --include \"packages/dd-trace/src/lambda/**/*.js\" -- npm run test:lambda",
     "test:llmobs:sdk": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" --exclude \"packages/dd-trace/test/llmobs/plugins/**/*.spec.js\" \"packages/dd-trace/test/llmobs/**/*.spec.js\" ",
     "test:llmobs:sdk:ci": "nyc --no-clean --include \"packages/dd-trace/src/llmobs/**/*.js\" -- npm run test:llmobs:sdk",
-    "test:llmobs:plugins": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/dd-trace/test/llmobs/plugins/**/*.spec.js\"",
+    "test:llmobs:plugins": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/dd-trace/test/llmobs/plugins/@($(echo $PLUGINS))/*.spec.js\"",
     "test:llmobs:plugins:ci": "yarn services && nyc --no-clean --include \"packages/dd-trace/src/llmobs/**/*.js\" -- npm run test:llmobs:plugins",
     "test:plugins": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/datadog-instrumentations/test/@($(echo $PLUGINS)).spec.js\" \"packages/datadog-plugin-@($(echo $PLUGINS))/test/**/*.spec.js\"",
     "test:plugins:ci": "yarn services && nyc --no-clean --include \"packages/datadog-instrumentations/src/@($(echo $PLUGINS)).js\" --include \"packages/datadog-instrumentations/src/@($(echo $PLUGINS))/**/*.js\" --include \"packages/datadog-plugin-@($(echo $PLUGINS))/src/**/*.js\" -- npm run test:plugins",
@@ -81,7 +81,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@datadog/libdatadog": "^0.3.0",
+    "@datadog/libdatadog": "^0.4.0",
     "@datadog/native-appsec": "8.4.0",
     "@datadog/native-iast-rewriter": "2.6.1",
     "@datadog/native-iast-taint-tracking": "3.2.0",

package/packages/datadog-instrumentations/src/helpers/hooks.js

@@ -88,6 +88,7 @@ module.exports = {
   mysql2: () => require('../mysql2'),
   net: () => require('../net'),
   next: () => require('../next'),
+  'node-serialize': () => require('../node-serialize'),
   'node:child_process': () => require('../child_process'),
   'node:crypto': () => require('../crypto'),
   'node:dns': () => require('../dns'),
@@ -96,6 +97,7 @@ module.exports = {
   'node:https': () => require('../http'),
   'node:net': () => require('../net'),
   'node:url': () => require('../url'),
+  'node:vm': () => require('../vm'),
   nyc: () => require('../nyc'),
   oracledb: () => require('../oracledb'),
   openai: () => require('../openai'),
@@ -122,6 +124,7 @@ module.exports = {
   undici: () => require('../undici'),
   url: () => require('../url'),
   vitest: { esmFirst: true, fn: () => require('../vitest') },
+  vm: () => require('../vm'),
   when: () => require('../when'),
   winston: () => require('../winston'),
   workerpool: () => require('../mocha')

package/packages/datadog-instrumentations/src/jest.js

@@ -12,7 +12,8 @@ const {
   getTestParametersString,
   addEfdStringToTestName,
   removeEfdStringFromTestName,
-  getIsFaultyEarlyFlakeDetection
+  getIsFaultyEarlyFlakeDetection,
+  JEST_WORKER_LOGS_PAYLOAD_CODE
 } = require('../../dd-trace/src/plugins/util/test')
 const {
   getFormattedJestTestParameters,
@@ -30,6 +31,7 @@ const testSuiteFinishCh = channel('ci:jest:test-suite:finish')
 
 const workerReportTraceCh = channel('ci:jest:worker-report:trace')
 const workerReportCoverageCh = channel('ci:jest:worker-report:coverage')
+const workerReportLogsCh = channel('ci:jest:worker-report:logs')
 
 const testSuiteCodeCoverageCh = channel('ci:jest:test-suite:code-coverage')
 
@@ -301,7 +303,7 @@ function getWrappedEnvironment (BaseEnvironment, jestVersion) {
         const numRetries = this.global[RETRY_TIMES]
         const numTestExecutions = event.test?.invocations
         const willBeRetried = numRetries > 0 && numTestExecutions - 1 < numRetries
-        const mightHitBreakpoint = this.isDiEnabled && numTestExecutions >= 1
+        const mightHitBreakpoint = this.isDiEnabled && numTestExecutions >= 2
 
         const asyncResource = asyncResources.get(event.test)
 
@@ -317,7 +319,7 @@ function getWrappedEnvironment (BaseEnvironment, jestVersion) {
 
         // After finishing it might take a bit for the snapshot to be handled.
         // This means that tests retried with DI are BREAKPOINT_HIT_GRACE_PERIOD_MS slower at least.
-        if (mightHitBreakpoint) {
+        if (status === 'fail' && mightHitBreakpoint) {
           await new Promise(resolve => {
             setTimeout(() => {
               resolve()
@@ -979,6 +981,12 @@ addHook({
       })
       return
     }
+    if (code === JEST_WORKER_LOGS_PAYLOAD_CODE) { // datadog logs payload
+      sessionAsyncResource.runInAsyncScope(() => {
+        workerReportLogsCh.publish(data)
+      })
+      return
+    }
     return _onMessage.apply(this, arguments)
   })
   return childProcessWorker

package/packages/datadog-instrumentations/src/node-serialize.js

@@ -0,0 +1,22 @@
+'use strict'
+
+const shimmer = require('../../datadog-shimmer')
+const { channel, addHook } = require('./helpers/instrument')
+
+const nodeUnserializeCh = channel('datadog:node-serialize:unserialize:start')
+
+function wrapUnserialize (serialize) {
+  return function wrappedUnserialize (obj) {
+    if (nodeUnserializeCh.hasSubscribers) {
+      nodeUnserializeCh.publish({ obj })
+    }
+
+    return serialize.apply(this, arguments)
+  }
+}
+
+addHook({ name: 'node-serialize', versions: ['0.0.4'] }, serialize => {
+  shimmer.wrap(serialize, 'unserialize', wrapUnserialize)
+
+  return serialize
+})

package/packages/datadog-instrumentations/src/openai.js

@@ -338,6 +338,8 @@ for (const shim of V4_PACKAGE_SHIMS) {
               })
           })
 
+          ch.end.publish(ctx)
+
           return apiProm
         })
       })

package/packages/datadog-instrumentations/src/vitest.js

@@ -179,7 +179,9 @@ function getSortWrapper (sort) {
       const knownTestsResponse = await getChannelPromise(knownTestsCh)
       if (!knownTestsResponse.err) {
         knownTests = knownTestsResponse.knownTests
-        const testFilepaths = await this.ctx.getTestFilepaths()
+        const getFilePaths = this.ctx.getTestFilepaths || this.ctx._globTestFilepaths
+
+        const testFilepaths = await getFilePaths.call(this.ctx)
 
         isEarlyFlakeDetectionFaultyCh.publish({
           knownTests: knownTests.vitest || {},
@@ -492,15 +494,6 @@ addHook({
   return vitestPackage
 })
 
-addHook({
-  name: 'vitest',
-  versions: ['>=2.1.0'],
-  filePattern: 'dist/chunks/RandomSequencer.*'
-}, (randomSequencerPackage) => {
-  shimmer.wrap(randomSequencerPackage.B.prototype, 'sort', getSortWrapper)
-  return randomSequencerPackage
-})
-
 addHook({
   name: 'vitest',
   versions: ['>=2.0.5 <2.1.0'],
@@ -513,6 +506,24 @@ addHook({
   return vitestPackage
 })
 
+addHook({
+  name: 'vitest',
+  versions: ['>=2.1.0 <3.0.0'],
+  filePattern: 'dist/chunks/RandomSequencer.*'
+}, (randomSequencerPackage) => {
+  shimmer.wrap(randomSequencerPackage.B.prototype, 'sort', getSortWrapper)
+  return randomSequencerPackage
+})
+
+addHook({
+  name: 'vitest',
+  versions: ['>=3.0.0'],
+  filePattern: 'dist/chunks/resolveConfig.*'
+}, (randomSequencerPackage) => {
+  shimmer.wrap(randomSequencerPackage.B.prototype, 'sort', getSortWrapper)
+  return randomSequencerPackage
+})
+
 // Can't specify file because compiled vitest includes hashes in their files
 addHook({
   name: 'vitest',
@@ -533,15 +544,17 @@ addHook({
   versions: ['>=1.6.0'],
   file: 'dist/index.js'
 }, (vitestPackage, frameworkVersion) => {
-  shimmer.wrap(vitestPackage, 'startTests', startTests => async function (testPath) {
+  shimmer.wrap(vitestPackage, 'startTests', startTests => async function (testPaths) {
     let testSuiteError = null
     if (!testSuiteStartCh.hasSubscribers) {
       return startTests.apply(this, arguments)
     }
+    // From >=3.0.1, the first arguments changes from a string to an object containing the filepath
+    const testSuiteAbsolutePath = testPaths[0]?.filepath || testPaths[0]
 
     const testSuiteAsyncResource = new AsyncResource('bound-anonymous-fn')
     testSuiteAsyncResource.runInAsyncScope(() => {
-      testSuiteStartCh.publish({ testSuiteAbsolutePath: testPath[0], frameworkVersion })
+      testSuiteStartCh.publish({ testSuiteAbsolutePath, frameworkVersion })
     })
     const startTestsResponse = await startTests.apply(this, arguments)
 

package/packages/datadog-instrumentations/src/vm.js

@@ -0,0 +1,49 @@
+'use strict'
+
+const { channel, addHook } = require('./helpers/instrument')
+const shimmer = require('../../datadog-shimmer')
+const names = ['vm', 'node:vm']
+
+const runScriptStartChannel = channel('datadog:vm:run-script:start')
+const sourceTextModuleStartChannel = channel('datadog:vm:source-text-module:start')
+
+addHook({ name: names }, function (vm) {
+  vm.Script = class extends vm.Script {
+    constructor (code) {
+      super(...arguments)
+
+      if (runScriptStartChannel.hasSubscribers && code) {
+        runScriptStartChannel.publish({ code })
+      }
+    }
+  }
+
+  if (vm.SourceTextModule && typeof vm.SourceTextModule === 'function') {
+    vm.SourceTextModule = class extends vm.SourceTextModule {
+      constructor (code) {
+        super(...arguments)
+
+        if (sourceTextModuleStartChannel.hasSubscribers && code) {
+          sourceTextModuleStartChannel.publish({ code })
+        }
+      }
+    }
+  }
+
+  shimmer.wrap(vm, 'runInContext', wrapVMMethod)
+  shimmer.wrap(vm, 'runInNewContext', wrapVMMethod)
+  shimmer.wrap(vm, 'runInThisContext', wrapVMMethod)
+  shimmer.wrap(vm, 'compileFunction', wrapVMMethod)
+
+  return vm
+})
+
+function wrapVMMethod (original) {
+  return function wrappedVMMethod (code) {
+    if (runScriptStartChannel.hasSubscribers && code) {
+      runScriptStartChannel.publish({ code })
+    }
+
+    return original.apply(this, arguments)
+  }
+}

package/packages/datadog-plugin-http/src/client.js

@@ -59,6 +59,11 @@ class HttpClientPlugin extends ClientPlugin {
     }
 
     if (this.shouldInjectTraceHeaders(options, uri)) {
+      // Clone the headers object in case an upstream lib has a reference to the original headers
+      // Implemented due to aws-sdk issue where request signing is broken if we mutate the headers
+      // Explained further in:
+      // https://github.com/open-telemetry/opentelemetry-js-contrib/issues/1609#issuecomment-1826167348
+      options.headers = Object.assign({}, options.headers)
       this.tracer.inject(span, HTTP_HEADERS, options.headers)
     }
 
@@ -72,10 +77,6 @@ class HttpClientPlugin extends ClientPlugin {
   }
 
   shouldInjectTraceHeaders (options, uri) {
-    if (hasAmazonSignature(options) && !this.config.enablePropagationWithAmazonHeaders) {
-      return false
-    }
-
     if (!this.config.propagationFilter(uri)) {
       return false
     }
@@ -212,31 +213,6 @@ function getHooks (config) {
   return { request }
 }
 
-function hasAmazonSignature (options) {
-  if (!options) {
-    return false
-  }
-
-  if (options.headers) {
-    const headers = Object.keys(options.headers)
-      .reduce((prev, next) => Object.assign(prev, {
-        [next.toLowerCase()]: options.headers[next]
-      }), {})
-
-    if (headers['x-amz-signature']) {
-      return true
-    }
-
-    if ([].concat(headers.authorization).some(startsWith('AWS4-HMAC-SHA256'))) {
-      return true
-    }
-  }
-
-  const search = options.search || options.path
-
-  return search && search.toLowerCase().indexOf('x-amz-signature=') !== -1
-}
-
 function extractSessionDetails (options) {
   if (typeof options === 'string') {
     return new URL(options).host
@@ -248,8 +224,4 @@ function extractSessionDetails (options) {
   return { host, port }
 }
 
-function startsWith (searchString) {
-  return value => String(value).startsWith(searchString)
-}
-
 module.exports = HttpClientPlugin

package/packages/datadog-plugin-jest/src/index.js

@@ -265,6 +265,12 @@ class JestPlugin extends CiPlugin {
       })
     })
 
+    this.addSub('ci:jest:worker-report:logs', (logsPayloads) => {
+      JSON.parse(logsPayloads).forEach(({ testConfiguration, logMessage }) => {
+        this.tracer._exporter.exportDiLogs(testConfiguration, logMessage)
+      })
+    })
+
     this.addSub('ci:jest:test-suite:finish', ({ status, errorMessage, error }) => {
       this.testSuiteSpan.setTag(TEST_STATUS, status)
       if (error) {

package/packages/datadog-plugin-langchain/src/index.js

@@ -1,89 +1,21 @@
 'use strict'
 
-const { MEASURED } = require('../../../ext/tags')
-const { storage } = require('../../datadog-core')
-const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
+const LangChainTracingPlugin = require('./tracing')
+const LangChainLLMObsPlugin = require('../../dd-trace/src/llmobs/plugins/langchain')
+const CompositePlugin = require('../../dd-trace/src/plugins/composite')
 
-const API_KEY = 'langchain.request.api_key'
-const MODEL = 'langchain.request.model'
-const PROVIDER = 'langchain.request.provider'
-const TYPE = 'langchain.request.type'
-
-const LangChainHandler = require('./handlers/default')
-const LangChainChatModelHandler = require('./handlers/language_models/chat_model')
-const LangChainLLMHandler = require('./handlers/language_models/llm')
-const LangChainChainHandler = require('./handlers/chain')
-const LangChainEmbeddingHandler = require('./handlers/embedding')
-
-class LangChainPlugin extends TracingPlugin {
+class LangChainPlugin extends CompositePlugin {
   static get id () { return 'langchain' }
-  static get operation () { return 'invoke' }
-  static get system () { return 'langchain' }
-  static get prefix () {
-    return 'tracing:apm:langchain:invoke'
-  }
-
-  constructor () {
-    super(...arguments)
-
-    const langchainConfig = this._tracerConfig.langchain || {}
-    this.handlers = {
-      chain: new LangChainChainHandler(langchainConfig),
-      chat_model: new LangChainChatModelHandler(langchainConfig),
-      llm: new LangChainLLMHandler(langchainConfig),
-      embedding: new LangChainEmbeddingHandler(langchainConfig),
-      default: new LangChainHandler(langchainConfig)
+  static get plugins () {
+    return {
+      // ordering here is important - the llm observability plugin must come first
+      // so that we can add annotations associated with the span before it finishes.
+      // however, because the tracing plugin uses `bindStart` vs the llmobs' `start`,
+      // the span is guaranteed to be created in the tracing plugin before the llmobs one is called
+      llmobs: LangChainLLMObsPlugin,
+      tracing: LangChainTracingPlugin
     }
   }
-
-  bindStart (ctx) {
-    const { resource, type } = ctx
-    const handler = this.handlers[type]
-
-    const instance = ctx.instance
-    const apiKey = handler.extractApiKey(instance)
-    const provider = handler.extractProvider(instance)
-    const model = handler.extractModel(instance)
-
-    const tags = handler.getSpanStartTags(ctx, provider) || []
-
-    if (apiKey) tags[API_KEY] = apiKey
-    if (provider) tags[PROVIDER] = provider
-    if (model) tags[MODEL] = model
-    if (type) tags[TYPE] = type
-
-    const span = this.startSpan('langchain.request', {
-      service: this.config.service,
-      resource,
-      kind: 'client',
-      meta: {
-        [MEASURED]: 1,
-        ...tags
-      }
-    }, false)
-
-    const store = storage.getStore() || {}
-    ctx.currentStore = { ...store, span }
-
-    return ctx.currentStore
-  }
-
-  asyncEnd (ctx) {
-    const span = ctx.currentStore.span
-
-    const { type } = ctx
-
-    const handler = this.handlers[type]
-    const tags = handler.getSpanEndTags(ctx) || {}
-
-    span.addTags(tags)
-
-    span.finish()
-  }
-
-  getHandler (type) {
-    return this.handlers[type] || this.handlers.default
-  }
 }
 
 module.exports = LangChainPlugin

package/packages/datadog-plugin-langchain/src/tracing.js

@@ -0,0 +1,89 @@
+'use strict'
+
+const { MEASURED } = require('../../../ext/tags')
+const { storage } = require('../../datadog-core')
+const TracingPlugin = require('../../dd-trace/src/plugins/tracing')
+
+const API_KEY = 'langchain.request.api_key'
+const MODEL = 'langchain.request.model'
+const PROVIDER = 'langchain.request.provider'
+const TYPE = 'langchain.request.type'
+
+const LangChainHandler = require('./handlers/default')
+const LangChainChatModelHandler = require('./handlers/language_models/chat_model')
+const LangChainLLMHandler = require('./handlers/language_models/llm')
+const LangChainChainHandler = require('./handlers/chain')
+const LangChainEmbeddingHandler = require('./handlers/embedding')
+
+class LangChainTracingPlugin extends TracingPlugin {
+  static get id () { return 'langchain' }
+  static get operation () { return 'invoke' }
+  static get system () { return 'langchain' }
+  static get prefix () {
+    return 'tracing:apm:langchain:invoke'
+  }
+
+  constructor () {
+    super(...arguments)
+
+    const langchainConfig = this._tracerConfig.langchain || {}
+    this.handlers = {
+      chain: new LangChainChainHandler(langchainConfig),
+      chat_model: new LangChainChatModelHandler(langchainConfig),
+      llm: new LangChainLLMHandler(langchainConfig),
+      embedding: new LangChainEmbeddingHandler(langchainConfig),
+      default: new LangChainHandler(langchainConfig)
+    }
+  }
+
+  bindStart (ctx) {
+    const { resource, type } = ctx
+    const handler = this.handlers[type]
+
+    const instance = ctx.instance
+    const apiKey = handler.extractApiKey(instance)
+    const provider = handler.extractProvider(instance)
+    const model = handler.extractModel(instance)
+
+    const tags = handler.getSpanStartTags(ctx, provider) || []
+
+    if (apiKey) tags[API_KEY] = apiKey
+    if (provider) tags[PROVIDER] = provider
+    if (model) tags[MODEL] = model
+    if (type) tags[TYPE] = type
+
+    const span = this.startSpan('langchain.request', {
+      service: this.config.service,
+      resource,
+      kind: 'client',
+      meta: {
+        [MEASURED]: 1,
+        ...tags
+      }
+    }, false)
+
+    const store = storage.getStore() || {}
+    ctx.currentStore = { ...store, span }
+
+    return ctx.currentStore
+  }
+
+  asyncEnd (ctx) {
+    const span = ctx.currentStore.span
+
+    const { type } = ctx
+
+    const handler = this.handlers[type]
+    const tags = handler.getSpanEndTags(ctx) || {}
+
+    span.addTags(tags)
+
+    span.finish()
+  }
+
+  getHandler (type) {
+    return this.handlers[type] || this.handlers.default
+  }
+}
+
+module.exports = LangChainTracingPlugin

package/packages/dd-trace/src/appsec/iast/analyzers/analyzers.js

@@ -17,6 +17,7 @@ module.exports = {
   SSRF: require('./ssrf-analyzer'),
   TEMPLATE_INJECTION_ANALYZER: require('./template-injection-analyzer'),
   UNVALIDATED_REDIRECT_ANALYZER: require('./unvalidated-redirect-analyzer'),
+  UNTRUSTED_DESERIALIZATION_ANALYZER: require('./untrusted-deserialization-analyzer'),
   WEAK_CIPHER_ANALYZER: require('./weak-cipher-analyzer'),
   WEAK_HASH_ANALYZER: require('./weak-hash-analyzer'),
   WEAK_RANDOMNESS_ANALYZER: require('./weak-randomness-analyzer'),

package/packages/dd-trace/src/appsec/iast/analyzers/code-injection-analyzer.js

@@ -10,6 +10,8 @@ class CodeInjectionAnalyzer extends InjectionAnalyzer {
 
   onConfigure () {
     this.addSub('datadog:eval:call', ({ script }) => this.analyze(script))
+    this.addSub('datadog:vm:run-script:start', ({ code }) => this.analyze(code))
+    this.addSub('datadog:vm:source-text-module:start', ({ code }) => this.analyze(code))
   }
 
   _areRangesVulnerable () {

package/packages/dd-trace/src/appsec/iast/analyzers/untrusted-deserialization-analyzer.js

@@ -0,0 +1,16 @@
+'use strict'
+
+const InjectionAnalyzer = require('./injection-analyzer')
+const { UNTRUSTED_DESERIALIZATION } = require('../vulnerabilities')
+
+class UntrustedDeserializationAnalyzer extends InjectionAnalyzer {
+  constructor () {
+    super(UNTRUSTED_DESERIALIZATION)
+  }
+
+  onConfigure () {
+    this.addSub('datadog:node-serialize:unserialize:start', ({ obj }) => this.analyze(obj))
+  }
+}
+
+module.exports = new UntrustedDeserializationAnalyzer()

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js

@@ -25,19 +25,20 @@ class SensitiveHandler {
 
     this._sensitiveAnalyzers = new Map()
     this._sensitiveAnalyzers.set(vulnerabilities.CODE_INJECTION, taintedRangeBasedSensitiveAnalyzer)
-    this._sensitiveAnalyzers.set(vulnerabilities.TEMPLATE_INJECTION, taintedRangeBasedSensitiveAnalyzer)
     this._sensitiveAnalyzers.set(vulnerabilities.COMMAND_INJECTION, commandSensitiveAnalyzer)
-    this._sensitiveAnalyzers.set(vulnerabilities.NOSQL_MONGODB_INJECTION, jsonSensitiveAnalyzer)
+    this._sensitiveAnalyzers.set(vulnerabilities.HARDCODED_PASSWORD, (evidence) => {
+      return hardcodedPasswordAnalyzer(evidence, this._valuePattern)
+    })
+    this._sensitiveAnalyzers.set(vulnerabilities.HEADER_INJECTION, (evidence) => {
+      return headerSensitiveAnalyzer(evidence, this._namePattern, this._valuePattern)
+    })
     this._sensitiveAnalyzers.set(vulnerabilities.LDAP_INJECTION, ldapSensitiveAnalyzer)
+    this._sensitiveAnalyzers.set(vulnerabilities.NOSQL_MONGODB_INJECTION, jsonSensitiveAnalyzer)
     this._sensitiveAnalyzers.set(vulnerabilities.SQL_INJECTION, sqlSensitiveAnalyzer)
     this._sensitiveAnalyzers.set(vulnerabilities.SSRF, urlSensitiveAnalyzer)
+    this._sensitiveAnalyzers.set(vulnerabilities.TEMPLATE_INJECTION, taintedRangeBasedSensitiveAnalyzer)
+    this._sensitiveAnalyzers.set(vulnerabilities.UNTRUSTED_DESERIALIZATION, taintedRangeBasedSensitiveAnalyzer)
     this._sensitiveAnalyzers.set(vulnerabilities.UNVALIDATED_REDIRECT, urlSensitiveAnalyzer)
-    this._sensitiveAnalyzers.set(vulnerabilities.HEADER_INJECTION, (evidence) => {
-      return headerSensitiveAnalyzer(evidence, this._namePattern, this._valuePattern)
-    })
-    this._sensitiveAnalyzers.set(vulnerabilities.HARDCODED_PASSWORD, (evidence) => {
-      return hardcodedPasswordAnalyzer(evidence, this._valuePattern)
-    })
   }
 
   isSensibleName (name) {

package/packages/dd-trace/src/appsec/iast/vulnerabilities.js

@@ -15,6 +15,7 @@ module.exports = {
   SSRF: 'SSRF',
   TEMPLATE_INJECTION: 'TEMPLATE_INJECTION',
   UNVALIDATED_REDIRECT: 'UNVALIDATED_REDIRECT',
+  UNTRUSTED_DESERIALIZATION: 'UNTRUSTED_DESERIALIZATION',
   WEAK_CIPHER: 'WEAK_CIPHER',
   WEAK_HASH: 'WEAK_HASH',
   WEAK_RANDOMNESS: 'WEAK_RANDOMNESS',

package/packages/dd-trace/src/appsec/waf/waf_context_wrapper.js

@@ -19,6 +19,7 @@ class WAFContextWrapper {
     this.rulesVersion = rulesVersion
     this.addressesToSkip = new Set()
     this.knownAddresses = knownAddresses
+    this.cachedUserIdActions = new Map()
   }
 
   run ({ persistent, ephemeral }, raspRule) {
@@ -27,6 +28,16 @@ class WAFContextWrapper {
       return
     }
 
+    // SPECIAL CASE FOR USER_ID
+    // TODO: make this universal
+    const userId = persistent?.[addresses.USER_ID] || ephemeral?.[addresses.USER_ID]
+    if (userId) {
+      const cachedAction = this.cachedUserIdActions.get(userId)
+      if (cachedAction) {
+        return cachedAction
+      }
+    }
+
     const payload = {}
     let payloadHasData = false
     const newAddressesToSkip = new Set(this.addressesToSkip)
@@ -79,6 +90,12 @@ class WAFContextWrapper {
 
       const blockTriggered = !!getBlockingAction(result.actions)
 
+      // SPECIAL CASE FOR USER_ID
+      // TODO: make this universal
+      if (userId && ruleTriggered && blockTriggered) {
+        this.setUserIdCache(userId, result)
+      }
+
       Reporter.reportMetrics({
         duration: result.totalRuntime / 1e3,
         durationExt: parseInt(end - start) / 1e3,
@@ -105,6 +122,26 @@ class WAFContextWrapper {
     }
   }
 
+  setUserIdCache (userId, result) {
+    // using old loops for speed
+    for (let i = 0; i < result.events.length; i++) {
+      const event = result.events[i]
+
+      for (let j = 0; j < event?.rule_matches?.length; j++) {
+        const match = event.rule_matches[j]
+
+        for (let k = 0; k < match?.parameters?.length; k++) {
+          const parameter = match.parameters[k]
+
+          if (parameter?.address === addresses.USER_ID) {
+            this.cachedUserIdActions.set(userId, result.actions)
+            return
+          }
+        }
+      }
+    }
+  }
+
   dispose () {
     this.ddwafContext.dispose()
   }