dd-trace 6.12.0 → 6.14.0

package/packages/dd-trace/src/aiguard/redaction.js

@@ -0,0 +1,183 @@
+'use strict'
+
+/** @typedef {import('../../../../index').aiguard.RedactionReplacement} RedactionReplacement */
+
+const SEGMENT_PATTERN = /^([A-Za-z0-9_]+)(?:\[([0-9]+)\])?$/
+
+/**
+ * Converts the raw backend replacements into the public, typed contract.
+ *
+ * @param {unknown} replacements
+ * @returns {RedactionReplacement[]}
+ */
+function normalizeRedactionReplacements (replacements) {
+  if (!Array.isArray(replacements)) return []
+
+  const result = []
+  for (const entry of replacements) {
+    if (entry === null || typeof entry !== 'object' || Array.isArray(entry)) continue
+
+    const { path, replacement } = entry
+    if (typeof path !== 'string' || path.length === 0 || typeof replacement !== 'string') continue
+
+    result.push({ path, replacement })
+  }
+  return result
+}
+
+/**
+ * Parses an AI Guard location path into named segments and optional indexes.
+ *
+ * @param {string} path
+ * @returns {Array<{ name: string, index: number|undefined }>|undefined}
+ */
+function parsePath (path) {
+  const segments = []
+  for (const rawSegment of path.split('.')) {
+    const match = SEGMENT_PATTERN.exec(rawSegment)
+    if (!match) return
+
+    segments.push({
+      name: match[1],
+      index: match[2] === undefined ? undefined : Number(match[2]),
+    })
+  }
+  return segments
+}
+
+/**
+ * Reports whether a parsed path targets an allowed message string.
+ *
+ * @param {Array<{ name: string, index: number|undefined }>} segments
+ * @returns {boolean}
+ */
+function isRedactablePath (segments) {
+  const first = segments[0]
+  if (first?.name !== 'messages' || first.index === undefined) return false
+
+  if (segments.length === 2) {
+    const content = segments[1]
+    return content.name === 'content' && content.index === undefined
+  }
+
+  if (segments.length === 3) {
+    const content = segments[1]
+    const text = segments[2]
+    return content.name === 'content' && content.index !== undefined &&
+      text.name === 'text' && text.index === undefined
+  }
+
+  if (segments.length === 4) {
+    const toolCalls = segments[1]
+    const functionSegment = segments[2]
+    const argumentsSegment = segments[3]
+    return toolCalls.name === 'tool_calls' && toolCalls.index !== undefined &&
+      functionSegment.name === 'function' && functionSegment.index === undefined &&
+      argumentsSegment.name === 'arguments' && argumentsSegment.index === undefined
+  }
+
+  return false
+}
+
+/**
+ * Resolves a location path to a writable string container and key.
+ *
+ * @param {{ messages: Array<object> }} root
+ * @param {string} path
+ * @returns {{ container: object|Array<unknown>, key: string|number }|undefined}
+ */
+function resolveWritableString (root, path) {
+  const segments = parsePath(path)
+  if (!segments || !isRedactablePath(segments)) return
+
+  const terminal = segments.at(-1)
+  let node = root
+  for (let i = 0; i < segments.length - 1; i++) {
+    const { name, index } = segments[i]
+    if (!node || typeof node !== 'object' || !Object.hasOwn(node, name)) return
+
+    node = node[name]
+    if (index !== undefined) {
+      if (!Array.isArray(node) || index >= node.length) return
+      node = node[index]
+    }
+  }
+
+  if (!node || typeof node !== 'object') return
+  if (!Object.hasOwn(node, terminal.name) || typeof node[terminal.name] !== 'string') return
+  return { container: node, key: terminal.name }
+}
+
+/**
+ * Applies redaction replacements to an AI Guard message list.
+ * The caller transfers ownership of a private snapshot. Successful replacements mutate that snapshot in place.
+ *
+ * @param {Array<object>} messages
+ * @param {unknown} replacements
+ * @returns {{ messages: Array<object>, redacted: boolean, failures: number }}
+ */
+function redactMessages (messages, replacements) {
+  if (!Array.isArray(messages) || replacements === undefined || replacements === null) {
+    return { messages, redacted: false, failures: 0 }
+  }
+
+  try {
+    if (!Array.isArray(replacements)) {
+      return { messages, redacted: false, failures: 1 }
+    }
+    if (replacements.length === 0) return { messages, redacted: false, failures: 0 }
+
+    const replacementsByPath = new Map()
+    const conflictingPaths = new Set()
+    let failures = 0
+    for (const entry of replacements) {
+      if (!entry || typeof entry !== 'object') {
+        failures++
+        continue
+      }
+
+      const { path, replacement } = entry
+      if (typeof path !== 'string' || path.length === 0 || typeof replacement !== 'string') {
+        failures++
+        continue
+      }
+
+      if (conflictingPaths.has(path)) continue
+      if (replacementsByPath.has(path) && replacementsByPath.get(path) !== replacement) {
+        replacementsByPath.delete(path)
+        conflictingPaths.add(path)
+        failures++
+        continue
+      }
+      replacementsByPath.set(path, replacement)
+    }
+
+    if (replacementsByPath.size === 0) return { messages, redacted: false, failures }
+
+    const root = { messages }
+    const targets = []
+
+    for (const [path, replacement] of replacementsByPath) {
+      const resolved = resolveWritableString(root, path)
+      if (!resolved) {
+        failures++
+        continue
+      }
+
+      targets.push({ ...resolved, replacement })
+    }
+
+    for (const { container, key, replacement } of targets) {
+      container[key] = replacement
+    }
+
+    return { messages, redacted: targets.length > 0, failures }
+  } catch {
+    return { messages, redacted: false, failures: 1 }
+  }
+}
+
+module.exports = {
+  normalizeRedactionReplacements,
+  redactMessages,
+}

package/packages/dd-trace/src/aiguard/sdk.js

@@ -12,6 +12,7 @@ class AIGuard extends NoopAIGuard {
   #tracer
   #client
   #reporter
+  #redactionEnabled
   #meta
 
   /**
@@ -29,6 +30,7 @@ class AIGuard extends NoopAIGuard {
     this.#tracer = tracer
     this.#client = new AIGuardClient(config)
     this.#reporter = new EvaluationReporter(config)
+    this.#redactionEnabled = config.experimental.aiguard.redactionEnabled
     this.#meta = { service: config.service, env: config.env }
     this.#initialized = true
   }
@@ -45,13 +47,16 @@ class AIGuard extends NoopAIGuard {
       const report = this.#reporter.start(span, messages, { source, integration })
       let evaluation
       try {
-        evaluation = await this.#client.evaluate(messages, this.#meta)
+        evaluation = await this.#client.evaluate(report.messages, this.#meta)
       } catch (error) {
         this.#reporter.fail(report, error.telemetryType ?? TAGS.ERROR_TYPE_CLIENT)
         throw error
       }
 
-      const outcome = createEvaluationOutcome(evaluation, block)
+      const outcome = createEvaluationOutcome(report.messages, evaluation, {
+        block,
+        redactionEnabled: this.#redactionEnabled,
+      })
       this.#reporter.finish(report, outcome)
 
       if (outcome.shouldBlock) {

package/packages/dd-trace/src/aiguard/tags.js

@@ -7,6 +7,7 @@ module.exports = {
   ACTION_TAG_KEY: 'ai_guard.action',
   REASON_TAG_KEY: 'ai_guard.reason',
   BLOCKED_TAG_KEY: 'ai_guard.blocked',
+  REDACTED_TAG_KEY: 'ai_guard.redacted',
   EVENT_TAG_KEY: 'ai_guard.event',
   META_STRUCT_KEY: 'ai_guard',
 
@@ -27,4 +28,5 @@ module.exports = {
   ERROR_TYPE_CLIENT: 'client_error',
   ERROR_TYPE_STATUS: 'bad_status',
   ERROR_TYPE_RESPONSE: 'bad_response',
+  ERROR_TYPE_REDACTION: 'redaction_error',
 }

package/packages/dd-trace/src/appsec/api_security/index.js

@@ -5,6 +5,8 @@ const { isSchemaAttribute } = require('../reporter')
 const appsecTelemetry = require('../telemetry')
 const sampler = require('./sampler')
 
+/** @typedef {import('../../opentracing/span')} DatadogSpan */
+
 /**
  * Map a sampling decision into the corresponding API Security telemetry metric.
  *
@@ -13,14 +15,14 @@ const sampler = require('./sampler')
  *   - MISSING_ROUTE: missing_route
  *   - SKIP: no metric emitted
  *
- * @param {import('http').IncomingMessage} req
+ * @param {DatadogSpan} rootSpan Span the sampling decision was attached to
  * @param {'sample' | 'missing_route' | 'skip'} samplingDecision Sampler decision
  * @param {{ attributes?: Record<string, unknown> } | undefined} wafResult WAF run result
  */
-function reportRequest (req, samplingDecision, wafResult) {
+function reportRootSpanRequest (rootSpan, samplingDecision, wafResult) {
   switch (samplingDecision) {
     case sampler.SamplingDecision.SAMPLE: {
-      const framework = getFramework(req)
+      const framework = getFramework(rootSpan)
       if (hasSchemaAttributes(wafResult?.attributes)) {
         appsecTelemetry.incrementApiSecRequestSchemaMetric(framework)
       } else {
@@ -29,13 +31,26 @@ function reportRequest (req, samplingDecision, wafResult) {
       break
     }
     case sampler.SamplingDecision.MISSING_ROUTE:
-      appsecTelemetry.incrementApiSecMissingRouteMetric(getFramework(req))
+      appsecTelemetry.incrementApiSecMissingRouteMetric(getFramework(rootSpan))
       break
   }
 }
 
-function getFramework (req) {
-  return web.root(req)?.context()?.getTag?.('component')
+/**
+ * Node HTTP adapter over {@link reportRootSpanRequest}.
+ *
+ * @param {import('http').IncomingMessage} req
+ * @param {'sample' | 'missing_route' | 'skip'} samplingDecision Sampler decision
+ * @param {{ attributes?: Record<string, unknown> } | undefined} wafResult WAF run result
+ */
+function reportRequest (req, samplingDecision, wafResult) {
+  if (samplingDecision === sampler.SamplingDecision.SKIP) return
+
+  reportRootSpanRequest(web.root(req), samplingDecision, wafResult)
+}
+
+function getFramework (rootSpan) {
+  return rootSpan?.context?.()?.getTag?.('component')
 }
 
 function hasSchemaAttributes (attributes) {
@@ -50,6 +65,8 @@ module.exports = {
   configure: sampler.configure,
   disable: sampler.disable,
   sampleRequest: sampler.sampleRequest,
+  sampleRootSpanRequest: sampler.sampleRootSpanRequest,
   reportRequest,
+  reportRootSpanRequest,
   SamplingDecision: sampler.SamplingDecision,
 }

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -8,6 +8,8 @@ const { keepTrace } = require('../../priority_sampler')
 const { ASM } = require('../../standalone/product')
 const { isBlocked } = require('../blocking')
 
+/** @typedef {import('../../opentracing/span')} DatadogSpan */
+
 const MAX_SIZE = 4096
 
 const SamplingDecision = Object.freeze({
@@ -44,77 +46,113 @@ function disable () {
 }
 
 /**
- * @param {import('http').IncomingMessage} req
- * @param {import('http').ServerResponse} res
+ * @param {DatadogSpan} rootSpan Span the sampling decision is attached to
+ * @param {object} request
+ * @param {string} request.method
+ * @param {number|string} request.statusCode
+ * @param {string|undefined} request.route Tri-state: a route string, an empty string (still a
+ *   valid route — dd-trace-js represents the express root path '/' as an empty path segment), or
+ *   `undefined` meaning no route information at all.
+ * @param {boolean} [request.blocked] Whether the response was blocked by ASM
  * @param {boolean} record When true and the decision is SAMPLE, records the endpoint in the TTL cache
  * @returns {'sample' | 'missing_route' | 'skip'}
  */
-function sampleRequest (req, res, record = false) {
+function sampleRootSpanRequest (rootSpan, request, record = false) {
   if (!enabled) return SamplingDecision.SKIP
 
-  const rootSpan = web.root(req)
   if (!rootSpan) return SamplingDecision.SKIP
 
-  if (!asmStandaloneEnabled) {
-    let priority = getSpanPriority(rootSpan)
-    if (!priority) {
-      rootSpan._prioritySampler?.sample(rootSpan)
-      priority = getSpanPriority(rootSpan)
-    }
+  const { method, statusCode, route, blocked = false } = request ?? {}
 
-    if (priority === AUTO_REJECT || priority === USER_REJECT) {
-      return SamplingDecision.SKIP
-    }
+  if (!method || !statusCode) {
+    log.warn('[ASM] Unsupported groupkey for API security')
+    return SamplingDecision.SKIP
   }
 
-  const resolved = resolveSamplingKey(req, res)
-  if (!resolved) return SamplingDecision.SKIP
+  if (isRejected(rootSpan)) return SamplingDecision.SKIP
 
-  if (record && resolved.route === null) {
-    if (resolved.status === 404 || isBlocked(res)) return SamplingDecision.SKIP
+  if (isRoutelessRecord(route, record)) {
+    if (isNotFound(statusCode) || blocked) return SamplingDecision.SKIP
     return SamplingDecision.MISSING_ROUTE
   }
 
-  if (sampledRequests.has(resolved.key)) return SamplingDecision.SKIP
+  const key = buildSamplingKey(method, route, statusCode)
+  if (sampledRequests.has(key)) return SamplingDecision.SKIP
 
   if (asmStandaloneEnabled) {
     keepTrace(rootSpan, ASM)
   }
 
   if (record) {
-    sampledRequests.set(resolved.key, undefined)
+    sampledRequests.set(key, undefined)
   }
 
   return SamplingDecision.SAMPLE
 }
 
 /**
+ * Node HTTP adapter over {@link sampleRootSpanRequest}.
+ *
  * @param {import('http').IncomingMessage} req
  * @param {import('http').ServerResponse} res
- * @returns {boolean} Whether this request's endpoint is currently recorded in the TTL cache.
+ * @param {boolean} record When true and the decision is SAMPLE, records the endpoint in the TTL cache
+ * @returns {'sample' | 'missing_route' | 'skip'}
  */
-function wasSampled (req, res) {
-  const resolved = resolveSamplingKey(req, res)
-  return resolved !== null && sampledRequests.has(resolved.key)
-}
+function sampleRequest (req, res, record = false) {
+  if (!enabled) return SamplingDecision.SKIP
 
-function resolveSamplingKey (req, res) {
-  const method = req.method
-  const status = res.statusCode
+  const rootSpan = web.root(req)
+  if (!rootSpan) return SamplingDecision.SKIP
 
-  if (!method || !status) {
-    log.warn('[ASM] Unsupported groupkey for API security')
-    return null
-  }
+  if (isRejected(rootSpan)) return SamplingDecision.SKIP
+
+  const statusCode = res.statusCode
+  const route = getRouteOrEndpoint(web.getContext(req), statusCode)
+
+  return sampleRootSpanRequest(rootSpan, {
+    method: req.method,
+    statusCode,
+    route,
+    blocked: isRoutelessRecord(route, record) && !isNotFound(statusCode) ? isBlocked(res) : false,
+  }, record)
+}
 
-  const context = web.getContext(req)
-  const route = getRouteOrEndpoint(context, status)
+/**
+ * Whether this is a request with no route information
+ *
+ * @param {string|undefined} route
+ * @param {boolean} record
+ * @returns {boolean}
+ */
+function isRoutelessRecord (route, record) {
+  return record && route === undefined
+}
 
-  // route === null signals "no route information at all". An empty string is still a valid
-  // route (dd-trace-js represents the express root path '/' as an empty path segment).
-  return { method, status, route, key: method + (route ?? '') + status }
+/**
+ * @param {number|string} statusCode
+ * @returns {boolean}
+ */
+function isNotFound (statusCode) {
+  return Number(statusCode) === 404
+}
+
+/**
+ * @param {string} method
+ * @param {string|undefined} route A route string, an empty string (still a valid route), or
+ *   `undefined`
+ * @param {number|string} statusCode
+ * @returns {string}
+ */
+function buildSamplingKey (method, route, statusCode) {
+  return method + (route ?? '') + statusCode
 }
 
+/**
+ * @param {{ paths?: string[], span?: object }} [context] Web context of the request
+ * @param {number|string} statusCode
+ * @returns {string|undefined} A route string, an empty string (still a valid route), or
+ *   `undefined` when no route information is available.
+ */
 function getRouteOrEndpoint (context, statusCode) {
   // The router plugin populates `context.paths` whenever the framework matched something.
   // For express's root '/' route the matched path is normalized to '' (see datadog-plugin-router),
@@ -125,23 +163,44 @@ function getRouteOrEndpoint (context, statusCode) {
     return paths.join('')
   }
 
-  if (statusCode === 404) return null
+  if (isNotFound(statusCode)) return
 
   const endpoint = context?.span?.context()?.getTag?.('http.endpoint')
   if (endpoint) return endpoint
+}
 
-  return null
+/**
+ * Whether the span's trace is dropped, forcing the sampling decision if none was made yet.
+ *
+ * Always false under ASM standalone: there the trace is kept via `keepTrace(rootSpan, ASM)`
+ * regardless of the APM sampling decision.
+ *
+ * @param {DatadogSpan} rootSpan
+ * @returns {boolean}
+ */
+function isRejected (rootSpan) {
+  if (asmStandaloneEnabled) return false
+
+  let priority = getSpanPriority(rootSpan)
+  if (priority == null) {
+    rootSpan._prioritySampler?.sample(rootSpan)
+    priority = getSpanPriority(rootSpan)
+  }
+
+  return priority === AUTO_REJECT || priority === USER_REJECT
 }
 
 function getSpanPriority (span) {
   const spanContext = span.context?.()
-  return spanContext._sampling?.priority
+  const priority = spanContext?._sampling?.priority
+
+  return priority == null ? priority : Number(priority)
 }
 
 module.exports = {
   configure,
   disable,
   sampleRequest,
-  wasSampled,
+  sampleRootSpanRequest,
   SamplingDecision,
 }

package/packages/dd-trace/src/appsec/graphql.js

@@ -32,11 +32,15 @@ function disable () {
   disableGraphql()
 }
 
-function onGraphqlStartResolver ({ abortController, resolverInfo }) {
+/**
+ * @param {{ createResolverInfo?: (data: object) => object | null }} data
+ */
+function onGraphqlStartResolver (data) {
   const req = getActiveRequest()
 
   if (!req) return
 
+  const resolverInfo = data.createResolverInfo?.(data)
   if (!resolverInfo || typeof resolverInfo !== 'object') return
 
   const result = waf.run({ ephemeral: { [addresses.HTTP_INCOMING_GRAPHQL_RESOLVER]: resolverInfo } }, req)
@@ -46,7 +50,7 @@ function onGraphqlStartResolver ({ abortController, resolverInfo }) {
     if (requestData?.isInGraphqlRequest) {
       requestData.blocked = true
       requestData.wafAction = blockingAction
-      abortController?.abort()
+      data.abortController?.abort()
     }
   }
 }

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -178,12 +178,12 @@ class TaintTrackingPlugin extends SourceIastPlugin {
   addGraphQLSubscriptions () {
     this.addSub(
       { channelName: 'apm:graphql:resolve:start', tag: HTTP_REQUEST_BODY },
-      (data) => {
+      ({ rootCtx, args }) => {
         const iastContext = getIastContext(storage('legacy').getStore())
-        const source = data.rootCtx?.source
+        const source = rootCtx?.source
         const ranges = source && getRanges(iastContext, source)
         if (ranges?.length) {
-          this._taintTrackingHandler(ranges[0].iinfo.type, data.args, null, iastContext)
+          this._taintTrackingHandler(ranges[0].iinfo.type, args, null, iastContext)
         }
       }
     )

package/packages/dd-trace/src/appsec/iast/taint-tracking/taint-tracking-impl.js

@@ -242,7 +242,8 @@ function lodashTaintTrackingHandler (message) {
     const context = getContextDefault()
     const transactionId = getTransactionId(context)
     if (transactionId) {
-      message.result = getLodashTaintedUtilFn(message.operation)(transactionId, message.result, ...message.arguments)
+      const taintResult = getLodashTaintedUtilFn(message.operation)
+      message.result = taintResult(transactionId, message.result, ...message.arguments)
     }
   } catch (e) {
     log.error('[ASM] Error invoking CSI lodash %s', message.operation, e)

package/packages/dd-trace/src/appsec/iast/telemetry/span-tags.js

@@ -46,8 +46,14 @@ function filterTags (tags) {
 }
 
 function processTagValue (tags) {
-  return tags.map(tag => tag.includes(':') ? getSegment(tag, ':', 1) : tag)
-    .join('_').replaceAll('.', '_')
+  let processedTags = ''
+  let isFirstTag = true
+  for (const tag of tags) {
+    if (!isFirstTag) processedTags += '_'
+    processedTags += tag.includes(':') ? getSegment(tag, ':', 1) : tag
+    isFirstTag = false
+  }
+  return processedTags.replaceAll('.', '_')
 }
 
 module.exports = {

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/sql-sensitive-analyzer.js

@@ -8,58 +8,33 @@ const MYSQL_STRING_LITERAL = String.raw`"(?:\\"|[^"])*"|'(?:\\'|[^'])*'`
 const LINE_COMMENT = '--.*$'
 const BLOCK_COMMENT = String.raw`/\*[\s\S]*\*/`
 const EXPONENT = String.raw`(?:E[-+]?\d+[fd]?)?`
-const INTEGER_NUMBER = String.raw`(?<!\w)\d+`
+const INTEGER_NUMBER = String.raw`\b\d+`
 const DECIMAL_NUMBER = String.raw`\d*\.\d+`
 const HEX_NUMBER = 'x\'[0-9a-f]+\'|0x[0-9a-f]+'
 const BIN_NUMBER = 'b\'[0-9a-f]+\'|0b[0-9a-f]+'
 const NUMERIC_LITERAL =
-  `[-+]?(?:${
-    [
-      HEX_NUMBER,
-      BIN_NUMBER,
-      DECIMAL_NUMBER + EXPONENT,
-      INTEGER_NUMBER + EXPONENT,
-    ].join('|')
-  })`
+  `[-+]?(?:${HEX_NUMBER}|${BIN_NUMBER}|${DECIMAL_NUMBER + EXPONENT}|${INTEGER_NUMBER + EXPONENT})`
 const ORACLE_ESCAPED_LITERAL = String.raw`q'<.*?>'|q'\(.*?\)'|q'\{.*?\}'|q'\[.*?\]'|q'(?<ESCAPE>.).*?\k<ESCAPE>'`
 
 const patterns = {
   ANSI: new RegExp( // Default
-    [
-      NUMERIC_LITERAL,
-      STRING_LITERAL,
-      LINE_COMMENT,
-      BLOCK_COMMENT,
-    ].join('|'),
+    `${NUMERIC_LITERAL}|${STRING_LITERAL}|${LINE_COMMENT}|${BLOCK_COMMENT}`,
     'gmi'
   ),
   MYSQL: new RegExp(
-    [
-      NUMERIC_LITERAL,
-      MYSQL_STRING_LITERAL,
-      LINE_COMMENT,
-      BLOCK_COMMENT,
-    ].join('|'),
+    `${NUMERIC_LITERAL}|${MYSQL_STRING_LITERAL}|${LINE_COMMENT}|${BLOCK_COMMENT}`,
     'gmi'
   ),
   POSTGRES: new RegExp(
-    [
-      NUMERIC_LITERAL,
-      POSTGRESQL_ESCAPED_LITERAL,
-      STRING_LITERAL,
-      LINE_COMMENT,
-      BLOCK_COMMENT,
-    ].join('|'),
+    `${NUMERIC_LITERAL}|${POSTGRESQL_ESCAPED_LITERAL}|${STRING_LITERAL}|${LINE_COMMENT}|${BLOCK_COMMENT}`,
+    'gmi'
+  ),
+  ORACLE: new RegExp(
+    // The capture owns the quote delimiter while the lazy quantifier owns the body.
+    // eslint-disable-next-line regexp/optimal-quantifier-concatenation
+    `${NUMERIC_LITERAL}|${ORACLE_ESCAPED_LITERAL}|${STRING_LITERAL}|${LINE_COMMENT}|${BLOCK_COMMENT}`,
     'gmi'
   ),
-  ORACLE: new RegExp([
-    NUMERIC_LITERAL,
-    ORACLE_ESCAPED_LITERAL,
-    STRING_LITERAL,
-    LINE_COMMENT,
-    BLOCK_COMMENT,
-  ].join('|'),
-  'gmi'),
 }
 patterns.SQLITE = patterns.MYSQL
 patterns.MARIADB = patterns.MYSQL

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/url-sensitive-analyzer.js

@@ -8,7 +8,7 @@ const AUTHORITY = '^(?:[^:]+:)?//([^@]+)@'
 // boundaries), so excluding them preserves match semantics for valid URLs while keeping
 // the regex linear on arbitrary input.
 const QUERY_FRAGMENT = '[?#&]([^=&;?#]+)=([^?#&]+)'
-const pattern = new RegExp([AUTHORITY, QUERY_FRAGMENT].join('|'), 'gmi')
+const pattern = new RegExp(`${AUTHORITY}|${QUERY_FRAGMENT}`, 'gm')
 
 module.exports = function extractSensitiveRanges (evidence) {
   try {