dd-trace 6.15.0 → 6.17.0

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/sql-sensitive-analyzer.js

@@ -114,11 +114,10 @@ function digitRunEnd (value, from, length) {
 }
 
 /**
- * Handles plain integer and decimal literals. Exponents and radix literals defer to `NUMERIC`.
+ * Returns the end of a plain integer or decimal literal, or `-1` to delegate exponents and radix literals to `NUMERIC`.
  * @param {string} value
  * @param {number} intEnd Index after the integer digit run measured by the caller.
  * @param {number} length
- * @returns {number} Index after the literal, or `-1` to defer to the `NUMERIC` regex.
  */
 function scanPlainNumber (value, intEnd, length) {
   // A digit run touching `x`/`b` is a radix prefix (`0x`, `0b`) — let the regex own it.
@@ -177,7 +176,6 @@ const FALL_THROUGH = -2 // not a literal start -> advance one character and reco
  * @param {string} value
  * @param {number} from
  * @param {number} length
- * @returns {number} Index of the first line terminator at or after `from`, else `length`.
  */
 function lineEnd (value, from, length) {
   for (let i = from; i < length; i++) {
@@ -196,7 +194,6 @@ function lineEnd (value, from, length) {
  * @param {number} quote Char code of the opening delimiter, `'` or `"`.
  * @param {boolean} conservativeBackslash Whether an odd backslash before a closing quote makes the
  *   remainder ambiguous and therefore unterminated.
- * @returns {number} Index after the closing quote, or `UNTERMINATED`.
  */
 function scanQuotedDoubled (value, start, length, quote, conservativeBackslash) {
   let backslashCount = 0
@@ -229,7 +226,6 @@ function scanQuotedDoubled (value, start, length, quote, conservativeBackslash)
  * @param {number} length
  * @param {number} quote Char code of the opening delimiter, `'` or `"`.
  * @param {boolean} doubled Whether two adjacent quotes escape each other.
- * @returns {number} Index after the closing quote, or `UNTERMINATED`.
  */
 function scanQuotedBackslash (value, start, length, quote, doubled) {
   for (let i = start + 1; i < length; i++) {
@@ -269,12 +265,13 @@ function isPostgresEscapeString (value, quoteIndex) {
 /**
  * Oracle `q'X…X'`: `X` is one of `< ( { [` (closed by its mirror) or any other char (closed by
  * itself). The body may span line terminators.
+ * The result is the index after the closing `X'`.
+ * It is `FALL_THROUGH` when `q'` ends the value or is followed by a line terminator.
+ * Oracle forbids whitespace as the delimiter, so this case is a plain string instead of a quote opener.
+ * It is `UNTERMINATED` when no closing delimiter exists.
  * @param {string} value
  * @param {number} start
  * @param {number} length
- * @returns {number} Index after the closing `X'`; `FALL_THROUGH` when `q'` is at the end of the value
- *   or followed by a line terminator — Oracle forbids whitespace as the delimiter, so that `'` is a
- *   plain string, not a quote opener; or `UNTERMINATED`.
  */
 function scanOracleQuote (value, start, length) {
   const delimiter = value.charCodeAt(start + 2)
@@ -294,11 +291,12 @@ function scanOracleQuote (value, start, length) {
  * Postgres `$tag$ … $tag$`, where `tag` is empty or an identifier. The body may span line
  * terminators — PL/pgSQL function bodies routinely do, and treating a newline as the end of the
  * literal would leave the rest of a multi-line body unredacted.
+ * The result is the index after the closing tag.
+ * It is `FALL_THROUGH` when no second `$` exists.
+ * It is `UNTERMINATED` when the opening tag is malformed or has no close.
  * @param {string} value
  * @param {number} start
  * @param {number} length
- * @returns {number} Index after the closing tag; `FALL_THROUGH` when no second `$` exists; or
- *   `UNTERMINATED` when the opening tag is malformed or has no close.
  */
 function scanDollarQuote (value, start, length) {
   const tagEnd = value.indexOf('$', start + 1)

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/url-sensitive-analyzer.js

@@ -2,13 +2,13 @@
 
 const log = require('../../../../../log')
 
-const AUTHORITY = '^(?:[^:]+:)?//([^@]+)@'
+const AUTHORITY = String.raw`^(?:[^:]+:)?[\t\r\n]*/[\t\r\n]*/([^@]+)@`
 // The key class excludes `?` and `#` so the greedy quantifier is bounded per fragment.
 // Query keys cannot legitimately contain those characters (they delimit query/fragment
 // boundaries), so excluding them preserves match semantics for valid URLs while keeping
 // the regex linear on arbitrary input.
 const QUERY_FRAGMENT = '[?#&]([^=&;?#]+)=([^?#&]+)'
-const pattern = new RegExp(`${AUTHORITY}|${QUERY_FRAGMENT}`, 'gm')
+const pattern = new RegExp(`${AUTHORITY}|${QUERY_FRAGMENT}`, 'g')
 
 module.exports = function extractSensitiveRanges (evidence) {
   try {

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js

@@ -24,8 +24,8 @@ const MAX_EVIDENCE_LENGTH = 32_768
 
 class SensitiveHandler {
   constructor () {
-    this._namePattern = new RegExp(/** @type {string} */ (defaults['iast.redactionNamePattern']), 'gmi')
-    this._valuePattern = new RegExp(/** @type {string} */ (defaults['iast.redactionValuePattern']), 'gmi')
+    this._namePattern = new RegExp(/** @type {string} */ (defaults['iast.DD_IAST_REDACTION_NAME_PATTERN']), 'gmi')
+    this._valuePattern = new RegExp(/** @type {string} */ (defaults['iast.DD_IAST_REDACTION_VALUE_PATTERN']), 'gmi')
 
     this._sensitiveAnalyzers = new Map()
     this._sensitiveAnalyzers.set(vulnerabilities.CODE_INJECTION, taintedRangeBasedSensitiveAnalyzer)

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/utils.js

@@ -13,7 +13,10 @@ const REGEX_FOR_STRINGIFY_SENSITIVE_NOT_STRING = new RegExp(String.raw`"${STRING
 const REGEX_FOR_STRINGIFY_SENSITIVE = new RegExp(String.raw`${STRINGIFY_SENSITIVE_KEY}_\d+_(\d+)_`)
 const REGEX_FOR_STRINGIFY_RANGE = new RegExp(String.raw`(${STRINGIFY_RANGE_KEY}_\d+_)`)
 
-const sensitiveValueRegex = new RegExp(/** @type {string} */ (defaults['iast.redactionValuePattern']), 'gmi')
+const sensitiveValueRegex = new RegExp(
+  /** @type {string} */ (defaults['iast.DD_IAST_REDACTION_VALUE_PATTERN']),
+  'gmi'
+)
 
 function iterateObject (target, fn, levelKeys = [], depth = 10, visited = new Set()) {
   for (const key of Object.keys(target)) {

package/packages/dd-trace/src/appsec/iast/vulnerability-reporter.js

@@ -138,15 +138,15 @@ function replaceCallSiteFromSourceMap (callsite) {
 }
 
 function start (config, _tracer) {
-  deduplicationEnabled = config.iast.deduplicationEnabled
-  stackTraceEnabled = config.iast.stackTrace.enabled
-  stackTraceMaxDepth = config.appsec.stackTrace.maxDepth
-  maxStackTraces = config.appsec.stackTrace.maxStackTraces
+  deduplicationEnabled = config.iast.DD_IAST_DEDUPLICATION_ENABLED
+  stackTraceEnabled = config.iast.DD_IAST_STACK_TRACE_ENABLED
+  stackTraceMaxDepth = config.appsec.DD_APPSEC_MAX_STACK_TRACE_DEPTH
+  maxStackTraces = config.appsec.DD_APPSEC_MAX_STACK_TRACES
 
   vulnerabilitiesFormatter.setRedactVulnerabilities(
-    config.iast.redactionEnabled,
-    config.iast.redactionNamePattern,
-    config.iast.redactionValuePattern
+    config.iast.DD_IAST_REDACTION_ENABLED,
+    config.iast.DD_IAST_REDACTION_NAME_PATTERN,
+    config.iast.DD_IAST_REDACTION_VALUE_PATTERN
   )
   if (deduplicationEnabled) {
     startClearCacheTimer()

package/packages/dd-trace/src/appsec/index.js

@@ -87,7 +87,7 @@ function enable (_config) {
     appsecTelemetry.enable(_config)
     graphql.enable()
 
-    if (_config.appsec.rasp.enabled) {
+    if (_config.appsec.DD_APPSEC_RASP_ENABLED) {
       rasp.enable(_config)
     }
 
@@ -101,7 +101,7 @@ function enable (_config) {
 
     apiSecurity.configure(_config)
 
-    UserTracking.setCollectionMode(_config.appsec.eventTracking.mode, false)
+    UserTracking.setCollectionMode(_config.appsec.DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE, false)
 
     httpRequest.setConfig(_config)
 

package/packages/dd-trace/src/appsec/lambda.js

@@ -11,6 +11,8 @@ const waf = require('./waf')
 
 const activeInvocations = new WeakMap()
 
+const MAX_RESPONSE_BODY_SIZE = 16 * 1024 * 1024
+
 /**
  * Maps pre-extracted HTTP data from the Lambda event to WAF addresses,
  * runs the WAF, and reports results on the span.
@@ -86,11 +88,12 @@ function onLambdaStartInvocation (data) {
  * WAF pass, disposes the WAF context, and finishes the request report.
  *
  * @param {{ span: object, statusCode: string | undefined,
- *           responseHeaders: Record<string, string> | undefined }} data
+ *           responseHeaders: Record<string, string> | undefined,
+ *           responseBody: unknown, isBase64Encoded: boolean | undefined }} data
  */
 function onLambdaEndInvocation (data) {
   try {
-    const { span, statusCode, responseHeaders } = data
+    const { span, statusCode, responseHeaders, responseBody, isBase64Encoded } = data
 
     if (!span) {
       log.warn('[ASM] No span provided in Lambda end invocation')
@@ -127,6 +130,11 @@ function onLambdaEndInvocation (data) {
 
       if (samplingDecision === apiSecurity.SamplingDecision.SAMPLE) {
         persistent[addresses.WAF_CONTEXT_PROCESSOR] = { 'extract-schema': true }
+
+        const parsedBody = parseResponseBody(responseBody, responseHeaders, isBase64Encoded)
+        if (parsedBody !== undefined) {
+          persistent[addresses.HTTP_INCOMING_RESPONSE_BODY] = parsedBody
+        }
       }
 
       let wafResult
@@ -147,6 +155,67 @@ function onLambdaEndInvocation (data) {
   }
 }
 
+/**
+ * Turns the raw response body published by the Lambda layer into the object the WAF expects
+ *
+ * @param {unknown} rawBody
+ * @param {Record<string, string> | undefined} headers Already lowercased by the Lambda layer
+ * @param {boolean | undefined} isBase64Encoded
+ * @returns {object | undefined} The parsed body, or `undefined` when it cannot be used
+ */
+function parseResponseBody (rawBody, headers, isBase64Encoded) {
+  if (!rawBody) return
+
+  // A handler that answered with the payload itself needs no parsing, and no content type either.
+  if (typeof rawBody === 'object') return rawBody
+
+  if (typeof rawBody !== 'string') return
+
+  if (!isJsonContentType(headers?.['content-type'])) return
+
+  if (isOverSizeCap(rawBody, isBase64Encoded)) {
+    log.debug('[ASM] Lambda response body larger than %d bytes, skipping schema extraction',
+      MAX_RESPONSE_BODY_SIZE)
+    return
+  }
+
+  const contentEncoding = headers?.['content-encoding']?.toLowerCase()
+  if (contentEncoding && contentEncoding !== 'identity') return
+
+  try {
+    const parsed = JSON.parse(isBase64Encoded ? Buffer.from(rawBody, 'base64').toString('utf8') : rawBody)
+
+    // A JSON scalar carries no schema worth extracting.
+    if (parsed === null || typeof parsed !== 'object') return
+
+    return parsed
+  } catch {
+    // The SyntaxError message embeds a fragment of the body, which is customer data.
+    log.debug('[ASM] Failed to parse Lambda response body')
+  }
+}
+
+/**
+ * @param {string | undefined} contentType
+ */
+function isJsonContentType (contentType) {
+  return typeof contentType === 'string' && contentType.toLowerCase().includes('json')
+}
+
+/**
+ * Tells whether a raw body exceeds the size cap, without decoding or measuring it when avoidable
+ *
+ * @param {string} rawBody
+ * @param {boolean | undefined} isBase64Encoded
+ */
+function isOverSizeCap (rawBody, isBase64Encoded) {
+  if (isBase64Encoded) return Math.floor(rawBody.length * 3 / 4) >= MAX_RESPONSE_BODY_SIZE
+  if (rawBody.length >= MAX_RESPONSE_BODY_SIZE) return true
+  if (rawBody.length * 3 < MAX_RESPONSE_BODY_SIZE) return false
+
+  return Buffer.byteLength(rawBody, 'utf8') >= MAX_RESPONSE_BODY_SIZE
+}
+
 module.exports = {
   onLambdaStartInvocation,
   onLambdaEndInvocation,

package/packages/dd-trace/src/appsec/rasp/utils.js

@@ -45,7 +45,11 @@ class DatadogRaspAbortError extends Error {
 function handleResult (result, req, res, abortController, config, raspRule) {
   const generateStackTraceAction = result?.actions?.generate_stack
 
-  const { enabled, maxDepth, maxStackTraces } = config.appsec.stackTrace
+  const {
+    DD_APPSEC_STACK_TRACE_ENABLED: enabled,
+    DD_APPSEC_MAX_STACK_TRACE_DEPTH: maxDepth,
+    DD_APPSEC_MAX_STACK_TRACES: maxStackTraces,
+  } = config.appsec
 
   const rootSpan = web.root(req)
 

package/packages/dd-trace/src/appsec/remote_config.js

@@ -43,7 +43,7 @@ function enable (rcInstance, config, appsec) {
           setCollectionMode(rcConfig.auto_user_instrum.mode)
           autoUserInstrumModeId = configId
         } else if (configId === autoUserInstrumModeId) {
-          setCollectionMode(config.appsec.eventTracking.mode)
+          setCollectionMode(config.appsec.DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE)
           autoUserInstrumModeId = null
         }
       }
@@ -68,7 +68,7 @@ function enableOrDisableAppsec (action, rcConfig, config, appsec) {
     const isRemoteConfigControlling = action === 'apply' || action === 'modify'
     const shouldEnable = isRemoteConfigControlling
       ? rcConfig.asm.enabled // take control
-      : config.appsec.enabled // give back control to local config
+      : config.appsec.DD_APPSEC_ENABLED // give back control to local config
 
     if (shouldEnable) {
       appsec.enable(config)
@@ -79,8 +79,10 @@ function enableOrDisableAppsec (action, rcConfig, config, appsec) {
     // TODO: Use configWithOrigin /generateTelemetry instead of manually constructing the change.
     updateConfig([
       {
-        name: 'appsec.enabled',
-        origin: isRemoteConfigControlling ? 'remote_config' : config.getOrigin('appsec.enabled'),
+        name: 'DD_APPSEC_ENABLED',
+        origin: isRemoteConfigControlling
+          ? 'remote_config'
+          : config.getOrigin('appsec.DD_APPSEC_ENABLED'),
         value: shouldEnable,
       },
     ], config)
@@ -93,7 +95,7 @@ function enableOrDisableAppsec (action, rcConfig, config, appsec) {
  * @param {object} appsecConfig - Appsec config
  */
 function enableWafUpdate (appsecConfig) {
-  if (rc && appsecConfig && !appsecConfig.rules) {
+  if (rc && appsecConfig && !appsecConfig.DD_APPSEC_RULES) {
     // dirty require to make startup faster for serverless
     const { ASM_WAF_PRODUCTS } = require('./rc-products')
     const RuleManager = require('./rule_manager')
@@ -119,7 +121,7 @@ function enableWafUpdate (appsecConfig) {
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRACE_TAGGING_RULES, true)
     rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXTENDED_DATA_COLLECTION, true)
 
-    if (appsecConfig.rasp?.enabled) {
+    if (appsecConfig.DD_APPSEC_RASP_ENABLED) {
       rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SQLI, true)
       rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_SSRF, true)
       rc.updateCapabilities(RemoteConfigCapabilities.ASM_RASP_LFI, true)

package/packages/dd-trace/src/appsec/reporter.js

@@ -8,7 +8,7 @@ const web = require('../plugins/util/web')
 const { ipHeaderList } = require('../plugins/util/ip_extractor')
 const { keepTrace } = require('../priority_sampler')
 const { ASM } = require('../standalone/product')
-const { isEmpty } = require('../util')
+const { isEmpty, truncateString } = require('../util')
 const { getActiveRequest } = require('./store')
 const {
   incrementWafInitMetric,
@@ -114,11 +114,15 @@ const NON_EXTENDED_REQUEST_HEADERS = new Set([...requestHeadersList, ...eventHea
 const NON_EXTENDED_RESPONSE_HEADERS = new Set(responseHeaderList)
 const REDACTED_HEADERS = new Set(redactedHeadersList)
 
+/**
+ * @param {import('../config/config-types').ConfigProperties['appsec']} _config
+ * @param {boolean} [inferredProxyServicesEnabled]
+ */
 function init (_config, inferredProxyServicesEnabled) {
-  config.headersExtendedCollectionEnabled = _config.extendedHeadersCollection.enabled
-  config.maxHeadersCollected = _config.extendedHeadersCollection.maxHeaders
-  config.headersRedaction = _config.extendedHeadersCollection.redaction
-  config.raspBodyCollection = _config.rasp.bodyCollection
+  config.headersExtendedCollectionEnabled = _config.DD_APPSEC_COLLECT_ALL_HEADERS
+  config.maxHeadersCollected = _config.DD_APPSEC_MAX_COLLECTED_HEADERS
+  config.headersRedaction = _config.DD_APPSEC_HEADER_COLLECTION_REDACTION_ENABLED
+  config.raspBodyCollection = _config.DD_APPSEC_RASP_COLLECT_REQUEST_BODY
   config.inferredProxyServicesEnabled = inferredProxyServicesEnabled
 }
 
@@ -431,7 +435,7 @@ function truncateRequestBody (target, depth = 0) {
   switch (typeof target) {
     case 'string':
       if (target.length > COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH) {
-        return { value: target.slice(0, COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH), truncated: true }
+        return { value: truncateString(target, COLLECTED_REQUEST_BODY_MAX_STRING_LENGTH), truncated: true }
       }
       return { value: target, truncated: false }
     case 'object': {

package/packages/dd-trace/src/appsec/rule_manager.js

@@ -20,15 +20,15 @@ let appliedActions = new Map()
  */
 
 /**
- * @typedef {import('./waf').WAFConfig & { rules?: string }} AppSecConfig
+ * @typedef {import('./waf').WAFConfig & { DD_APPSEC_RULES?: string }} AppSecConfig
  */
 
 /**
  * @param {AppSecConfig} config
  */
 function loadRules (config) {
-  const defaultRules = config.rules
-    ? JSON.parse(readFileSync(config.rules, 'utf8'))
+  const defaultRules = config.DD_APPSEC_RULES
+    ? JSON.parse(readFileSync(config.DD_APPSEC_RULES, 'utf8'))
     : require('./recommended.json')
 
   waf.init(defaultRules, config)

package/packages/dd-trace/src/appsec/sdk/track_event.js

@@ -14,7 +14,6 @@ const { getRootSpan } = require('./utils')
  * @param {import('../../tracer')} tracer
  * @param {import('../../../../../index').User} user
  * @param {Record<string, string>} [metadata]
- * @returns {void}
  */
 function trackUserLoginSuccessEvent (tracer, user, metadata) {
   // TODO: better user check here and in _setUser() ?
@@ -48,7 +47,6 @@ function trackUserLoginSuccessEvent (tracer, user, metadata) {
  * @param {string} userId
  * @param {boolean} exists
  * @param {Record<string, string>} [metadata]
- * @returns {void}
  */
 function trackUserLoginFailureEvent (tracer, userId, exists, metadata) {
   if (!userId || typeof userId !== 'string') {

package/packages/dd-trace/src/appsec/telemetry/api_security.js

@@ -1,8 +1,6 @@
 'use strict'
 
-const telemetryMetrics = require('../../telemetry/metrics')
-
-const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+const { appsecMetrics } = require('./common')
 
 const normalizedFrameworkCache = new Map()
 

package/packages/dd-trace/src/appsec/telemetry/common.js

@@ -1,6 +1,9 @@
 'use strict'
 
+const telemetryMetrics = require('../../telemetry/metrics')
+
 const DD_TELEMETRY_REQUEST_METRICS = Symbol('_dd.appsec.telemetry.request.metrics')
+const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
 
 const tags = {
   BLOCK_FAILURE: 'block_failure',
@@ -22,6 +25,7 @@ function getVersionsTags (wafVersion, rulesVersion) {
 }
 
 module.exports = {
+  appsecMetrics,
   tags,
   getVersionsTags,
   DD_TELEMETRY_REQUEST_METRICS,

package/packages/dd-trace/src/appsec/telemetry/index.js

@@ -5,14 +5,13 @@ const {
   incrementApiSecRequestNoSchema,
   incrementApiSecRequestSchema,
 } = require('./api_security')
-const { DD_TELEMETRY_REQUEST_METRICS } = require('./common')
+const { appsecMetrics, DD_TELEMETRY_REQUEST_METRICS, getVersionsTags } = require('./common')
 const { incrementMissingUserId, incrementMissingUserLogin, incrementSdkEvent } = require('./user')
 const {
   addRaspRequestMetrics,
   trackRaspMetrics,
   trackRaspRuleMatch,
   trackRaspRuleSkipped,
-  incrementRaspDurationMetrics,
 } = require('./rasp')
 const {
   addWafRequestMetrics,
@@ -21,7 +20,6 @@ const {
   incrementWafUpdates,
   incrementWafConfigErrors,
   incrementWafRequests,
-  incrementWafDurationMetrics,
 } = require('./waf')
 
 const metricsStoreMap = new WeakMap()
@@ -150,8 +148,28 @@ function incrementRequestDurationMetrics (req) {
   const store = getStore(req)
   const requestMetrics = store[DD_TELEMETRY_REQUEST_METRICS]
 
-  incrementWafDurationMetrics(requestMetrics)
-  incrementRaspDurationMetrics(requestMetrics)
+  if (!requestMetrics.duration && !requestMetrics.durationExt &&
+      !requestMetrics.raspDuration && !requestMetrics.raspDurationExt) return
+
+  const { duration, durationExt, raspDuration, raspDurationExt, wafVersion, rulesVersion } = requestMetrics
+
+  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
+
+  if (duration) {
+    appsecMetrics.distribution('waf.duration', versionsTags).track(duration)
+  }
+
+  if (durationExt) {
+    appsecMetrics.distribution('waf.duration_ext', versionsTags).track(durationExt)
+  }
+
+  if (raspDuration) {
+    appsecMetrics.distribution('rasp.duration', versionsTags).track(raspDuration)
+  }
+
+  if (raspDurationExt) {
+    appsecMetrics.distribution('rasp.duration_ext', versionsTags).track(raspDurationExt)
+  }
 }
 
 function incrementMissingUserLoginMetric (framework, eventType) {

package/packages/dd-trace/src/appsec/telemetry/rasp.js

@@ -1,9 +1,6 @@
 'use strict'
 
-const telemetryMetrics = require('../../telemetry/metrics')
-const { DD_TELEMETRY_REQUEST_METRICS, getVersionsTags } = require('./common')
-
-const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+const { appsecMetrics, DD_TELEMETRY_REQUEST_METRICS, getVersionsTags } = require('./common')
 
 const BLOCKING_STATUS = {
   FAILURE: 'failure',
@@ -77,21 +74,6 @@ function trackRaspRuleMatch (store, raspRule, blockTriggered, blocked) {
   appsecMetrics.count('rasp.rule.match', tags).inc(1)
 }
 
-function incrementRaspDurationMetrics (requestMetrics) {
-  const { raspDuration, raspDurationExt, wafVersion, rulesVersion } = requestMetrics
-  if (!raspDuration && !raspDurationExt) return
-
-  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
-
-  if (raspDuration) {
-    appsecMetrics.distribution('rasp.duration', versionsTags).track(raspDuration)
-  }
-
-  if (raspDurationExt) {
-    appsecMetrics.distribution('rasp.duration_ext', versionsTags).track(raspDurationExt)
-  }
-}
-
 function trackRaspRuleSkipped (raspRule, reason) {
   const tags = { reason, rule_type: raspRule.type }
 
@@ -115,5 +97,4 @@ module.exports = {
   trackRaspMetrics,
   trackRaspRuleMatch,
   trackRaspRuleSkipped,
-  incrementRaspDurationMetrics,
 }

package/packages/dd-trace/src/appsec/telemetry/user.js

@@ -1,8 +1,6 @@
 'use strict'
 
-const telemetryMetrics = require('../../telemetry/metrics')
-
-const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+const { appsecMetrics } = require('./common')
 
 function incrementMissingUserLogin (framework, eventType) {
   appsecMetrics.count('instrum.user_auth.missing_user_login', {

package/packages/dd-trace/src/appsec/telemetry/waf.js

@@ -1,9 +1,6 @@
 'use strict'
 
-const telemetryMetrics = require('../../telemetry/metrics')
-const { tags, getVersionsTags, DD_TELEMETRY_REQUEST_METRICS } = require('./common')
-
-const appsecMetrics = telemetryMetrics.manager.namespace('appsec')
+const { appsecMetrics, tags, getVersionsTags, DD_TELEMETRY_REQUEST_METRICS } = require('./common')
 
 const DD_TELEMETRY_WAF_RESULT_TAGS = Symbol('_dd.appsec.telemetry.waf.result.tags')
 
@@ -126,21 +123,6 @@ function incrementWafRequests (store) {
   }
 }
 
-function incrementWafDurationMetrics (requestMetrics) {
-  const { duration, durationExt, wafVersion, rulesVersion } = requestMetrics
-  if (!duration && !durationExt) return
-
-  const versionsTags = getVersionsTags(wafVersion, rulesVersion)
-
-  if (duration) {
-    appsecMetrics.distribution('waf.duration', versionsTags).track(duration)
-  }
-
-  if (durationExt) {
-    appsecMetrics.distribution('waf.duration_ext', versionsTags).track(durationExt)
-  }
-}
-
 function incrementTruncatedMetrics (metrics, truncationReason) {
   const truncationTags = { truncation_reason: truncationReason }
   appsecMetrics.count('waf.input_truncated', truncationTags).inc(1)
@@ -163,5 +145,4 @@ module.exports = {
   incrementWafUpdates,
   incrementWafConfigErrors,
   incrementWafRequests,
-  incrementWafDurationMetrics,
 }

package/packages/dd-trace/src/appsec/waf/index.js

@@ -25,7 +25,7 @@ let limiter = new Limiter(100)
 let WAFManager = null
 
 /**
- * @typedef {import('./waf_manager').WAFManagerConfig & { rateLimit: number }} WAFConfig
+ * @typedef {import('./waf_manager').WAFManagerConfig & { DD_APPSEC_TRACE_RATE_LIMIT: number }} WAFConfig
  */
 
 const waf = {
@@ -48,7 +48,7 @@ const waf = {
 function init (rules, config) {
   destroy()
 
-  limiter = new Limiter(config.rateLimit)
+  limiter = new Limiter(config.DD_APPSEC_TRACE_RATE_LIMIT)
 
   // Lazy loading improves the startup time
   WAFManager = require('./waf_manager')

package/packages/dd-trace/src/appsec/waf/waf_manager.js

@@ -8,9 +8,9 @@ const contexts = new WeakMap()
 
 /**
  * @typedef {object} WAFManagerConfig
- * @property {number} wafTimeout - Maximum time in microseconds for WAF execution
- * @property {string} obfuscatorKeyRegex - Regex to redact sensitive data by key
- * @property {string} obfuscatorValueRegex - Regex to redact sensitive data by value
+ * @property {number} DD_APPSEC_WAF_TIMEOUT - Maximum time in microseconds for WAF execution
+ * @property {string} DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP - Regex to redact sensitive data by key
+ * @property {string} DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP - Regex to redact sensitive data by value
  */
 
 class WAFManager {
@@ -22,7 +22,7 @@ class WAFManager {
    */
   constructor (rules, config) {
     this.config = config
-    this.wafTimeout = config.wafTimeout
+    this.wafTimeout = config.DD_APPSEC_WAF_TIMEOUT
     this.ddwaf = this._loadDDWAF(rules)
     this.rulesVersion = this.ddwaf.diagnostics.ruleset_version
     this.defaultRules = rules
@@ -36,7 +36,10 @@ class WAFManager {
       const { DDWAF } = require('@datadog/native-appsec')
       this.ddwafVersion = DDWAF.version()
 
-      const { obfuscatorKeyRegex, obfuscatorValueRegex } = this.config
+      const {
+        DD_APPSEC_OBFUSCATION_PARAMETER_KEY_REGEXP: obfuscatorKeyRegex,
+        DD_APPSEC_OBFUSCATION_PARAMETER_VALUE_REGEXP: obfuscatorValueRegex,
+      } = this.config
       return new DDWAF(rules, WAFManager.defaultWafConfigPath, { obfuscatorKeyRegex, obfuscatorValueRegex })
     } catch (err) {
       this.ddwafVersion ||= 'unknown'

package/packages/dd-trace/src/carrier.js

@@ -81,7 +81,6 @@ function defineField (fieldName, headerName, read, operations) {
     /**
      * @param {Carrier} carrier
      * @param {Value} value
-     * @returns {void}
      */
     write (carrier, value) {
       carrier[headerName] = value
@@ -89,7 +88,6 @@ function defineField (fieldName, headerName, read, operations) {
 
     /**
      * @param {Carrier} carrier
-     * @returns {boolean}
      */
     has (carrier) {
       return headerName in carrier
@@ -97,7 +95,6 @@ function defineField (fieldName, headerName, read, operations) {
 
     /**
      * @param {Carrier} carrier
-     * @returns {void}
      */
     delete (carrier) {
       delete carrier[headerName]
@@ -106,7 +103,6 @@ function defineField (fieldName, headerName, read, operations) {
     /**
      * @param {Carrier} carrier
      * @param {Carrier} target
-     * @returns {void}
      */
     copy (carrier, target) {
       if (Object.hasOwn(carrier, headerName)) target[headerName] = carrier[headerName]
@@ -308,7 +304,6 @@ defineCapability('legacyBaggage', FIELD_READ | FIELD_WRITE, {
   /**
    * @param {Carrier} carrier
    * @param {Record<string, string>} target
-   * @returns {void}
    */
   read (carrier, target) {
     for (const name of Object.keys(carrier)) {