dd-trace 6.16.0 → 6.17.0

package/packages/dd-trace/src/aiguard/integrations/openai.js

@@ -7,6 +7,8 @@ const {
   getChatCompletionsOutputMessages,
   getResponsesInputMessages,
   getResponsesOutputMessages,
+  getStreamedChatCompletionsOutputMessages,
+  getStreamedResponsesOutputMessages,
 } = require('../messages/openai')
 const { decode } = require('../messages/utils')
 const { SOURCE_AUTO } = require('../tags')
@@ -18,18 +20,21 @@ const responsesInterceptChannel = channel('dd-trace:openai:responses:intercept')
 let isEnabled = false
 let aiguard
 let opts
+let analyzeStreamResponses
 
 /**
  * Subscribes AI Guard to the OpenAI interception channels.
  *
  * @param {object} aiguardInstance
  * @param {boolean} block
+ * @param {boolean} analyzeStreams
  */
-function enable (aiguardInstance, block) {
+function enable (aiguardInstance, block, analyzeStreams) {
   if (isEnabled) return
 
   aiguard = aiguardInstance
   opts = { block, source: SOURCE_AUTO, integration: 'openai' }
+  analyzeStreamResponses = analyzeStreams
 
   chatCompletionsInterceptChannel.subscribe(onChatCompletions)
   responsesInterceptChannel.subscribe(onResponses)
@@ -45,6 +50,7 @@ function disable () {
 
   aiguard = undefined
   opts = undefined
+  analyzeStreamResponses = undefined
   isEnabled = false
 }
 
@@ -52,7 +58,6 @@ function onChatCompletions (ctx) {
   const inputMessages = getChatCompletionsInputMessages(ctx.arguments?.[0])
   if (!inputMessages?.length) return
 
-  // `parse` and `asResponse` are both wrapped, and either may run more than once per call.
   let inputEvaluation
   ctx.beforeResult = () => {
     if (!isEnabled) return
@@ -60,18 +65,27 @@ function onChatCompletions (ctx) {
     return inputEvaluation
   }
 
-  // One model call has one output however many readers observe it.
+  const isStream = ctx.arguments[0].stream
+  if (isStream && !analyzeStreamResponses) return
+
   let outputEvaluation
   ctx.onResult = body => {
     if (!isEnabled) return body
 
+    if (isStream) {
+      outputEvaluation ??= interceptStream(body, chunks => {
+        return getStreamedChatCompletionsOutputMessages(chunks)
+          .map(message => [...inputMessages, message])
+      }, ctx)
+      return outputEvaluation
+    }
+
     const conversations = decode(
       () => getChatCompletionsOutputMessages(body).map(message => [...inputMessages, message]),
       null,
       'AIGuard: unable to decode OpenAI response body: %s'
     )
-    if (conversations === null) return body
-    if (conversations.length === 0) return body
+    if (!conversations?.length) return body
 
     outputEvaluation ??= evaluate(ctx, aiguard, conversations, opts)
     return outputEvaluation.then(() => body)
@@ -89,21 +103,81 @@ function onResponses (ctx) {
     return inputEvaluation
   }
 
+  const isStream = ctx.arguments[0].stream
+  if (isStream && !analyzeStreamResponses) return
+
   let outputEvaluation
   ctx.onResult = body => {
     if (!isEnabled) return body
 
+    if (isStream) {
+      outputEvaluation ??= interceptStream(body, chunks => {
+        const outputMessages = getStreamedResponsesOutputMessages(chunks)
+        return outputMessages.length ? [[...inputMessages, ...outputMessages]] : []
+      }, ctx)
+      return outputEvaluation
+    }
+
     const outputMessages = decode(
       () => getResponsesOutputMessages(body),
       null,
       'AIGuard: unable to decode OpenAI response body: %s'
     )
-    if (outputMessages === null) return body
-    if (!outputMessages.length) return body
+    if (!outputMessages?.length) return body
 
     outputEvaluation ??= evaluate(ctx, aiguard, [[...inputMessages, ...outputMessages]], opts)
     return outputEvaluation.then(() => body)
   }
 }
 
+/**
+ * Uses the OpenAI SDK's stream splitting support to evaluate one branch and return the other.
+ *
+ * @param {object} stream
+ * @param {(chunks: Array<object>) => Array<Array<object>>} getConversations
+ * @param {object} ctx
+ * @returns {object|Promise<object>}
+ */
+function interceptStream (stream, getConversations, ctx) {
+  if (typeof stream?.tee !== 'function') return stream
+
+  let branches
+  try {
+    branches = stream.tee()
+  } catch {
+    return stream
+  }
+
+  const [evaluationStream, resultStream] = branches
+  return drainStream(evaluationStream).then(chunks => {
+    if (!isEnabled) return resultStream
+    const conversations = decode(
+      () => getConversations(chunks),
+      null,
+      'AIGuard: unable to decode the streamed OpenAI response: %s'
+    )
+    if (!conversations?.length) return resultStream
+    return evaluate(ctx, aiguard, conversations, opts).then(() => resultStream)
+  }, () => resultStream)
+}
+
+/**
+ * @param {object} stream
+ * @returns {Promise<Array<object>>}
+ */
+function drainStream (stream) {
+  const chunks = []
+  const iterator = stream[Symbol.asyncIterator]()
+
+  function readAll () {
+    return iterator.next().then(({ done, value }) => {
+      if (done) return chunks
+      chunks.push(value)
+      return readAll()
+    })
+  }
+
+  return readAll()
+}
+
 module.exports = { enable, disable }

package/packages/dd-trace/src/aiguard/messages/anthropic.js

@@ -220,7 +220,6 @@ function partsToContent (parts, hasImages) {
 
 /**
  * @param {Array<object>} parts
- * @returns {boolean}
  */
 function hasImageParts (parts) {
   return parts.some(part => part.type === 'image_url')
@@ -267,7 +266,6 @@ function convertAnthropicToolResultContent (content) {
 
 /**
  * @param {unknown} content
- * @returns {string}
  */
 function convertServerToolResultContent (content) {
   if (typeof content === 'string') return content || '[tool result]'

package/packages/dd-trace/src/aiguard/messages/openai.js

@@ -195,6 +195,68 @@ function getResponsesOutputMessages (body) {
   return convertOpenAIResponseItemsToMessages(body?.output, 'assistant')
 }
 
+/**
+ * Combines streamed chat completion deltas into regular output messages.
+ *
+ * @param {Array<object>} chunks
+ * @returns {Array<object>}
+ */
+function getStreamedChatCompletionsOutputMessages (chunks) {
+  const messages = new Map()
+
+  for (const chunk of chunks) {
+    if (!Array.isArray(chunk?.choices)) continue
+    for (const choice of chunk.choices) {
+      const delta = choice.delta
+      if (!delta) continue
+
+      const index = choice.index ?? 0
+      const message = messages.get(index) ?? { role: 'assistant' }
+      messages.set(index, message)
+
+      if (typeof delta.role === 'string') message.role = delta.role
+      if (typeof delta.content === 'string') message.content = (message.content ?? '') + delta.content
+      if (typeof delta.refusal === 'string') message.refusal = (message.refusal ?? '') + delta.refusal
+
+      if (delta.function_call) {
+        const functionCall = message.function_call ??= {}
+        functionCall.name ??= delta.function_call.name
+        if (typeof delta.function_call.arguments === 'string') {
+          functionCall.arguments = (functionCall.arguments ?? '') + delta.function_call.arguments
+        }
+      }
+
+      if (!Array.isArray(delta.tool_calls)) continue
+      for (const toolCallDelta of delta.tool_calls) {
+        const toolCalls = message.tool_calls ??= []
+        const toolCall = toolCalls[toolCallDelta.index ?? 0] ??= { function: {} }
+        toolCall.id ??= toolCallDelta.id
+        toolCall.type ??= toolCallDelta.type
+        toolCall.function.name ??= toolCallDelta.function?.name
+        if (typeof toolCallDelta.function?.arguments === 'string') {
+          toolCall.function.arguments = (toolCall.function.arguments ?? '') + toolCallDelta.function.arguments
+        }
+      }
+    }
+  }
+
+  const choices = [...messages.values()].map(message => {
+    if (message.tool_calls) message.tool_calls = message.tool_calls.filter(Boolean)
+    return { message }
+  })
+  return getChatCompletionsOutputMessages({ choices })
+}
+
+/**
+ * Gets output messages from the final response snapshot in a Responses API stream.
+ *
+ * @param {Array<object>} chunks
+ * @returns {Array<object>}
+ */
+function getStreamedResponsesOutputMessages (chunks) {
+  return getResponsesOutputMessages(chunks.at(-1)?.response)
+}
+
 /**
  * Converts one OpenAI reusable prompt variable value to message content.
  *
@@ -348,7 +410,6 @@ function openAIResponseImageContentPart (part) {
  * Extracts a stable text marker from an OpenAI file content part.
  *
  * @param {{file_id?: string|null, file_url?: string, filename?: string, file_data?: string}} part
- * @returns {string}
  */
 function openAIResponseFileContentPart (part) {
   return part.file_id ?? part.file_url ?? part.filename ?? FILE_FALLBACK
@@ -362,5 +423,7 @@ module.exports = {
   convertOpenAIResponsePromptToMessages,
   getResponsesInputMessages,
   getResponsesOutputMessages,
+  getStreamedChatCompletionsOutputMessages,
+  getStreamedResponsesOutputMessages,
   openAIResponseContentToMessageContent,
 }

package/packages/dd-trace/src/aiguard/messages/utils.js

@@ -22,7 +22,6 @@ function stringifyIfNeeded (value) {
 
 /**
  * @param {unknown} value
- * @returns {string}
  */
 function stringifyOrEmpty (value) {
   return stringifyIfNeeded(value) ?? ''

package/packages/dd-trace/src/aiguard/redaction.js

@@ -49,7 +49,6 @@ function parsePath (path) {
  * Reports whether a parsed path targets an allowed message string.
  *
  * @param {Array<{ name: string, index: number|undefined }>} segments
- * @returns {boolean}
  */
 function isRedactablePath (segments) {
   const first = segments[0]

package/packages/dd-trace/src/aiguard/sdk.js

@@ -30,7 +30,7 @@ class AIGuard extends NoopAIGuard {
     this.#tracer = tracer
     this.#client = new AIGuardClient(config)
     this.#reporter = new EvaluationReporter(config)
-    this.#redactionEnabled = config.experimental.aiguard.redactionEnabled
+    this.#redactionEnabled = config.aiguard.DD_AI_GUARD_REDACTION_ENABLED
     this.#meta = { service: config.service, env: config.env }
     this.#initialized = true
   }

package/packages/dd-trace/src/appsec/activation.js

@@ -6,7 +6,7 @@ const Activation = {
   DISABLED: 'Disabled',
 
   fromConfig (config) {
-    switch (config.appsec.enabled) {
+    switch (config.appsec.DD_APPSEC_ENABLED) {
       // ASM is activated by an env var DD_APPSEC_ENABLED=true
       case true:
         return Activation.ENABLED

package/packages/dd-trace/src/appsec/api_security/normalized-route.js

@@ -215,7 +215,6 @@ function compileRoute (route, parse, makeMatcher) {
  * @param {number} g
  * @param {Map<number, number>} groupParent
  * @param {Set<number>} present
- * @returns {boolean}
  */
 function groupActive (g, groupParent, present) {
   while (g !== 0) {
@@ -229,7 +228,6 @@ function groupActive (g, groupParent, present) {
  * URL-encode chars outside the RFC-1103 static alphabet [A-Za-z0-9.-~_]. The 'u' flag iterates whole
  * codepoints so surrogate pairs encode as correct multi-byte UTF-8.
  * @param {string} str
- * @returns {string}
  */
 function encodeStaticSegment (str) {
   return str.replaceAll(/[^A-Za-z0-9.\-~_]/gu, c => {
@@ -246,7 +244,6 @@ function encodeStaticSegment (str) {
 /**
  * URL-encode the 6 characters not allowed in a normalized param name (/?#+{}).
  * @param {string} name
- * @returns {string}
  */
 function encodeParamName (name) {
   return name.replaceAll(/[/?#+{}]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'))
@@ -256,7 +253,6 @@ function encodeParamName (name) {
  * Render the normalized route for a given set of present optional groups.
  * @param {CompiledRoute} compiled
  * @param {Set<number>} present
- * @returns {string}
  */
 function renderRoute (compiled, present) {
   const { segments, groupParent } = compiled
@@ -367,7 +363,6 @@ function resolvePresence (compiled, params) {
  * Stable bitmask key for a present-group set (group ids are small, route-local).
  * @param {number[]} optionalGroups
  * @param {Set<number>} present
- * @returns {number}
  */
 function presenceBitmask (optionalGroups, present) {
   let mask = 0

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -122,7 +122,6 @@ function sampleRequest (req, res, record = false) {
  *
  * @param {string|undefined} route
  * @param {boolean} record
- * @returns {boolean}
  */
 function isRoutelessRecord (route, record) {
   return record && route === undefined
@@ -130,7 +129,6 @@ function isRoutelessRecord (route, record) {
 
 /**
  * @param {number|string} statusCode
- * @returns {boolean}
  */
 function isNotFound (statusCode) {
   return Number(statusCode) === 404
@@ -141,7 +139,6 @@ function isNotFound (statusCode) {
  * @param {string|undefined} route A route string, an empty string (still a valid route), or
  *   `undefined`
  * @param {number|string} statusCode
- * @returns {string}
  */
 function buildSamplingKey (method, route, statusCode) {
   return method + (route ?? '') + statusCode
@@ -176,7 +173,6 @@ function getRouteOrEndpoint (context, statusCode) {
  * regardless of the APM sampling decision.
  *
  * @param {DatadogSpan} rootSpan
- * @returns {boolean}
  */
 function isRejected (rootSpan) {
   if (asmStandaloneEnabled) return false

package/packages/dd-trace/src/appsec/blocking/index.js

@@ -204,9 +204,9 @@ function handleResults (actions, req, res, rootSpan, abortController) {
  * @param {import('../../config/config-base')} [config] - Tracer configuration
  */
 function setTemplates (config) {
-  templates.html.body = config?.appsec?.blockedTemplateHtml
-  templates.json.body = config?.appsec?.blockedTemplateJson
-  templates.graphqlJson.body = config?.appsec?.blockedTemplateGraphql
+  templates.html.body = config?.appsec?.DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML
+  templates.json.body = config?.appsec?.DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON
+  templates.graphqlJson.body = config?.appsec?.DD_APPSEC_GRAPHQL_BLOCKED_TEMPLATE_JSON
 
   for (const type of Object.keys(templates)) {
     const template = templates[type]

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -102,7 +102,6 @@ function recordResponseBodyIgnored (req, tag) {
 /**
  * @param {import('http').IncomingMessage} originatingReq inbound request (for metrics).
  * @param {import('http').IncomingMessage} res downstream response.
- * @returns {boolean} whether downstream response body should be collected for AppSec.
  */
 function evaluateResponseBodyCollection (originatingReq, res) {
   const maxBytes = config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES
@@ -131,7 +130,6 @@ function evaluateResponseBodyCollection (originatingReq, res) {
  * Probabilistic gate for downstream response body capture (rate + per-request cap).
  * Only used from {@link planResponseBodyCollection}; does not increment {@link bodyAnalysisCount}.
  * @param {import('http').IncomingMessage} req originating server request.
- * @returns {boolean}
  */
 function shouldSampleBody (req) {
   globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
@@ -150,7 +148,6 @@ function shouldSampleBody (req) {
 
 /**
  * @param {import('http').IncomingMessage} res downstream HTTP response.
- * @returns {boolean}
  */
 function isRedirectResponse (res) {
   const location = res.headers?.location || ''
@@ -271,7 +268,6 @@ function incrementDownstreamAnalysisCount (req) {
 /**
  * Returns the HTTP method to use for a downstream request, defaulting to GET.
  * @param {string} method method supplied in the outgoing request options.
- * @returns {string} validated HTTP method.
  */
 function getMethod (method) {
   return typeof method === 'string' && method ? method : 'GET'
@@ -351,6 +347,7 @@ module.exports = {
   disable,
   planResponseBodyCollection,
   incrementDownstreamAnalysisCount,
+  extractMimeType,
   extractRequestData,
   extractResponseData,
 }

package/packages/dd-trace/src/appsec/iast/index.js

@@ -31,7 +31,7 @@ let isEnabled = false
 function enable (config, _tracer) {
   if (isEnabled) return
 
-  iastTelemetry.configure(config, config.iast?.telemetryVerbosity)
+  iastTelemetry.configure(config, config.iast?.DD_IAST_TELEMETRY_VERBOSITY)
   enableFsPlugin(IAST_MODULE)
   enableAllAnalyzers(config)
   enableTaintTracking(config.iast, iastTelemetry.verbosity)

package/packages/dd-trace/src/appsec/iast/overhead-controller.js

@@ -73,7 +73,7 @@ const OPERATIONS = {
     },
     name: REPORT_VULNERABILITY,
     initialTokenBucketSize () {
-      return typeof config.maxContextOperations === 'number' ? config.maxContextOperations : 2
+      return typeof config.DD_IAST_MAX_CONTEXT_OPERATIONS === 'number' ? config.DD_IAST_MAX_CONTEXT_OPERATIONS : 2
     },
     initContext: function (context) {
       context.tokens[REPORT_VULNERABILITY] = this.initialTokenBucketSize()
@@ -146,8 +146,8 @@ function _resetGlobalContext () {
 
 function acquireRequest (rootSpan) {
   if (availableRequest > 0 && rootSpan) {
-    const sampling = config && typeof config.requestSampling === 'number'
-      ? config.requestSampling
+    const sampling = config && typeof config.DD_IAST_REQUEST_SAMPLING === 'number'
+      ? config.DD_IAST_REQUEST_SAMPLING
       : 30
     if (rootSpan.context().toSpanId().slice(-2) <= sampling) {
       availableRequest--
@@ -158,7 +158,7 @@ function acquireRequest (rootSpan) {
 }
 
 function releaseRequest () {
-  if (availableRequest < config.maxConcurrentRequests) {
+  if (availableRequest < config.DD_IAST_MAX_CONCURRENT_REQUESTS) {
     availableRequest++
   }
 }
@@ -174,7 +174,7 @@ function initializeRequestContext (iastContext) {
 
 function configure (cfg) {
   config = cfg
-  availableRequest = config.maxConcurrentRequests
+  availableRequest = config.DD_IAST_MAX_CONCURRENT_REQUESTS
 }
 
 function startGlobalContext () {

package/packages/dd-trace/src/appsec/iast/taint-tracking/index.js

@@ -20,7 +20,7 @@ module.exports = {
     kafkaContextPlugin.enable(config)
     kafkaConsumerPlugin.enable(config)
 
-    setMaxTransactions(config.maxConcurrentRequests)
+    setMaxTransactions(config.DD_IAST_MAX_CONCURRENT_REQUESTS)
   },
   disableTaintTracking () {
     disableTaintOperations()

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -30,7 +30,7 @@ class TaintTrackingPlugin extends SourceIastPlugin {
   configure (config) {
     super.configure(config)
 
-    let rowsToTaint = this.iastConfig?.dbRowsToTaint
+    let rowsToTaint = this.iastConfig?.DD_IAST_DB_ROWS_TO_TAINT
     if (typeof rowsToTaint !== 'number') {
       rowsToTaint = 1
     }

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js

@@ -97,7 +97,7 @@ function getPrepareStackTraceAccessor () {
 
 function getCompileMethodFn (compileMethod) {
   let delegate = function (content, filename) {
-    if (isDdTrace(filename) || !isPrivateModule(filename) || !config.iast?.enabled) {
+    if (isDdTrace(filename) || !isPrivateModule(filename) || !config.iast?.DD_IAST_ENABLED) {
       return compileMethod.apply(this, [content, filename])
     }
 
@@ -163,7 +163,7 @@ function shimPrepareStackTrace () {
 
 function enableRewriter (telemetryVerbosity) {
   try {
-    if (config.iast?.enabled) {
+    if (config.iast?.DD_IAST_ENABLED) {
       const rewriter = getRewriter(telemetryVerbosity)
       if (rewriter) {
         shimPrepareStackTrace()
@@ -218,7 +218,7 @@ let enableEsmRewriter = function (telemetryVerbosity) {
           telemetryVerbosity,
           chainSourceMap: isFlagPresent('--enable-source-maps'),
           orchestrionConfig,
-          iastEnabled: config?.iast?.enabled,
+          iastEnabled: config?.iast?.DD_IAST_ENABLED,
         },
       })
     } catch (e) {

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-analyzers/sql-sensitive-analyzer.js

@@ -114,11 +114,10 @@ function digitRunEnd (value, from, length) {
 }
 
 /**
- * Handles plain integer and decimal literals. Exponents and radix literals defer to `NUMERIC`.
+ * Returns the end of a plain integer or decimal literal, or `-1` to delegate exponents and radix literals to `NUMERIC`.
  * @param {string} value
  * @param {number} intEnd Index after the integer digit run measured by the caller.
  * @param {number} length
- * @returns {number} Index after the literal, or `-1` to defer to the `NUMERIC` regex.
  */
 function scanPlainNumber (value, intEnd, length) {
   // A digit run touching `x`/`b` is a radix prefix (`0x`, `0b`) — let the regex own it.
@@ -177,7 +176,6 @@ const FALL_THROUGH = -2 // not a literal start -> advance one character and reco
  * @param {string} value
  * @param {number} from
  * @param {number} length
- * @returns {number} Index of the first line terminator at or after `from`, else `length`.
  */
 function lineEnd (value, from, length) {
   for (let i = from; i < length; i++) {
@@ -196,7 +194,6 @@ function lineEnd (value, from, length) {
  * @param {number} quote Char code of the opening delimiter, `'` or `"`.
  * @param {boolean} conservativeBackslash Whether an odd backslash before a closing quote makes the
  *   remainder ambiguous and therefore unterminated.
- * @returns {number} Index after the closing quote, or `UNTERMINATED`.
  */
 function scanQuotedDoubled (value, start, length, quote, conservativeBackslash) {
   let backslashCount = 0
@@ -229,7 +226,6 @@ function scanQuotedDoubled (value, start, length, quote, conservativeBackslash)
  * @param {number} length
  * @param {number} quote Char code of the opening delimiter, `'` or `"`.
  * @param {boolean} doubled Whether two adjacent quotes escape each other.
- * @returns {number} Index after the closing quote, or `UNTERMINATED`.
  */
 function scanQuotedBackslash (value, start, length, quote, doubled) {
   for (let i = start + 1; i < length; i++) {
@@ -269,12 +265,13 @@ function isPostgresEscapeString (value, quoteIndex) {
 /**
  * Oracle `q'X…X'`: `X` is one of `< ( { [` (closed by its mirror) or any other char (closed by
  * itself). The body may span line terminators.
+ * The result is the index after the closing `X'`.
+ * It is `FALL_THROUGH` when `q'` ends the value or is followed by a line terminator.
+ * Oracle forbids whitespace as the delimiter, so this case is a plain string instead of a quote opener.
+ * It is `UNTERMINATED` when no closing delimiter exists.
  * @param {string} value
  * @param {number} start
  * @param {number} length
- * @returns {number} Index after the closing `X'`; `FALL_THROUGH` when `q'` is at the end of the value
- *   or followed by a line terminator — Oracle forbids whitespace as the delimiter, so that `'` is a
- *   plain string, not a quote opener; or `UNTERMINATED`.
  */
 function scanOracleQuote (value, start, length) {
   const delimiter = value.charCodeAt(start + 2)
@@ -294,11 +291,12 @@ function scanOracleQuote (value, start, length) {
  * Postgres `$tag$ … $tag$`, where `tag` is empty or an identifier. The body may span line
  * terminators — PL/pgSQL function bodies routinely do, and treating a newline as the end of the
  * literal would leave the rest of a multi-line body unredacted.
+ * The result is the index after the closing tag.
+ * It is `FALL_THROUGH` when no second `$` exists.
+ * It is `UNTERMINATED` when the opening tag is malformed or has no close.
  * @param {string} value
  * @param {number} start
  * @param {number} length
- * @returns {number} Index after the closing tag; `FALL_THROUGH` when no second `$` exists; or
- *   `UNTERMINATED` when the opening tag is malformed or has no close.
  */
 function scanDollarQuote (value, start, length) {
   const tagEnd = value.indexOf('$', start + 1)

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/evidence-redaction/sensitive-handler.js

@@ -24,8 +24,8 @@ const MAX_EVIDENCE_LENGTH = 32_768
 
 class SensitiveHandler {
   constructor () {
-    this._namePattern = new RegExp(/** @type {string} */ (defaults['iast.redactionNamePattern']), 'gmi')
-    this._valuePattern = new RegExp(/** @type {string} */ (defaults['iast.redactionValuePattern']), 'gmi')
+    this._namePattern = new RegExp(/** @type {string} */ (defaults['iast.DD_IAST_REDACTION_NAME_PATTERN']), 'gmi')
+    this._valuePattern = new RegExp(/** @type {string} */ (defaults['iast.DD_IAST_REDACTION_VALUE_PATTERN']), 'gmi')
 
     this._sensitiveAnalyzers = new Map()
     this._sensitiveAnalyzers.set(vulnerabilities.CODE_INJECTION, taintedRangeBasedSensitiveAnalyzer)

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/utils.js

@@ -13,7 +13,10 @@ const REGEX_FOR_STRINGIFY_SENSITIVE_NOT_STRING = new RegExp(String.raw`"${STRING
 const REGEX_FOR_STRINGIFY_SENSITIVE = new RegExp(String.raw`${STRINGIFY_SENSITIVE_KEY}_\d+_(\d+)_`)
 const REGEX_FOR_STRINGIFY_RANGE = new RegExp(String.raw`(${STRINGIFY_RANGE_KEY}_\d+_)`)
 
-const sensitiveValueRegex = new RegExp(/** @type {string} */ (defaults['iast.redactionValuePattern']), 'gmi')
+const sensitiveValueRegex = new RegExp(
+  /** @type {string} */ (defaults['iast.DD_IAST_REDACTION_VALUE_PATTERN']),
+  'gmi'
+)
 
 function iterateObject (target, fn, levelKeys = [], depth = 10, visited = new Set()) {
   for (const key of Object.keys(target)) {

package/packages/dd-trace/src/appsec/iast/vulnerability-reporter.js

@@ -138,15 +138,15 @@ function replaceCallSiteFromSourceMap (callsite) {
 }
 
 function start (config, _tracer) {
-  deduplicationEnabled = config.iast.deduplicationEnabled
-  stackTraceEnabled = config.iast.stackTrace.enabled
-  stackTraceMaxDepth = config.appsec.stackTrace.maxDepth
-  maxStackTraces = config.appsec.stackTrace.maxStackTraces
+  deduplicationEnabled = config.iast.DD_IAST_DEDUPLICATION_ENABLED
+  stackTraceEnabled = config.iast.DD_IAST_STACK_TRACE_ENABLED
+  stackTraceMaxDepth = config.appsec.DD_APPSEC_MAX_STACK_TRACE_DEPTH
+  maxStackTraces = config.appsec.DD_APPSEC_MAX_STACK_TRACES
 
   vulnerabilitiesFormatter.setRedactVulnerabilities(
-    config.iast.redactionEnabled,
-    config.iast.redactionNamePattern,
-    config.iast.redactionValuePattern
+    config.iast.DD_IAST_REDACTION_ENABLED,
+    config.iast.DD_IAST_REDACTION_NAME_PATTERN,
+    config.iast.DD_IAST_REDACTION_VALUE_PATTERN
   )
   if (deduplicationEnabled) {
     startClearCacheTimer()

package/packages/dd-trace/src/appsec/index.js

@@ -87,7 +87,7 @@ function enable (_config) {
     appsecTelemetry.enable(_config)
     graphql.enable()
 
-    if (_config.appsec.rasp.enabled) {
+    if (_config.appsec.DD_APPSEC_RASP_ENABLED) {
       rasp.enable(_config)
     }
 
@@ -101,7 +101,7 @@ function enable (_config) {
 
     apiSecurity.configure(_config)
 
-    UserTracking.setCollectionMode(_config.appsec.eventTracking.mode, false)
+    UserTracking.setCollectionMode(_config.appsec.DD_APPSEC_AUTO_USER_INSTRUMENTATION_MODE, false)
 
     httpRequest.setConfig(_config)