dd-trace 6.16.0 → 6.18.0

package/packages/dd-trace/src/aiguard/evaluation.js

@@ -9,6 +9,7 @@ const { keepTrace } = require('../priority_sampler')
 const { extractIp } = require('../plugins/util/ip_extractor')
 const { AI_GUARD } = require('../standalone/product')
 const telemetryMetrics = require('../telemetry/metrics')
+const { truncateString } = require('../util')
 const { normalizeRedactionReplacements, redactMessages } = require('./redaction')
 const TAGS = require('./tags')
 
@@ -96,7 +97,6 @@ function parseEvaluationResponse (body) {
  *
  * @param {boolean} block
  * @param {{ action: string, blockingEnabled: boolean }} evaluation
- * @returns {boolean}
  */
 function shouldBlockEvaluation (block, evaluation) {
   return block && evaluation.blockingEnabled && evaluation.action !== ALLOW
@@ -158,9 +158,9 @@ class EvaluationReporter {
    */
   constructor (config) {
     this.#config = config
-    this.#maxMessagesLength = config.experimental.aiguard.maxMessagesLength
-    this.#maxContentSize = config.experimental.aiguard.maxContentSize
-    this.#redactionEnabled = config.experimental.aiguard.redactionEnabled
+    this.#maxMessagesLength = config.aiguard.DD_AI_GUARD_MAX_MESSAGES_LENGTH
+    this.#maxContentSize = config.aiguard.DD_AI_GUARD_MAX_CONTENT_SIZE
+    this.#redactionEnabled = config.aiguard.DD_AI_GUARD_REDACTION_ENABLED
   }
 
   /**
@@ -211,7 +211,6 @@ class EvaluationReporter {
    *
    * @param {EvaluationReport} report
    * @param {string} errorType
-   * @returns {void}
    */
   fail (report, errorType) {
     report.metaStruct.messages = this.#buildMessagesForMetaStruct(report.messages, report.telemetryTags)
@@ -224,7 +223,6 @@ class EvaluationReporter {
    *
    * @param {EvaluationReport} report
    * @param {EvaluationOutcome} outcome
-   * @returns {void}
    */
   finish (report, outcome) {
     const { result, redaction, shouldBlock } = outcome
@@ -299,14 +297,13 @@ class EvaluationReporter {
    * Truncates text in a cloned message to one shared content-size limit.
    *
    * @param {{ content?: string|ContentPart[] }} message
-   * @returns {boolean}
    */
   #truncateMessageContent (message) {
     const { content } = message
     if (typeof content === 'string') {
       if (content.length <= this.#maxContentSize) return false
 
-      message.content = content.slice(0, this.#maxContentSize)
+      message.content = truncateString(content, this.#maxContentSize)
       return true
     }
 
@@ -319,7 +316,7 @@ class EvaluationReporter {
       if (typeof text !== 'string') continue
 
       if (text.length > remainingContentSize) {
-        part.text = text.slice(0, remainingContentSize)
+        part.text = truncateString(text, remainingContentSize)
         truncated = true
         remainingContentSize = 0
       } else {
@@ -333,7 +330,6 @@ class EvaluationReporter {
    * Returns whether a message represents a tool call or tool output.
    *
    * @param {Message} message
-   * @returns {boolean}
    */
   #isToolCall (message) {
     return Boolean(message.tool_calls || message.tool_call_id)
@@ -370,7 +366,6 @@ class EvaluationReporter {
    * Adds missing client IP tags to the service entry span.
    *
    * @param {Span} rootSpan
-   * @returns {void}
    */
   #setRootSpanClientIpTags (rootSpan) {
     const currentTags = rootSpan.context().getTags()
@@ -411,7 +406,6 @@ class EvaluationReporter {
    *
    * @param {Span} guardSpan
    * @param {Span} rootSpan
-   * @returns {void}
    */
   #copyServiceEntryTagsToGuardSpan (guardSpan, rootSpan) {
     const rootTags = rootSpan.context().getTags()

package/packages/dd-trace/src/aiguard/index.js

@@ -17,8 +17,8 @@ function enable (tracer, config) {
 
   try {
     aiguard = new AIGuard(tracer, config)
-    const block = config.experimental?.aiguard?.block !== false
-    const analyzeStreamResponses = config.DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED
+    const block = config.aiguard.DD_AI_GUARD_BLOCK !== false
+    const analyzeStreamResponses = config.aiguard.DD_AI_GUARD_ANALYZE_STREAM_RESPONSES_ENABLED
 
     incomingHttpRequestStart.subscribe(onIncomingHttpRequestStart)
     integrations.enable(aiguard, block, analyzeStreamResponses)

package/packages/dd-trace/src/aiguard/integrations/index.js

@@ -17,7 +17,7 @@ function enable (aiguard, block, analyzeStreamResponses) {
   if (isEnabled) return
 
   anthropic.enable(aiguard, block)
-  openai.enable(aiguard, block)
+  openai.enable(aiguard, block, analyzeStreamResponses)
   vercelAi.enable(aiguard, block, analyzeStreamResponses)
 
   isEnabled = true

package/packages/dd-trace/src/aiguard/integrations/openai.js

@@ -7,6 +7,8 @@ const {
   getChatCompletionsOutputMessages,
   getResponsesInputMessages,
   getResponsesOutputMessages,
+  getStreamedChatCompletionsOutputMessages,
+  getStreamedResponsesOutputMessages,
 } = require('../messages/openai')
 const { decode } = require('../messages/utils')
 const { SOURCE_AUTO } = require('../tags')
@@ -18,18 +20,21 @@ const responsesInterceptChannel = channel('dd-trace:openai:responses:intercept')
 let isEnabled = false
 let aiguard
 let opts
+let analyzeStreamResponses
 
 /**
  * Subscribes AI Guard to the OpenAI interception channels.
  *
  * @param {object} aiguardInstance
  * @param {boolean} block
+ * @param {boolean} analyzeStreams
  */
-function enable (aiguardInstance, block) {
+function enable (aiguardInstance, block, analyzeStreams) {
   if (isEnabled) return
 
   aiguard = aiguardInstance
   opts = { block, source: SOURCE_AUTO, integration: 'openai' }
+  analyzeStreamResponses = analyzeStreams
 
   chatCompletionsInterceptChannel.subscribe(onChatCompletions)
   responsesInterceptChannel.subscribe(onResponses)
@@ -45,6 +50,7 @@ function disable () {
 
   aiguard = undefined
   opts = undefined
+  analyzeStreamResponses = undefined
   isEnabled = false
 }
 
@@ -52,7 +58,6 @@ function onChatCompletions (ctx) {
   const inputMessages = getChatCompletionsInputMessages(ctx.arguments?.[0])
   if (!inputMessages?.length) return
 
-  // `parse` and `asResponse` are both wrapped, and either may run more than once per call.
   let inputEvaluation
   ctx.beforeResult = () => {
     if (!isEnabled) return
@@ -60,18 +65,27 @@ function onChatCompletions (ctx) {
     return inputEvaluation
   }
 
-  // One model call has one output however many readers observe it.
+  const isStream = ctx.arguments[0].stream
+  if (isStream && !analyzeStreamResponses) return
+
   let outputEvaluation
   ctx.onResult = body => {
     if (!isEnabled) return body
 
+    if (isStream) {
+      outputEvaluation ??= interceptStream(body, chunks => {
+        return getStreamedChatCompletionsOutputMessages(chunks)
+          .map(message => [...inputMessages, message])
+      }, ctx)
+      return outputEvaluation
+    }
+
     const conversations = decode(
       () => getChatCompletionsOutputMessages(body).map(message => [...inputMessages, message]),
       null,
       'AIGuard: unable to decode OpenAI response body: %s'
     )
-    if (conversations === null) return body
-    if (conversations.length === 0) return body
+    if (!conversations?.length) return body
 
     outputEvaluation ??= evaluate(ctx, aiguard, conversations, opts)
     return outputEvaluation.then(() => body)
@@ -89,21 +103,81 @@ function onResponses (ctx) {
     return inputEvaluation
   }
 
+  const isStream = ctx.arguments[0].stream
+  if (isStream && !analyzeStreamResponses) return
+
   let outputEvaluation
   ctx.onResult = body => {
     if (!isEnabled) return body
 
+    if (isStream) {
+      outputEvaluation ??= interceptStream(body, chunks => {
+        const outputMessages = getStreamedResponsesOutputMessages(chunks)
+        return outputMessages.length ? [[...inputMessages, ...outputMessages]] : []
+      }, ctx)
+      return outputEvaluation
+    }
+
     const outputMessages = decode(
       () => getResponsesOutputMessages(body),
       null,
       'AIGuard: unable to decode OpenAI response body: %s'
     )
-    if (outputMessages === null) return body
-    if (!outputMessages.length) return body
+    if (!outputMessages?.length) return body
 
     outputEvaluation ??= evaluate(ctx, aiguard, [[...inputMessages, ...outputMessages]], opts)
     return outputEvaluation.then(() => body)
   }
 }
 
+/**
+ * Uses the OpenAI SDK's stream splitting support to evaluate one branch and return the other.
+ *
+ * @param {object} stream
+ * @param {(chunks: Array<object>) => Array<Array<object>>} getConversations
+ * @param {object} ctx
+ * @returns {object|Promise<object>}
+ */
+function interceptStream (stream, getConversations, ctx) {
+  if (typeof stream?.tee !== 'function') return stream
+
+  let branches
+  try {
+    branches = stream.tee()
+  } catch {
+    return stream
+  }
+
+  const [evaluationStream, resultStream] = branches
+  return drainStream(evaluationStream).then(chunks => {
+    if (!isEnabled) return resultStream
+    const conversations = decode(
+      () => getConversations(chunks),
+      null,
+      'AIGuard: unable to decode the streamed OpenAI response: %s'
+    )
+    if (!conversations?.length) return resultStream
+    return evaluate(ctx, aiguard, conversations, opts).then(() => resultStream)
+  }, () => resultStream)
+}
+
+/**
+ * @param {object} stream
+ * @returns {Promise<Array<object>>}
+ */
+function drainStream (stream) {
+  const chunks = []
+  const iterator = stream[Symbol.asyncIterator]()
+
+  function readAll () {
+    return iterator.next().then(({ done, value }) => {
+      if (done) return chunks
+      chunks.push(value)
+      return readAll()
+    })
+  }
+
+  return readAll()
+}
+
 module.exports = { enable, disable }

package/packages/dd-trace/src/aiguard/messages/anthropic.js

@@ -220,7 +220,6 @@ function partsToContent (parts, hasImages) {
 
 /**
  * @param {Array<object>} parts
- * @returns {boolean}
  */
 function hasImageParts (parts) {
   return parts.some(part => part.type === 'image_url')
@@ -267,7 +266,6 @@ function convertAnthropicToolResultContent (content) {
 
 /**
  * @param {unknown} content
- * @returns {string}
  */
 function convertServerToolResultContent (content) {
   if (typeof content === 'string') return content || '[tool result]'

package/packages/dd-trace/src/aiguard/messages/openai.js

@@ -195,6 +195,68 @@ function getResponsesOutputMessages (body) {
   return convertOpenAIResponseItemsToMessages(body?.output, 'assistant')
 }
 
+/**
+ * Combines streamed chat completion deltas into regular output messages.
+ *
+ * @param {Array<object>} chunks
+ * @returns {Array<object>}
+ */
+function getStreamedChatCompletionsOutputMessages (chunks) {
+  const messages = new Map()
+
+  for (const chunk of chunks) {
+    if (!Array.isArray(chunk?.choices)) continue
+    for (const choice of chunk.choices) {
+      const delta = choice.delta
+      if (!delta) continue
+
+      const index = choice.index ?? 0
+      const message = messages.get(index) ?? { role: 'assistant' }
+      messages.set(index, message)
+
+      if (typeof delta.role === 'string') message.role = delta.role
+      if (typeof delta.content === 'string') message.content = (message.content ?? '') + delta.content
+      if (typeof delta.refusal === 'string') message.refusal = (message.refusal ?? '') + delta.refusal
+
+      if (delta.function_call) {
+        const functionCall = message.function_call ??= {}
+        functionCall.name ??= delta.function_call.name
+        if (typeof delta.function_call.arguments === 'string') {
+          functionCall.arguments = (functionCall.arguments ?? '') + delta.function_call.arguments
+        }
+      }
+
+      if (!Array.isArray(delta.tool_calls)) continue
+      for (const toolCallDelta of delta.tool_calls) {
+        const toolCalls = message.tool_calls ??= []
+        const toolCall = toolCalls[toolCallDelta.index ?? 0] ??= { function: {} }
+        toolCall.id ??= toolCallDelta.id
+        toolCall.type ??= toolCallDelta.type
+        toolCall.function.name ??= toolCallDelta.function?.name
+        if (typeof toolCallDelta.function?.arguments === 'string') {
+          toolCall.function.arguments = (toolCall.function.arguments ?? '') + toolCallDelta.function.arguments
+        }
+      }
+    }
+  }
+
+  const choices = [...messages.values()].map(message => {
+    if (message.tool_calls) message.tool_calls = message.tool_calls.filter(Boolean)
+    return { message }
+  })
+  return getChatCompletionsOutputMessages({ choices })
+}
+
+/**
+ * Gets output messages from the final response snapshot in a Responses API stream.
+ *
+ * @param {Array<object>} chunks
+ * @returns {Array<object>}
+ */
+function getStreamedResponsesOutputMessages (chunks) {
+  return getResponsesOutputMessages(chunks.at(-1)?.response)
+}
+
 /**
  * Converts one OpenAI reusable prompt variable value to message content.
  *
@@ -348,7 +410,6 @@ function openAIResponseImageContentPart (part) {
  * Extracts a stable text marker from an OpenAI file content part.
  *
  * @param {{file_id?: string|null, file_url?: string, filename?: string, file_data?: string}} part
- * @returns {string}
  */
 function openAIResponseFileContentPart (part) {
   return part.file_id ?? part.file_url ?? part.filename ?? FILE_FALLBACK
@@ -362,5 +423,7 @@ module.exports = {
   convertOpenAIResponsePromptToMessages,
   getResponsesInputMessages,
   getResponsesOutputMessages,
+  getStreamedChatCompletionsOutputMessages,
+  getStreamedResponsesOutputMessages,
   openAIResponseContentToMessageContent,
 }

package/packages/dd-trace/src/aiguard/messages/utils.js

@@ -22,7 +22,6 @@ function stringifyIfNeeded (value) {
 
 /**
  * @param {unknown} value
- * @returns {string}
  */
 function stringifyOrEmpty (value) {
   return stringifyIfNeeded(value) ?? ''

package/packages/dd-trace/src/aiguard/redaction.js

@@ -49,7 +49,6 @@ function parsePath (path) {
  * Reports whether a parsed path targets an allowed message string.
  *
  * @param {Array<{ name: string, index: number|undefined }>} segments
- * @returns {boolean}
  */
 function isRedactablePath (segments) {
   const first = segments[0]

package/packages/dd-trace/src/aiguard/sdk.js

@@ -30,7 +30,7 @@ class AIGuard extends NoopAIGuard {
     this.#tracer = tracer
     this.#client = new AIGuardClient(config)
     this.#reporter = new EvaluationReporter(config)
-    this.#redactionEnabled = config.experimental.aiguard.redactionEnabled
+    this.#redactionEnabled = config.aiguard.DD_AI_GUARD_REDACTION_ENABLED
     this.#meta = { service: config.service, env: config.env }
     this.#initialized = true
   }

package/packages/dd-trace/src/appsec/activation.js

@@ -6,7 +6,7 @@ const Activation = {
   DISABLED: 'Disabled',
 
   fromConfig (config) {
-    switch (config.appsec.enabled) {
+    switch (config.appsec.DD_APPSEC_ENABLED) {
       // ASM is activated by an env var DD_APPSEC_ENABLED=true
       case true:
         return Activation.ENABLED

package/packages/dd-trace/src/appsec/api_security/normalized-route.js

@@ -215,7 +215,6 @@ function compileRoute (route, parse, makeMatcher) {
  * @param {number} g
  * @param {Map<number, number>} groupParent
  * @param {Set<number>} present
- * @returns {boolean}
  */
 function groupActive (g, groupParent, present) {
   while (g !== 0) {
@@ -229,7 +228,6 @@ function groupActive (g, groupParent, present) {
  * URL-encode chars outside the RFC-1103 static alphabet [A-Za-z0-9.-~_]. The 'u' flag iterates whole
  * codepoints so surrogate pairs encode as correct multi-byte UTF-8.
  * @param {string} str
- * @returns {string}
  */
 function encodeStaticSegment (str) {
   return str.replaceAll(/[^A-Za-z0-9.\-~_]/gu, c => {
@@ -246,7 +244,6 @@ function encodeStaticSegment (str) {
 /**
  * URL-encode the 6 characters not allowed in a normalized param name (/?#+{}).
  * @param {string} name
- * @returns {string}
  */
 function encodeParamName (name) {
   return name.replaceAll(/[/?#+{}]/g, c => '%' + c.charCodeAt(0).toString(16).toUpperCase().padStart(2, '0'))
@@ -256,7 +253,6 @@ function encodeParamName (name) {
  * Render the normalized route for a given set of present optional groups.
  * @param {CompiledRoute} compiled
  * @param {Set<number>} present
- * @returns {string}
  */
 function renderRoute (compiled, present) {
   const { segments, groupParent } = compiled
@@ -367,7 +363,6 @@ function resolvePresence (compiled, params) {
  * Stable bitmask key for a present-group set (group ids are small, route-local).
  * @param {number[]} optionalGroups
  * @param {Set<number>} present
- * @returns {number}
  */
 function presenceBitmask (optionalGroups, present) {
   let mask = 0

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -122,7 +122,6 @@ function sampleRequest (req, res, record = false) {
  *
  * @param {string|undefined} route
  * @param {boolean} record
- * @returns {boolean}
  */
 function isRoutelessRecord (route, record) {
   return record && route === undefined
@@ -130,7 +129,6 @@ function isRoutelessRecord (route, record) {
 
 /**
  * @param {number|string} statusCode
- * @returns {boolean}
  */
 function isNotFound (statusCode) {
   return Number(statusCode) === 404
@@ -141,7 +139,6 @@ function isNotFound (statusCode) {
  * @param {string|undefined} route A route string, an empty string (still a valid route), or
  *   `undefined`
  * @param {number|string} statusCode
- * @returns {string}
  */
 function buildSamplingKey (method, route, statusCode) {
   return method + (route ?? '') + statusCode
@@ -176,7 +173,6 @@ function getRouteOrEndpoint (context, statusCode) {
  * regardless of the APM sampling decision.
  *
  * @param {DatadogSpan} rootSpan
- * @returns {boolean}
  */
 function isRejected (rootSpan) {
   if (asmStandaloneEnabled) return false

package/packages/dd-trace/src/appsec/blocking/index.js

@@ -204,9 +204,9 @@ function handleResults (actions, req, res, rootSpan, abortController) {
  * @param {import('../../config/config-base')} [config] - Tracer configuration
  */
 function setTemplates (config) {
-  templates.html.body = config?.appsec?.blockedTemplateHtml
-  templates.json.body = config?.appsec?.blockedTemplateJson
-  templates.graphqlJson.body = config?.appsec?.blockedTemplateGraphql
+  templates.html.body = config?.appsec?.DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML
+  templates.json.body = config?.appsec?.DD_APPSEC_HTTP_BLOCKED_TEMPLATE_JSON
+  templates.graphqlJson.body = config?.appsec?.DD_APPSEC_GRAPHQL_BLOCKED_TEMPLATE_JSON
 
   for (const type of Object.keys(templates)) {
     const template = templates[type]

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -102,7 +102,6 @@ function recordResponseBodyIgnored (req, tag) {
 /**
  * @param {import('http').IncomingMessage} originatingReq inbound request (for metrics).
  * @param {import('http').IncomingMessage} res downstream response.
- * @returns {boolean} whether downstream response body should be collected for AppSec.
  */
 function evaluateResponseBodyCollection (originatingReq, res) {
   const maxBytes = config.appsec.DD_API_SECURITY_MAX_DOWNSTREAM_BODY_BYTES
@@ -131,7 +130,6 @@ function evaluateResponseBodyCollection (originatingReq, res) {
  * Probabilistic gate for downstream response body capture (rate + per-request cap).
  * Only used from {@link planResponseBodyCollection}; does not increment {@link bodyAnalysisCount}.
  * @param {import('http').IncomingMessage} req originating server request.
- * @returns {boolean}
  */
 function shouldSampleBody (req) {
   globalRequestCounter = (globalRequestCounter + 1n) & UINT64_MAX
@@ -150,7 +148,6 @@ function shouldSampleBody (req) {
 
 /**
  * @param {import('http').IncomingMessage} res downstream HTTP response.
- * @returns {boolean}
  */
 function isRedirectResponse (res) {
   const location = res.headers?.location || ''
@@ -271,7 +268,6 @@ function incrementDownstreamAnalysisCount (req) {
 /**
  * Returns the HTTP method to use for a downstream request, defaulting to GET.
  * @param {string} method method supplied in the outgoing request options.
- * @returns {string} validated HTTP method.
  */
 function getMethod (method) {
   return typeof method === 'string' && method ? method : 'GET'
@@ -351,6 +347,7 @@ module.exports = {
   disable,
   planResponseBodyCollection,
   incrementDownstreamAnalysisCount,
+  extractMimeType,
   extractRequestData,
   extractResponseData,
 }

package/packages/dd-trace/src/appsec/iast/index.js

@@ -31,7 +31,7 @@ let isEnabled = false
 function enable (config, _tracer) {
   if (isEnabled) return
 
-  iastTelemetry.configure(config, config.iast?.telemetryVerbosity)
+  iastTelemetry.configure(config, config.iast?.DD_IAST_TELEMETRY_VERBOSITY)
   enableFsPlugin(IAST_MODULE)
   enableAllAnalyzers(config)
   enableTaintTracking(config.iast, iastTelemetry.verbosity)

package/packages/dd-trace/src/appsec/iast/overhead-controller.js

@@ -73,7 +73,7 @@ const OPERATIONS = {
     },
     name: REPORT_VULNERABILITY,
     initialTokenBucketSize () {
-      return typeof config.maxContextOperations === 'number' ? config.maxContextOperations : 2
+      return typeof config.DD_IAST_MAX_CONTEXT_OPERATIONS === 'number' ? config.DD_IAST_MAX_CONTEXT_OPERATIONS : 2
     },
     initContext: function (context) {
       context.tokens[REPORT_VULNERABILITY] = this.initialTokenBucketSize()
@@ -146,8 +146,8 @@ function _resetGlobalContext () {
 
 function acquireRequest (rootSpan) {
   if (availableRequest > 0 && rootSpan) {
-    const sampling = config && typeof config.requestSampling === 'number'
-      ? config.requestSampling
+    const sampling = config && typeof config.DD_IAST_REQUEST_SAMPLING === 'number'
+      ? config.DD_IAST_REQUEST_SAMPLING
       : 30
     if (rootSpan.context().toSpanId().slice(-2) <= sampling) {
       availableRequest--
@@ -158,7 +158,7 @@ function acquireRequest (rootSpan) {
 }
 
 function releaseRequest () {
-  if (availableRequest < config.maxConcurrentRequests) {
+  if (availableRequest < config.DD_IAST_MAX_CONCURRENT_REQUESTS) {
     availableRequest++
   }
 }
@@ -174,7 +174,7 @@ function initializeRequestContext (iastContext) {
 
 function configure (cfg) {
   config = cfg
-  availableRequest = config.maxConcurrentRequests
+  availableRequest = config.DD_IAST_MAX_CONCURRENT_REQUESTS
 }
 
 function startGlobalContext () {

package/packages/dd-trace/src/appsec/iast/taint-tracking/index.js

@@ -20,7 +20,7 @@ module.exports = {
     kafkaContextPlugin.enable(config)
     kafkaConsumerPlugin.enable(config)
 
-    setMaxTransactions(config.maxConcurrentRequests)
+    setMaxTransactions(config.DD_IAST_MAX_CONCURRENT_REQUESTS)
   },
   disableTaintTracking () {
     disableTaintOperations()

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -30,7 +30,7 @@ class TaintTrackingPlugin extends SourceIastPlugin {
   configure (config) {
     super.configure(config)
 
-    let rowsToTaint = this.iastConfig?.dbRowsToTaint
+    let rowsToTaint = this.iastConfig?.DD_IAST_DB_ROWS_TO_TAINT
     if (typeof rowsToTaint !== 'number') {
       rowsToTaint = 1
     }

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js

@@ -97,7 +97,7 @@ function getPrepareStackTraceAccessor () {
 
 function getCompileMethodFn (compileMethod) {
   let delegate = function (content, filename) {
-    if (isDdTrace(filename) || !isPrivateModule(filename) || !config.iast?.enabled) {
+    if (isDdTrace(filename) || !isPrivateModule(filename) || !config.iast?.DD_IAST_ENABLED) {
       return compileMethod.apply(this, [content, filename])
     }
 
@@ -163,7 +163,7 @@ function shimPrepareStackTrace () {
 
 function enableRewriter (telemetryVerbosity) {
   try {
-    if (config.iast?.enabled) {
+    if (config.iast?.DD_IAST_ENABLED) {
       const rewriter = getRewriter(telemetryVerbosity)
       if (rewriter) {
         shimPrepareStackTrace()
@@ -218,7 +218,7 @@ let enableEsmRewriter = function (telemetryVerbosity) {
           telemetryVerbosity,
           chainSourceMap: isFlagPresent('--enable-source-maps'),
           orchestrionConfig,
-          iastEnabled: config?.iast?.enabled,
+          iastEnabled: config?.iast?.DD_IAST_ENABLED,
         },
       })
     } catch (e) {