dd-trace 6.21.0 → 6.22.0

package/packages/datadog-shimmer/src/shimmer.js

@@ -314,11 +314,11 @@ function assertMethod (target, name, method) {
     let message = 'No target object provided'
 
     if (target) {
-      if (typeof target !== 'object' && typeof target !== 'function') {
-        message = 'Invalid target'
-      } else {
+      if (typeof target === 'object' || typeof target === 'function') {
         name = String(name)
         message = method ? `Original method ${name} is not a function` : `No original method ${name}`
+      } else {
+        message = 'Invalid target'
       }
     }
 
@@ -335,7 +335,8 @@ function assertMethod (target, name, method) {
 function assertNotClass (target) {
   // Frozen functions also have a non-writable `prototype`; inspect their source only then.
   if ('prototype' in target &&
-      Object.getOwnPropertyDescriptor(target, 'prototype').writable === false &&
+      // Bound generators inherit `prototype` without owning one, so the descriptor may still be missing.
+      Object.getOwnPropertyDescriptor(target, 'prototype')?.writable === false &&
       (!Object.isFrozen(target) || Function.prototype.toString.call(target).startsWith('class'))) {
     throw new TypeError('Target is a native class constructor and cannot be wrapped.')
   }

package/packages/datadog-webpack/index.js

@@ -6,11 +6,15 @@ const fs = require('node:fs')
 const instrumentations = require('../datadog-instrumentations/src/helpers/instrumentations')
 const extractPackageAndModulePath = require('../datadog-instrumentations/src/helpers/extract-package-and-module-path')
 const hooks = require('../datadog-instrumentations/src/helpers/hooks')
+const { getRewriteTarget } = require('../datadog-instrumentations/src/helpers/rewriter/targets')
 const { isESMFile } = require('../datadog-esbuild/src/utils')
+const { getValueFromEnvSources } = require('../dd-trace/src/config/helper')
 const log = require('./src/log')
 
 const PLUGIN_NAME = 'DatadogWebpackPlugin'
 
+const DD_BUNDLER_INJECT_GIT_METADATA = getValueFromEnvSources('DD_BUNDLER_INJECT_GIT_METADATA') !== false
+
 for (const hook of Object.values(hooks)) {
   if (hook !== null && typeof hook === 'object') {
     hook.fn()
@@ -80,50 +84,55 @@ class DatadogWebpackPlugin {
       }
     })
 
-    const gitMetadata = getGitMetadata()
-    if (gitMetadata.repositoryURL || gitMetadata.commitSHA) {
-      const banner =
-        'if (typeof process === \'object\' && process !== null &&\n' +
-        '    process.env !== null && typeof process.env === \'object\') {\n' +
-        (gitMetadata.repositoryURL
-          ? `  process.env.DD_GIT_REPOSITORY_URL = ${JSON.stringify(gitMetadata.repositoryURL)};\n`
-          : '') +
-        (gitMetadata.commitSHA
-          ? `  process.env.DD_GIT_COMMIT_SHA = ${JSON.stringify(gitMetadata.commitSHA)};\n`
-          : '') +
-        '}\n'
-
-      compiler.hooks.thisCompilation.tap(PLUGIN_NAME, (compilation) => {
-        compilation.hooks.processAssets.tap(
-          { name: PLUGIN_NAME, stage: -2000 },
-          () => {
-            for (const chunk of compilation.chunks) {
-              if (!chunk.canBeInitial()) continue
-              for (const filename of chunk.files) {
-                if (!filename.endsWith('.js') && !filename.endsWith('.mjs')) continue
-                compilation.updateAsset(filename, (old) => {
-                  const content = banner + old.source()
-                  return {
-                    source () { return content },
-                    size () { return Buffer.byteLength(content, 'utf8') },
-                    map () { return old.map() },
-                    sourceAndMap () { return { source: content, map: old.map() } },
-                    updateHash (hash) { hash.update(content) },
-                  }
-                })
+    // Bake DD_GIT_* into assets unless DD_BUNDLER_INJECT_GIT_METADATA=false (stable artifact hashes).
+    if (DD_BUNDLER_INJECT_GIT_METADATA) {
+      const gitMetadata = getGitMetadata()
+      if (gitMetadata.repositoryURL || gitMetadata.commitSHA) {
+        const banner =
+          'if (typeof process === \'object\' && process !== null &&\n' +
+          '    process.env !== null && typeof process.env === \'object\') {\n' +
+          (gitMetadata.repositoryURL
+            ? `  process.env.DD_GIT_REPOSITORY_URL = ${JSON.stringify(gitMetadata.repositoryURL)};\n`
+            : '') +
+          (gitMetadata.commitSHA
+            ? `  process.env.DD_GIT_COMMIT_SHA = ${JSON.stringify(gitMetadata.commitSHA)};\n`
+            : '') +
+          '}\n'
+
+        compiler.hooks.thisCompilation.tap(PLUGIN_NAME, (compilation) => {
+          compilation.hooks.processAssets.tap(
+            { name: PLUGIN_NAME, stage: -2000 },
+            () => {
+              for (const chunk of compilation.chunks) {
+                if (!chunk.canBeInitial()) continue
+                for (const filename of chunk.files) {
+                  if (!filename.endsWith('.js') && !filename.endsWith('.mjs')) continue
+                  compilation.updateAsset(filename, (old) => {
+                    const content = banner + old.source()
+                    return {
+                      source () { return content },
+                      size () { return Buffer.byteLength(content, 'utf8') },
+                      map () { return old.map() },
+                      sourceAndMap () { return { source: content, map: old.map() } },
+                      updateHash (hash) { hash.update(content) },
+                    }
+                  })
+                }
               }
             }
-          }
-        )
-      })
+          )
+        })
 
-      log.debug(
-        'Automatically injected git metadata (DD_GIT_REPOSITORY_URL: %s, DD_GIT_COMMIT_SHA: %s)',
-        gitMetadata.repositoryURL || 'not available',
-        gitMetadata.commitSHA || 'not available'
-      )
+        log.debug(
+          'Automatically injected git metadata (DD_GIT_REPOSITORY_URL: %s, DD_GIT_COMMIT_SHA: %s)',
+          gitMetadata.repositoryURL || 'not available',
+          gitMetadata.commitSHA || 'not available'
+        )
+      } else {
+        log.warn('No git metadata available - skipping injection')
+      }
     } else {
-      log.warn('No git metadata available - skipping injection')
+      log.debug('Skipping git metadata injection (DD_BUNDLER_INJECT_GIT_METADATA=false)')
     }
 
     compiler.hooks.normalModuleFactory.tap(PLUGIN_NAME, (nmf) => {
@@ -146,8 +155,9 @@ class DatadogWebpackPlugin {
         }
 
         const request = resolveData.request
+        const isModuleOfInterest = modulesOfInterest.has(request) || modulesOfInterest.has(`${pkg}/${modulePath}`)
 
-        if (!modulesOfInterest.has(request) && !modulesOfInterest.has(`${pkg}/${modulePath}`)) {
+        if (!isModuleOfInterest && getRewriteTarget(normalizedResource) === undefined) {
           return
         }
 
@@ -177,10 +187,12 @@ class DatadogWebpackPlugin {
         const version = packageJson.version
         const pkgPath = request === pkg ? pkg : `${pkg}/${modulePath}`
 
+        // Webpack runs loaders right-to-left, so appending makes this loader see the package's original source
+        // before any user transpiler lowers the syntax Orchestrion function queries match on.
         createData.loaders ||= []
-        createData.loaders.unshift({
+        createData.loaders.push({
           loader: require.resolve('./src/loader'),
-          options: { pkg, version, path: pkgPath },
+          options: { pkg, version, path: pkgPath, rewriteOnly: !isModuleOfInterest },
         })
 
         log.debug('LOAD: %s@%s, pkg "%s"', pkg, version, pkgPath)

package/packages/datadog-webpack/src/loader.js

@@ -1,26 +1,74 @@
 'use strict'
 
+const { filename } = require('../../datadog-instrumentations/src/helpers/instrumentation-utils')
+const { createBundlerRewriter } = require('../../datadog-instrumentations/src/helpers/rewriter')
+const { getRewriteTarget } = require('../../datadog-instrumentations/src/helpers/rewriter/targets')
+
 const CHANNEL = 'dd-trace:bundler:load'
+// Resolved from dd-trace so the injected require works even when dc-polyfill is not hoisted next to the target.
+const DC_MODULE = require.resolve('dc-polyfill').replaceAll('\\', '/')
+const DC_MODULE_LITERAL = JSON.stringify(DC_MODULE)
+
+let rewrite
 
 /**
- * Webpack loader that appends a dc-polyfill channel publish to a CJS module.
- * Called for each module-of-interest identified by DatadogWebpackPlugin.
+ * Webpack loader called for each module-of-interest identified by DatadogWebpackPlugin.
+ * Orchestrion rewrite targets are rewritten and, for pure Orchestrion integrations, get an activation publish
+ * appended. Modules with export hooks get a dc-polyfill channel publish of their CJS exports appended.
  *
  * @param {string} source
+ * @param {string|object} [inputSourceMap]
  */
-module.exports = function loader (source) {
+module.exports = function loader (source, inputSourceMap) {
   this.cacheable(false)
-  const { pkg, version, path: pkgPath } = this.getOptions()
+  const { pkg, version, path: pkgPath, rewriteOnly } = this.getOptions()
+  const target = getRewriteTarget(this.resourcePath.replaceAll('\\', '/'))
+
+  let code = source
+  let map = inputSourceMap
+
+  if (target) {
+    rewrite ??= createBundlerRewriter(DC_MODULE)
+    const result = rewrite(source, this.resourcePath, 'commonjs', target, inputSourceMap)
+    code = result.code
+    map = result.map
+
+    if (code !== source && target.activate) {
+      const payload = JSON.stringify({
+        activate: true,
+        package: target.moduleName,
+        version,
+        path: filename(target.moduleName, target.filePath),
+      })
+      this.callback(
+        null,
+        `${code}\n;{\n` +
+        `  const __dd_ch = require(${DC_MODULE_LITERAL}).channel('${CHANNEL}');\n` +
+        `  if (__dd_ch.hasSubscribers) __dd_ch.publish(${payload});\n` +
+        '}\n',
+        map
+      )
+      return
+    }
+  }
+
+  // Rewrite-only targets have no export hook, so publishing their exports would only report a missing hook.
+  if (rewriteOnly) {
+    this.callback(null, code, map)
+    return
+  }
 
-  return (
-    source +
+  this.callback(
+    null,
+    code +
     '\n;{\n' +
-    '  const __dd_dc = require(\'dc-polyfill\');\n' +
+    `  const __dd_dc = require(${DC_MODULE_LITERAL});\n` +
     `  const __dd_ch = __dd_dc.channel('${CHANNEL}');\n` +
     '  const __dd_mod = module.exports;\n' +
     `  const __dd_payload = { module: __dd_mod, version: '${version}', package: '${pkg}', path: '${pkgPath}' };\n` +
     '  __dd_ch.publish(__dd_payload);\n' +
     '  module.exports = __dd_payload.module;\n' +
-    '}\n'
+    '}\n',
+    map
   )
 }

package/packages/dd-trace/src/aiguard/integrations/vercel-ai.js

@@ -73,8 +73,7 @@ function onModelIntercept (ctx) {
         null,
         'AIGuard: unable to decode the model result: %s'
       )
-      if (outputMessages === null) return result
-      if (!outputMessages.length) return result
+      if (outputMessages === null || !outputMessages.length) return result
 
       return evaluate(ctx, aiguard, [outputMessages], opts).then(() => result)
     }
@@ -112,8 +111,7 @@ function interceptStreamedResult (ctx, result, inputMessages) {
       null,
       'AIGuard: unable to decode the streamed model result: %s'
     )
-    if (outputMessages === null) return replayed
-    if (!outputMessages.length) return replayed
+    if (outputMessages === null || !outputMessages.length) return replayed
 
     return evaluate(ctx, aiguard, [outputMessages], opts).then(() => replayed)
   })

package/packages/dd-trace/src/aiguard/messages/utils.js

@@ -10,8 +10,7 @@ const IMAGE_FALLBACK = '[image]'
  * @returns {string|undefined|null}
  */
 function stringifyIfNeeded (value) {
-  if (value == null) return value
-  if (typeof value === 'string') return value
+  if (value == null || typeof value === 'string') return value
 
   try {
     return JSON.stringify(value)

package/packages/dd-trace/src/aiguard/redaction.js

@@ -102,8 +102,14 @@ function resolveWritableString (root, path) {
     }
   }
 
-  if (!node || typeof node !== 'object') return
-  if (!Object.hasOwn(node, terminal.name) || typeof node[terminal.name] !== 'string') return
+  if (
+    !node ||
+    typeof node !== 'object' ||
+    !Object.hasOwn(node, terminal.name) ||
+    typeof node[terminal.name] !== 'string'
+  ) {
+    return
+  }
   return { container: node, key: terminal.name }
 }
 

package/packages/dd-trace/src/appsec/api_security/normalized-route.js

@@ -383,8 +383,9 @@ function presenceBitmask (optionalGroups, present) {
  * @returns {string|null}
  */
 function normalizeRouteExpress (route, params, urlPath, parse, makeMatcher) {
-  if (typeof route !== 'string' || !route) return null
-  if (typeof parse !== 'function' || typeof makeMatcher !== 'function') return null
+  if (typeof route !== 'string' || !route || typeof parse !== 'function' || typeof makeMatcher !== 'function') {
+    return null
+  }
 
   let entry = routeCache.get(route)
   if (entry === undefined) {

package/packages/dd-trace/src/appsec/api_security/sampler.js

@@ -58,9 +58,7 @@ function disable () {
  * @returns {'sample' | 'missing_route' | 'skip'}
  */
 function sampleRootSpanRequest (rootSpan, request, record = false) {
-  if (!enabled) return SamplingDecision.SKIP
-
-  if (!rootSpan) return SamplingDecision.SKIP
+  if (!enabled || !rootSpan) return SamplingDecision.SKIP
 
   const { method, statusCode, route, blocked = false } = request ?? {}
 
@@ -102,9 +100,7 @@ function sampleRequest (req, res, record = false) {
   if (!enabled) return SamplingDecision.SKIP
 
   const rootSpan = web.root(req)
-  if (!rootSpan) return SamplingDecision.SKIP
-
-  if (isRejected(rootSpan)) return SamplingDecision.SKIP
+  if (!rootSpan || isRejected(rootSpan)) return SamplingDecision.SKIP
 
   const statusCode = res.statusCode
   const route = getRouteOrEndpoint(web.getContext(req), statusCode)

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -163,15 +163,7 @@ function isRedirectResponse (res) {
  * @param {object} ctx http client instrumentation context (mutated).
  */
 function planResponseBodyCollection (originatingReq, res, ctx) {
-  if (!config) {
-    return
-  }
-
-  if (isRedirectResponse(res)) {
-    return
-  }
-
-  if (!shouldSampleBody(originatingReq)) {
+  if (!config || isRedirectResponse(res) || !shouldSampleBody(originatingReq)) {
     return
   }
 

package/packages/dd-trace/src/appsec/handlers/http-request.js

@@ -60,9 +60,7 @@ function onRequestCookieParser ({ req, res, abortController, cookies }) {
   if (!cookies || typeof cookies !== 'object') return
 
   const rootSpan = web.root(req)
-  if (!rootSpan) return
-
-  if (isEmpty(cookies)) return
+  if (!rootSpan || isEmpty(cookies)) return
   analyzedCookies.add(cookies)
 
   const results = waf.run({
@@ -189,9 +187,7 @@ function onRequestQueryParsed ({ req, res, query, abortController }) {
   }
 
   const rootSpan = web.root(req)
-  if (!rootSpan) return
-
-  if (isEmpty(query)) return
+  if (!rootSpan || isEmpty(query)) return
 
   const results = waf.run({
     persistent: {
@@ -204,9 +200,7 @@ function onRequestQueryParsed ({ req, res, query, abortController }) {
 
 function onRequestProcessParams ({ req, res, abortController, params }) {
   const rootSpan = web.root(req)
-  if (!rootSpan) return
-
-  if (!params || typeof params !== 'object' || isEmpty(params)) return
+  if (!rootSpan || !params || typeof params !== 'object' || isEmpty(params)) return
 
   const results = waf.run({
     persistent: {

package/packages/dd-trace/src/appsec/handlers/http-response.js

@@ -11,8 +11,13 @@ const { storedResponseHeaders, copyHeadersOmitting } = require('./http-shared')
 const responseAnalyzedSet = new WeakSet()
 
 function onResponseBody ({ req, res, body }) {
-  if (!body || typeof body !== 'object') return
-  if (apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE) return
+  if (
+    !body ||
+    typeof body !== 'object' ||
+    apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE
+  ) {
+    return
+  }
 
   // we don't support blocking at this point, so no results needed
   waf.run({

package/packages/dd-trace/src/appsec/iast/analyzers/path-traversal-analyzer.js

@@ -2,6 +2,7 @@
 
 const path = require('path')
 
+const { APPSEC_FS_STORAGE } = require('../../rasp/fs-plugin')
 const { getIastContext } = require('../iast-context')
 const { storage } = require('../../../../../datadog-core')
 const { PATH_TRAVERSAL } = require('../vulnerabilities')
@@ -29,10 +30,10 @@ class PathTraversalAnalyzer extends InjectionAnalyzer {
 
   onConfigure () {
     this.addSub('apm:fs:operation:start', (obj) => {
-      const store = storage('legacy').getStore()
-      const outOfReqOrChild = !store?.fs?.root
+      const fs = storage(APPSEC_FS_STORAGE).getStore()
+      const outOfReqOrChild = !fs?.root
 
-      // we could filter out all the nested fs.operations based on store.fs.root
+      // we could filter out all the nested fs.operations based on fs.root
       // but if we spect a store in the context to be present we are going to exclude
       // all out_of_the_request fs.operations
       // AppsecFsPlugin must be enabled

package/packages/dd-trace/src/appsec/iast/analyzers/set-cookies-header-interceptor.js

@@ -17,10 +17,7 @@ class SetCookiesHeaderInterceptor extends Plugin {
 
   _handleCookies (name, value, res) {
     if (name.toLowerCase() === 'set-cookie') {
-      let allCookies = value
-      if (typeof value === 'string') {
-        allCookies = [value]
-      }
+      const allCookies = typeof value === 'string' ? [value] : value
       const alreadyCheckedCookies = this._getAlreadyCheckedCookiesInResponse(res)
 
       let location

package/packages/dd-trace/src/appsec/iast/taint-tracking/operations-taint-object.js

@@ -3,9 +3,11 @@
 const TaintedUtils = require('@datadog/native-iast-taint-tracking')
 const { IAST_TRANSACTION_ID } = require('../iast-context')
 const log = require('../../../log')
+const { typedArrayLength } = require('../../../util')
 const { HTTP_REQUEST_PARAMETER } = require('./source-types')
 
-const SEPARATOR = '\u0000' // Unit Separator (cannot be in URL keys)
+const SEPARATOR = '\0' // Unit Separator (cannot be in URL keys)
+const MAX_TRAVERSED_BINARY_VIEW_LENGTH = 1024
 
 function taintObject (iastContext, object, type) {
   let result = object
@@ -31,6 +33,10 @@ function taintObject (iastContext, object, type) {
         } else if (typeof value === 'object' && !visited.has(value)) {
           visited.add(value)
 
+          // Binary view elements are numbers, but named properties may hold strings. Their keys cannot be listed
+          // without also materializing one key per element, so only small views are walked.
+          if (ArrayBuffer.isView(value) && typedArrayLength(value) > MAX_TRAVERSED_BINARY_VIEW_LENGTH) continue
+
           for (const key of Object.keys(value)) {
             queue.push({ parent: value, property: property ? `${property}.${key}` : key, value: value[key], key })
           }

package/packages/dd-trace/src/appsec/iast/taint-tracking/plugin.js

@@ -264,9 +264,7 @@ class TaintTrackingPlugin extends SourceIastPlugin {
   }
 
   _taintDatabaseResult (result, dbOrigin, iastContext, name) {
-    if (!iastContext) return result
-
-    if (this._rowsToTaint === 0) return result
+    if (!iastContext || this._rowsToTaint === 0) return result
 
     if (Array.isArray(result)) {
       for (let i = 0; i < result.length && i < this._rowsToTaint; i++) {

package/packages/dd-trace/src/appsec/iast/taint-tracking/rewriter-esm.mjs

@@ -31,9 +31,7 @@ export async function initialize (data) {
 export async function load (url, context, nextLoad) {
   const result = await nextLoad(url, context)
 
-  if (!port) return result
-  if (!result.source) return result
-  if (url.includes(ddTraceDir) || url.includes('iitm=true')) return result
+  if (!port || !result.source || url.includes(ddTraceDir) || url.includes('iitm=true')) return result
 
   let passes
   try {

package/packages/dd-trace/src/appsec/iast/telemetry/iast-metric.js

@@ -24,12 +24,7 @@ function formatTags (tags, tagKey) {
 }
 
 function getNamespace (scope, context) {
-  let namespace = globalNamespace
-
-  if (scope === Scope.REQUEST) {
-    namespace = getNamespaceFromContext(context) || globalNamespace
-  }
-  return namespace
+  return scope === Scope.REQUEST ? getNamespaceFromContext(context) || globalNamespace : globalNamespace
 }
 
 class IastMetric {

package/packages/dd-trace/src/appsec/lambda.js

@@ -169,9 +169,7 @@ function parseResponseBody (rawBody, headers, isBase64Encoded) {
   // A handler that answered with the payload itself needs no parsing, and no content type either.
   if (typeof rawBody === 'object') return rawBody
 
-  if (typeof rawBody !== 'string') return
-
-  if (!isJsonContentType(headers?.['content-type'])) return
+  if (typeof rawBody !== 'string' || !isJsonContentType(headers?.['content-type'])) return
 
   if (isOverSizeCap(rawBody, isBase64Encoded)) {
     log.debug('[ASM] Lambda response body larger than %d bytes, skipping schema extraction',

package/packages/dd-trace/src/appsec/rasp/fs-plugin.js

@@ -1,11 +1,13 @@
 'use strict'
 
-const Plugin = require('../../plugins/plugin')
+const dc = require('dc-polyfill')
+
 const { storage } = require('../../../../datadog-core')
 const log = require('../../log')
 
 const RASP_MODULE = 'rasp'
 const IAST_MODULE = 'iast'
+const APPSEC_FS_STORAGE = 'appsec-fs'
 
 const enabledFor = {
   [RASP_MODULE]: false,
@@ -13,42 +15,53 @@ const enabledFor = {
 }
 
 let fsPlugin
-
-function getStoreToStart (fsProps, store = storage('legacy').getStore()) {
-  if (store && !store.fs?.opExcluded) {
+const legacyStorage = storage('legacy')
+const appsecFsStorage = storage(APPSEC_FS_STORAGE)
+const fsOperationStart = dc.channel('apm:fs:operation:start')
+const fsOperationFinish = dc.channel('apm:fs:operation:finish')
+const responseRenderStart = dc.channel('tracing:datadog:express:response:render:start')
+const responseRenderEnd = dc.channel('tracing:datadog:express:response:render:end')
+
+function getStoreToStart (fsProps, store = appsecFsStorage.getStore()) {
+  // Only track operations inside a traced context, like a request. Callbacks of fs streams and watchers keep
+  // the state of the operation that created them, so state created outside of one would leak into every request
+  // of a server started from such a callback. The tracing fs plugin enters a noop store when no span is active.
+  const legacyStore = legacyStorage.getStore()
+  if (!legacyStore || legacyStore.noop) return
+
+  if (!store || !store.opExcluded) {
     return {
       ...store,
-      fs: {
-        ...store.fs,
-        ...fsProps,
-        parentStore: store,
-      },
+      ...fsProps,
+      parentStore: store,
     }
   }
 
   return store
 }
 
-class AppsecFsPlugin extends Plugin {
+class AppsecFsPlugin {
   enable () {
-    this.addBind('apm:fs:operation:start', this._onFsOperationStart)
-    this.addBind('apm:fs:operation:finish', this._onFsOperationFinishOrRenderEnd)
-    this.addBind('tracing:datadog:express:response:render:start', this._onResponseRenderStart)
-    this.addBind('tracing:datadog:express:response:render:end', this._onFsOperationFinishOrRenderEnd)
-    // We might have to add the same subscribers for fastify later
-
-    super.configure(true)
+    // The tracing fs plugin binds the legacy store on these channels. AppSec
+    // keeps its fs-only state in a dedicated storage namespace to avoid
+    // clobbering tracing state while still tracking nested operations.
+    fsOperationStart.bindStore(appsecFsStorage, this._onFsOperationStart)
+    fsOperationFinish.bindStore(appsecFsStorage, this._onFsOperationFinishOrRenderEnd)
+    responseRenderStart.bindStore(appsecFsStorage, this._onResponseRenderStart)
+    responseRenderEnd.bindStore(appsecFsStorage, this._onFsOperationFinishOrRenderEnd)
   }
 
   disable () {
-    super.configure(false)
+    fsOperationStart.unbindStore(appsecFsStorage)
+    fsOperationFinish.unbindStore(appsecFsStorage)
+    responseRenderStart.unbindStore(appsecFsStorage)
+    responseRenderEnd.unbindStore(appsecFsStorage)
   }
 
   _onFsOperationStart () {
-    const store = storage('legacy').getStore()
-    if (store) {
-      return getStoreToStart({ root: store.fs?.root === undefined }, store)
-    }
+    const store = appsecFsStorage.getStore()
+
+    return getStoreToStart({ root: store?.root === undefined }, store)
   }
 
   _onResponseRenderStart () {
@@ -56,11 +69,7 @@ class AppsecFsPlugin extends Plugin {
   }
 
   _onFsOperationFinishOrRenderEnd () {
-    const store = storage('legacy').getStore()
-    if (store?.fs) {
-      return store.fs.parentStore
-    }
-    return store
+    return appsecFsStorage.getStore()?.parentStore
   }
 }
 
@@ -97,6 +106,7 @@ module.exports = {
   disable,
 
   AppsecFsPlugin,
+  APPSEC_FS_STORAGE,
 
   RASP_MODULE,
   IAST_MODULE,

package/packages/dd-trace/src/appsec/rasp/lfi.js

@@ -6,9 +6,14 @@ const { fsOperationStart, incomingHttpRequestStart, expressResponseRenderStart }
 const { storage } = require('../../../../datadog-core')
 const web = require('../../plugins/util/web')
 const { FS_OPERATION_PATH } = require('../addresses')
-const { getRequest } = require('../store')
+const { getActiveRequest } = require('../store')
 const waf = require('../waf')
-const { enable: enableFsPlugin, disable: disableFsPlugin, RASP_MODULE } = require('./fs-plugin')
+const {
+  APPSEC_FS_STORAGE,
+  enable: enableFsPlugin,
+  disable: disableFsPlugin,
+  RASP_MODULE,
+} = require('./fs-plugin')
 const { RULE_TYPES, handleResult } = require('./utils')
 
 let config
@@ -59,11 +64,10 @@ function analyzeLfiInResponseRender (ctx) {
 }
 
 function analyzeLfi (ctx) {
-  const store = storage('legacy').getStore()
-  const fs = store?.fs
+  const fs = storage(APPSEC_FS_STORAGE).getStore()
   if (!fs) return
 
-  const req = getRequest(store)
+  const req = getActiveRequest()
   if (!req) return
 
   const res = web.getContext(req)?.res