dd-trace 6.7.0 → 6.9.0

package/packages/datadog-shimmer/src/shimmer.js

@@ -15,6 +15,10 @@ const skipMethodSize = skipMethods.size
 
 const nonConfigurableModuleExports = new WeakMap()
 
+/**
+ * @typedef {NonNullable<ReturnType<typeof globalThis.Object.getOwnPropertyDescriptor>>} Descriptor
+ */
+
 // Reused descriptor scratch space for the `name` and `length` slots that
 // `copyProperties` and `wrapCallback` rewrite per wrap. `Object.defineProperty`
 // reads the descriptor's slots synchronously and does not retain the object,
@@ -46,7 +50,7 @@ function copyProperties (original, wrapped) {
   if (ownKeys.length !== 2) {
     for (const key of ownKeys) {
       if (skipMethods.has(key)) continue
-      const descriptor = /** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(original, key))
+      const descriptor = /** @type {Descriptor} */ (Object.getOwnPropertyDescriptor(original, key))
       if (descriptor.writable && descriptor.enumerable && descriptor.configurable) {
         wrapped[key] = original[key]
       } else if (descriptor.writable || descriptor.configurable || !Object.hasOwn(wrapped, key)) {
@@ -65,7 +69,7 @@ function copyObjectProperties (original, wrapped, skipKey) {
   const ownKeys = Reflect.ownKeys(original)
   for (const key of ownKeys) {
     if (key === skipKey) continue
-    const descriptor = /** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(original, key))
+    const descriptor = /** @type {Descriptor} */ (Object.getOwnPropertyDescriptor(original, key))
     if (descriptor.writable && descriptor.enumerable && descriptor.configurable) {
       wrapped[key] = original[key]
     } else if (descriptor.writable || descriptor.configurable || !Object.hasOwn(wrapped, key)) {

package/packages/datadog-webpack/index.js

@@ -141,7 +141,7 @@ class DatadogWebpackPlugin {
         // (#8980); absent peers stay opaque, so a build that does not opt into the feature does
         // not follow their dependency chain (#8635).
         if (matchesOptionalPeerFile(normalizedResource)) {
-          createData.loaders = createData.loaders || []
+          createData.loaders ||= []
           createData.loaders.push({ loader: require.resolve('./src/optional-peer-loader') })
           log.debug('INLINE: optional-peer loader applied to %s', normalizedResource)
           return
@@ -188,7 +188,7 @@ class DatadogWebpackPlugin {
         const version = packageJson.version
         const pkgPath = request === pkg ? pkg : `${pkg}/${modulePath}`
 
-        createData.loaders = createData.loaders || []
+        createData.loaders ||= []
         createData.loaders.unshift({
           loader: require.resolve('./src/loader'),
           options: { pkg, version, path: pkgPath },

package/packages/dd-trace/src/aiguard/sdk.js

@@ -121,6 +121,9 @@ class AIGuard extends NoopAIGuard {
    *
    * - Clones each message so callers cannot mutate the data set in the meta struct.
    * - Truncates the list of messages and `content` fields emitting metrics accordingly.
+   *
+   * @param {import('../../../../index').aiguard.Message[]} messages
+   * @param {{ source: string, integration: string }} telemetryTags
    */
   #buildMessagesForMetaStruct (messages, telemetryTags) {
     const size = Math.min(messages.length, this.#maxMessagesLength)

package/packages/dd-trace/src/appsec/{blocking.js → blocking/index.js}

@@ -1,10 +1,10 @@
 'use strict'
 
-const { LRUCache } = require('../../../../vendor/dist/lru-cache')
-const log = require('../log')
-const web = require('../plugins/util/web')
-const blockedTemplates = require('./blocked_templates')
-const { updateBlockFailureMetric } = require('./telemetry')
+const { LRUCache } = require('../../../../../vendor/dist/lru-cache')
+const log = require('../../log')
+const web = require('../../plugins/util/web')
+const { updateBlockFailureMetric } = require('../telemetry')
+const blockedTemplates = require('./templates')
 
 // Bounded by the LRU as defense-in-depth: getSpecificKey already keys on the
 // resolved route (or the path with the query string stripped) so cardinality
@@ -182,7 +182,26 @@ function getBlockingAction (actions) {
 }
 
 /**
- * @param {import('../config/config-base')} [config] - Tracer configuration
+ * Turns a WAF result's actions into a blocking response, when one is requested.
+ * Single seam from WAF output to {@link block}, shared by every request/response/auth handler.
+ *
+ * @param {Record<string, unknown>|undefined} actions WAF result actions.
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @param {object} rootSpan
+ * @param {AbortController} abortController
+ */
+function handleResults (actions, req, res, rootSpan, abortController) {
+  if (!actions || !req || !res || !rootSpan || !abortController) return
+
+  const blockingAction = getBlockingAction(actions)
+  if (blockingAction) {
+    block(req, res, rootSpan, abortController, blockingAction)
+  }
+}
+
+/**
+ * @param {import('../../config/config-base')} [config] - Tracer configuration
  */
 function setTemplates (config) {
   templates.html.body = config?.appsec?.blockedTemplateHtml
@@ -233,6 +252,7 @@ module.exports = {
   specificBlockingTypes,
   getBlockingData,
   getBlockingAction,
+  handleResults,
   setTemplates,
   isBlocked,
   setDefaultBlockingActionParameters,

package/packages/dd-trace/src/appsec/downstream_requests.js

@@ -307,7 +307,7 @@ function parseBody (body, contentType) {
       const formBody = Buffer.isBuffer(body) ? body.toString('utf8') : String(body)
       const params = new URLSearchParams(formBody)
       const result = {}
-      for (const [key, value] of params.entries()) {
+      for (const [key, value] of params) {
         if (key in result) {
           const existing = result[key]
           if (Array.isArray(existing)) {

package/packages/dd-trace/src/appsec/handlers/auth.js

@@ -0,0 +1,62 @@
+'use strict'
+
+const log = require('../../log')
+const web = require('../../plugins/util/web')
+const addresses = require('../addresses')
+const { handleResults } = require('../blocking')
+const { getActiveRequest } = require('../store')
+const UserTracking = require('../user_tracking')
+const waf = require('../waf')
+
+function onPassportVerify ({ framework, login, user, success, abortController }) {
+  const req = getActiveRequest()
+  const rootSpan = req && web.root(req)
+
+  if (!rootSpan) {
+    log.warn('[ASM] No rootSpan found in onPassportVerify')
+    return
+  }
+
+  const results = UserTracking.trackLogin(framework, login, user, success, rootSpan)
+
+  handleResults(results?.actions, req, web.getContext(req)?.res, rootSpan, abortController)
+}
+
+function onPassportDeserializeUser ({ user, abortController }) {
+  const req = getActiveRequest()
+  const rootSpan = req && web.root(req)
+
+  if (!rootSpan) {
+    log.warn('[ASM] No rootSpan found in onPassportDeserializeUser')
+    return
+  }
+
+  const results = UserTracking.trackUser(user, rootSpan)
+
+  handleResults(results?.actions, req, web.getContext(req)?.res, rootSpan, abortController)
+}
+
+function onExpressSession ({ req, res, sessionId, abortController }) {
+  const rootSpan = web.root(req)
+  if (!rootSpan) {
+    log.warn('[ASM] No rootSpan found in onExpressSession')
+    return
+  }
+
+  const isSdkCalled = rootSpan.context().getTag('usr.session_id')
+  if (isSdkCalled) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.USER_SESSION_ID]: sessionId,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+module.exports = {
+  onPassportVerify,
+  onPassportDeserializeUser,
+  onExpressSession,
+}

package/packages/dd-trace/src/appsec/handlers/http-request.js

@@ -0,0 +1,215 @@
+'use strict'
+
+const { HTTP_CLIENT_IP } = require('../../../../../ext/tags')
+const web = require('../../plugins/util/web')
+const { extractIp } = require('../../plugins/util/ip_extractor')
+const { isEmpty } = require('../../util')
+const addresses = require('../addresses')
+const apiSecurity = require('../api_security')
+const { handleResults } = require('../blocking')
+const Reporter = require('../reporter')
+const { getActiveRequest } = require('../store')
+const waf = require('../waf')
+const { storedResponseHeaders, copyHeadersOmitting } = require('./http-shared')
+
+const analyzedBodies = new WeakSet()
+const analyzedCookies = new WeakSet()
+const storedBodies = new WeakMap()
+
+let config
+
+/**
+ * @param {import('../../config/config-base')|undefined} _config
+ */
+function setConfig (_config) {
+  config = _config
+}
+
+function onRequestBodyParsed ({ req, res, body, abortController }) {
+  if (body === undefined || body === null) return
+
+  if (!req) {
+    req = getActiveRequest()
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (!req.body) {
+    // do not store body if it is in req.body
+    storedBodies.set(req, body)
+  }
+
+  if (typeof body === 'object') {
+    if (isEmpty(body)) return
+    analyzedBodies.add(body)
+  }
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_BODY]: body,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onRequestCookieParser ({ req, res, abortController, cookies }) {
+  if (!cookies || typeof cookies !== 'object') return
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (isEmpty(cookies)) return
+  analyzedCookies.add(cookies)
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_COOKIES]: cookies,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function incomingHttpStartTranslator ({ req, res, abortController }) {
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  const clientIp = extractIp(config, req)
+
+  rootSpan.addTags({
+    '_dd.appsec.enabled': 1,
+    '_dd.runtime_family': 'nodejs',
+    [HTTP_CLIENT_IP]: clientIp,
+  })
+
+  if (config.inferredProxyServicesEnabled) {
+    const context = web.getContext(req)
+    if (context?.inferredProxySpan) {
+      context.inferredProxySpan.setTag('_dd.appsec.enabled', 1)
+    }
+  }
+
+  const persistent = {
+    [addresses.HTTP_INCOMING_URL]: req.url,
+    [addresses.HTTP_INCOMING_HEADERS]: copyHeadersOmitting(req.headers, 'cookie'),
+    [addresses.HTTP_INCOMING_METHOD]: req.method,
+  }
+
+  if (clientIp) {
+    persistent[addresses.HTTP_CLIENT_IP] = clientIp
+  }
+
+  const results = waf.run({ persistent }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function incomingHttpEndTranslator ({ req, res }) {
+  const persistent = {}
+
+  // we need to keep this to support other body parsers
+  if (req.body !== undefined && req.body !== null) {
+    if (typeof req.body === 'object') {
+      if (!isEmpty(req.body) && !analyzedBodies.has(req.body)) {
+        persistent[addresses.HTTP_INCOMING_BODY] = req.body
+      }
+    } else {
+      persistent[addresses.HTTP_INCOMING_BODY] = req.body
+    }
+  }
+
+  // we need to keep this to support other cookie parsers
+  if (
+    req.cookies !== null &&
+    typeof req.cookies === 'object' &&
+    !isEmpty(req.cookies) &&
+    !analyzedCookies.has(req.cookies)
+  ) {
+    persistent[addresses.HTTP_INCOMING_COOKIES] = req.cookies
+  }
+
+  // we need to keep this to support nextjs
+  const query = req.query
+  if (
+    query !== null &&
+    typeof query === 'object' &&
+    !isEmpty(query)
+  ) {
+    persistent[addresses.HTTP_INCOMING_QUERY] = query
+  }
+
+  // This hook runs before span finish, so ensure route/endpoint tags are available before API Security sampling runs.
+  web.setRouteOrEndpointTag(req)
+
+  const apiSecSamplingDecision = apiSecurity.sampleRequest(req, res, true)
+  if (apiSecSamplingDecision === apiSecurity.SamplingDecision.SAMPLE) {
+    persistent[addresses.WAF_CONTEXT_PROCESSOR] = { 'extract-schema': true }
+  }
+
+  let wafResult
+  if (!isEmpty(persistent)) {
+    wafResult = waf.run({ persistent }, req)
+  }
+
+  apiSecurity.reportRequest(req, apiSecSamplingDecision, wafResult)
+
+  waf.disposeContext(req)
+
+  const storedHeaders = storedResponseHeaders.get(req) || {}
+
+  const body = req.body || storedBodies.get(req)
+  Reporter.finishRequest(req, res, storedHeaders, body)
+
+  if (storedHeaders) {
+    storedResponseHeaders.delete(req)
+  }
+  storedBodies.delete(req)
+}
+
+function onRequestQueryParsed ({ req, res, query, abortController }) {
+  if (!query || typeof query !== 'object') return
+
+  if (!req) {
+    req = getActiveRequest()
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (isEmpty(query)) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_QUERY]: query,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onRequestProcessParams ({ req, res, abortController, params }) {
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (!params || typeof params !== 'object' || isEmpty(params)) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_PARAMS]: params,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+module.exports = {
+  setConfig,
+  onRequestBodyParsed,
+  onRequestCookieParser,
+  incomingHttpStartTranslator,
+  incomingHttpEndTranslator,
+  onRequestQueryParsed,
+  onRequestProcessParams,
+}

package/packages/dd-trace/src/appsec/handlers/http-response.js

@@ -0,0 +1,78 @@
+'use strict'
+
+const web = require('../../plugins/util/web')
+const { isEmpty } = require('../../util')
+const addresses = require('../addresses')
+const apiSecurity = require('../api_security')
+const { isBlocked, callBlockDelegation, handleResults } = require('../blocking')
+const waf = require('../waf')
+const { storedResponseHeaders, copyHeadersOmitting } = require('./http-shared')
+
+const responseAnalyzedSet = new WeakSet()
+
+function onResponseBody ({ req, res, body }) {
+  if (!body || typeof body !== 'object') return
+  if (apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE) return
+
+  // we don't support blocking at this point, so no results needed
+  waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_RESPONSE_BODY]: body,
+    },
+  }, req)
+}
+
+function onResponseWriteHead ({ req, res, abortController, statusCode, responseHeaders }) {
+  // Normalize header names to lowercase so downstream consumers see the same shape
+  // regardless of how the caller wrote them.
+  const normalizedResponseHeaders = {}
+  for (const [key, value] of Object.entries(responseHeaders)) {
+    normalizedResponseHeaders[key.toLowerCase()] = value
+  }
+
+  if (!isEmpty(normalizedResponseHeaders)) {
+    storedResponseHeaders.set(req, normalizedResponseHeaders)
+  }
+
+  // TODO: do not call waf if inside block()
+  // if (isBlocking()) {
+  //   return
+  // }
+
+  // avoid "write after end" error
+  if (isBlocked(res) || callBlockDelegation(res)) {
+    abortController?.abort()
+    return
+  }
+
+  // avoid double waf call
+  if (responseAnalyzedSet.has(res)) {
+    return
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_RESPONSE_CODE]: String(statusCode),
+      [addresses.HTTP_INCOMING_RESPONSE_HEADERS]: copyHeadersOmitting(normalizedResponseHeaders, 'set-cookie'),
+    },
+  }, req)
+
+  responseAnalyzedSet.add(res)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onResponseOperation ({ res, abortController }) {
+  if (isBlocked(res)) {
+    abortController?.abort()
+  }
+}
+
+module.exports = {
+  onResponseBody,
+  onResponseWriteHead,
+  onResponseOperation,
+}

package/packages/dd-trace/src/appsec/handlers/http-shared.js

@@ -0,0 +1,24 @@
+'use strict'
+
+// Response headers captured on `responseWriteHead` (http-response) and later read
+// when the request finishes (http-request end translator). This is the only piece
+// of per-request state shared across the two handler modules.
+const storedResponseHeaders = new WeakMap()
+
+/**
+ * @param {Record<string, unknown>} src
+ * @param {string} omit
+ * @returns {Record<string, unknown>}
+ */
+function copyHeadersOmitting (src, omit) {
+  const filtered = {}
+  for (const key of Object.keys(src)) {
+    if (key !== omit) filtered[key] = src[key]
+  }
+  return filtered
+}
+
+module.exports = {
+  storedResponseHeaders,
+  copyHeadersOmitting,
+}

package/packages/dd-trace/src/appsec/handlers/payments.js

@@ -0,0 +1,104 @@
+'use strict'
+
+const addresses = require('../addresses')
+const waf = require('../waf')
+
+function onStripeCheckoutSessionCreate (payload) {
+  if (payload?.mode !== 'payment') return
+
+  waf.run({
+    persistent: {
+      [addresses.PAYMENT_CREATION]: {
+        integration: 'stripe',
+        id: payload.id,
+        amount_total: payload.amount_total,
+        client_reference_id: payload.client_reference_id,
+        currency: payload.currency,
+        'discounts.coupon': payload.discounts?.[0]?.coupon,
+        'discounts.promotion_code': payload.discounts?.[0]?.promotion_code,
+        livemode: payload.livemode,
+        'total_details.amount_discount': payload.total_details?.amount_discount,
+        'total_details.amount_shipping': payload.total_details?.amount_shipping,
+      },
+    },
+  })
+}
+
+function onStripePaymentIntentCreate (payload) {
+  if (payload === null || typeof payload !== 'object') return
+
+  waf.run({
+    persistent: {
+      [addresses.PAYMENT_CREATION]: {
+        integration: 'stripe',
+        id: payload.id,
+        amount: payload.amount,
+        currency: payload.currency,
+        livemode: payload.livemode,
+        payment_method: payload.payment_method,
+      },
+    },
+  })
+}
+
+function onStripeConstructEvent (payload) {
+  const object = payload?.data?.object
+  if (object === null || typeof object !== 'object') return
+
+  let persistent
+
+  switch (payload.type) {
+    case 'payment_intent.succeeded':
+      persistent = {
+        [addresses.PAYMENT_SUCCESS]: {
+          integration: 'stripe',
+          id: object.id,
+          amount: object.amount,
+          currency: object.currency,
+          livemode: object.livemode,
+          payment_method: object.payment_method,
+        },
+      }
+      break
+
+    case 'payment_intent.payment_failed':
+      persistent = {
+        [addresses.PAYMENT_FAILURE]: {
+          integration: 'stripe',
+          id: object.id,
+          amount: object.amount,
+          currency: object.currency,
+          'last_payment_error.code': object.last_payment_error?.code,
+          'last_payment_error.decline_code': object.last_payment_error?.decline_code,
+          'last_payment_error.payment_method.id': object.last_payment_error?.payment_method?.id,
+          'last_payment_error.payment_method.type': object.last_payment_error?.payment_method?.type,
+          livemode: object.livemode,
+        },
+      }
+      break
+
+    case 'payment_intent.canceled':
+      persistent = {
+        [addresses.PAYMENT_CANCELLATION]: {
+          integration: 'stripe',
+          id: object.id,
+          amount: object.amount,
+          cancellation_reason: object.cancellation_reason,
+          currency: object.currency,
+          livemode: object.livemode,
+        },
+      }
+      break
+
+    default:
+      return
+  }
+
+  waf.run({ persistent })
+}
+
+module.exports = {
+  onStripeCheckoutSessionCreate,
+  onStripePaymentIntentCreate,
+  onStripeConstructEvent,
+}

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-base-analyzer.js

@@ -56,7 +56,7 @@ class HardcodedBaseAnalyzer extends Analyzer {
   }
 
   _getEvidence (value) {
-    return { value: `${value.data}` }
+    return { value: value.data }
   }
 
   _getLocation (value) {

package/packages/dd-trace/src/appsec/iast/analyzers/hardcoded-password-analyzer.js

@@ -11,7 +11,7 @@ class HardcodedPasswordAnalyzer extends HardcodedBaseAnalyzer {
   }
 
   _getEvidence (value) {
-    return { value: `${value.ident}` }
+    return { value: value.ident }
   }
 }
 

package/packages/dd-trace/src/appsec/iast/analyzers/hsts-header-missing-analyzer.js

@@ -31,7 +31,7 @@ class HstsHeaderMissingAnalyzer extends MissingHeaderAnalyzer {
       semicolonIndex === -1 ? headerValue.length : semicolonIndex
     )
 
-    const timestamp = Number.parseInt(timestampString)
+    const timestamp = Number.parseInt(timestampString, 10)
     // eslint-disable-next-line eqeqeq
     return timestamp > 0 && timestamp == timestampString
   }

package/packages/dd-trace/src/appsec/iast/analyzers/sql-injection-analyzer.js

@@ -74,7 +74,7 @@ class SqlInjectionAnalyzer extends StoredInjectionAnalyzer {
   }
 
   analyze (value, store, dialect) {
-    store = store || storage('legacy').getStore()
+    store ||= storage('legacy').getStore()
     if (!(store && store.sqlAnalyzed)) {
       super.analyze(value, store, dialect)
     }

package/packages/dd-trace/src/appsec/iast/taint-tracking/taint-tracking-impl.js

@@ -215,9 +215,7 @@ function getTaintTrackingImpl (telemetryVerbosity, dummy = false) {
   if (dummy) return TaintTrackingNoop
 
   // with Verbosity.DEBUG every invocation of a TaintedUtils method increases the EXECUTED_PROPAGATION metric
-  return isDebugAllowed(telemetryVerbosity)
-    ? createImplWith(getContextDebug)
-    : createImplWith(getContextDefault)
+  return createImplWith(isDebugAllowed(telemetryVerbosity) ? getContextDebug : getContextDefault)
 }
 
 function getTaintTrackingNoop () {

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/utils.js

@@ -35,7 +35,7 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
   let value
   const ranges = []
   const sensitiveRanges = []
-  objRanges = objRanges || {}
+  objRanges ||= {}
 
   if (objRanges || loadSensitiveRanges) {
     const cloneObj = Array.isArray(obj) ? [] : {}
@@ -150,7 +150,7 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
 
             sensitiveRanges.push({
               start,
-              end: start + Number.parseInt(regexRes[1]),
+              end: start + Number.parseInt(regexRes[1], 10),
             })
             segments.push(value.slice(pos, rangeKeyIndex))
             outputLength += cleanLength