dd-trace 6.8.0 → 6.10.0

package/packages/dd-trace/src/appsec/handlers/http-request.js

@@ -0,0 +1,228 @@
+'use strict'
+
+const { HTTP_CLIENT_IP } = require('../../../../../ext/tags')
+const log = require('../../log')
+const web = require('../../plugins/util/web')
+const { extractIp } = require('../../plugins/util/ip_extractor')
+const { isEmpty } = require('../../util')
+const addresses = require('../addresses')
+const apiSecurity = require('../api_security')
+const { normalizeRoute } = require('../api_security/normalized-route')
+const { handleResults } = require('../blocking')
+const Reporter = require('../reporter')
+const { getActiveRequest } = require('../store')
+const waf = require('../waf')
+const { storedResponseHeaders, copyHeadersOmitting } = require('./http-shared')
+
+const analyzedBodies = new WeakSet()
+const analyzedCookies = new WeakSet()
+const storedBodies = new WeakMap()
+
+let config
+
+/**
+ * @param {import('../../config/config-base')|undefined} _config
+ */
+function setConfig (_config) {
+  config = _config
+}
+
+function onRequestBodyParsed ({ req, res, body, abortController }) {
+  if (body === undefined || body === null) return
+
+  if (!req) {
+    req = getActiveRequest()
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (!req.body) {
+    // do not store body if it is in req.body
+    storedBodies.set(req, body)
+  }
+
+  if (typeof body === 'object') {
+    if (isEmpty(body)) return
+    analyzedBodies.add(body)
+  }
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_BODY]: body,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onRequestCookieParser ({ req, res, abortController, cookies }) {
+  if (!cookies || typeof cookies !== 'object') return
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (isEmpty(cookies)) return
+  analyzedCookies.add(cookies)
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_COOKIES]: cookies,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function incomingHttpStartTranslator ({ req, res, abortController }) {
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  const clientIp = extractIp(config, req)
+
+  rootSpan.addTags({
+    '_dd.appsec.enabled': 1,
+    '_dd.runtime_family': 'nodejs',
+    [HTTP_CLIENT_IP]: clientIp,
+  })
+
+  if (config.inferredProxyServicesEnabled) {
+    const context = web.getContext(req)
+    if (context?.inferredProxySpan) {
+      context.inferredProxySpan.setTag('_dd.appsec.enabled', 1)
+    }
+  }
+
+  const persistent = {
+    [addresses.HTTP_INCOMING_URL]: req.url,
+    [addresses.HTTP_INCOMING_HEADERS]: copyHeadersOmitting(req.headers, 'cookie'),
+    [addresses.HTTP_INCOMING_METHOD]: req.method,
+  }
+
+  if (clientIp) {
+    persistent[addresses.HTTP_CLIENT_IP] = clientIp
+  }
+
+  const results = waf.run({ persistent }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function incomingHttpEndTranslator ({ req, res }) {
+  const persistent = {}
+
+  // we need to keep this to support other body parsers
+  if (req.body !== undefined && req.body !== null) {
+    if (typeof req.body === 'object') {
+      if (!isEmpty(req.body) && !analyzedBodies.has(req.body)) {
+        persistent[addresses.HTTP_INCOMING_BODY] = req.body
+      }
+    } else {
+      persistent[addresses.HTTP_INCOMING_BODY] = req.body
+    }
+  }
+
+  // we need to keep this to support other cookie parsers
+  if (
+    req.cookies !== null &&
+    typeof req.cookies === 'object' &&
+    !isEmpty(req.cookies) &&
+    !analyzedCookies.has(req.cookies)
+  ) {
+    persistent[addresses.HTTP_INCOMING_COOKIES] = req.cookies
+  }
+
+  // we need to keep this to support nextjs
+  const query = req.query
+  if (
+    query !== null &&
+    typeof query === 'object' &&
+    !isEmpty(query)
+  ) {
+    persistent[addresses.HTTP_INCOMING_QUERY] = query
+  }
+
+  // This hook runs before span finish, so ensure route/endpoint tags are available before API Security sampling runs.
+  web.setRouteOrEndpointTag(req)
+
+  if (config.appsec.DD_API_SECURITY_ENABLED) {
+    try {
+      const normalized = normalizeRoute(req)
+      if (normalized !== null) {
+        web.root(req)?.setTag('_dd.appsec.normalized_route', normalized)
+      }
+    } catch (e) {
+      log.debug('[ASM] Unable to compute normalized route: %s', e.message)
+    }
+  }
+
+  const apiSecSamplingDecision = apiSecurity.sampleRequest(req, res, true)
+  if (apiSecSamplingDecision === apiSecurity.SamplingDecision.SAMPLE) {
+    persistent[addresses.WAF_CONTEXT_PROCESSOR] = { 'extract-schema': true }
+  }
+
+  let wafResult
+  if (!isEmpty(persistent)) {
+    wafResult = waf.run({ persistent }, req)
+  }
+
+  apiSecurity.reportRequest(req, apiSecSamplingDecision, wafResult)
+
+  waf.disposeContext(req)
+
+  const storedHeaders = storedResponseHeaders.get(req) || {}
+
+  const body = req.body || storedBodies.get(req)
+  Reporter.finishRequest(req, res, storedHeaders, body)
+
+  if (storedHeaders) {
+    storedResponseHeaders.delete(req)
+  }
+  storedBodies.delete(req)
+}
+
+function onRequestQueryParsed ({ req, res, query, abortController }) {
+  if (!query || typeof query !== 'object') return
+
+  if (!req) {
+    req = getActiveRequest()
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (isEmpty(query)) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_QUERY]: query,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onRequestProcessParams ({ req, res, abortController, params }) {
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (!params || typeof params !== 'object' || isEmpty(params)) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_PARAMS]: params,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+module.exports = {
+  setConfig,
+  onRequestBodyParsed,
+  onRequestCookieParser,
+  incomingHttpStartTranslator,
+  incomingHttpEndTranslator,
+  onRequestQueryParsed,
+  onRequestProcessParams,
+}

package/packages/dd-trace/src/appsec/handlers/http-response.js

@@ -0,0 +1,78 @@
+'use strict'
+
+const web = require('../../plugins/util/web')
+const { isEmpty } = require('../../util')
+const addresses = require('../addresses')
+const apiSecurity = require('../api_security')
+const { isBlocked, callBlockDelegation, handleResults } = require('../blocking')
+const waf = require('../waf')
+const { storedResponseHeaders, copyHeadersOmitting } = require('./http-shared')
+
+const responseAnalyzedSet = new WeakSet()
+
+function onResponseBody ({ req, res, body }) {
+  if (!body || typeof body !== 'object') return
+  if (apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE) return
+
+  // we don't support blocking at this point, so no results needed
+  waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_RESPONSE_BODY]: body,
+    },
+  }, req)
+}
+
+function onResponseWriteHead ({ req, res, abortController, statusCode, responseHeaders }) {
+  // Normalize header names to lowercase so downstream consumers see the same shape
+  // regardless of how the caller wrote them.
+  const normalizedResponseHeaders = {}
+  for (const [key, value] of Object.entries(responseHeaders)) {
+    normalizedResponseHeaders[key.toLowerCase()] = value
+  }
+
+  if (!isEmpty(normalizedResponseHeaders)) {
+    storedResponseHeaders.set(req, normalizedResponseHeaders)
+  }
+
+  // TODO: do not call waf if inside block()
+  // if (isBlocking()) {
+  //   return
+  // }
+
+  // avoid "write after end" error
+  if (isBlocked(res) || callBlockDelegation(res)) {
+    abortController?.abort()
+    return
+  }
+
+  // avoid double waf call
+  if (responseAnalyzedSet.has(res)) {
+    return
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_RESPONSE_CODE]: String(statusCode),
+      [addresses.HTTP_INCOMING_RESPONSE_HEADERS]: copyHeadersOmitting(normalizedResponseHeaders, 'set-cookie'),
+    },
+  }, req)
+
+  responseAnalyzedSet.add(res)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onResponseOperation ({ res, abortController }) {
+  if (isBlocked(res)) {
+    abortController?.abort()
+  }
+}
+
+module.exports = {
+  onResponseBody,
+  onResponseWriteHead,
+  onResponseOperation,
+}

package/packages/dd-trace/src/appsec/handlers/http-shared.js

@@ -0,0 +1,24 @@
+'use strict'
+
+// Response headers captured on `responseWriteHead` (http-response) and later read
+// when the request finishes (http-request end translator). This is the only piece
+// of per-request state shared across the two handler modules.
+const storedResponseHeaders = new WeakMap()
+
+/**
+ * @param {Record<string, unknown>} src
+ * @param {string} omit
+ * @returns {Record<string, unknown>}
+ */
+function copyHeadersOmitting (src, omit) {
+  const filtered = {}
+  for (const key of Object.keys(src)) {
+    if (key !== omit) filtered[key] = src[key]
+  }
+  return filtered
+}
+
+module.exports = {
+  storedResponseHeaders,
+  copyHeadersOmitting,
+}

package/packages/dd-trace/src/appsec/handlers/payments.js

@@ -0,0 +1,104 @@
+'use strict'
+
+const addresses = require('../addresses')
+const waf = require('../waf')
+
+function onStripeCheckoutSessionCreate (payload) {
+  if (payload?.mode !== 'payment') return
+
+  waf.run({
+    persistent: {
+      [addresses.PAYMENT_CREATION]: {
+        integration: 'stripe',
+        id: payload.id,
+        amount_total: payload.amount_total,
+        client_reference_id: payload.client_reference_id,
+        currency: payload.currency,
+        'discounts.coupon': payload.discounts?.[0]?.coupon,
+        'discounts.promotion_code': payload.discounts?.[0]?.promotion_code,
+        livemode: payload.livemode,
+        'total_details.amount_discount': payload.total_details?.amount_discount,
+        'total_details.amount_shipping': payload.total_details?.amount_shipping,
+      },
+    },
+  })
+}
+
+function onStripePaymentIntentCreate (payload) {
+  if (payload === null || typeof payload !== 'object') return
+
+  waf.run({
+    persistent: {
+      [addresses.PAYMENT_CREATION]: {
+        integration: 'stripe',
+        id: payload.id,
+        amount: payload.amount,
+        currency: payload.currency,
+        livemode: payload.livemode,
+        payment_method: payload.payment_method,
+      },
+    },
+  })
+}
+
+function onStripeConstructEvent (payload) {
+  const object = payload?.data?.object
+  if (object === null || typeof object !== 'object') return
+
+  let persistent
+
+  switch (payload.type) {
+    case 'payment_intent.succeeded':
+      persistent = {
+        [addresses.PAYMENT_SUCCESS]: {
+          integration: 'stripe',
+          id: object.id,
+          amount: object.amount,
+          currency: object.currency,
+          livemode: object.livemode,
+          payment_method: object.payment_method,
+        },
+      }
+      break
+
+    case 'payment_intent.payment_failed':
+      persistent = {
+        [addresses.PAYMENT_FAILURE]: {
+          integration: 'stripe',
+          id: object.id,
+          amount: object.amount,
+          currency: object.currency,
+          'last_payment_error.code': object.last_payment_error?.code,
+          'last_payment_error.decline_code': object.last_payment_error?.decline_code,
+          'last_payment_error.payment_method.id': object.last_payment_error?.payment_method?.id,
+          'last_payment_error.payment_method.type': object.last_payment_error?.payment_method?.type,
+          livemode: object.livemode,
+        },
+      }
+      break
+
+    case 'payment_intent.canceled':
+      persistent = {
+        [addresses.PAYMENT_CANCELLATION]: {
+          integration: 'stripe',
+          id: object.id,
+          amount: object.amount,
+          cancellation_reason: object.cancellation_reason,
+          currency: object.currency,
+          livemode: object.livemode,
+        },
+      }
+      break
+
+    default:
+      return
+  }
+
+  waf.run({ persistent })
+}
+
+module.exports = {
+  onStripeCheckoutSessionCreate,
+  onStripePaymentIntentCreate,
+  onStripeConstructEvent,
+}

package/packages/dd-trace/src/appsec/iast/analyzers/hsts-header-missing-analyzer.js

@@ -31,7 +31,7 @@ class HstsHeaderMissingAnalyzer extends MissingHeaderAnalyzer {
       semicolonIndex === -1 ? headerValue.length : semicolonIndex
     )
 
-    const timestamp = Number.parseInt(timestampString)
+    const timestamp = Number.parseInt(timestampString, 10)
     // eslint-disable-next-line eqeqeq
     return timestamp > 0 && timestamp == timestampString
   }

package/packages/dd-trace/src/appsec/iast/vulnerabilities-formatter/utils.js

@@ -150,7 +150,7 @@ function stringifyWithRanges (obj, objRanges, loadSensitiveRanges = false) {
 
             sensitiveRanges.push({
               start,
-              end: start + Number.parseInt(regexRes[1]),
+              end: start + Number.parseInt(regexRes[1], 10),
             })
             segments.push(value.slice(pos, rangeKeyIndex))
             outputLength += cleanLength