dd-trace 6.8.0 → 6.9.0

package/packages/datadog-plugin-vitest/src/index.js

@@ -7,6 +7,7 @@ const {
   TEST_STATUS,
   TEST_TYPE,
   VITEST_POOL,
+  addIntelligentTestRunnerSpanTags,
   finishAllTraceSpans,
   getTestSuitePath,
   getTestSuiteCommonTags,
@@ -15,7 +16,6 @@ const {
   getIsFaultyEarlyFlakeDetection,
   TEST_SOURCE_FILE,
   TEST_IS_RETRY,
-  TEST_CODE_COVERAGE_LINES_PCT,
   TEST_CODE_OWNERS,
   TEST_COMMAND,
   TEST_LEVELS_METADATA,
@@ -41,11 +41,21 @@ const {
   TEST_BROWSER_NAME,
   TEST_IS_RUM_ACTIVE,
   TEST_PARAMETERS,
+  TEST_ITR_UNSKIPPABLE,
+  TEST_ITR_FORCED_RUN,
+  ITR_CORRELATION_ID,
 } = require('../../dd-trace/src/plugins/util/test')
 const { COMPONENT } = require('../../dd-trace/src/constants')
+const id = require('../../dd-trace/src/id')
 const {
   TELEMETRY_EVENT_CREATED,
   TELEMETRY_EVENT_FINISHED,
+  TELEMETRY_CODE_COVERAGE_STARTED,
+  TELEMETRY_CODE_COVERAGE_FINISHED,
+  TELEMETRY_CODE_COVERAGE_EMPTY,
+  TELEMETRY_CODE_COVERAGE_NUM_FILES,
+  TELEMETRY_ITR_FORCED_TO_RUN,
+  TELEMETRY_ITR_UNSKIPPABLE,
   TELEMETRY_TEST_SESSION,
 } = require('../../dd-trace/src/ci-visibility/telemetry')
 const { DD_MAJOR } = require('../../../version')
@@ -343,7 +353,9 @@ class VitestPlugin extends CiPlugin {
       testName,
       testSuiteAbsolutePath,
       isNew,
+      isAttemptToFix,
       isDisabled,
+      isQuarantined,
       isRumActive,
       isTestFrameworkWorker,
       requestErrorTags,
@@ -362,7 +374,9 @@ class VitestPlugin extends CiPlugin {
         [TEST_SOURCE_START]: testStartLine || 1,
         [TEST_STATUS]: 'skip',
         [TEST_FINAL_STATUS]: 'skip',
+        ...(isAttemptToFix ? { [TEST_MANAGEMENT_IS_ATTEMPT_TO_FIX]: 'true' } : {}),
         ...(isDisabled ? { [TEST_MANAGEMENT_IS_DISABLED]: 'true' } : {}),
+        ...(isQuarantined ? { [TEST_MANAGEMENT_IS_QUARANTINED]: 'true' } : {}),
         ...(isNew ? { [TEST_IS_NEW]: 'true' } : {}),
         ...(isRumActive ? { [TEST_IS_RUM_ACTIVE]: 'true' } : {}),
         ...(isTestFrameworkWorker ? { [TEST_IS_TEST_FRAMEWORK_WORKER]: 'true' } : {}),
@@ -393,10 +407,16 @@ class VitestPlugin extends CiPlugin {
         frameworkVersion,
         isTestFrameworkWorker,
         isVitestNoWorkerInitActive,
+        disableTestImpactAnalysis,
         isBrowserMode,
         browserDriver,
         browserName,
         browserProjectName,
+        isCodeCoverageEnabled,
+        coverageLibrary,
+        itrCorrelationId,
+        isUnskippable,
+        isForcedToRun,
       } = ctx
 
       const testCommand = ctx.testCommand || 'vitest run'
@@ -416,6 +436,7 @@ class VitestPlugin extends CiPlugin {
       const testSessionName = getTestSessionName(this.config, trimmedCommand, this.testEnvironmentMetadata)
       if (this.tracer._exporter.addMetadataTags) {
         const libraryCapabilitiesTags = this.getLibraryCapabilitiesTags(frameworkVersion, {
+          disableTestImpactAnalysis,
           isVitestNoWorkerInitActive,
         })
         this.tracer._exporter.addMetadataTags({
@@ -444,6 +465,20 @@ class VitestPlugin extends CiPlugin {
       if (isTestFrameworkWorker) {
         testSuiteMetadata[TEST_IS_TEST_FRAMEWORK_WORKER] = 'true'
       }
+      if (itrCorrelationId) {
+        testSuiteMetadata[ITR_CORRELATION_ID] = itrCorrelationId
+      }
+      if (isUnskippable) {
+        testSuiteMetadata[TEST_ITR_UNSKIPPABLE] = 'true'
+        this.telemetry.count(TELEMETRY_ITR_UNSKIPPABLE, { testLevel: 'suite' })
+      }
+      if (isForcedToRun) {
+        testSuiteMetadata[TEST_ITR_FORCED_RUN] = 'true'
+        this.telemetry.count(TELEMETRY_ITR_FORCED_TO_RUN, { testLevel: 'suite' })
+      }
+      if (isCodeCoverageEnabled) {
+        this.telemetry.ciVisEvent(TELEMETRY_CODE_COVERAGE_STARTED, 'suite', { library: coverageLibrary })
+      }
       setBrowserTags(testSuiteMetadata, {
         browserDriver,
         browserName,
@@ -473,9 +508,33 @@ class VitestPlugin extends CiPlugin {
       return ctx.currentStore
     })
 
-    this.addSub('ci:vitest:test-suite:finish', ({ testSuiteSpan, status, deferFlush, onDone }) => {
+    this.addSub('ci:vitest:test-suite:finish', ({
+      testSuiteSpan,
+      status,
+      coverageFiles,
+      coverageLibrary,
+      testSuiteAbsolutePath,
+      deferFlush,
+      onDone,
+    }) => {
       if (testSuiteSpan) {
         testSuiteSpan.setTag(TEST_STATUS, status)
+        if (coverageFiles) {
+          if (!coverageFiles.length) {
+            this.telemetry.count(TELEMETRY_CODE_COVERAGE_EMPTY)
+          }
+          const files = new Set(coverageFiles)
+          files.add(testSuiteAbsolutePath)
+          const relativeFiles = [...files].map(filename => getTestSuitePath(filename, this.repositoryRoot))
+          const { _traceId, _spanId } = testSuiteSpan.context()
+          this.tracer._exporter.exportCoverage({
+            sessionId: _traceId,
+            suiteId: _spanId,
+            files: relativeFiles,
+          })
+          this.telemetry.ciVisEvent(TELEMETRY_CODE_COVERAGE_FINISHED, 'suite', { library: coverageLibrary })
+          this.telemetry.distribution(TELEMETRY_CODE_COVERAGE_NUM_FILES, {}, relativeFiles.length)
+        }
         testSuiteSpan.finish()
         finishAllTraceSpans(testSuiteSpan)
       }
@@ -490,6 +549,17 @@ class VitestPlugin extends CiPlugin {
       }
     })
 
+    this.addSub('ci:vitest:worker-report:coverage', data => {
+      const formattedCoverages = JSON.parse(data).map(coverage => ({
+        sessionId: id(coverage.sessionId),
+        suiteId: id(coverage.suiteId),
+        files: coverage.files,
+      }))
+      for (const formattedCoverage of formattedCoverages) {
+        this.tracer._exporter.exportCoverage(formattedCoverage)
+      }
+    })
+
     this.addBind('ci:vitest:test-suite:error', (ctx) => {
       const { error } = ctx
       const testSuiteSpan = ctx.currentStore?.testSuiteSpan
@@ -512,12 +582,18 @@ class VitestPlugin extends CiPlugin {
       isEarlyFlakeDetectionEnabled,
       isEarlyFlakeDetectionFaulty,
       isTestManagementTestsEnabled,
+      isCodeCoverageEnabled,
+      isSuitesSkippingEnabled,
+      isSuitesSkipped,
+      numSkippedSuites,
+      hasUnskippableSuites,
+      hasForcedToRunSuites,
       requestErrorTags,
       vitestPool,
       isVitestNoWorkerInitActive,
       onDone,
     }) => {
-      for (const [tag, value] of Object.entries(requestErrorTags || {})) {
+      for (const [tag, value] of Object.entries(requestErrorTags)) {
         this.testSessionSpan.setTag(tag, value)
         this.testModuleSpan.setTag(tag, value)
       }
@@ -527,10 +603,20 @@ class VitestPlugin extends CiPlugin {
         this.testModuleSpan.setTag('error', error)
         this.testSessionSpan.setTag('error', error)
       }
-      if (testCodeCoverageLinesTotal !== undefined) {
-        this.testModuleSpan.setTag(TEST_CODE_COVERAGE_LINES_PCT, testCodeCoverageLinesTotal)
-        this.testSessionSpan.setTag(TEST_CODE_COVERAGE_LINES_PCT, testCodeCoverageLinesTotal)
-      }
+      addIntelligentTestRunnerSpanTags(
+        this.testSessionSpan,
+        this.testModuleSpan,
+        {
+          isSuitesSkipped,
+          isSuitesSkippingEnabled,
+          isCodeCoverageEnabled,
+          testCodeCoverageLinesTotal,
+          skippingType: 'suite',
+          skippingCount: numSkippedSuites,
+          hasUnskippableSuites,
+          hasForcedToRunSuites,
+        }
+      )
       if (isEarlyFlakeDetectionEnabled) {
         this.testSessionSpan.setTag(TEST_EARLY_FLAKE_ENABLED, 'true')
       }
@@ -566,12 +652,14 @@ class VitestPlugin extends CiPlugin {
    * Returns Vitest library capability metadata tags.
    * @param {string} frameworkVersion - The Vitest version.
    * @param {object} [ctx] - Diagnostic channel context.
+   * @param {boolean} [ctx.disableTestImpactAnalysis] - Whether TIA is unsupported for this run.
    * @param {boolean} [ctx.isVitestNoWorkerInitActive] - Whether no-worker init is active for this run.
    * @returns {Record<string, string|undefined>}
    */
   getLibraryCapabilitiesTags (frameworkVersion, ctx = {}) {
     return getDefaultLibraryCapabilitiesTags(this.constructor.id, frameworkVersion, {
       omitFailedTestReplay: ctx.isVitestNoWorkerInitActive,
+      omitTestImpactAnalysis: ctx.disableTestImpactAnalysis || ctx.isVitestNoWorkerInitActive,
     })
   }
 

package/packages/datadog-shimmer/src/shimmer.js

@@ -15,6 +15,10 @@ const skipMethodSize = skipMethods.size
 
 const nonConfigurableModuleExports = new WeakMap()
 
+/**
+ * @typedef {NonNullable<ReturnType<typeof globalThis.Object.getOwnPropertyDescriptor>>} Descriptor
+ */
+
 // Reused descriptor scratch space for the `name` and `length` slots that
 // `copyProperties` and `wrapCallback` rewrite per wrap. `Object.defineProperty`
 // reads the descriptor's slots synchronously and does not retain the object,
@@ -46,7 +50,7 @@ function copyProperties (original, wrapped) {
   if (ownKeys.length !== 2) {
     for (const key of ownKeys) {
       if (skipMethods.has(key)) continue
-      const descriptor = /** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(original, key))
+      const descriptor = /** @type {Descriptor} */ (Object.getOwnPropertyDescriptor(original, key))
       if (descriptor.writable && descriptor.enumerable && descriptor.configurable) {
         wrapped[key] = original[key]
       } else if (descriptor.writable || descriptor.configurable || !Object.hasOwn(wrapped, key)) {
@@ -65,7 +69,7 @@ function copyObjectProperties (original, wrapped, skipKey) {
   const ownKeys = Reflect.ownKeys(original)
   for (const key of ownKeys) {
     if (key === skipKey) continue
-    const descriptor = /** @type {PropertyDescriptor} */ (Object.getOwnPropertyDescriptor(original, key))
+    const descriptor = /** @type {Descriptor} */ (Object.getOwnPropertyDescriptor(original, key))
     if (descriptor.writable && descriptor.enumerable && descriptor.configurable) {
       wrapped[key] = original[key]
     } else if (descriptor.writable || descriptor.configurable || !Object.hasOwn(wrapped, key)) {

package/packages/dd-trace/src/aiguard/sdk.js

@@ -121,6 +121,9 @@ class AIGuard extends NoopAIGuard {
    *
    * - Clones each message so callers cannot mutate the data set in the meta struct.
    * - Truncates the list of messages and `content` fields emitting metrics accordingly.
+   *
+   * @param {import('../../../../index').aiguard.Message[]} messages
+   * @param {{ source: string, integration: string }} telemetryTags
    */
   #buildMessagesForMetaStruct (messages, telemetryTags) {
     const size = Math.min(messages.length, this.#maxMessagesLength)

package/packages/dd-trace/src/appsec/{blocking.js → blocking/index.js}

@@ -1,10 +1,10 @@
 'use strict'
 
-const { LRUCache } = require('../../../../vendor/dist/lru-cache')
-const log = require('../log')
-const web = require('../plugins/util/web')
-const blockedTemplates = require('./blocked_templates')
-const { updateBlockFailureMetric } = require('./telemetry')
+const { LRUCache } = require('../../../../../vendor/dist/lru-cache')
+const log = require('../../log')
+const web = require('../../plugins/util/web')
+const { updateBlockFailureMetric } = require('../telemetry')
+const blockedTemplates = require('./templates')
 
 // Bounded by the LRU as defense-in-depth: getSpecificKey already keys on the
 // resolved route (or the path with the query string stripped) so cardinality
@@ -182,7 +182,26 @@ function getBlockingAction (actions) {
 }
 
 /**
- * @param {import('../config/config-base')} [config] - Tracer configuration
+ * Turns a WAF result's actions into a blocking response, when one is requested.
+ * Single seam from WAF output to {@link block}, shared by every request/response/auth handler.
+ *
+ * @param {Record<string, unknown>|undefined} actions WAF result actions.
+ * @param {import('http').IncomingMessage} req
+ * @param {import('http').ServerResponse} res
+ * @param {object} rootSpan
+ * @param {AbortController} abortController
+ */
+function handleResults (actions, req, res, rootSpan, abortController) {
+  if (!actions || !req || !res || !rootSpan || !abortController) return
+
+  const blockingAction = getBlockingAction(actions)
+  if (blockingAction) {
+    block(req, res, rootSpan, abortController, blockingAction)
+  }
+}
+
+/**
+ * @param {import('../../config/config-base')} [config] - Tracer configuration
  */
 function setTemplates (config) {
   templates.html.body = config?.appsec?.blockedTemplateHtml
@@ -233,6 +252,7 @@ module.exports = {
   specificBlockingTypes,
   getBlockingData,
   getBlockingAction,
+  handleResults,
   setTemplates,
   isBlocked,
   setDefaultBlockingActionParameters,

package/packages/dd-trace/src/appsec/handlers/auth.js

@@ -0,0 +1,62 @@
+'use strict'
+
+const log = require('../../log')
+const web = require('../../plugins/util/web')
+const addresses = require('../addresses')
+const { handleResults } = require('../blocking')
+const { getActiveRequest } = require('../store')
+const UserTracking = require('../user_tracking')
+const waf = require('../waf')
+
+function onPassportVerify ({ framework, login, user, success, abortController }) {
+  const req = getActiveRequest()
+  const rootSpan = req && web.root(req)
+
+  if (!rootSpan) {
+    log.warn('[ASM] No rootSpan found in onPassportVerify')
+    return
+  }
+
+  const results = UserTracking.trackLogin(framework, login, user, success, rootSpan)
+
+  handleResults(results?.actions, req, web.getContext(req)?.res, rootSpan, abortController)
+}
+
+function onPassportDeserializeUser ({ user, abortController }) {
+  const req = getActiveRequest()
+  const rootSpan = req && web.root(req)
+
+  if (!rootSpan) {
+    log.warn('[ASM] No rootSpan found in onPassportDeserializeUser')
+    return
+  }
+
+  const results = UserTracking.trackUser(user, rootSpan)
+
+  handleResults(results?.actions, req, web.getContext(req)?.res, rootSpan, abortController)
+}
+
+function onExpressSession ({ req, res, sessionId, abortController }) {
+  const rootSpan = web.root(req)
+  if (!rootSpan) {
+    log.warn('[ASM] No rootSpan found in onExpressSession')
+    return
+  }
+
+  const isSdkCalled = rootSpan.context().getTag('usr.session_id')
+  if (isSdkCalled) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.USER_SESSION_ID]: sessionId,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+module.exports = {
+  onPassportVerify,
+  onPassportDeserializeUser,
+  onExpressSession,
+}

package/packages/dd-trace/src/appsec/handlers/http-request.js

@@ -0,0 +1,215 @@
+'use strict'
+
+const { HTTP_CLIENT_IP } = require('../../../../../ext/tags')
+const web = require('../../plugins/util/web')
+const { extractIp } = require('../../plugins/util/ip_extractor')
+const { isEmpty } = require('../../util')
+const addresses = require('../addresses')
+const apiSecurity = require('../api_security')
+const { handleResults } = require('../blocking')
+const Reporter = require('../reporter')
+const { getActiveRequest } = require('../store')
+const waf = require('../waf')
+const { storedResponseHeaders, copyHeadersOmitting } = require('./http-shared')
+
+const analyzedBodies = new WeakSet()
+const analyzedCookies = new WeakSet()
+const storedBodies = new WeakMap()
+
+let config
+
+/**
+ * @param {import('../../config/config-base')|undefined} _config
+ */
+function setConfig (_config) {
+  config = _config
+}
+
+function onRequestBodyParsed ({ req, res, body, abortController }) {
+  if (body === undefined || body === null) return
+
+  if (!req) {
+    req = getActiveRequest()
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (!req.body) {
+    // do not store body if it is in req.body
+    storedBodies.set(req, body)
+  }
+
+  if (typeof body === 'object') {
+    if (isEmpty(body)) return
+    analyzedBodies.add(body)
+  }
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_BODY]: body,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onRequestCookieParser ({ req, res, abortController, cookies }) {
+  if (!cookies || typeof cookies !== 'object') return
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (isEmpty(cookies)) return
+  analyzedCookies.add(cookies)
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_COOKIES]: cookies,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function incomingHttpStartTranslator ({ req, res, abortController }) {
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  const clientIp = extractIp(config, req)
+
+  rootSpan.addTags({
+    '_dd.appsec.enabled': 1,
+    '_dd.runtime_family': 'nodejs',
+    [HTTP_CLIENT_IP]: clientIp,
+  })
+
+  if (config.inferredProxyServicesEnabled) {
+    const context = web.getContext(req)
+    if (context?.inferredProxySpan) {
+      context.inferredProxySpan.setTag('_dd.appsec.enabled', 1)
+    }
+  }
+
+  const persistent = {
+    [addresses.HTTP_INCOMING_URL]: req.url,
+    [addresses.HTTP_INCOMING_HEADERS]: copyHeadersOmitting(req.headers, 'cookie'),
+    [addresses.HTTP_INCOMING_METHOD]: req.method,
+  }
+
+  if (clientIp) {
+    persistent[addresses.HTTP_CLIENT_IP] = clientIp
+  }
+
+  const results = waf.run({ persistent }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function incomingHttpEndTranslator ({ req, res }) {
+  const persistent = {}
+
+  // we need to keep this to support other body parsers
+  if (req.body !== undefined && req.body !== null) {
+    if (typeof req.body === 'object') {
+      if (!isEmpty(req.body) && !analyzedBodies.has(req.body)) {
+        persistent[addresses.HTTP_INCOMING_BODY] = req.body
+      }
+    } else {
+      persistent[addresses.HTTP_INCOMING_BODY] = req.body
+    }
+  }
+
+  // we need to keep this to support other cookie parsers
+  if (
+    req.cookies !== null &&
+    typeof req.cookies === 'object' &&
+    !isEmpty(req.cookies) &&
+    !analyzedCookies.has(req.cookies)
+  ) {
+    persistent[addresses.HTTP_INCOMING_COOKIES] = req.cookies
+  }
+
+  // we need to keep this to support nextjs
+  const query = req.query
+  if (
+    query !== null &&
+    typeof query === 'object' &&
+    !isEmpty(query)
+  ) {
+    persistent[addresses.HTTP_INCOMING_QUERY] = query
+  }
+
+  // This hook runs before span finish, so ensure route/endpoint tags are available before API Security sampling runs.
+  web.setRouteOrEndpointTag(req)
+
+  const apiSecSamplingDecision = apiSecurity.sampleRequest(req, res, true)
+  if (apiSecSamplingDecision === apiSecurity.SamplingDecision.SAMPLE) {
+    persistent[addresses.WAF_CONTEXT_PROCESSOR] = { 'extract-schema': true }
+  }
+
+  let wafResult
+  if (!isEmpty(persistent)) {
+    wafResult = waf.run({ persistent }, req)
+  }
+
+  apiSecurity.reportRequest(req, apiSecSamplingDecision, wafResult)
+
+  waf.disposeContext(req)
+
+  const storedHeaders = storedResponseHeaders.get(req) || {}
+
+  const body = req.body || storedBodies.get(req)
+  Reporter.finishRequest(req, res, storedHeaders, body)
+
+  if (storedHeaders) {
+    storedResponseHeaders.delete(req)
+  }
+  storedBodies.delete(req)
+}
+
+function onRequestQueryParsed ({ req, res, query, abortController }) {
+  if (!query || typeof query !== 'object') return
+
+  if (!req) {
+    req = getActiveRequest()
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (isEmpty(query)) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_QUERY]: query,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onRequestProcessParams ({ req, res, abortController, params }) {
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  if (!params || typeof params !== 'object' || isEmpty(params)) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_PARAMS]: params,
+    },
+  }, req)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+module.exports = {
+  setConfig,
+  onRequestBodyParsed,
+  onRequestCookieParser,
+  incomingHttpStartTranslator,
+  incomingHttpEndTranslator,
+  onRequestQueryParsed,
+  onRequestProcessParams,
+}

package/packages/dd-trace/src/appsec/handlers/http-response.js

@@ -0,0 +1,78 @@
+'use strict'
+
+const web = require('../../plugins/util/web')
+const { isEmpty } = require('../../util')
+const addresses = require('../addresses')
+const apiSecurity = require('../api_security')
+const { isBlocked, callBlockDelegation, handleResults } = require('../blocking')
+const waf = require('../waf')
+const { storedResponseHeaders, copyHeadersOmitting } = require('./http-shared')
+
+const responseAnalyzedSet = new WeakSet()
+
+function onResponseBody ({ req, res, body }) {
+  if (!body || typeof body !== 'object') return
+  if (apiSecurity.sampleRequest(req, res) !== apiSecurity.SamplingDecision.SAMPLE) return
+
+  // we don't support blocking at this point, so no results needed
+  waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_RESPONSE_BODY]: body,
+    },
+  }, req)
+}
+
+function onResponseWriteHead ({ req, res, abortController, statusCode, responseHeaders }) {
+  // Normalize header names to lowercase so downstream consumers see the same shape
+  // regardless of how the caller wrote them.
+  const normalizedResponseHeaders = {}
+  for (const [key, value] of Object.entries(responseHeaders)) {
+    normalizedResponseHeaders[key.toLowerCase()] = value
+  }
+
+  if (!isEmpty(normalizedResponseHeaders)) {
+    storedResponseHeaders.set(req, normalizedResponseHeaders)
+  }
+
+  // TODO: do not call waf if inside block()
+  // if (isBlocking()) {
+  //   return
+  // }
+
+  // avoid "write after end" error
+  if (isBlocked(res) || callBlockDelegation(res)) {
+    abortController?.abort()
+    return
+  }
+
+  // avoid double waf call
+  if (responseAnalyzedSet.has(res)) {
+    return
+  }
+
+  const rootSpan = web.root(req)
+  if (!rootSpan) return
+
+  const results = waf.run({
+    persistent: {
+      [addresses.HTTP_INCOMING_RESPONSE_CODE]: String(statusCode),
+      [addresses.HTTP_INCOMING_RESPONSE_HEADERS]: copyHeadersOmitting(normalizedResponseHeaders, 'set-cookie'),
+    },
+  }, req)
+
+  responseAnalyzedSet.add(res)
+
+  handleResults(results?.actions, req, res, rootSpan, abortController)
+}
+
+function onResponseOperation ({ res, abortController }) {
+  if (isBlocked(res)) {
+    abortController?.abort()
+  }
+}
+
+module.exports = {
+  onResponseBody,
+  onResponseWriteHead,
+  onResponseOperation,
+}

package/packages/dd-trace/src/appsec/handlers/http-shared.js

@@ -0,0 +1,24 @@
+'use strict'
+
+// Response headers captured on `responseWriteHead` (http-response) and later read
+// when the request finishes (http-request end translator). This is the only piece
+// of per-request state shared across the two handler modules.
+const storedResponseHeaders = new WeakMap()
+
+/**
+ * @param {Record<string, unknown>} src
+ * @param {string} omit
+ * @returns {Record<string, unknown>}
+ */
+function copyHeadersOmitting (src, omit) {
+  const filtered = {}
+  for (const key of Object.keys(src)) {
+    if (key !== omit) filtered[key] = src[key]
+  }
+  return filtered
+}
+
+module.exports = {
+  storedResponseHeaders,
+  copyHeadersOmitting,
+}