Skip to content

Commit cd7c187

Browse files
rochdevrochdev
committed
Merge branch 'event-based-tracing-koa' of github.com:DataDog/dd-trace-js into event-based-tracing-koa
2 parents 5234a82 + bae6be5 commit cd7c187

File tree

9 files changed

+127
-80
lines changed

9 files changed

+127
-80
lines changed

‎.gitlab/benchmarks.yml

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,24 @@ benchmarks-pr-comment:
4848

4949
KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: dd-trace-js
5050

51+
check-big-regressions:
52+
stage: benchmarks-pr-comment
53+
when: on_success
54+
tags: ["arch:amd64"]
55+
image: $BASE_CI_IMAGE
56+
script:
57+
- export REPORTS_DIR="$(pwd)/reports/" && (mkdir "${REPORTS_DIR}" || :)
58+
- git config --global url."https://gitlab-ci-token:${CI_JOB_TOKEN}@gitlab.ddbuild.io/DataDog/".insteadOf "https://github.com/DataDog/"
59+
- git clone --branch dd-trace-js https://github.com/DataDog/relenv-microbenchmarking-platform /platform && cd /platform
60+
- ./steps/fail-on-regression.sh
61+
variables:
62+
UPSTREAM_PROJECT_ID: $CI_PROJECT_ID # The ID of the current project. This ID is unique across all projects on the GitLab instance.
63+
UPSTREAM_PROJECT_NAME: $CI_PROJECT_NAME # "dd-trace-js"
64+
UPSTREAM_BRANCH: $CI_COMMIT_REF_NAME # The branch or tag name for which project is built.
65+
UPSTREAM_COMMIT_SHA: $CI_COMMIT_SHA # The commit revision the project is built for.
66+
67+
KUBERNETES_SERVICE_ACCOUNT_OVERWRITE: dd-trace-js
68+
5169
benchmark-v14:
5270
extends: .benchmarks
5371
variables:

‎integration-tests/cucumber.spec.js

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
const { exec } = require('child_process')
44

55
const getPort = require('get-port')
6+
const semver = require('semver')
67
const { assert } = require('chai')
78

89
const {
@@ -13,13 +14,14 @@ const {
1314
const { FakeCiVisIntake } = require('./ci-visibility-intake')
1415
const { TEST_STATUS, TEST_COMMAND, TEST_BUNDLE } = require('../packages/dd-trace/src/plugins/util/test')
1516

16-
const versions = ['7.0.0', 'latest']
17+
const isOldNode = semver.satisfies(process.version, '<=12')
18+
const versions = ['7.0.0', isOldNode ? '8' : 'latest']
1719

1820
versions.forEach(version => {
1921
describe(`cucumber@${version}`, () => {
2022
let sandbox, cwd, receiver, childProcess
2123
before(async () => {
22-
sandbox = await createSandbox(['@cucumber/cucumber', 'assert'], true)
24+
sandbox = await createSandbox([`@cucumber/cucumber@${version}`, 'assert'], true)
2325
cwd = sandbox.folder
2426
})
2527

‎package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
},
6262
"dependencies": {
6363
"@datadog/native-appsec": "2.0.0",
64-
"@datadog/native-iast-rewriter": "1.1.2",
64+
"@datadog/native-iast-rewriter": "2.0.1",
6565
"@datadog/native-iast-taint-tracking": "1.1.1",
6666
"@datadog/native-metrics": "^1.5.0",
6767
"@datadog/pprof": "^2.0.0",

‎packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,10 +40,13 @@ function getCompileMethodFn (compileMethod) {
4040
return function (content, filename) {
4141
try {
4242
if (isPrivateModule(filename) && isNotLibraryFile(filename)) {
43-
content = rewriter.rewrite(content, filename)
43+
const rewritten = rewriter.rewrite(content, filename)
44+
if (rewritten && rewritten.content) {
45+
return compileMethod.apply(this, [rewritten.content, filename])
46+
}
4447
}
4548
} catch (e) {
46-
log.debug(e)
49+
log.error(e)
4750
}
4851
return compileMethod.apply(this, [content, filename])
4952
}

‎packages/dd-trace/src/appsec/recommended.json

Lines changed: 42 additions & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"version": "2.2",
33
"metadata": {
4-
"rules_version": "1.5.1"
4+
"rules_version": "1.5.2"
55
},
66
"rules": [
77
{
@@ -1351,16 +1351,11 @@
13511351
"etc/timezone",
13521352
"etc/modules",
13531353
"etc/passwd",
1354-
"etc/passwd~",
1355-
"etc/passwd-",
13561354
"etc/shadow",
1357-
"etc/shadow~",
1358-
"etc/shadow-",
13591355
"etc/fstab",
13601356
"etc/motd",
13611357
"etc/hosts",
13621358
"etc/group",
1363-
"etc/group-",
13641359
"etc/alias",
13651360
"etc/crontab",
13661361
"etc/crypttab",
@@ -1871,11 +1866,8 @@
18711866
"dev/tcp/",
18721867
"dev/udp/",
18731868
"dev/zero",
1874-
"etc/group",
18751869
"etc/master.passwd",
1876-
"etc/passwd",
18771870
"etc/pwd.db",
1878-
"etc/shadow",
18791871
"etc/shells",
18801872
"etc/spwd.db",
18811873
"proc/self/",
@@ -4090,9 +4082,7 @@
40904082
"java.lang.number",
40914083
"java.lang.object",
40924084
"java.lang.process",
4093-
"java.lang.processbuilder",
40944085
"java.lang.reflect",
4095-
"java.lang.runtime",
40964086
"java.lang.string",
40974087
"java.lang.stringbuilder",
40984088
"java.lang.system",
@@ -4455,6 +4445,44 @@
44554445
],
44564446
"transformers": []
44574447
},
4448+
{
4449+
"id": "dog-942-001",
4450+
"name": "Blind XSS callback domains",
4451+
"tags": {
4452+
"type": "xss",
4453+
"category": "attack_attempt",
4454+
"confidence": "1"
4455+
},
4456+
"conditions": [
4457+
{
4458+
"parameters": {
4459+
"inputs": [
4460+
{
4461+
"address": "server.request.query"
4462+
},
4463+
{
4464+
"address": "server.request.body"
4465+
},
4466+
{
4467+
"address": "server.request.path_params"
4468+
},
4469+
{
4470+
"address": "server.request.headers.no_cookies"
4471+
},
4472+
{
4473+
"address": "grpc.server.request.message"
4474+
}
4475+
],
4476+
"regex": "https?:\\/\\/(?:.*\\.)?(?:bxss\\.in|xss\\.ht|js\\.rip)",
4477+
"options": {
4478+
"case_sensitive": false
4479+
}
4480+
},
4481+
"operator": "match_regex"
4482+
}
4483+
],
4484+
"transformers": []
4485+
},
44584486
{
44594487
"id": "nfd-000-001",
44604488
"name": "Detect common directory discovery scans",
@@ -5083,36 +5111,6 @@
50835111
"removeNulls"
50845112
]
50855113
},
5086-
{
5087-
"id": "sqr-000-007",
5088-
"name": "NoSQL: Detect common exploitation strategy",
5089-
"tags": {
5090-
"type": "nosql_injection",
5091-
"category": "attack_attempt"
5092-
},
5093-
"conditions": [
5094-
{
5095-
"parameters": {
5096-
"inputs": [
5097-
{
5098-
"address": "server.request.query"
5099-
},
5100-
{
5101-
"address": "server.request.body"
5102-
},
5103-
{
5104-
"address": "server.request.path_params"
5105-
}
5106-
],
5107-
"regex": "^\\$(eq|ne|(l|g)te?|n?in|not|(n|x|)or|and|regex|where|expr|exists)$"
5108-
},
5109-
"operator": "match_regex"
5110-
}
5111-
],
5112-
"transformers": [
5113-
"keys_only"
5114-
]
5115-
},
51165114
{
51175115
"id": "sqr-000-008",
51185116
"name": "Windows: Detect attempts to exfiltrate .ini files",
@@ -5312,7 +5310,7 @@
53125310
"address": "grpc.server.request.message"
53135311
}
53145312
],
5315-
"regex": "^(jar:)?(http|https):\\/\\/((\\[)?[:0-9a-f\\.x]{2,}(\\])?)(:[0-9]{1,5})?(\\/.*)?$"
5313+
"regex": "^(jar:)?(http|https):\\/\\/((\\[)?[:0-9a-f\\.x]{2,}(\\])?)(:[0-9]{1,5})?(\\/[^:@]*)?$"
53165314
},
53175315
"operator": "match_regex"
53185316
}
@@ -5349,7 +5347,7 @@
53495347
"address": "grpc.server.request.message"
53505348
}
53515349
],
5352-
"regex": "(http|https):\\/\\/(?:.*\\.)?(?:burpcollaborator\\.net|localtest\\.me|mail\\.ebc\\.apple\\.com|bugbounty\\.dod\\.network|.*\\.[nx]ip\\.io|oastify\\.com|oast\\.(?:pro|live|site|online|fun|me)|sslip\\.io|requestbin\\.com|requestbin\\.net|hookbin\\.com|webhook\\.site|canarytokens\\.com|interact\\.sh|ngrok\\.io|bugbounty\\.click)"
5350+
"regex": "(http|https):\\/\\/(?:.*\\.)?(?:burpcollaborator\\.net|localtest\\.me|mail\\.ebc\\.apple\\.com|bugbounty\\.dod\\.network|.*\\.[nx]ip\\.io|oastify\\.com|oast\\.(?:pro|live|site|online|fun|me)|sslip\\.io|requestbin\\.com|requestbin\\.net|hookbin\\.com|webhook\\.site|canarytokens\\.com|interact\\.sh|ngrok\\.io|bugbounty\\.click|prbly\\.win|qualysperiscope\\.com)"
53535351
},
53545352
"operator": "match_regex"
53555353
}
@@ -6723,4 +6721,4 @@
67236721
"transformers": []
67246722
}
67256723
]
6726-
}
6724+
}

‎packages/dd-trace/src/lambda/handler.js

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,14 @@ let __lambdaTimeout
2222
* @param {*} context AWS Lambda context object.
2323
*/
2424
function checkTimeout (context) {
25-
let remainingTimeInMillis = context.getRemainingTimeInMillis()
26-
const apmFlushDeadline = parseInt(process.env.DD_APM_FLUSH_DEADLINE)
27-
if (apmFlushDeadline && apmFlushDeadline <= remainingTimeInMillis) {
28-
remainingTimeInMillis = apmFlushDeadline
29-
}
25+
const remainingTimeInMillis = context.getRemainingTimeInMillis()
26+
27+
let apmFlushDeadline = parseInt(process.env.DD_APM_FLUSH_DEADLINE_MILLISECONDS) || 100
28+
apmFlushDeadline = apmFlushDeadline < 0 ? 100 : apmFlushDeadline
3029

3130
__lambdaTimeout = setTimeout(() => {
3231
timeoutChannel.publish(undefined)
33-
}, remainingTimeInMillis - 50)
32+
}, remainingTimeInMillis - apmFlushDeadline)
3433
}
3534

3635
/**

‎packages/dd-trace/test/lambda/fixtures/handler.js

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,7 @@ const _tracer = require('../../../../dd-trace')
44
exports.handler = async (...args) => {
55
const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
66

7-
await _tracer.trace('self.sleepy', () => sleep(200))
8-
7+
await _tracer.trace('self.sleepy', () => sleep(50))
98
const response = {
109
statusCode: 200,
1110
body: JSON.stringify(

‎packages/dd-trace/test/lambda/index.spec.js

Lines changed: 47 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ describe('lambda', () => {
3232

3333
it('patches lambda function correctly', async () => {
3434
const _context = {
35-
getRemainingTimeInMillis: () => 300
35+
getRemainingTimeInMillis: () => 150
3636
}
3737
const _event = {}
3838
const _handlerPath = path.resolve(__dirname, './fixtures/handler.js')
@@ -53,26 +53,54 @@ describe('lambda', () => {
5353
await checkTraces
5454
})
5555

56-
it('returns traces with error when handler is about to timeout', async () => {
57-
const _context = {
58-
getRemainingTimeInMillis: () => 150
59-
}
60-
const _event = {}
61-
const _handlerPath = path.resolve(__dirname, './fixtures/handler.js')
62-
const app = require(_handlerPath)
63-
datadog = require('./fixtures/datadog-lambda')
64-
let result
65-
(datadog(app.handler)(_event, _context)).then((data) => { result = data })
66-
setTimeout(() => {
67-
expect(result).to.equal(undefined)
68-
}, _context.getRemainingTimeInMillis())
56+
describe('timeout spans', () => {
57+
const deadlines = [
58+
{
59+
envVar: 'default'
60+
// will use default remaining time
61+
},
62+
{
63+
envVar: 'DD_APM_FLUSH_DEADLINE_MILLISECONDS',
64+
value: '-100' // will default to 0
65+
},
66+
{
67+
envVar: 'DD_APM_FLUSH_DEADLINE_MILLISECONDS',
68+
value: '10' // subtract 10 from the remaining time
69+
}
70+
]
6971

70-
const checkTraces = agent.use((_traces) => {
71-
const trace = _traces[0][0]
72-
expect(trace.error).to.equal(1)
73-
expect(trace.meta['error.type']).to.equal('Impending Timeout')
72+
deadlines.forEach(deadline => {
73+
const flushDeadlineEnvVar = deadline.envVar
74+
const customDeadline = deadline.value ? deadline.value : ''
75+
76+
it(`traces error on impending timeout using ${flushDeadlineEnvVar} ${customDeadline} deadline`, (done) => {
77+
process.env[flushDeadlineEnvVar] = customDeadline
78+
79+
const _context = {
80+
getRemainingTimeInMillis: () => 25
81+
}
82+
const _event = {}
83+
84+
const _handlerPath = path.resolve(__dirname, './fixtures/handler.js')
85+
const app = require(_handlerPath)
86+
datadog = require('./fixtures/datadog-lambda')
87+
88+
let error = false
89+
agent.use((_traces) => {
90+
// First trace, since errors are tagged at root span level.
91+
const trace = _traces[0][0]
92+
expect(trace.error).to.equal(1)
93+
error = true
94+
expect(trace.meta['error.type']).to.equal('Impending Timeout')
95+
// Ensure that once this finish, an error was tagged.
96+
}).then(() => expect(error).to.equal(true))
97+
98+
// Since these are expected to timeout and one can't kill the
99+
// environment, one has to wait for the result to come in so
100+
// the traces are verified above.
101+
datadog(app.handler)(_event, _context).then(_ => done(), done)
102+
})
74103
})
75-
await checkTraces
76104
})
77105
})
78106
})

‎yarn.lock

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -196,10 +196,10 @@
196196
dependencies:
197197
node-gyp-build "^3.9.0"
198198

199-
"@datadog/native-iast-rewriter@1.1.2":
200-
version "1.1.2"
201-
resolved "https://registry.yarnpkg.com/@datadog/native-iast-rewriter/-/native-iast-rewriter-1.1.2.tgz#793cbf92d218ec80d645be0830023656b81018ea"
202-
integrity sha512-pigRfRtAjZjMjqIXyXb98S4aDnuHz/EmqpoxAajFZsNjBLM87YonwSY5zoBdCsOyA46ddKOJRoCQd5ZalpOFMQ==
199+
"@datadog/native-iast-rewriter@2.0.1":
200+
version "2.0.1"
201+
resolved "https://registry.yarnpkg.com/@datadog/native-iast-rewriter/-/native-iast-rewriter-2.0.1.tgz#dc4a23796870f2d840053ae879c61547eda6bb89"
202+
integrity sha512-Mm+FG3XxEbPrAfJQPOMHts7iZZXRvg9gnGeeFRGkyirmRcQcOpZO4wFe/8K61DUVa5pXpgAJQ2ZkBGYF1O9STg==
203203
dependencies:
204204
node-gyp-build "^4.5.0"
205205

0 commit comments

Comments
 (0)