diff --git a/packages/dd-trace/src/appsec/rasp/index.js b/packages/dd-trace/src/appsec/rasp/index.js index 6da75c91283..5b3d1b3d7de 100644 --- a/packages/dd-trace/src/appsec/rasp/index.js +++ b/packages/dd-trace/src/appsec/rasp/index.js @@ -104,6 +104,7 @@ function enable (config) { process.on('uncaughtExceptionMonitor', handleUncaughtExceptionMonitor) expressMiddlewareError.subscribe(blockOnDatadogRaspAbortError) + require('dc-polyfill').channel('apm:fastify:middleware:error').subscribe(blockOnDatadogRaspAbortError) } function disable () { diff --git a/packages/dd-trace/src/appsec/rasp/utils.js b/packages/dd-trace/src/appsec/rasp/utils.js index f3b3cea6ba9..6944f8c1ec4 100644 --- a/packages/dd-trace/src/appsec/rasp/utils.js +++ b/packages/dd-trace/src/appsec/rasp/utils.js @@ -19,6 +19,11 @@ const RULE_TYPES = { SSRF: 'ssrf' } +const ALLOWED_ROOTSPAN_NAMES = new Set([ + 'express.request', + 'fastify.request' +]) + class DatadogRaspAbortError extends Error { constructor (req, res, blockingAction, raspRule, ruleTriggered) { super('DatadogRaspAbortError') @@ -53,8 +58,8 @@ function handleResult (result, req, res, abortController, config, raspRule) { if (abortController && !abortOnUncaughtException) { const blockingAction = getBlockingAction(result?.actions) - // Should block only in express - if (blockingAction && rootSpan?.context()._name === 'express.request') { + const rootSpanName = rootSpan?.context()._name + if (blockingAction && ALLOWED_ROOTSPAN_NAMES.has(rootSpanName)) { const abortError = new DatadogRaspAbortError(req, res, blockingAction, raspRule, ruleTriggered) abortController.abort(abortError)