Conversation
| moveDependency('@opentelemetry/api') | ||
| moveDependency('@opentelemetry/api-logs') | ||
|
|
||
| addOptionalFromDdTrace('@datadog/native-appsec') |
There was a problem hiding this comment.
Why not moveDependency('@datadog/native-appsec')?
There was a problem hiding this comment.
I've changed the implementation to mimic datadog/pprof package using moveDependency
| if (!this.tracerWrapper.currentSpan) return false; | ||
| this.wrappedCurrentSpan = new SpanWrapper(this.tracerWrapper.currentSpan, {}); | ||
|
|
||
| processAppsecResponse(event, this.tracerWrapper.currentSpan); |
There was a problem hiding this comment.
The signature of this function is span: any, statusCode?: string, responseHeaders?: Record<string, string> wondering if this correct way to call it
There was a problem hiding this comment.
Good catch. Fixed and included a test
| const cookies = parseCookieHeader(headers.cookie); | ||
| const headersNoCookies = { ...headers }; | ||
| delete headersNoCookies.cookie; | ||
| return { cookies, headersNoCookies }; |
There was a problem hiding this comment.
If cookies is undefined returned from parseCookieHeader we should not add it right?
|
|
||
| const cookies = parseCookieArray(event.cookies) || parseCookieHeader(headers.cookie); | ||
|
|
||
| let route: string | undefined; |
There was a problem hiding this comment.
The route could be undefined or empty string similar to tracer?
There was a problem hiding this comment.
It could be for v2. Fixed!
CarlesDD
force-pushed
the
ccapell/APPSEC-60752/in-app-waf-port
branch
from
a9a47e9 to
a79197a
Compare
2 participants
What does this PR do?
Adds AppSec support to the Lambda layer by extracting HTTP data from Lambda events and publishing it to diagnostic channels consumed by dd-trace-js's AppSec subsystem.
Changes:
move_ddtrace_dependency.jsnow reads@datadog/native-appsecfrom dd-trace'soptionalDependenciesand promotes it to a direct dependency so it survives--ignore-optional. The Dockerfile runs the script beforerm -rf node_modulesand strips unused native prebuilds (non-Linux-glibc platforms)src/appsec/event-data-extractor.ts): Parses API Gateway v1/v2, ALB, and Lambda Function URL events, extracting headers, method, path, query, body, client IP, path params, cookies, and routesrc/appsec/index.ts): ChecksDD_APPSEC_ENABLEDand publishes extracted data todatadog:lambda:start-invocation/datadog:lambda:end-invocationdiagnostic channelsinitAppsec()called inonStartInvocation,processAppSecRequestandprocessAppSecResponsecalled inonEndingInvocationMotivation
Porting the In-App WAF security product to AWS Lambda for the Node.js runtime. The Lambda layer extracts HTTP data and dispatches it to the tracer for WAF execution and reporting.
The layer is intentionally kept thin, only extracting and publishing data. All security logic (WAF, reporting, trace keeping) lives in dd-trace-js.
Testing Guidelines
Additional Notes
@datadog/native-appsecis NOT added to this repo'spackage.json. The version is read dynamically from dd-trace'soptionalDependenciesat build time, so dd-trace-js remains the single owner of the native module version.DD_APPSEC_ENABLED.Types of Changes
Check all that apply
APPSEC-60752