Module: Datadog::AppSec::Contrib::AwsLambda::Gateway::Watcher

Defined in:
lib/datadog/appsec/contrib/aws_lambda/gateway/watcher.rb

Class Method Summary collapse

Class Method Details

.watch ⇒ Object 



16
17
18
19
20
21
 
# File 'lib/datadog/appsec/contrib/aws_lambda/gateway/watcher.rb', line 16

def watch
  gateway = Instrumentation.gateway

  watch_request(gateway)
  watch_response(gateway)
end

.watch_request(gateway = Instrumentation.gateway) ⇒ Object 



23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
 
# File 'lib/datadog/appsec/contrib/aws_lambda/gateway/watcher.rb', line 23

def watch_request(gateway = Instrumentation.gateway)
  gateway.watch("aws_lambda.request.start") do |stack, payload|
    context = payload.context
    next stack.call(payload) unless context

    persistent_data = WAFAddresses.from_request(payload.data)
    result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)

    if result.match? || !result.attributes.empty?
      context.events.push(
        AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
      )
    end

    if result.match?
      AppSec::Event.tag(context, result)
      TraceKeeper.keep!(context.trace) if result.keep?
      AppSec::ActionsHandler.handle(result.actions)
    end

    stack.call(payload)
  end
end

.watch_response(gateway = Instrumentation.gateway) ⇒ Object 



47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
 
# File 'lib/datadog/appsec/contrib/aws_lambda/gateway/watcher.rb', line 47

def watch_response(gateway = Instrumentation.gateway)
  gateway.watch("aws_lambda.response.start") do |stack, payload|
    context = payload.context
    next stack.call(payload) unless context

    persistent_data = WAFAddresses.from_response(payload.data)
    result = context.run_waf(persistent_data, {}, Datadog.configuration.appsec.waf_timeout)

    if result.match?
      AppSec::Event.tag(context, result)
      TraceKeeper.keep!(context.trace) if result.keep?

      context.events.push(
        AppSec::SecurityEvent.new(result, trace: context.trace, span: context.span)
      )

      AppSec::ActionsHandler.handle(result.actions)
    end

    stack.call(payload)
  end
end