Raw response body

[estringana]

Motivation

Adds support for sending the raw HTTP response body to the WAF for inspection via a new WAF address server.response.body.raw.

When DD_APPSEC_RAW_RESPONSE_BODY_ENABLED=1 is set, the extension captures the raw response body and passes it to the WAF before the response is sent to the client. This allows WAF rules to detect sensitive data or attack patterns in HTTP
responses.

Changes:

• Capture the raw response body and send it to the WAF as server.response.body.raw
• Register the new AsmRawResponseBody (bit 49) remote config capability so the Agent knows the tracer supports this feature
• Add DD_APPSEC_RAW_RESPONSE_BODY_ENABLED to the configuration registry
• Add integration tests verifying WAF fires on server.response.body.raw
• Add capability test verifying ASM_RAW_RESPONSE_BODY is advertised
• Add system test in APPSEC_CUSTOM_RULES scenario (PHP only, missing_feature for all other tracers)

RFC: https://docs.google.com/document/d/1gvYRWNQ28GyRIAepx59di-KxIqZsqY1a9XwFYaXmGG4

Workflow

1. ⚠️ Create your PR as draft ⚠️
2. Work on you PR until the CI passes
3. Mark it as ready for review
   • Test logic is modified? -> Get a review from RFC owner.
   • Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

• Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
• A docker base image is modified?
  • the relevant build-XXX-image label is present
• A scenario is added, removed or renamed?
  • Get a review from R&P team

[github-actions]

CODEOWNERS have been resolved as:

tests/appsec/waf/test_raw_response_body.py                              @DataDog/asm-libraries @DataDog/system-tests-core
manifests/cpp_nginx.yml                                                 @DataDog/dd-trace-cpp
manifests/dotnet.yml                                                    @DataDog/apm-dotnet @DataDog/asm-dotnet
manifests/golang.yml                                                    @DataDog/dd-trace-go-guild
manifests/java.yml                                                      @DataDog/asm-java @DataDog/apm-java
manifests/nodejs.yml                                                    @DataDog/dd-trace-js
manifests/php.yml                                                       @DataDog/apm-php @DataDog/asm-php
manifests/python.yml                                                    @DataDog/apm-python @DataDog/asm-python
manifests/ruby.yml                                                      @DataDog/ruby-guild @DataDog/asm-ruby
tests/appsec/custom_rules.json                                          @DataDog/asm-libraries @DataDog/system-tests-core
utils/_context/_scenarios/__init__.py                                   @DataDog/system-tests-core
utils/_features.py                                                      @DataDog/system-tests-core

[datadog-prod-us1-5]

 

⚠️ Warnings

🚦 3 Pipeline jobs failed

Testing the test | Test the test     

Testing the test | lint / lint     

Testing the test | all-jobs-are-green     

ℹ️ Info

No other issues found (see more)

🧪 All tests passed
❄️ No new flaky tests detected

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 78f2ef3 | Docs | Datadog PR Page | Give us feedback!}