WIP

Author: jandro996

dd-smoke-tests/resteasy/build.gradle

@@ -16,6 +16,7 @@ dependencies {
   implementation group: 'org.jboss.resteasy', name: 'resteasy-undertow', version:'3.1.0.Final'
   implementation group: 'org.jboss.resteasy', name: 'resteasy-cdi', version:'3.1.0.Final'
   implementation group: 'org.jboss.weld.servlet', name: 'weld-servlet', version: '2.4.8.Final'
+  implementation 'org.jboss.resteasy:resteasy-jackson2-provider:3.1.0.Final'
 
   implementation group: 'javax.el', name: 'javax.el-api', version:'3.0.0'
 
@@ -24,6 +25,7 @@ dependencies {
 
   testImplementation project(':dd-smoke-tests')
   testImplementation(testFixtures(project(":dd-smoke-tests:iast-util")))
+  testImplementation project(':dd-smoke-tests:appsec')
 }
 
 tasks.withType(Test).configureEach {

dd-smoke-tests/resteasy/src/main/java/smoketest/resteasy/App.java

@@ -1,15 +1,19 @@
 package smoketest.resteasy;
 
+import com.fasterxml.jackson.jaxrs.json.JacksonJsonProvider;
 import java.util.HashSet;
 import java.util.Set;
 import javax.ws.rs.core.Application;
+import org.jboss.resteasy.plugins.providers.StringTextStar;
 
 public class App extends Application {
 
   private Set<Object> singletons = new HashSet<Object>();
 
   public App() {
     singletons.add(new Resource());
+    singletons.add(new StringTextStar()); // Writer for String
+    singletons.add(new JacksonJsonProvider()); // Writer for json
   }
 
   @Override

dd-smoke-tests/resteasy/src/main/java/smoketest/resteasy/RequestBody.java

@@ -0,0 +1,45 @@
+package smoketest.resteasy;
+
+import java.util.List;
+
+public class RequestBody {
+  private List<KeyValue> main;
+  private Object nullable;
+
+  public List<KeyValue> getMain() {
+    return main;
+  }
+
+  public void setMain(List<KeyValue> main) {
+    this.main = main;
+  }
+
+  public Object getNullable() {
+    return nullable;
+  }
+
+  public void setNullable(Object nullable) {
+    this.nullable = nullable;
+  }
+
+  public static class KeyValue {
+    private String key;
+    private Double value;
+
+    public String getKey() {
+      return key;
+    }
+
+    public void setKey(String key) {
+      this.key = key;
+    }
+
+    public Double getValue() {
+      return value;
+    }
+
+    public void setValue(Double value) {
+      this.value = value;
+    }
+  }
+}

dd-smoke-tests/resteasy/src/main/java/smoketest/resteasy/Resource.java

@@ -6,9 +6,11 @@
 import java.util.List;
 import java.util.Set;
 import java.util.SortedSet;
+import javax.ws.rs.Consumes;
 import javax.ws.rs.CookieParam;
 import javax.ws.rs.GET;
 import javax.ws.rs.HeaderParam;
+import javax.ws.rs.POST;
 import javax.ws.rs.Path;
 import javax.ws.rs.PathParam;
 import javax.ws.rs.Produces;
@@ -94,4 +96,18 @@ public Response responseLocation(@QueryParam("param") String param) throws URISy
   public Response getCookie() throws SQLException {
     return Response.ok().cookie(new NewCookie("user-id", "7")).build();
   }
+
+  @Path("/api_security/response")
+  @POST
+  @Produces(MediaType.APPLICATION_JSON)
+  @Consumes(MediaType.APPLICATION_JSON)
+  public Response bodyJson(RequestBody input) {
+    return Response.ok(input).build();
+  }
+
+  @GET
+  @Path("/api_security/sampling/{i}")
+  public Response apiSecuritySamplingWithStatus(@PathParam("i") int i) {
+    return Response.status(i).header("content-type", "text/plain").entity("Hello!\n").build();
+  }
 }

dd-smoke-tests/resteasy/src/test/groovy/smoketest/ResteasyAppsecSmokeTest.groovy

@@ -0,0 +1,101 @@
+package smoketest
+
+import datadog.smoketest.appsec.AbstractAppSecServerSmokeTest
+import datadog.trace.agent.test.utils.OkHttpUtils
+import datadog.trace.api.Platform
+import groovy.json.JsonOutput
+import groovy.json.JsonSlurper
+import okhttp3.MediaType
+import okhttp3.Request
+import okhttp3.RequestBody
+import okhttp3.Response
+import spock.lang.IgnoreIf
+
+import java.util.zip.GZIPInputStream
+
+@IgnoreIf({
+  System.getProperty("java.vendor").contains("IBM") && System.getProperty("java.version").contains("1.8.")
+})
+class ResteasyAppsecSmokeTest extends AbstractAppSecServerSmokeTest {
+
+  @Override
+  ProcessBuilder createProcessBuilder() {
+    String jarPath = System.getProperty("datadog.smoketest.resteasy.jar.path")
+
+    List<String> command = new ArrayList<>()
+    command.add(javaPath())
+    command.addAll(defaultJavaProperties)
+    command.addAll(defaultAppSecProperties)
+    if (Platform.isJavaVersionAtLeast(17)) {
+      command.addAll(["--add-opens", "java.base/java.lang=ALL-UNNAMED"])
+    }
+    command.addAll(["-jar", jarPath, Integer.toString(httpPort)])
+    ProcessBuilder processBuilder = new ProcessBuilder(command)
+    processBuilder.directory(new File(buildDirectory))
+  }
+
+  void 'API Security samples only one request per endpoint'() {
+    given:
+    def url = "http://localhost:${httpPort}/hello/api_security/sampling/200?test=value"
+    def request = new Request.Builder()
+      .url(url)
+      .addHeader('X-My-Header', "value")
+      .get()
+      .build()
+
+    when:
+    List<Response> responses = (1..3).collect {
+      client.newCall(request).execute()
+    }
+
+    then:
+    responses.each {
+      assert it.code() == 200
+    }
+    waitForTraceCount(3)
+    def spans = rootSpans.toList().toSorted { it.span.duration }
+    spans.size() == 3
+    def sampledSpans = spans.findAll {
+      it.meta.keySet().any {
+        it.startsWith('_dd.appsec.s.req.')
+      }
+    }
+    sampledSpans.size() == 1
+    def span = sampledSpans[0]
+    span.meta.containsKey('_dd.appsec.s.req.query')
+    span.meta.containsKey('_dd.appsec.s.req.params')
+    span.meta.containsKey('_dd.appsec.s.req.headers')
+  }
+
+
+  void 'test response schema extraction'() {
+    given:
+    def url = "http://localhost:${httpPort}/hello/api_security/response"
+    def client = OkHttpUtils.clientBuilder().build()
+    def body = [
+      "main"    : [["key": "id001", "value": 1345.67], ["value": 1567.89, "key": "id002"]],
+      "nullable": null,
+    ]
+    def request = new Request.Builder()
+      .url(url)
+      .post(RequestBody.create(MediaType.get('application/json'), JsonOutput.toJson(body)))
+      .build()
+
+    when:
+    final response = client.newCall(request).execute()
+    waitForTraceCount(1)
+
+    then:
+    response.code() == 200
+    def span = rootSpans.first()
+    span.meta.containsKey('_dd.appsec.s.res.headers')
+    span.meta.containsKey('_dd.appsec.s.res.body')
+    final schema = new JsonSlurper().parse(unzip(span.meta.get('_dd.appsec.s.res.body')))
+    assert schema == [["main": [[[["key": [8], "value": [16]]]], ["len": 2]], "nullable": [1]]]
+  }
+
+  private static byte[] unzip(final String text) {
+    final inflaterStream = new GZIPInputStream(new ByteArrayInputStream(text.decodeBase64()))
+    return inflaterStream.getBytes()
+  }
+}