feat(appsec): enable api security

florentinl · florentinl · commit abcfe532b8b2 · 2025-07-23T17:36:06.000+02:00
diff --git a/datadog_lambda/asm.py b/datadog_lambda/asm.py
@@ -185,13 +185,19 @@ def asm_start_response(
             "content-type": "application/json",
         }
 
+    if isinstance(response, dict) and "statusCode" in response:
+        body = response.get("body")
+    else:
+        body = response
+
     core.dispatch(
         # The matching listener is registered in ddtrace.appsec._handlers
         "aws_lambda.start_response",
         (
             span,
             status_code,
             response_headers,
+            body,
         ),
     )
 
diff --git a/datadog_lambda/wrapper.py b/datadog_lambda/wrapper.py
@@ -318,6 +318,9 @@ def _after(self, event, context):
                 if status_code:
                     self.inferred_span.set_tag("http.status_code", status_code)
 
+                if self.trigger_tags and (route := self.trigger_tags.get("http.route")):
+                    self.inferred_span.set_tag("http.route", route)
+
                 if config.service:
                     self.inferred_span.set_tag("peer.service", config.service)
 
diff --git a/tests/integration/snapshots/logs/async-metrics_python310.log b/tests/integration/snapshots/logs/async-metrics_python310.log
@@ -66,6 +66,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -613,6 +614,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/async-metrics_python311.log b/tests/integration/snapshots/logs/async-metrics_python311.log
@@ -66,6 +66,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -613,6 +614,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/async-metrics_python312.log b/tests/integration/snapshots/logs/async-metrics_python312.log
@@ -66,6 +66,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -613,6 +614,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/async-metrics_python313.log b/tests/integration/snapshots/logs/async-metrics_python313.log
@@ -66,6 +66,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -613,6 +614,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/async-metrics_python38.log b/tests/integration/snapshots/logs/async-metrics_python38.log
@@ -66,6 +66,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -613,6 +614,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/async-metrics_python39.log b/tests/integration/snapshots/logs/async-metrics_python39.log
@@ -66,6 +66,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -613,6 +614,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/sync-metrics_python310.log b/tests/integration/snapshots/logs/sync-metrics_python310.log
@@ -46,6 +46,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -653,6 +654,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/sync-metrics_python311.log b/tests/integration/snapshots/logs/sync-metrics_python311.log
@@ -46,6 +46,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -653,6 +654,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/sync-metrics_python312.log b/tests/integration/snapshots/logs/sync-metrics_python312.log
@@ -46,6 +46,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -653,6 +654,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/sync-metrics_python313.log b/tests/integration/snapshots/logs/sync-metrics_python313.log
@@ -46,6 +46,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -653,6 +654,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/sync-metrics_python38.log b/tests/integration/snapshots/logs/sync-metrics_python38.log
@@ -46,6 +46,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -653,6 +654,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/integration/snapshots/logs/sync-metrics_python39.log b/tests/integration/snapshots/logs/sync-metrics_python39.log
@@ -46,6 +46,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
@@ -653,6 +654,7 @@ HTTP GET https://www.datadoghq.com/ Headers: ["Accept-Encoding:gzip, deflate","A
           "_inferred_span.synchronicity": "sync",
           "_inferred_span.tag_source": "self",
           "http.status_code": "200",
+          "http.route": "/httpapi/get",
           "peer.service": "integration-tests-python",
           "_dd.peer.service.source": "peer.service",
           "_dd.base_service": "integration-tests-python",
diff --git a/tests/test_asm.py b/tests/test_asm.py
@@ -106,6 +106,7 @@
         },
         "200",
         {"Content-Type": "text/html"},
+        None,
         True,
     ),
     (
@@ -123,6 +124,7 @@
             "Content-Type": "text/plain",
             "X-Error": "Not Found",
         },
+        None,
         True,
     ),
     (
@@ -140,6 +142,7 @@
             "Location": "/user/123",
             "Content-Type": "application/json",
         },
+        None,
         True,
     ),
     (
@@ -158,6 +161,7 @@
             "Content-Type": "application/json",
             "X-Custom-Header": "test-value",
         },
+        '{"message": "success"}',
         True,
     ),
     (
@@ -169,6 +173,7 @@
         },
         "200",
         {"Content-Type": "application/json"},
+        None,
         True,
     ),
     (
@@ -180,6 +185,7 @@
         },
         "200",
         {"Content-Type": "text/plain"},
+        None,
         True,
     ),
     (
@@ -188,6 +194,7 @@
         {"statusCode": 200},
         "200",
         {},
+        None,
         False,  # Should not dispatch for non-HTTP events
     ),
     (
@@ -196,6 +203,7 @@
         "Hello, World!",
         "200",
         {"content-type": "application/json"},
+        "Hello, World!",
         True,
     ),
     (
@@ -204,6 +212,7 @@
         {"message": "Hello, World!"},
         "200",
         {"content-type": "application/json"},
+        {"message": "Hello, World!"},
         True,
     ),
 ]
@@ -326,7 +335,7 @@ def test_asm_start_request_parametrized(
 
 
 @pytest.mark.parametrize(
-    "name,event_file,response,status_code,expected_headers,should_dispatch",
+    "name,event_file,response,status_code,expected_headers,expected_body,should_dispatch",
     ASM_START_RESPONSE_TEST_CASES,
 )
 @patch("datadog_lambda.asm.core")
@@ -337,6 +346,7 @@ def test_asm_start_response_parametrized(
     response,
     status_code,
     expected_headers,
+    expected_body,
     should_dispatch,
 ):
     """Test ASM start response for various HTTP event types using parametrization"""
@@ -362,11 +372,12 @@ def test_asm_start_response_parametrized(
 
         # Extract the dispatched arguments
         dispatch_args = call_args[0][1]
-        span, response_status_code, response_headers = dispatch_args
+        span, response_status_code, response_headers, response_body = dispatch_args
 
         assert span == mock_span
         assert response_status_code == status_code
         assert response_headers == expected_headers
+        assert response_body == expected_body
     else:
         # Verify core.dispatch was not called for non-HTTP events
         mock_core.dispatch.assert_not_called()

Original file line number	Diff line number	Diff line change
`@@ -185,13 +185,19 @@ def asm_start_response(`
`185`	`185`	`"content-type": "application/json",`
`186`	`186`	`}`
`187`	`187`
	`188`	`+ if isinstance(response, dict) and "statusCode" in response:`
	`189`	`+ body = response.get("body")`
	`190`	`+ else:`
	`191`	`+ body = response`
	`192`	`+`
`188`	`193`	`core.dispatch(`
`189`	`194`	`# The matching listener is registered in ddtrace.appsec._handlers`
`190`	`195`	`"aws_lambda.start_response",`
`191`	`196`	`(`
`192`	`197`	`span,`
`193`	`198`	`status_code,`
`194`	`199`	`response_headers,`
	`200`	`+ body,`
`195`	`201`	`),`
`196`	`202`	`)`
`197`	`203`