internal/appsec: fix derivatives serdes on simple types (#2905)

Signed-off-by: Eliott Bouhana <[email protected]>

internal/appsec/emitter/trace/service_entry_span.go

@@ -41,8 +41,8 @@ type (
 
  // ServiceEntrySpanTagsBulk is a bulk event that is used to send tags to a service entry span
  ServiceEntrySpanTagsBulk struct {
- Tags []JSONServiceEntrySpanTag
- JSONTags []JSONServiceEntrySpanTag
+ Tags  []JSONServiceEntrySpanTag
+ SerializableTags []JSONServiceEntrySpanTag
  }
 )
 
@@ -55,19 +55,30 @@ func (op *ServiceEntrySpanOperation) SetTag(key string, value any) {
  op.tags[key] = value
 }
 
-// SetJSONTag adds the key/value pair to the tags to add to the service entry span. Value will be serialized as JSON.
-func (op *ServiceEntrySpanOperation) SetJSONTag(key string, value any) {
+// SetSerializableTag adds the key/value pair to the tags to add to the service entry span.
+// The value MAY be serialized as JSON if necessary but simple types will not be serialized.
+func (op *ServiceEntrySpanOperation) SetSerializableTag(key string, value any) {
  op.mu.Lock()
  defer op.mu.Unlock()
- op.jsonTags[key] = value
+ op.setSerializableTag(key, value)
 }
 
-// SetJSONTags adds the key/value pairs to the tags to add to the service entry span. Values will be serialized as JSON.
-func (op *ServiceEntrySpanOperation) SetJSONTags(tags map[string]any) {
+// SetSerializableTags adds the key/value pairs to the tags to add to the service entry span.
+// Values MAY be serialized as JSON if necessary but simple types will not be serialized.
+func (op *ServiceEntrySpanOperation) SetSerializableTags(tags map[string]any) {
  op.mu.Lock()
  defer op.mu.Unlock()
- for k, v := range tags {
- op.jsonTags[k] = v
+ for key, value := range tags {
+ op.setSerializableTag(key, value)
+ }
+}
+
+func (op *ServiceEntrySpanOperation) setSerializableTag(key string, value any) {
+ switch value.(type) {
+ case string, int8, int16, int32, int64, uint8, uint16, uint32, uint64, float32, float64, bool:
+ op.tags[key] = value
+ default:
+ op.jsonTags[key] = value
  }
 }
 
@@ -96,7 +107,7 @@ func (op *ServiceEntrySpanOperation) OnServiceEntrySpanTagEvent(tag ServiceEntry
 
 // OnJSONServiceEntrySpanTagEvent is a callback that is called when a dyngo.OnData is triggered with a JSONServiceEntrySpanTag event
 func (op *ServiceEntrySpanOperation) OnJSONServiceEntrySpanTagEvent(tag JSONServiceEntrySpanTag) {
- op.SetJSONTag(tag.Key, tag.Value)
+ op.SetSerializableTag(tag.Key, tag.Value)
 }
 
 // OnServiceEntrySpanTagsBulkEvent is a callback that is called when a dyngo.OnData is triggered with a ServiceEntrySpanTagsBulk event
@@ -105,8 +116,8 @@ func (op *ServiceEntrySpanOperation) OnServiceEntrySpanTagsBulkEvent(bulk Servic
  op.SetTag(v.Key, v.Value)
  }
 
- for _, v := range bulk.JSONTags {
- op.SetJSONTag(v.Key, v.Value)
+ for _, v := range bulk.SerializableTags {
+ op.SetSerializableTag(v.Key, v.Value)
  }
 }
 

internal/appsec/listener/waf/waf.go

@@ -112,7 +112,7 @@ func (waf *Feature) onFinish(op *waf.ContextOperation, _ waf.ContextRes) {
  log.Debug("appsec: failed to set event span tags: %v", err)
  }
 
- op.SetJSONTags(op.Derivatives())
+ op.SetSerializableTags(op.Derivatives())
  if stacks := op.StackTraces(); len(stacks) > 0 {
  op.SetTag(stacktrace.SpanKey, stacktrace.GetSpanValue(stacks...))
  }

internal/appsec/waf_test.go

@@ -967,13 +967,20 @@ func TestAttackerFingerprinting(t *testing.T) {
  resp, err := srv.Client().Do(req)
  require.NoError(t, err)
  defer resp.Body.Close()
- spans := mt.FinishedSpans()
 
- require.Len(t, spans, 1)
- require.Contains(t, spans[0].Tags(), "_dd.appsec.fp.http.header")
- require.Contains(t, spans[0].Tags(), "_dd.appsec.fp.http.endpoint")
- require.Contains(t, spans[0].Tags(), "_dd.appsec.fp.http.network")
- require.Contains(t, spans[0].Tags(), "_dd.appsec.fp.session")
+ require.Len(t, mt.FinishedSpans(), 1)
+
+ tags := mt.FinishedSpans()[0].Tags()
+
+ require.Contains(t, tags, "_dd.appsec.fp.http.header")
+ require.Contains(t, tags, "_dd.appsec.fp.http.endpoint")
+ require.Contains(t, tags, "_dd.appsec.fp.http.network")
+ require.Contains(t, tags, "_dd.appsec.fp.session")
+
+ require.Regexp(t, `^hdr-`, tags["_dd.appsec.fp.http.header"])
+ require.Regexp(t, `^http-`, tags["_dd.appsec.fp.http.endpoint"])
+ require.Regexp(t, `^ssn-`, tags["_dd.appsec.fp.session"])
+ require.Regexp(t, `^net-`, tags["_dd.appsec.fp.http.network"])
 }
 
 func init() {