GraphQL Blocking

[hoolioh]

What does this PR do?

This PR adds blocking capabilities to GraphQL operations. In order to do that the instrumentation gets every resolver and directive information, format it and publish it. Then this information is handled in the proper Appsec module so it can be analyzed. In the event that the operation contains an attack an abort controller is signaled which will throw an custom exception which, in turn, prevent the current and coming resolvers from being executed. The aforementioned exception is later caught just to finalize the spans properly.

Motivation

Add threat protection to GraphQL operations.

Additional Notes

APM files added/modified:

• docs/test.ts
• index.d.ts
• integration-tests/graphql.spec.js
• packages/datadog-instrumentations/src/apollo-server-core.js
• packages/datadog-instrumentations/src/apollo-server.js
• packages/datadog-instrumentations/src/graphql.js
• packages/datadog-instrumentations/src/helpers/hooks.js
• packages/datadog-plugin-graphql/src/resolve.js

APPSEC-12041

[github-actions]

Overall package size

Self size: 5.77 MB
Deduped: 61.88 MB
No deduping: 62.64 MB

Dependency sizes

name	version	self size	total size
@datadog/native-iast-taint-tracking	1.6.4	16.43 MB	16.44 MB
@datadog/native-appsec	5.0.0	15.16 MB	15.17 MB
@datadog/pprof	4.1.0	9.36 MB	10.21 MB
protobufjs	7.2.5	2.77 MB	6.56 MB
@datadog/native-iast-rewriter	2.2.2	2.29 MB	2.37 MB
@opentelemetry/core	1.14.0	872.87 kB	1.47 MB
@datadog/native-metrics	2.0.0	898.77 kB	1.3 MB
@opentelemetry/api	1.4.1	780.32 kB	780.32 kB
import-in-the-middle	1.4.2	41.4 kB	704.79 kB
pprof-format	2.0.7	588.12 kB	588.12 kB
msgpack-lite	0.1.26	201.16 kB	281.59 kB
opentracing	0.14.7	194.81 kB	194.81 kB
semver	7.5.4	93.4 kB	123.8 kB
@datadog/sketches-js	2.1.0	109.9 kB	109.9 kB
lodash.sortby	4.7.0	75.76 kB	75.76 kB
lru-cache	7.14.0	74.95 kB	74.95 kB
ipaddr.js	2.1.0	60.23 kB	60.23 kB
ignore	5.2.4	51.22 kB	51.22 kB
int64-buffer	0.1.10	49.18 kB	49.18 kB
istanbul-lib-coverage	3.2.0	29.34 kB	29.34 kB
lodash.uniq	4.5.0	25.01 kB	25.01 kB
tlhunter-sorted-set	0.1.0	24.94 kB	24.94 kB
limiter	1.1.5	23.17 kB	23.17 kB
dc-polyfill	0.1.2	22.77 kB	22.77 kB
retry	0.13.1	18.85 kB	18.85 kB
lodash.kebabcase	4.1.1	17.75 kB	17.75 kB
node-abort-controller	3.1.1	16.89 kB	16.89 kB
lodash.pick	4.4.0	16.33 kB	16.33 kB
jest-docblock	29.7.0	8.99 kB	12.76 kB
crypto-randomuuid	1.0.0	11.18 kB	11.18 kB
path-to-regexp	0.1.7	6.78 kB	6.78 kB
koalas	1.0.2	6.47 kB	6.47 kB
methods	1.1.2	5.29 kB	5.29 kB
module-details-from-path	1.0.3	4.47 kB	4.47 kB

_{🤖 This report was automatically generated by heaviest-objects-in-the-universe}

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (0a1f575) 85.14% compared to head (8f427dc) 84.56%.
Report is 41 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #3819      +/-   ##
==========================================
- Coverage   85.14%   84.56%   -0.59%     
==========================================
  Files         228      233       +5     
  Lines        9345     9711     +366     
  Branches       33       33              
==========================================
+ Hits         7957     8212     +255     
- Misses       1388     1499     +111     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[pr-commenter]

Benchmarks

Benchmark execution time: 2023-12-19 15:45:42

Comparing candidate commit 8f427dc in PR branch julio/graphql-blocking with baseline commit 0a1f575 in branch master.

Found 1 performance improvements and 1 performance regressions! Performance is the same for 519 metrics, 11 unstable metrics.

scenario:log-skip-log-16

• 🟥 cpu_user_time [+15.967ms; +24.419ms] or [+5.430%; +8.304%]

scenario:plugin-graphql-with-depth-off-18

• 🟩 max_rss_usage [-129.954MB; -118.458MB] or [-13.505%; -12.310%]

[mabilbao]

This line is breaking to me.

I am using KeystoneJS and the schema generated is not returning directives sometimes.
For example:

🚀 ~ getResolverInfo ~ info.fieldNodes[0]: {
  kind: 'Field',
  name: { kind: 'Name', value: 'user' },
  arguments: [ { kind: 'Argument', name: [Object], value: [Object] } ],
  selectionSet: {
    kind: 'SelectionSet',
    selections: [ [Object], [Object], [Object] ],
    loc: Location {
      start: 19,
      end: 108,
      startToken: [Token],
      endToken: [Token],
      source: [Source]
    }
  }
}

Of course, the error I am getting is: TypeError: directives is not iterable.

---

Should we validate if directives is effectively iterable before the for?

[simon-id]

We'll investigate and fix this bug as fast as possible. Thank you for reporting the issue!

[mabilbao]

Thank you @simon-id! I've just created an issue with the same topic and more details 😄

#4097

[simon-id]

Oh wow perfect, I was about to create one too. Thank you for being proactive and let's continue this discussion there.