DataDog / dd-appsec-php

Datadog PHP Application Security
Other
10 stars 3 forks source link

Minor misconfiguration causes errors to be thrown #241

Open NickStallman opened 1 year ago

NickStallman commented 1 year ago

Description

It's possible to have a misconfiguration that throws some errors visibly on the website.

Warning: Unknown: [ddappsec] Failed to add tag _dd.appsec.event_rules.version in Unknown on line 0
Warning: Unknown: [ddappsec] Expecting an object from \ddtrace\root_span in Unknown on line 0
Warning: Unknown: [ddappsec] Expecting an object from \ddtrace\root_span in Unknown on line 0
Warning: Unknown: [ddappsec] Failed to add _dd.runtime_family to root span in Unknown on line 0
Warning: Unknown: [ddappsec] Expecting an object from \ddtrace\root_span in Unknown on line 0

You get this when you have:

datadog.trace.enabled = Off
datadog.appsec.enabled = On

It's a silly configuration, however I'd expect it to throw a warning in the PHP log file when the module is loaded, and reset appsec.enabled to Off if it doesn't detect trace.enabled is On. I wouldn't expect that kind of error to be thrown on page loads.

Tested on the latest versions of ddtrace and appsec.

edsrzf commented 1 year ago

I'm seeing this behavior with what I believe is a reasonable configuration.

I have:

The default for datadog.appsec.enabled depends on datadog.remote_config_enabled, which defaults to On. I've created a separate issue for this default in #242.