fix(iast): instrument cookie parseCookie for cookie >=1.1#9272
Conversation
Overall package sizeSelf size: 6.71 MB Dependency sizes| name | version | self size | total size | |------|---------|-----------|------------| | import-in-the-middle | 3.3.1 | 122.62 kB | 437.94 kB | | opentracing | 0.14.7 | 194.81 kB | 194.81 kB | | dc-polyfill | 0.1.11 | 25.74 kB | 25.74 kB |🤖 This report was automatically generated by heaviest-objects-in-the-universe |
🎉 All green!🧪 All tests passed 🔄 Datadog auto-retried 1 job - 1 passed on retry 🎯 Code Coverage (details) 🔗 Commit SHA: d8383d9 | Docs | Datadog PR Page | Give us feedback! |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 17548f60b2
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
BenchmarksBenchmark execution time: 2026-07-10 17:11:17 Comparing candidate commit d8383d9 in PR branch Found 0 performance improvements and 0 performance regressions! Performance is the same for 2320 metrics, 38 unstable metrics.
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #9272 +/- ##
========================================
Coverage 96.56% 96.57%
========================================
Files 918 918
Lines 121564 121577 +13
Branches 20883 21200 +317
========================================
+ Hits 117394 117407 +13
Misses 4170 4170
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
17548f6 to
d06efb6
Compare
cookie 1.1 added a parseCookie alias next to parse, and cookie 2.0 dropped parse entirely in an ESM-only rewrite that exports only parseCookie. The hook only wrapped parse, so the datadog:cookie:parse:finish channel never fired for callers using parseCookie (all of cookie 2.x, and 1.x code that adopted the new name) and IAST stopped tainting those cookies. Wrap every parse entry the installed version exposes; a single call hits one export, so wrapping both names when present does not double-publish.
Node.js >=22 exposes cookie 2.x to require() as a module namespace whose writable export descriptor still rejects redefinition. Without a mutable replacement, the instrumentation aborts and IAST leaves parsed cookie values untainted.
d06efb6 to
d8383d9
Compare
cookie 1.1 added a parseCookie alias next to parse, and cookie 2.0 dropped parse entirely in an ESM-only rewrite that exports only parseCookie. The hook only wrapped parse, so the datadog:cookie:parse:finish channel never fired for callers using parseCookie (all of cookie 2.x, and 1.x code that adopted the new name) and IAST stopped tainting those cookies. Wrap every parse entry the installed version exposes; a single call hits one export, so wrapping both names when present does not double-publish.
cookie 1.1 added a parseCookie alias next to parse, and cookie 2.0 dropped parse entirely in an ESM-only rewrite that exports only parseCookie. The hook only wrapped parse, so the datadog:cookie:parse:finish channel never fired for callers using parseCookie (all of cookie 2.x, and 1.x code that adopted the new name) and IAST stopped tainting those cookies. Wrap every parse entry the installed version exposes; a single call hits one export, so wrapping both names when present does not double-publish.
cookie 1.1 added a parseCookie alias next to parse, and cookie 2.0 dropped parse entirely in an ESM-only rewrite that exports only parseCookie. The hook only wrapped parse, so the datadog:cookie:parse:finish channel never fired for callers using parseCookie (all of cookie 2.x, and 1.x code that adopted the new name) and IAST stopped tainting those cookies.
Wrap every parse entry the installed version exposes; a single call hits one export, so wrapping both names when present does not double-publish.
The plugin ESM integration test gains a parseCookie fixture for the named-export 2.x shape, and both it and the IAST source test skip cookie 2.x on Node <22, which the package's engines field requires.