dd-native-iast-rewriter-js

Nodejs native AST rewriter heavily based on Speedy Web Compiler o SWC compiler used to instrument Javascript source files.

Workflow

1. Parse Javascript code to obtain the AST
2. Replace certain AST expressions -> Currently it is focused in certain operators like + and +=, template literals and some String methods
3. Generate the new Javascript code as from the modified AST -> In addition to the Javascript code, the corresponding source map is returned chaining it with the original source map if necessary.

Usage

1const Rewriter = require('@datadog/native-iast-rewriter')
2
3const rewriter = new Rewriter(rewriterConfig)
4const result = rewriter.rewrite(code, filename)

Configuration options

1
2RewriterConfig {
3  // enable/disable sourceMap chaining - false by default
4  chainSourceMap?: boolean
5
6  // enable/disable comments printing - false by default
7  comments?: boolean
8
9  // establishes the prefix for the injected local variables - 6 random characters by default
10  localVarPrefix?: string
11
12  // sets the list of methods or operators to be rewritten
13  csiMethods?: Array<CsiMethod>
14
15  // extracts hardcoded string literals - true by default
16  literals?: boolean
17}
18
19CsiMethod {
20  // name of the String method to rewrite
21  src: string
22
23  // optional name of the replacement method. If not specified a convention shall be used
24  dst?: string
25
26  // indicates if it is an operator like +
27  operator?: boolean
28}

Example

1const Rewriter = require('@datadog/native-iast-rewriter')
2
3const rewriterConfig = {
4  csiMethods: [{ src: 'substring' }],
5  localVarPrefix: 'test',
6}
7
8const rewriter = new Rewriter(rewriterConfig)
9
10const code = `function sub(a) {
11  return a.substring(1)
12}`
13const result = rewriter.rewrite(code, filename)
14
15console.log(result.content)
16/*
17function sub(a) {
18  let __datadog_test_0, __datadog_test_1;
19  return (__datadog_test_0 = a, __datadog_test_1 = __datadog_test_0.substring, _ddiast.stringSubstring(__datadog_test_1.call(__datadog_test_0, 1), __datadog_test_1, __datadog_test_0, 1));
20}
21*/

Local setup

To set up the project locally, you should install cargo and wasm-pack:

$ curl https://sh.rustup.rs -sSf | sh

$ cargo install wasm-pack

and project dependencies:

$ npm install

Build

Build the project with

$ npm run build

It will compile WASM binaries by default and then it will be possible to run the tests with

$ npm t