fix(appsec): Implement limits for analyzed downstream requests

packages/datadog-instrumentations/src/http/client.js

@@ -56,6 +56,62 @@ function normalizeCallback (inputOptions, callback, inputURL) {
   return typeof inputOptions === 'function' ? [inputOptions, inputURL || {}] : [callback, inputOptions]
 }
 
+/**
+ * @param {string|null|undefined} contentType raw content-type header value.
+ * @returns {string|null} lowercase mime type without parameters.
+ */
+function extractMimeType (contentType) {
+  if (typeof contentType !== 'string') {
+    return null
+  }
+
+  return contentType.split(';', 1)[0].trim().toLowerCase()
+}
+
+/**
+ * @param {string|string[]|undefined} contentLength raw content-length header value.
+ * @returns {number|null} parsed content length or null when invalid.
+ */
+function parseContentLength (contentLength) {
+  if (contentLength == null) {
+    return null
+  }
+
+  const value = Array.isArray(contentLength) ? contentLength[0] : contentLength
+  const parsed = Number.parseInt(String(value), 10)
+
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    return null
+  }
+
+  return parsed
+}
+
+/**
+ * @param {import('http').IncomingMessage} res downstream response.
+ * @param {{ maxBytes: number, supportedMimeTypes: Set<string> }} responseBodyCollection collection limits.
+ * @returns {{ collect: boolean, reason?: string }}
+ */
+function evaluateResponseBodyCollection (res, responseBodyCollection) {
+  const { maxBytes, supportedMimeTypes } = responseBodyCollection
+
+  const mime = extractMimeType(res.headers?.['content-type'])
+  if (!mime || !supportedMimeTypes.has(mime)) {
+    return { collect: false, reason: 'content_type_invalid' }
+  }
+
+  const declaredContentLength = parseContentLength(res.headers?.['content-length'])
+  if (declaredContentLength == null || declaredContentLength === 0) {
+    return { collect: false, reason: 'content_length_missing' }
+  }
+
+  if (declaredContentLength > maxBytes) {
+    return { collect: false, reason: 'content_length_too_big' }
+  }
+
+  return { collect: true }
+}
+
 /**
  * Wires the downstream response so we can observe when the customer consumes
  * the body and when the stream finishes
@@ -77,11 +133,23 @@ function setupResponseInstrumentation (ctx, res) {
   let dataListenerAdded = false
   let dataReadStarted = false
 
-  const { shouldCollectBody } = ctx
-  const bodyChunks = shouldCollectBody ? [] : null
+  const { shouldCollectBody, responseBodyCollection } = ctx
+
+  let bodyChunks = null
+  let responseBodyIgnoredReason
+
+  if (shouldCollectBody && responseBodyCollection) {
+    const evaluation = evaluateResponseBodyCollection(res, responseBodyCollection)
+
+    if (evaluation.collect) {
+      bodyChunks = []
+    } else {
+      responseBodyIgnoredReason = evaluation.reason
+    }
+  }
 
   const collectChunk = chunk => {
-    if (!shouldCollectBody || !chunk) return
+    if (!bodyChunks || !chunk) return
 
     if (typeof chunk === 'string') {
       bodyChunks.push(chunk)
@@ -145,7 +213,7 @@ function setupResponseInstrumentation (ctx, res) {
         : Buffer.concat(bodyChunks)
     }
 
-    responseFinishChannel.publish({ ctx, res, body })
+    responseFinishChannel.publish({ ctx, res, body, responseBodyIgnoredReason })
     cleanup()
   }