profiler: add API key check at initialization of Profiler object

profiler/options.go

@@ -14,6 +14,7 @@ import (
 	"runtime"
 	"strings"
 	"time"
+	"unicode"
 
 	"gopkg.in/DataDog/dd-trace-go.v1/internal/globalconfig"
 	"gopkg.in/DataDog/dd-trace-go.v1/internal/log"
@@ -71,6 +72,19 @@ func urlForSite(site string) (string, error) {
 	return u, err
 }
 
+// isAPIKeyValid reports whether the given string is a structurally valid API key
+func isAPIKeyValid(key string) bool {
+	if len(key) != 32 {
+		return false
+	}
+	for _, c := range key {
+		if c > unicode.MaxASCII || (!unicode.IsLower(c) && !unicode.IsNumber(c)) {
+			return false
+		}
+	}
+	return true
+}
+
 func (c *config) addProfileType(t ProfileType) {
 	if c.types == nil {
 		c.types = make(map[ProfileType]struct{})

profiler/options_test.go

@@ -9,6 +9,7 @@ import (
 	"net"
 	"os"
 	"path/filepath"
+	"strconv"
 	"testing"
 	"time"
 
@@ -17,7 +18,32 @@ import (
 	"gopkg.in/DataDog/dd-trace-go.v1/internal/globalconfig"
 )
 
+// testAPIKey is an example API key for validation purposes
+const testAPIKey = "12345678901234567890123456789012"
+
 func TestOptions(t *testing.T) {
+	t.Run("APIKeyChecks", func(t *testing.T) {
+		var apikeytests = []struct {
+			in  string
+			out bool
+		}{
+			{"", false}, // Fail, empty string
+			{"1234567890123456789012345678901", false},   // Fail, too short
+			{"123456789012345678901234567890123", false}, // Fail, too long
+			{"12345678901234567890123456789012", true},   // Pass, numeric only
+			{"abcdefabcdabcdefabcdefabcdefabcd", true},   // Pass, alpha only
+			{"abcdefabcdabcdef7890abcdef789012", true},   // Pass, alphanumeric
+			{"abcdefabcdabcdef7890Abcdef789012", false},  // Fail, contains an uppercase
+			{"abcdefabcdabcdef7890@bcdef789012", false},  // Fail, contains an ASCII symbol
+			{"abcdefabcdabcdef7890ábcdef789012", false},  // Fail, lowercase extended ASCII
+			{"abcdefabcdabcdef7890ábcdef78901", false},   // Fail, lowercase extended ASCII, conservative
+		}
+
+		for i, tt := range apikeytests {
+			assert.Equal(t, tt.out, isAPIKeyValid(tt.in), strconv.Itoa(i)+" : "+tt.in)
+		}
+	})
+
 	t.Run("WithAgentAddr", func(t *testing.T) {
 		var cfg config
 		WithAgentAddr("test:123")(&cfg)
@@ -38,17 +64,18 @@ func TestOptions(t *testing.T) {
 
 	t.Run("WithAPIKey", func(t *testing.T) {
 		var cfg config
-		WithAPIKey("123")(&cfg)
-		assert.Equal(t, "123", cfg.apiKey)
+		WithAPIKey(testAPIKey)(&cfg)
+		assert.Equal(t, testAPIKey, cfg.apiKey)
 		assert.Equal(t, cfg.apiURL, cfg.targetURL)
 	})
 
 	t.Run("WithAPIKey/override", func(t *testing.T) {
 		os.Setenv("DD_API_KEY", "apikey")
 		defer os.Unsetenv("DD_API_KEY")
+		var testAPIKey = "12345678901234567890123456789012"
 		var cfg config
-		WithAPIKey("123")(&cfg)
-		assert.Equal(t, "123", cfg.apiKey)
+		WithAPIKey(testAPIKey)(&cfg)
+		assert.Equal(t, testAPIKey, cfg.apiKey)
 	})
 
 	t.Run("WithURL", func(t *testing.T) {
@@ -179,10 +206,10 @@ func TestEnvVars(t *testing.T) {
 	})
 
 	t.Run("DD_API_KEY", func(t *testing.T) {
-		os.Setenv("DD_API_KEY", "123")
+		os.Setenv("DD_API_KEY", testAPIKey)
 		defer os.Unsetenv("DD_API_KEY")
 		cfg := defaultConfig()
-		assert.Equal(t, "123", cfg.apiKey)
+		assert.Equal(t, testAPIKey, cfg.apiKey)
 	})
 
 	t.Run("DD_SITE", func(t *testing.T) {

profiler/profiler.go

@@ -6,6 +6,7 @@
 package profiler
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"runtime"
@@ -70,6 +71,9 @@ func newProfiler(opts ...Option) (*profiler, error) {
 		opt(cfg)
 	}
 	if cfg.apiKey != "" {
+		if !isAPIKeyValid(cfg.apiKey) {
+			return nil, errors.New("API key has incorrect format")
+		}
 		cfg.targetURL = cfg.apiURL
 	} else {
 		cfg.targetURL = cfg.agentURL

profiler/profiler_test.go

@@ -58,6 +58,16 @@ func TestStart(t *testing.T) {
 		assert.NotEmpty(t, activeProfiler.cfg.hostname)
 		mu.Unlock()
 	})
+
+	t.Run("options/GoodAPIKey", func(t *testing.T) {
+		_, err := newProfiler(WithAPIKey("12345678901234567890123456789012"))
+		assert.Nil(t, err)
+	})
+
+	t.Run("options/BadAPIKey", func(t *testing.T) {
+		_, err := newProfiler(WithAPIKey("aaaa"))
+		assert.NotNil(t, err)
+	})
 }
 
 func TestStartStopIdempotency(t *testing.T) {