Unsubscribe NextJS body and query channels on appsec disable (#4776)

DataDog · Oct 16, 2024 · 9489dc7 · 9489dc7
1 parent 7bd337b
commit 9489dc7
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/packages/dd-trace/src/appsec/index.js b/packages/dd-trace/src/appsec/index.js
@@ -290,6 +290,8 @@ function disable () {
   if (incomingHttpRequestStart.hasSubscribers) incomingHttpRequestStart.unsubscribe(incomingHttpStartTranslator)
   if (incomingHttpRequestEnd.hasSubscribers) incomingHttpRequestEnd.unsubscribe(incomingHttpEndTranslator)
   if (queryParser.hasSubscribers) queryParser.unsubscribe(onRequestQueryParsed)
+  if (nextBodyParsed.hasSubscribers) nextBodyParsed.unsubscribe(onRequestBodyParsed)
+  if (nextQueryParsed.hasSubscribers) nextQueryParsed.unsubscribe(onRequestQueryParsed)
   if (cookieParser.hasSubscribers) cookieParser.unsubscribe(onRequestCookieParser)
   if (responseBody.hasSubscribers) responseBody.unsubscribe(onResponseBody)
   if (passportVerify.hasSubscribers) passportVerify.unsubscribe(onPassportVerify)

diff --git a/packages/dd-trace/test/appsec/index.spec.js b/packages/dd-trace/test/appsec/index.spec.js
@@ -11,6 +11,8 @@ const {
   incomingHttpRequestStart,
   incomingHttpRequestEnd,
   queryParser,
+  nextBodyParsed,
+  nextQueryParsed,
   passportVerify,
   responseBody,
   responseWriteHead,
@@ -168,6 +170,8 @@ describe('AppSec Index', function () {
       expect(bodyParser.hasSubscribers).to.be.false
       expect(cookieParser.hasSubscribers).to.be.false
       expect(queryParser.hasSubscribers).to.be.false
+      expect(nextBodyParsed.hasSubscribers).to.be.false
+      expect(nextQueryParsed.hasSubscribers).to.be.false
       expect(passportVerify.hasSubscribers).to.be.false
       expect(responseWriteHead.hasSubscribers).to.be.false
       expect(responseSetHeader.hasSubscribers).to.be.false
@@ -177,6 +181,8 @@ describe('AppSec Index', function () {
       expect(bodyParser.hasSubscribers).to.be.true
       expect(cookieParser.hasSubscribers).to.be.true
       expect(queryParser.hasSubscribers).to.be.true
+      expect(nextBodyParsed.hasSubscribers).to.be.true
+      expect(nextQueryParsed.hasSubscribers).to.be.true
       expect(passportVerify.hasSubscribers).to.be.true
       expect(responseWriteHead.hasSubscribers).to.be.true
       expect(responseSetHeader.hasSubscribers).to.be.true
@@ -255,6 +261,8 @@ describe('AppSec Index', function () {
       expect(bodyParser.hasSubscribers).to.be.false
       expect(cookieParser.hasSubscribers).to.be.false
       expect(queryParser.hasSubscribers).to.be.false
+      expect(nextBodyParsed.hasSubscribers).to.be.false
+      expect(nextQueryParsed.hasSubscribers).to.be.false
       expect(passportVerify.hasSubscribers).to.be.false
       expect(responseWriteHead.hasSubscribers).to.be.false
       expect(responseSetHeader.hasSubscribers).to.be.false