Skip to content

IAST ESM support for iitm 2 #6712

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 5 commits into
base: master
Choose a base branch
from
Draft

IAST ESM support for iitm 2 #6712

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ca91847
Set global flag on ESM loader
CarlesDD Oct 21, 2025
1db5485
iitm 2.0.0
CarlesDD Oct 21, 2025
4130da6
Set global flag on ESM loader
CarlesDD Oct 21, 2025
fc33fbb
Revert "Set global flag on ESM loader"
CarlesDD Oct 21, 2025
0b9807b
Set global flag on ESM loader
CarlesDD Oct 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions initialize.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,10 @@ import {
getSource as origGetSource,
} from 'import-in-the-middle/hook.mjs'

// Set global flag to indicate ESM loader is active
// This is checked by rewriter.js to enable ESM rewriting for IAST
globalThis.__DD_ESM_LOADER_ACTIVE__ = true
Copy link
Collaborator

@BridgeAR BridgeAR Oct 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We start to pollute the global space quite a bit. What about using a single symbol that is an object for all dd-trace-js related things we want to add to the global space? That way we limit it to that single symbol and it is actually also less visible.

To make it even less visible, I would not make it enumerable either.


let hasInsertedInit = false
function insertInit (result) {
if (!hasInsertedInit) {
Expand Down
3 changes: 3 additions & 0 deletions loader-hook.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1,4 @@
// Set global flag to indicate ESM loader is active
// This is checked by rewriter.js to enable ESM rewriting for IAST
globalThis.__DD_ESM_LOADER_ACTIVE__ = true
export * from 'import-in-the-middle/hook.mjs'
2 changes: 1 addition & 1 deletion package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@
"crypto-randomuuid": "^1.0.0",
"dc-polyfill": "^0.1.10",
"ignore": "^7.0.5",
"import-in-the-middle": "^1.14.2",
"import-in-the-middle": "^2.0.0",
"istanbul-lib-coverage": "^3.2.2",
"jest-docblock": "^29.7.0",
"jsonpath-plus": "^10.3.0",
Expand Down
8 changes: 5 additions & 3 deletions packages/dd-trace/src/appsec/iast/taint-tracking/rewriter.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,11 +187,13 @@ function isEsmConfigured () {
const hasLoaderArg = isFlagPresent('--loader') || isFlagPresent('--experimental-loader')
if (hasLoaderArg) return true

// Fast path for common case when enabled
if (require.cache[`${process.cwd()}/node_modules/import-in-the-middle/hook.js`]) {
// Check if import-in-the-middle loader has been set up via a global flag
// This is set by loader-hook.mjs when ESM loader is active
if (globalThis.__DD_ESM_LOADER_ACTIVE__) {
return true
}
return Object.keys(require.cache).some(file => file.endsWith('import-in-the-middle/hook.js'))

return false
}

let enableEsmRewriter = function (telemetryVerbosity) {
Expand Down
8 changes: 4 additions & 4 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2649,10 +2649,10 @@ import-fresh@^3.2.1:
parent-module "^1.0.0"
resolve-from "^4.0.0"

import-in-the-middle@^1.14.2:
version "1.15.0"
resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-1.15.0.tgz#9e20827a322bbadaeb5e3bac49ea8f6d4685fdd8"
integrity sha512-bpQy+CrsRmYmoPMAE/0G33iwRqwW4ouqdRg8jgbH3aKuCtOc8lxgmYXg2dMM92CRiGP660EtBcymH/eVUpCSaA==
import-in-the-middle@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/import-in-the-middle/-/import-in-the-middle-2.0.0.tgz#295948cee94d0565314824c6bd75379d13e5b1a5"
integrity sha512-yNZhyQYqXpkT0AKq3F3KLasUSK4fHvebNH5hOsKQw2dhGSALvQ4U0BqUc5suziKvydO5u5hgN2hy1RJaho8U5A==
dependencies:
acorn "^8.14.0"
acorn-import-attributes "^1.9.5"
Expand Down