fix(openfeature): harden configuration source handling

Author: leoromanovsky

packages/dd-trace/src/openfeature/agentless_configuration_source.js

@@ -32,7 +32,7 @@ class AgentlessConfigurationSource {
     this._clearTimeout = options.clearTimeout || clearTimeout
     this._started = false
     this._closed = false
-    this._polling = false
+    this._pollInFlight = false
     this._etag = undefined
     this._timer = undefined
     this._activeRequest = undefined
@@ -78,14 +78,14 @@ class AgentlessConfigurationSource {
       callback(null, { stopped: true })
       return
     }
-    if (this._polling) {
+    if (this._pollInFlight) {
       callback(null, { skipped: true })
       return
     }
 
-    this._polling = true
+    this._pollInFlight = true
     this._attempt(1, (error, result) => {
-      this._polling = false
+      this._pollInFlight = false
       if (error && !this._closed) {
         log.debug('Feature Flagging agentless poll failed', error)
       }
@@ -273,7 +273,8 @@ class AgentlessConfigurationSource {
  */
 function parseConfiguration (body) {
   const parsed = JSON.parse(body)
-  if (!parsed || typeof parsed !== 'object' || !parsed.data || typeof parsed.data !== 'object') {
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) ||
+      !parsed.data || typeof parsed.data !== 'object' || Array.isArray(parsed.data)) {
     throw new Error('Expected a JSON:API Universal Flag Configuration response')
   }
   if (parsed.data.type !== 'universal-flag-configuration') {
@@ -285,6 +286,7 @@ function parseConfiguration (body) {
       typeof configuration.createdAt !== 'string' ||
       (configuration.format !== undefined && typeof configuration.format !== 'string') ||
       !configuration.environment || typeof configuration.environment !== 'object' ||
+      Array.isArray(configuration.environment) ||
       typeof configuration.environment.name !== 'string' ||
       !configuration.flags || typeof configuration.flags !== 'object' || Array.isArray(configuration.flags)) {
     const keys = configuration && typeof configuration === 'object'

packages/dd-trace/src/openfeature/configuration_source.js

@@ -26,13 +26,13 @@ function resolve (config) {
   return {
     mode,
     endpoint: endpoint(config, config.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_BASE_URL),
-    pollIntervalMs: positiveMilliseconds(
+    pollIntervalMs: positiveMillisecondsFromSeconds(
       config.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_POLL_INTERVAL_SECONDS,
       DEFAULT_POLL_INTERVAL_SECONDS,
       'poll interval',
       MAX_POLL_INTERVAL_SECONDS
     ),
-    requestTimeoutMs: positiveMilliseconds(
+    requestTimeoutMs: positiveMillisecondsFromSeconds(
       config.DD_FEATURE_FLAGS_CONFIGURATION_SOURCE_AGENTLESS_REQUEST_TIMEOUT_SECONDS,
       DEFAULT_REQUEST_TIMEOUT_SECONDS,
       'request timeout'
@@ -150,7 +150,7 @@ function endpoint (config, configuredBaseUrl) {
  * @param {number} [maximumSeconds] - Optional inclusive maximum.
  * @returns {number} Positive milliseconds.
  */
-function positiveMilliseconds (value, fallbackSeconds, setting, maximumSeconds) {
+function positiveMillisecondsFromSeconds (value, fallbackSeconds, setting, maximumSeconds) {
   const seconds = Number(value)
   if (!Number.isFinite(seconds) || seconds <= 0) {
     log.warn(

packages/dd-trace/src/openfeature/flagging_provider.js

@@ -67,6 +67,7 @@ class FlaggingProvider extends DatadogNodeServerProvider {
    */
   _setConfigurationSource (source) {
     if (this.#configurationSource) {
+      log.warn('%s already has a configuration source; ignoring duplicate source', this.constructor.name)
       source.stop()
       return
     }

packages/dd-trace/test/openfeature/agentless_configuration_source.spec.js

@@ -301,6 +301,31 @@ describe('AgentlessConfigurationSource', () => {
     sinon.assert.calledThrice(log.debug)
   })
 
+  it('rejects arrays where UFC envelope objects are required', async () => {
+    const configuration = JSON.parse(VALID_UFC)
+    responses.push(
+      { statusCode: 200, body: JSON.stringify([]) },
+      { statusCode: 200, body: JSON.stringify({ data: [] }) },
+      {
+        statusCode: 200,
+        body: JSON.stringify({
+          data: {
+            type: 'universal-flag-configuration',
+            attributes: { ...configuration, environment: [] },
+          },
+        }),
+      }
+    )
+    const configurationSource = source()
+
+    await poll(configurationSource)
+    await poll(configurationSource)
+    await poll(configurationSource)
+
+    sinon.assert.notCalled(applyConfiguration)
+    sinon.assert.calledThrice(log.debug)
+  })
+
   it('preserves last-known-good configuration and ETag after malformed JSON', async () => {
     responses.push(
       { statusCode: 200, headers: { etag: '"good"' }, body: VALID_RESPONSE },

packages/dd-trace/test/openfeature/flagging_provider.spec.js

@@ -224,6 +224,11 @@ describe('FlaggingProvider', () => {
       sinon.assert.notCalled(first.stop)
       sinon.assert.notCalled(duplicate.start)
       sinon.assert.calledOnce(duplicate.stop)
+      sinon.assert.calledOnceWithExactly(
+        log.warn,
+        '%s already has a configuration source; ignoring duplicate source',
+        'FlaggingProvider'
+      )
     })
   })