Instrument vm for code injection vulnerability

package.json

@@ -19,7 +19,7 @@
     "test": "SERVICES=* yarn services && mocha --expose-gc 'packages/dd-trace/test/setup/node.js' 'packages/*/test/**/*.spec.js'",
     "test:appsec": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" \"packages/dd-trace/test/appsec/**/*.spec.js\"",
     "test:appsec:ci": "nyc --no-clean --include \"packages/dd-trace/src/appsec/**/*.js\" --exclude \"packages/dd-trace/test/appsec/**/*.plugin.spec.js\" -- npm run test:appsec",
-    "test:appsec:plugins": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" \"packages/dd-trace/test/appsec/**/*.@($(echo $PLUGINS)).plugin.spec.js\"",
+    "test:appsec:plugins": "mocha -r \"packages/dd-trace/test/setup/mocha.js\" --experimental-vm-modules \"packages/dd-trace/test/appsec/**/*.@($(echo $PLUGINS)).plugin.spec.js\"",
     "test:appsec:plugins:ci": "yarn services && nyc --no-clean --include \"packages/dd-trace/src/appsec/**/*.js\" -- npm run test:appsec:plugins",
     "test:debugger": "mocha -r 'packages/dd-trace/test/setup/mocha.js' 'packages/dd-trace/test/debugger/**/*.spec.js'",
     "test:debugger:ci": "nyc --no-clean --include 'packages/dd-trace/src/debugger/**/*.js' -- npm run test:debugger",

packages/datadog-instrumentations/src/helpers/hooks.js

@@ -96,6 +96,7 @@ module.exports = {
   'node:https': () => require('../http'),
   'node:net': () => require('../net'),
   'node:url': () => require('../url'),
+  'node:vm': () => require('../vm'),
   nyc: () => require('../nyc'),
   oracledb: () => require('../oracledb'),
   openai: () => require('../openai'),
@@ -122,6 +123,7 @@ module.exports = {
   undici: () => require('../undici'),
   url: () => require('../url'),
   vitest: { esmFirst: true, fn: () => require('../vitest') },
+  vm: () => require('../vm'),
   when: () => require('../when'),
   winston: () => require('../winston'),
   workerpool: () => require('../mocha')

packages/datadog-instrumentations/src/vm.js

@@ -0,0 +1,47 @@
+'use strict'
+
+const { channel, addHook } = require('./helpers/instrument')
+const shimmer = require('../../datadog-shimmer')
+const names = ['vm', 'node:vm']
+
+const runScriptStartChannel = channel('datadog:vm:run-script:start')
+const sourceTextModuleStartChannel = channel('datadog:vm:source-text-module:start')
+
+addHook({ name: names }, function (vm) {
+  vm.Script = class extends vm.Script {
+    constructor (code) {
+      super(...arguments)
+
+      if (runScriptStartChannel.hasSubscribers && code) {
+        runScriptStartChannel.publish({ code })
+      }
+    }
+  }
+
+  vm.SourceTextModule = class extends vm.SourceTextModule {
+    constructor (sourceText) {
+      super(...arguments)
+
+      if (sourceTextModuleStartChannel.hasSubscribers && sourceText) {
+        sourceTextModuleStartChannel.publish({ sourceText })
+      }
+    }
+  }
+
+  shimmer.wrap(vm, 'runInContext', wrapVMMethod)
+  shimmer.wrap(vm, 'runInNewContext', wrapVMMethod)
+  shimmer.wrap(vm, 'runInThisContext', wrapVMMethod)
+  shimmer.wrap(vm, 'compileFunction', wrapVMMethod)
+
+  return vm
+})
+
+function wrapVMMethod (original) {
+  return function wrappedVMMethod (code) {
+    if (runScriptStartChannel.hasSubscribers && code) {
+      runScriptStartChannel.publish({ code })
+    }
+
+    return original.apply(this, arguments)
+  }
+}

packages/dd-trace/src/appsec/iast/analyzers/code-injection-analyzer.js

@@ -10,6 +10,8 @@ class CodeInjectionAnalyzer extends InjectionAnalyzer {
 
   onConfigure () {
     this.addSub('datadog:eval:call', ({ script }) => this.analyze(script))
+    this.addSub('datadog:vm:run-script:start', ({ code }) => this.analyze(code))
+    this.addSub('datadog:vm:source-text-module:start', ({ sourceText }) => this.analyze(sourceText))
   }
 
   _areRangesVulnerable () {