Fix DD_TRACE_SYMFONY_HTTP_ROUTE=false

DD_TRACE_SYMFONY_HTTP_ROUTE=false incorrectly fully disabled Symfony
request handling instrumentation.

Properly scoped it to its original intent: the extraction of the Symfony
route path for meta tag http.route.

Author: cataphract

appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/Symfony62Tests.groovy

@@ -125,14 +125,17 @@ class Symfony62Tests {
                    service apache2 restart''')
             assert res.exitCode == 0
 
+            // path params are always pushed to AppSec regardless of DD_TRACE_SYMFONY_HTTP_ROUTE,
+            // so the WAF still blocks based on the path param key 'param01'
             HttpRequest req = container.buildReq('/dynamic-path/someValue').GET().build()
             def trace = container.traceFromRequest(req, ofString()) { HttpResponse<String> re ->
-                assert re.statusCode() == 200
-                assert re.body().contains('Hi someValue!')
+                assert re.statusCode() == 403
             }
 
             Span span = trace.first()
-            assert span.meta."http.route" != '/dynamic-path/{param01}'
+            assert span.meta."http.route" == null
+            assert span.meta."symfony.route.name" != null
+            assert span.resource == 'app_home_dynamic'
         } finally {
             def res = CONTAINER.execInContainer(
                     'bash', '-c',

src/DDTrace/Integrations/Symfony/SymfonyIntegration.php

@@ -527,50 +527,52 @@ static function() {
                     $rootSpan->meta[Tag::HTTP_ROUTE] = $path;
                 }
             };
+        } else {
+            $handle_http_route = static function() { /* noop */ };
+        }
 
-            \DDTrace\trace_method(
-                'Symfony\Component\HttpKernel\HttpKernel',
-                'handle',
-                static function(SpanData $span, $args, $response) use ($handle_http_route) {
-                    /** @var Request $request */
-                    list($request) = $args;
+        \DDTrace\trace_method(
+            'Symfony\Component\HttpKernel\HttpKernel',
+            'handle',
+            static function(SpanData $span, $args, $response) use ($handle_http_route) {
+                /** @var Request $request */
+                list($request) = $args;
 
-                    $span->name = 'symfony.kernel.handle';
-                    $span->service = \ddtrace_config_app_name(self::$frameworkPrefix);
-                    $span->type = Type::WEB_SERVLET;
-                    $span->meta[Tag::COMPONENT] = self::NAME;
+                $span->name = 'symfony.kernel.handle';
+                $span->service = \ddtrace_config_app_name(self::$frameworkPrefix);
+                $span->type = Type::WEB_SERVLET;
+                $span->meta[Tag::COMPONENT] = self::NAME;
 
-                    $rootSpan = \DDTrace\root_span();
-                    $rootSpan->meta[Tag::HTTP_METHOD] = $request->getMethod();
-                    $rootSpan->meta[Tag::COMPONENT] = self::$frameworkPrefix;
-                    $rootSpan->meta[Tag::SPAN_KIND] = 'server';
-                    self::addTraceAnalyticsIfEnabled($rootSpan);
+                $rootSpan = \DDTrace\root_span();
+                $rootSpan->meta[Tag::HTTP_METHOD] = $request->getMethod();
+                $rootSpan->meta[Tag::COMPONENT] = self::$frameworkPrefix;
+                $rootSpan->meta[Tag::SPAN_KIND] = 'server';
+                self::addTraceAnalyticsIfEnabled($rootSpan);
 
-                    if (!array_key_exists(Tag::HTTP_URL, $rootSpan->meta)) {
-                        $rootSpan->meta[Tag::HTTP_URL] = Normalizer::urlSanitize($request->getUri());
-                    }
-                    if (isset($response)) {
-                        $rootSpan->meta[Tag::HTTP_STATUS_CODE] = $response->getStatusCode();
-                    }
+                if (!array_key_exists(Tag::HTTP_URL, $rootSpan->meta)) {
+                    $rootSpan->meta[Tag::HTTP_URL] = Normalizer::urlSanitize($request->getUri());
+                }
+                if (isset($response)) {
+                    $rootSpan->meta[Tag::HTTP_STATUS_CODE] = $response->getStatusCode();
+                }
 
-                    $route_name = $request->get('_route');
-                    if ($route_name !== null) {
-                        if (dd_trace_env_config("DD_HTTP_SERVER_ROUTE_BASED_NAMING")) {
-                            $rootSpan->resource = $route_name;
-                        }
-                        $rootSpan->meta['symfony.route.name'] = $route_name;
-                        $handle_http_route($route_name, $request, $rootSpan);
+                $route_name = $request->get('_route');
+                if ($route_name !== null) {
+                    if (dd_trace_env_config("DD_HTTP_SERVER_ROUTE_BASED_NAMING")) {
+                        $rootSpan->resource = $route_name;
                     }
+                    $rootSpan->meta['symfony.route.name'] = $route_name;
+                    $handle_http_route($route_name, $request, $rootSpan);
+                }
 
-                    $parameters = $request->get('_route_params');
-                    if (!empty($parameters) &&
-                        is_array($parameters) &&
-                        function_exists('datadog\appsec\push_addresses')) {
-                        \datadog\appsec\push_addresses(["server.request.path_params" => $parameters]);
-                    }
+                $parameters = $request->get('_route_params');
+                if (!empty($parameters) &&
+                    is_array($parameters) &&
+                    function_exists('datadog\appsec\push_addresses')) {
+                    \datadog\appsec\push_addresses(["server.request.path_params" => $parameters]);
                 }
-            );
-        }
+            }
+        );
 
         /*
          * EventDispatcher v4.3 introduced an arg hack that mutates the arguments.