Merge pull request #2663 from coneill-enhance/patch-1

fix: prevent unintentional modification of arguments

lib/datadog/kit/appsec/events.rb

@@ -23,7 +23,7 @@ def self.track_login_success(trace, user:, **others)
           track(LOGIN_SUCCESS_EVENT, trace, **others)
 
           user_options = user.dup
-          user_id = user.delete(:id)
+          user_id = user_options.delete(:id)
 
           raise ArgumentError, 'missing required key: :user => { :id }' if user_id.nil?
 

spec/datadog/kit/appsec/events_spec.rb

@@ -32,6 +32,15 @@
       end
       expect(meta).to include('usr.id' => '42', 'appsec.events.users.login.success.foo' => 'bar')
     end
+
+    it 'maintains integrity of user argument' do
+      user_argument = { id: '42' }
+      user_argument_dup = user_argument.dup
+      trace_op.measure('root') do
+        described_class.track_login_success(trace_op, user: user_argument, foo: 'bar')
+      end
+      expect(user_argument).to eql(user_argument_dup)
+    end
   end
 
   describe '#track_login_failure' do