datadog 2.21.0 → 2.23.0

data/ext/libdatadog_api/library_config.c

@@ -11,7 +11,7 @@ static VALUE _native_configurator_get(VALUE self);
 static VALUE _native_configurator_with_local_path(DDTRACE_UNUSED VALUE _self, VALUE rb_configurator, VALUE path);
 static VALUE _native_configurator_with_fleet_path(DDTRACE_UNUSED VALUE _self, VALUE rb_configurator, VALUE path);
 
-static VALUE config_vec_class = Qnil;
+static VALUE config_logged_result_class = Qnil;
 
 // ddog_Configurator memory management
 static void configurator_free(void *configurator_ptr) {
@@ -29,29 +29,29 @@ static const rb_data_type_t configurator_typed_data = {
   .flags = RUBY_TYPED_FREE_IMMEDIATELY
 };
 
-// ddog_Vec_LibraryConfig memory management
-static void config_vec_free(void *config_vec_ptr) {
-  ddog_Vec_LibraryConfig *config_vec = (ddog_Vec_LibraryConfig *)config_vec_ptr;
+// ddog_LibraryConfigLoggedResult memory management
+static void config_logged_result_free(void *config_logged_result_ptr) {
+  ddog_LibraryConfigLoggedResult *config_logged_result = (ddog_LibraryConfigLoggedResult *)config_logged_result_ptr;
 
-  ddog_library_config_drop(*config_vec);
-  ruby_xfree(config_vec_ptr);
+  ddog_library_config_drop(*config_logged_result);
+  ruby_xfree(config_logged_result_ptr);
 }
 
-static const rb_data_type_t config_vec_typed_data = {
-  .wrap_struct_name = "Datadog::Core::Configuration::StableConfigVec",
+static const rb_data_type_t config_logged_result_typed_data = {
+  .wrap_struct_name = "Datadog::Core::Configuration::StableConfigLoggedResult",
   .function = {
-    .dfree = config_vec_free,
+    .dfree = config_logged_result_free,
     .dsize = NULL,
   },
   .flags = RUBY_TYPED_FREE_IMMEDIATELY
 };
 
 void library_config_init(VALUE core_module) {
-  rb_global_variable(&config_vec_class);
+  rb_global_variable(&config_logged_result_class);
   VALUE configuration_module = rb_define_module_under(core_module, "Configuration");
   VALUE stable_config_module = rb_define_module_under(configuration_module, "StableConfig");
   VALUE configurator_class = rb_define_class_under(stable_config_module, "Configurator", rb_cObject);
-  config_vec_class = rb_define_class_under(configuration_module, "StableConfigVec", rb_cObject);
+  config_logged_result_class = rb_define_class_under(configuration_module, "StableConfigLoggedResult", rb_cObject);
 
   rb_define_alloc_func(configurator_class, _native_configurator_new);
   rb_define_method(configurator_class, "get", _native_configurator_get, 0);
@@ -61,11 +61,12 @@ void library_config_init(VALUE core_module) {
   rb_define_singleton_method(testing_module, "with_local_path", _native_configurator_with_local_path, 2);
   rb_define_singleton_method(testing_module, "with_fleet_path", _native_configurator_with_fleet_path, 2);
 
-  rb_undef_alloc_func(config_vec_class); // It cannot be created from Ruby code and only serves as an intermediate object for the Ruby GC
+  rb_undef_alloc_func(config_logged_result_class); // It cannot be created from Ruby code and only serves as an intermediate object for the Ruby GC
 }
 
 static VALUE _native_configurator_new(VALUE klass) {
-  ddog_Configurator *configurator = ddog_library_configurator_new(false, DDOG_CHARSLICE_C("ruby"));
+  // We always collect debug logs, so if DD_TRACE_DEBUG is set by stable config, we'll be able to log them.
+  ddog_Configurator *configurator = ddog_library_configurator_new(true, DDOG_CHARSLICE_C("ruby"));
 
   ddog_library_configurator_with_detect_process_info(configurator);
 
@@ -98,10 +99,11 @@ static VALUE _native_configurator_get(VALUE self) {
   ddog_Configurator *configurator;
   TypedData_Get_Struct(self, ddog_Configurator, &configurator_typed_data, configurator);
 
-  ddog_Result_VecLibraryConfig configurator_result = ddog_library_configurator_get(configurator);
+  // We don't allocate memory here so if there is an error, we don't need to manage the memory
+  ddog_LibraryConfigLoggedResult before_error_result = ddog_library_configurator_get(configurator);
 
-  if (configurator_result.tag == DDOG_RESULT_VEC_LIBRARY_CONFIG_ERR_VEC_LIBRARY_CONFIG) {
-    ddog_Error err = configurator_result.err;
+  if (before_error_result.tag == DDOG_LIBRARY_CONFIG_LOGGED_RESULT_ERR) {
+    ddog_Error err = before_error_result.err;
     VALUE message = get_error_details_and_drop(&err);
     if (is_config_loaded()) {
       log_warning(message);
@@ -111,14 +113,20 @@ static VALUE _native_configurator_get(VALUE self) {
     return rb_hash_new();
   }
 
-  // Wrapping config_vec into a Ruby object enables the Ruby GC to manage its memory
-  // We need to allocate memory for config_vec because once it is out of scope, it will be freed (at the end of this function)
-  // So we cannot reference it with &config_vec
+  // Wrapping config_logged_result into a Ruby object enables the Ruby GC to manage its memory
+  // We need to allocate memory for config_logged_result because once it is out of scope, it will be freed (at the end of this function)
   // We are doing this in case one of the ruby API raises an exception before the end of this function,
   // so the allocated memory will still be freed
-  ddog_Vec_LibraryConfig *config_vec = ruby_xmalloc(sizeof(ddog_Vec_LibraryConfig));
-  *config_vec = configurator_result.ok;
-  VALUE config_vec_rb = TypedData_Wrap_Struct(config_vec_class, &config_vec_typed_data, config_vec);
+  ddog_LibraryConfigLoggedResult *configurator_logged_result = ruby_xcalloc(1, sizeof(ddog_LibraryConfigLoggedResult));
+  *configurator_logged_result = before_error_result;
+  VALUE config_logged_result_rb = TypedData_Wrap_Struct(config_logged_result_class, &config_logged_result_typed_data, configurator_logged_result);
+
+  VALUE logs = Qnil;
+  if (configurator_logged_result->ok.logs.length > 0) {
+    logs = rb_utf8_str_new_cstr(configurator_logged_result->ok.logs.ptr);
+  }
+
+  ddog_Vec_LibraryConfig config_vec = configurator_logged_result->ok.value;
 
   VALUE local_config_hash = rb_hash_new();
   VALUE fleet_config_hash = rb_hash_new();
@@ -127,8 +135,8 @@ static VALUE _native_configurator_get(VALUE self) {
   bool fleet_config_id_set = false;
   VALUE local_hash = rb_hash_new();
   VALUE fleet_hash = rb_hash_new();
-  for (uintptr_t i = 0; i < config_vec->len; i++) {
-    ddog_LibraryConfig config = config_vec->ptr[i];
+  for (uintptr_t i = 0; i < config_vec.len; i++) {
+    ddog_LibraryConfig config = config_vec.ptr[i];
     VALUE selected_hash;
     if (config.source == DDOG_LIBRARY_CONFIG_SOURCE_LOCAL_STABLE_CONFIG) {
       selected_hash = local_config_hash;
@@ -156,9 +164,10 @@ static VALUE _native_configurator_get(VALUE self) {
   rb_hash_aset(fleet_hash, ID2SYM(rb_intern("config")), fleet_config_hash);
 
   VALUE result = rb_hash_new();
+  rb_hash_aset(result, ID2SYM(rb_intern("logs")), logs);
   rb_hash_aset(result, ID2SYM(rb_intern("local")), local_hash);
   rb_hash_aset(result, ID2SYM(rb_intern("fleet")), fleet_hash);
 
-  RB_GC_GUARD(config_vec_rb);
+  RB_GC_GUARD(config_logged_result_rb);
   return result;
 }

data/ext/libdatadog_api/process_discovery.c

@@ -42,7 +42,6 @@ static VALUE _native_store_tracer_metadata(int argc, VALUE *argv, VALUE self) {
   rb_scan_args(argc, argv, "1:", &logger, &options);
   if (options == Qnil) options = rb_hash_new();
 
-  VALUE schema_version = rb_hash_fetch(options, ID2SYM(rb_intern("schema_version")));
   VALUE runtime_id = rb_hash_fetch(options, ID2SYM(rb_intern("runtime_id")));
   VALUE tracer_language = rb_hash_fetch(options, ID2SYM(rb_intern("tracer_language")));
   VALUE tracer_version = rb_hash_fetch(options, ID2SYM(rb_intern("tracer_version")));
@@ -50,8 +49,9 @@ static VALUE _native_store_tracer_metadata(int argc, VALUE *argv, VALUE self) {
   VALUE service_name = rb_hash_fetch(options, ID2SYM(rb_intern("service_name")));
   VALUE service_env = rb_hash_fetch(options, ID2SYM(rb_intern("service_env")));
   VALUE service_version = rb_hash_fetch(options, ID2SYM(rb_intern("service_version")));
+  VALUE process_tags = rb_hash_fetch(options, ID2SYM(rb_intern("process_tags")));
+  VALUE container_id = rb_hash_fetch(options, ID2SYM(rb_intern("container_id")));
 
-  ENFORCE_TYPE(schema_version, T_FIXNUM);
   ENFORCE_TYPE(runtime_id, T_STRING);
   ENFORCE_TYPE(tracer_language, T_STRING);
   ENFORCE_TYPE(tracer_version, T_STRING);
@@ -59,17 +59,23 @@ static VALUE _native_store_tracer_metadata(int argc, VALUE *argv, VALUE self) {
   ENFORCE_TYPE(service_name, T_STRING);
   ENFORCE_TYPE(service_env, T_STRING);
   ENFORCE_TYPE(service_version, T_STRING);
-
-  ddog_Result_TracerMemfdHandle result = ddog_store_tracer_metadata(
-    (uint8_t) NUM2UINT(schema_version),
-    char_slice_from_ruby_string(runtime_id),
-    char_slice_from_ruby_string(tracer_language),
-    char_slice_from_ruby_string(tracer_version),
-    char_slice_from_ruby_string(hostname),
-    char_slice_from_ruby_string(service_name),
-    char_slice_from_ruby_string(service_env),
-    char_slice_from_ruby_string(service_version)
-  );
+  ENFORCE_TYPE(process_tags, T_STRING);
+  ENFORCE_TYPE(container_id, T_STRING);
+
+  void* builder = ddog_tracer_metadata_new();
+
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_RUNTIME_ID, StringValueCStr(runtime_id));
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_TRACER_LANGUAGE, StringValueCStr(tracer_language));
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_TRACER_VERSION, StringValueCStr(tracer_version));
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_HOSTNAME, StringValueCStr(hostname));
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_SERVICE_NAME, StringValueCStr(service_name));
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_SERVICE_ENV, StringValueCStr(service_env));
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_SERVICE_VERSION, StringValueCStr(service_version));
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_PROCESS_TAGS, StringValueCStr(process_tags));
+  ddog_tracer_metadata_set(builder, DDOG_METADATA_KIND_CONTAINER_ID, StringValueCStr(container_id));
+
+  ddog_Result_TracerMemfdHandle result = ddog_tracer_metadata_store(builder);
+  ddog_tracer_metadata_free(builder);
 
   if (result.tag == DDOG_RESULT_TRACER_MEMFD_HANDLE_ERR_TRACER_MEMFD_HANDLE) {
     rb_funcall(logger, rb_intern("debug"), 1, rb_sprintf("Failed to store the tracer configuration in a memory file descriptor: %"PRIsVALUE, get_error_details_and_drop(&result.err)));

data/ext/libdatadog_extconf_helpers.rb

@@ -10,7 +10,7 @@ module Datadog
   module LibdatadogExtconfHelpers
     # Used to make sure the correct gem version gets loaded, as extconf.rb does not get run with "bundle exec" and thus
     # may see multiple libdatadog versions. See https://github.com/DataDog/dd-trace-rb/pull/2531 for the horror story.
-    LIBDATADOG_VERSION = '~> 18.1.0.1.0'
+    LIBDATADOG_VERSION = '~> 24.0.1.1.0'
 
     # Used as an workaround for a limitation with how dynamic linking works in environments where the datadog gem and
     # libdatadog are moved after the extension gets compiled.

data/lib/datadog/appsec/api_security/endpoint_collection/grape_route_serializer.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module APISecurity
+      module EndpointCollection
+        # This module serializes Grape routes.
+        module GrapeRouteSerializer
+          module_function
+
+          def serialize(route, path_prefix: '')
+            path = path_prefix + route.pattern.origin
+
+            {
+              type: "REST",
+              resource_name: "#{route.request_method} #{path}",
+              operation_name: "http.request",
+              method: route.request_method,
+              path: path
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/endpoint_collection/rails_collector.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require_relative 'rails_route_serializer'
+require_relative 'grape_route_serializer'
+require_relative 'sinatra_route_serializer'
+
+module Datadog
+  module AppSec
+    module APISecurity
+      module EndpointCollection
+        # This class works with a collection of rails routes
+        # and produces an Enumerator that yields serialized endpoints.
+        class RailsCollector
+          def initialize(routes)
+            @routes = routes
+          end
+
+          def to_enum
+            Enumerator.new do |yielder|
+              @routes.each do |route|
+                if route.dispatcher?
+                  yielder.yield RailsRouteSerializer.serialize(route)
+                elsif mounted_grape_app?(route.app.rack_app)
+                  route.app.rack_app.routes.each do |grape_route|
+                    yielder.yield GrapeRouteSerializer.serialize(grape_route, path_prefix: route.path.spec.to_s)
+                  end
+                elsif mounted_sinatra_app?(route.app.rack_app)
+                  route.app.rack_app.routes.each do |method, sinatra_routes|
+                    next if method == 'HEAD'
+
+                    sinatra_routes.each do |sinatra_route, _, _|
+                      yielder.yield SinatraRouteSerializer.serialize(
+                        sinatra_route, method: method, path_prefix: route.path.spec.to_s
+                      )
+                    end
+                  end
+                end
+              end
+            end
+          end
+
+          private
+
+          def mounted_grape_app?(rack_app)
+            return false unless defined?(::Grape::API)
+
+            rack_app.is_a?(Class) && rack_app < ::Grape::API
+          end
+
+          def mounted_sinatra_app?(rack_app)
+            return false unless defined?(::Sinatra::Base)
+
+            rack_app.is_a?(Class) && rack_app < ::Sinatra::Base
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/endpoint_collection/rails_route_serializer.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module APISecurity
+      module EndpointCollection
+        # This module serializes Rails Journey Router routes.
+        module RailsRouteSerializer
+          FORMAT_SUFFIX = "(.:format)"
+
+          module_function
+
+          def serialize(route)
+            method = route.verb.empty? ? "*" : route.verb
+            path = route.path.spec.to_s.delete_suffix(FORMAT_SUFFIX)
+
+            {
+              type: "REST",
+              resource_name: "#{method} #{path}",
+              operation_name: "http.request",
+              method: method,
+              path: path
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/endpoint_collection/sinatra_route_serializer.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module APISecurity
+      module EndpointCollection
+        # This module serializes Sinatra routes.
+        module SinatraRouteSerializer
+          module_function
+
+          def serialize(route, method:, path_prefix: '')
+            path = path_prefix + route.safe_string
+
+            {
+              type: "REST",
+              resource_name: "#{method} #{path}",
+              operation_name: "http.request",
+              method: method,
+              path: path
+            }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/endpoint_collection.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module APISecurity
+      module EndpointCollection
+      end
+    end
+  end
+end

data/lib/datadog/appsec/api_security/route_extractor.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require_relative '../../tracing/contrib/rack/route_inference'
+
 module Datadog
   module AppSec
     module APISecurity
@@ -8,7 +10,8 @@ module Datadog
         SINATRA_ROUTE_KEY = 'sinatra.route'
         SINATRA_ROUTE_SEPARATOR = ' '
         GRAPE_ROUTE_KEY = 'grape.routing_args'
-        RAILS_ROUTE_KEY = 'action_dispatch.route_uri_pattern'
+        RAILS_ROUTE_URI_PATTERN_KEY = 'action_dispatch.route_uri_pattern'
+        RAILS_ROUTE_KEY = 'action_dispatch.route' # Rails 8.1.1+
         RAILS_ROUTES_KEY = 'action_dispatch.routes'
         RAILS_PATH_PARAMS_KEY = 'action_dispatch.request.path_parameters'
         RAILS_FORMAT_SUFFIX = '(.:format)'
@@ -35,6 +38,9 @@ module Datadog
         #       Rails > 7.1 (fast path)
         #         uses `action_dispatch.route_uri_pattern` with a string like
         #         "/users/:id(.:format)"
+        #       Rails > 8.1.1 (fast path)
+        #         uses `action_dispatch.route` to store the ActionDispatch::Journey::Route
+        #         that matched when the request was routed
         #
         # WARNING: This method works only *after* the request has been routed.
         #
@@ -50,11 +56,18 @@ module Datadog
             pattern = request.env[SINATRA_ROUTE_KEY].split(SINATRA_ROUTE_SEPARATOR, 2)[1]
             "#{request.script_name}#{pattern}"
           elsif request.env.key?(RAILS_ROUTE_KEY)
-            request.env[RAILS_ROUTE_KEY].delete_suffix(RAILS_FORMAT_SUFFIX)
+            request.env[RAILS_ROUTE_KEY].path.spec.to_s.delete_suffix(RAILS_FORMAT_SUFFIX)
+          elsif request.env.key?(RAILS_ROUTE_URI_PATTERN_KEY)
+            request.env[RAILS_ROUTE_URI_PATTERN_KEY].delete_suffix(RAILS_FORMAT_SUFFIX)
           elsif request.env.key?(RAILS_ROUTES_KEY) && !request.env.fetch(RAILS_PATH_PARAMS_KEY, {}).empty?
-            # NOTE: Rails mutate HEAD request in order to understand that route is supported.
-            #       It will assing GET request method and run the route recognition.
-            request = request.env[RAILS_ROUTES_KEY].request_class.new(request.env) if request.head?
+            # NOTE: In Rails < 7.1 this `request` argument will be a Rack::Request,
+            #       it does not have all the methods that ActionDispatch::Request has.
+            #       Before trying to use the router to recognize the route, we need to
+            #       create a new ActionDispatch::Request from the request env
+            #
+            # NOTE: Rails mutates HEAD request by changing the method to GET
+            #       and uses it for route recognition to check if the route is defined
+            request = request.env[RAILS_ROUTES_KEY].request_class.new(request.env)
 
             pattern = request.env[RAILS_ROUTES_KEY].router
               .recognize(request) { |route, _| break route.path.spec.to_s }
@@ -66,8 +79,12 @@ module Datadog
             #       to generic request path
             (pattern || request.path).delete_suffix(RAILS_FORMAT_SUFFIX)
           else
-            request.path
+            Tracing::Contrib::Rack::RouteInference.read_or_infer(request.env)
           end
+        rescue => e
+          AppSec.telemetry&.report(e, description: 'AppSec: Could not extract route pattern')
+
+          nil
         end
       end
     end

data/lib/datadog/appsec/api_security/sampler.rb

@@ -1,9 +1,9 @@
 # frozen_string_literal: true
 
 require 'zlib'
-require_relative 'lru_cache'
 require_relative 'route_extractor'
 require_relative '../../core/utils/time'
+require_relative '../../core/utils/lru_cache'
 
 module Datadog
   module AppSec
@@ -37,20 +37,23 @@ module Datadog
         def initialize(sample_delay)
           raise ArgumentError, 'sample_delay must be an Integer' unless sample_delay.is_a?(Integer)
 
-          @cache = LRUCache.new(MAX_CACHE_SIZE)
+          @cache = Core::Utils::LRUCache.new(MAX_CACHE_SIZE)
           @sample_delay_seconds = sample_delay
         end
 
         def sample?(request, response)
           return true if @sample_delay_seconds.zero?
+          return false if response.status == 404
 
-          key = Zlib.crc32("#{request.request_method}#{RouteExtractor.route_pattern(request)}#{response.status}")
+          route_pattern = RouteExtractor.route_pattern(request).to_s
+
+          key = Zlib.crc32("#{request.request_method}#{route_pattern}#{response.status}")
           current_timestamp = Core::Utils::Time.now.to_i
           cached_timestamp = @cache[key] || 0
 
           return false if current_timestamp - cached_timestamp <= @sample_delay_seconds
 
-          @cache.store(key, current_timestamp)
+          @cache[key] = current_timestamp
           true
         end
       end

data/lib/datadog/appsec/assets/blocked.html

@@ -82,12 +82,20 @@
         footer p {
             font-size: 16px
         }
+
+        .security-response-id {
+            font-size:14px;
+            color:#999;
+            margin-top:20px;
+            font-family:monospace
+        }
     </style>
 </head>
 
 <body>
     <main>
         <p>Sorry, you cannot access this page. Please contact the customer service team.</p>
+        <p class="security-response-id">Security Response ID: [security_response_id]</p>
     </main>
     <footer>
         <p>Security provided by <a

data/lib/datadog/appsec/assets/blocked.json

@@ -1 +1 @@
-{"errors": [{"title": "You've been blocked", "detail": "Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}]}
+{"errors":[{"title":"You've been blocked","detail":"Sorry, you cannot access this page. Please contact the customer service team. Security provided by Datadog."}],"security_response_id":"[security_response_id]"}

data/lib/datadog/appsec/assets/blocked.text

@@ -1,5 +1,7 @@
-You've been blocked
+You've been blocked.
 
 Sorry, you cannot access this page. Please contact the customer service team.
 
+Security Response ID: [security_response_id]
+
 Security provided by Datadog.

data/lib/datadog/appsec/assets/waf_rules/README.md

@@ -2,51 +2,45 @@ AppSec WAF rules based on [appsec-event-rules](https://github.com/datadog/appsec
 
 ## How to update
 
-> [!WARNING]
-> This process is a temporary workaround to maintain compatibility with the existing code structure and will be changed.
+In order to update rules, download `recommended.json` and `strict.json` of the desired version from [appsec-event-rules](https://github.com/datadog/appsec-event-rules) (example: [v1.13.3](https://github.com/DataDog/appsec-event-rules/tree/1.13.3/build))
 
-1. Download `recommended.json` and `strict.json` of the desired version from [appsec-event-rules](https://github.com/datadog/appsec-event-rules) (example: [v1.13.3](https://github.com/DataDog/appsec-event-rules/tree/1.13.3/build))
-2. Run the script below inside `waf_rules` folder to extract scanners and processors into separate files
+You can store the following code as a `Rakefile` under `lib/datadog/appsec/assets/waf_rules`
 
-    ```ruby
-    require 'json'
+```ruby
+def download(filename)
+  build_path = 'repos/DataDog/appsec-event-rules/contents/build'
 
-    recommended_rules = JSON.parse(File.read(File.expand_path('recommended.json', __dir__)))
-    strict_rules = JSON.parse(File.read(File.expand_path('strict.json', __dir__)))
+  system("gh api #{build_path}/#{filename} --jq '.content' | base64 -d > #{filename}")
+end
 
-    recommended_processors = recommended_rules.delete('processors')
-    strict_processors = strict_rules.delete('processors')
+task default: :update
 
-    if recommended_processors.sort_by { |processor| processor['id'] } !=
-        strict_processors.sort_by { |processor| processor['id'] }
-      raise 'Processors are not the same, unable to extract them'
-    end
+task :verify_dependencies do
+  next if system('which gh 1>/dev/null')
 
-    puts 'Extracting processors...'
-    File.open(File.expand_path('processors.json', __dir__), 'wb') do |file|
-      file.write(JSON.pretty_generate(recommended_processors))
-    end
+  abort <<~MESSAGE
+    \033[0;33mNOTE: To successfully execute that task make sure you have
+          GitHub CLI installed and authenticated https://cli.github.com/\033[0m
+  MESSAGE
+end
 
-    recommended_scanners = recommended_rules.delete('scanners')
-    strict_scanners = strict_rules.delete('scanners')
+desc 'Update recommended.json and strict.json to the latest version'
+task update: :verify_dependencies do
+  download('strict.json')
+  download('recommended.json')
 
-    if recommended_scanners.sort_by { |processor| processor['id'] } !=
-        strict_scanners.sort_by { |processor| processor['id'] }
-      raise 'Scanners are not the same, unable to extract them'
-    end
+  puts "\033[0;32mSuccess!\033[0m"
+end
+```
 
-    puts 'Extracting scanners...'
-    File.open(File.expand_path('scanners.json', __dir__), 'wb') do |file|
-      file.write(JSON.pretty_generate(recommended_scanners))
-    end
+And run the following command
 
-    puts 'Updating rules...'
+> [!IMPORTANT]
+> To run that command you will need to install GitHub CLI tool and authenticate it
+> See: https://cli.github.com/ (or ddtool)
 
-    File.open(File.expand_path('recommended.json', __dir__), 'wb') do |file|
-      file.write(JSON.pretty_generate(recommended_rules))
-    end
 
-    File.open(File.expand_path('strict.json', __dir__), 'wb') do |file|
-      file.write(JSON.pretty_generate(strict_rules))
-    end
-    ```
+```console
+$ bundle exec rake update
+Success!
+```