libddwaf 1.15.0.0.0-x86_64-linux → 1.18.0.0.1-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 680463b022230fdf677f2d0e9ac140ca487bb225b23f73c2bbf02219125eaf39
-  data.tar.gz: a00a6cdc1987bd1544626864f1ef371ed922a333e82982516e123702e1a20e60
+  metadata.gz: ef259ceefea0ae14550d17992796b271b7a27b21894fd4ed2dc3442202f35aa5
+  data.tar.gz: 5c54316bea2fadafd230d5539daa64b234b5341e4309c5045ebbfa9deb46a317
 SHA512:
-  metadata.gz: 2283e51cee5a5d2fcf760f4b2cca60db1278f216d236ea575c8a3ba2509c5000249e6f1056b0aae6d5c1b9af13023f29b26a7b2f88099d65ad30a5635800f31d
-  data.tar.gz: 4ffe31cade9cd4f555e7dadb04aa5a11ca3004b19e2e4249fc43df9d9c7c057ca1cf3c8274b6ca524c6bd37f19508f38ea836b4861b7fdeb252cbe29a1931880
+  metadata.gz: bd44f90381f700db4037fb1f8870b1c58be8b130f7b73a2e3c72083992fbe7ab55511dfd25c54dfbebc7686d9371c2fdffd0ef1e57f7f65e229bfcac6510bb10
+  data.tar.gz: 19bafde328e0122ddbb6db37746c0d983743be8135345ab2bbd4c0c82843632a1c52599ece27c90d55022e85ed5fca5f81b256cd049effe9bc23c6495066c275

data/CHANGELOG.md

@@ -1,8 +1,14 @@
+# 2025-02-20 v.1.18.0.0.1
+
+- Fixed memory-leak in `Datadog::AppSec::WAF::Context#run` when non-empty ephemeral data passed
+
 # 2024-10-29 v.1.15.0.0.0
+
 - Update to libddwaf 1.15.0
 - Changed `Datadog::AppSec::WAF::Context#run` interface to accommodate ephemeral data ([Breaking change](https://github.com/DataDog/libddwaf/blob/master/CHANGELOG.md#v1150-unstable))
 
 # 2023-09-11 v.1.14.0.0.0
+
 - Update to libddwaf 1.14.0
 - Add support for `Float` and `Nil` scalar values when converting from ruby to WAF Object and vice versa.
 

data/lib/datadog/appsec/waf/context.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module WAF
+      # Ruby representation of the ddwaf_context in libddwaf
+      # See https://github.com/DataDog/libddwaf/blob/10e3a1dfc7bc9bb8ab11a09a9f8b6b339eaf3271/BINDING_IMPL_NOTES.md?plain=1#L125-L158
+      class Context
+        RESULT_CODE = {
+          ddwaf_ok: :ok,
+          ddwaf_match: :match,
+          ddwaf_err_internal: :err_internal,
+          ddwaf_err_invalid_object: :err_invalid_object,
+          ddwaf_err_invalid_argument: :err_invalid_argument
+        }.freeze
+
+        attr_reader :context_obj
+
+        def initialize(handle)
+          handle_obj = handle.handle_obj
+          retain(handle)
+
+          @context_obj = LibDDWAF.ddwaf_context_init(handle_obj)
+          raise LibDDWAF::Error, 'Could not create context' if @context_obj.null?
+
+          validate!
+        end
+
+        def finalize
+          invalidate!
+
+          retained.each do |retained_obj|
+            next unless retained_obj.is_a?(LibDDWAF::Object)
+
+            LibDDWAF.ddwaf_object_free(retained_obj)
+          end
+
+          retained.clear
+          LibDDWAF.ddwaf_context_destroy(context_obj)
+        end
+
+        def run(persistent_data, ephemeral_data, timeout = LibDDWAF::DDWAF_RUN_TIMEOUT)
+          valid!
+
+          persistent_data_obj = Converter.ruby_to_object(
+            persistent_data,
+            max_container_size: LibDDWAF::DDWAF_MAX_CONTAINER_SIZE,
+            max_container_depth: LibDDWAF::DDWAF_MAX_CONTAINER_DEPTH,
+            max_string_length: LibDDWAF::DDWAF_MAX_STRING_LENGTH,
+            coerce: false
+          )
+          if persistent_data_obj.null?
+            raise LibDDWAF::Error, "Could not convert persistent data: #{persistent_data.inspect}"
+          end
+
+          # retain C objects in memory for subsequent calls to run
+          retain(persistent_data_obj)
+
+          ephemeral_data_obj = Converter.ruby_to_object(
+            ephemeral_data,
+            max_container_size: LibDDWAF::DDWAF_MAX_CONTAINER_SIZE,
+            max_container_depth: LibDDWAF::DDWAF_MAX_CONTAINER_DEPTH,
+            max_string_length: LibDDWAF::DDWAF_MAX_STRING_LENGTH,
+            coerce: false
+          )
+          if ephemeral_data_obj.null?
+            raise LibDDWAF::Error, "Could not convert ephemeral data: #{ephemeral_data.inspect}"
+          end
+
+          result_obj = LibDDWAF::Result.new
+          raise LibDDWAF::Error, 'Could not create result object' if result_obj.null?
+
+          code = LibDDWAF.ddwaf_run(@context_obj, persistent_data_obj, ephemeral_data_obj, result_obj, timeout)
+
+          result = Result.new(
+            RESULT_CODE[code],
+            Converter.object_to_ruby(result_obj[:events]),
+            result_obj[:total_runtime],
+            result_obj[:timeout],
+            Converter.object_to_ruby(result_obj[:actions]),
+            Converter.object_to_ruby(result_obj[:derivatives])
+          )
+
+          [RESULT_CODE[code], result]
+        ensure
+          LibDDWAF.ddwaf_result_free(result_obj) if result_obj
+          LibDDWAF.ddwaf_object_free(ephemeral_data_obj) if ephemeral_data_obj
+        end
+
+        private
+
+        # FIXME: Rename into something which reflect that it's impossible to run
+        #        libddwaf on finalized context (closed)
+        def validate!
+          @valid = true
+        end
+
+        def invalidate!
+          @valid = false
+        end
+
+        def valid?
+          @valid
+        end
+
+        def valid!
+          return if valid?
+
+          raise LibDDWAF::Error, "Attempt to use an invalid instance: #{inspect}"
+        end
+
+        def retained
+          @retained ||= []
+        end
+
+        def retain(object)
+          retained << object
+        end
+
+        def release(object)
+          retained.delete(object)
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/waf/converter.rb

@@ -0,0 +1,172 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module WAF
+      # Module responsible for Ruby-to-C and C-to-Ruby conversions
+      module Converter
+        module_function
+
+        # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+        def ruby_to_object(val, max_container_size: nil, max_container_depth: nil, max_string_length: nil, coerce: true)
+          case val
+          when Array
+            obj = LibDDWAF::Object.new
+            res = LibDDWAF.ddwaf_object_array(obj)
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val}"
+            end
+
+            max_index = max_container_size - 1 if max_container_size
+            val.each.with_index do |e, i| # rubocop:disable Style/MultilineIfModifier
+              member = Converter.ruby_to_object(e,
+                                                max_container_size: max_container_size,
+                                                max_container_depth: (max_container_depth - 1 if max_container_depth),
+                                                max_string_length: max_string_length,
+                                                coerce: coerce)
+              e_res = LibDDWAF.ddwaf_object_array_add(obj, member)
+              raise LibDDWAF::Error, "Could not add to array object: #{e.inspect}" unless e_res
+
+              break val if max_index && i >= max_index
+            end unless max_container_depth == 0
+
+            obj
+          when Hash
+            obj = LibDDWAF::Object.new
+            res = LibDDWAF.ddwaf_object_map(obj)
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val}"
+            end
+
+            max_index = max_container_size - 1 if max_container_size
+            val.each.with_index do |e, i| # rubocop:disable Style/MultilineIfModifier
+              # for Steep, which doesn't handle |(k, v), i|
+              k, v = e[0], e[1] # rubocop:disable Style/ParallelAssignment
+
+              k = k.to_s[0, max_string_length] if max_string_length
+              member = Converter.ruby_to_object(v,
+                                                max_container_size: max_container_size,
+                                                max_container_depth: (max_container_depth - 1 if max_container_depth),
+                                                max_string_length: max_string_length,
+                                                coerce: coerce)
+              kv_res = LibDDWAF.ddwaf_object_map_addl(obj, k.to_s, k.to_s.bytesize, member)
+              unless kv_res
+                raise LibDDWAF::Error, "Could not add to map object: #{k.inspect} => #{v.inspect}"
+              end
+
+              break val if max_index && i >= max_index
+            end unless max_container_depth == 0
+
+            obj
+          when String
+            obj = LibDDWAF::Object.new
+            encoded_val = val.to_s.encode('utf-8', invalid: :replace, undef: :replace)
+            val = encoded_val[0, max_string_length] if max_string_length
+            str = val.to_s
+            res = LibDDWAF.ddwaf_object_stringl(obj, str, str.bytesize)
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when Symbol
+            obj = LibDDWAF::Object.new
+            val = val.to_s[0, max_string_length] if max_string_length
+            str = val.to_s
+            res = LibDDWAF.ddwaf_object_stringl(obj, str, str.bytesize)
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when Integer
+            obj = LibDDWAF::Object.new
+            res = if coerce
+                    LibDDWAF.ddwaf_object_string(obj, val.to_s)
+                  elsif val < 0
+                    LibDDWAF.ddwaf_object_signed(obj, val)
+                  else
+                    LibDDWAF.ddwaf_object_unsigned(obj, val)
+                  end
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when Float
+            obj = LibDDWAF::Object.new
+            res = if coerce
+                    LibDDWAF.ddwaf_object_string(obj, val.to_s)
+                  else
+                    LibDDWAF.ddwaf_object_float(obj, val)
+                  end
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when TrueClass, FalseClass
+            obj = LibDDWAF::Object.new
+            res = if coerce
+                    LibDDWAF.ddwaf_object_string(obj, val.to_s)
+                  else
+                    LibDDWAF.ddwaf_object_bool(obj, val)
+                  end
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when NilClass
+            obj = LibDDWAF::Object.new
+            res = if coerce
+                    LibDDWAF.ddwaf_object_string(obj, '')
+                  else
+                    LibDDWAF.ddwaf_object_null(obj)
+                  end
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          else
+            Converter.ruby_to_object('')
+          end
+        end
+        # rubocop:enable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+
+        def object_to_ruby(obj)
+          case obj[:type]
+          when :ddwaf_obj_invalid, :ddwaf_obj_null
+            nil
+          when :ddwaf_obj_bool
+            obj[:valueUnion][:boolean]
+          when :ddwaf_obj_string
+            obj[:valueUnion][:stringValue].read_bytes(obj[:nbEntries])
+          when :ddwaf_obj_signed
+            obj[:valueUnion][:intValue]
+          when :ddwaf_obj_unsigned
+            obj[:valueUnion][:uintValue]
+          when :ddwaf_obj_float
+            obj[:valueUnion][:f64]
+          when :ddwaf_obj_array
+            (0...obj[:nbEntries]).each.with_object([]) do |i, a|
+              ptr = obj[:valueUnion][:array] + i * LibDDWAF::Object.size
+              e = Converter.object_to_ruby(LibDDWAF::Object.new(ptr))
+              a << e # steep:ignore
+            end
+          when :ddwaf_obj_map
+            (0...obj[:nbEntries]).each.with_object({}) do |i, h|
+              ptr = obj[:valueUnion][:array] + i * Datadog::AppSec::WAF::LibDDWAF::Object.size
+              o = Datadog::AppSec::WAF::LibDDWAF::Object.new(ptr)
+              l = o[:parameterNameLength]
+              k = o[:parameterName].read_bytes(l)
+              v = Converter.object_to_ruby(LibDDWAF::Object.new(ptr))
+              h[k] = v # steep:ignore
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/waf/handle.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module WAF
+      # Ruby representation of the ddwaf_handle in libddwaf
+      # See https://github.com/DataDog/libddwaf/blob/10e3a1dfc7bc9bb8ab11a09a9f8b6b339eaf3271/BINDING_IMPL_NOTES.md?plain=1#L4-L19
+      class Handle
+        attr_reader :handle_obj, :diagnostics, :config
+
+        def initialize(rule, limits: {}, obfuscator: {})
+          rule_obj = Converter.ruby_to_object(rule)
+          if rule_obj.null? || rule_obj[:type] == :ddwaf_object_invalid
+            raise LibDDWAF::Error, "Could not convert object #{rule.inspect}"
+          end
+
+          config_obj = Datadog::AppSec::WAF::LibDDWAF::Config.new
+          if config_obj.null?
+            raise LibDDWAF::Error, 'Could not create config struct'
+          end
+
+          config_obj[:limits][:max_container_size]  = limits[:max_container_size]  || LibDDWAF::DEFAULT_MAX_CONTAINER_SIZE
+          config_obj[:limits][:max_container_depth] = limits[:max_container_depth] || LibDDWAF::DEFAULT_MAX_CONTAINER_DEPTH
+          config_obj[:limits][:max_string_length]   = limits[:max_string_length]   || LibDDWAF::DEFAULT_MAX_STRING_LENGTH
+          config_obj[:obfuscator][:key_regex]       = FFI::MemoryPointer.from_string(obfuscator[:key_regex])   if obfuscator[:key_regex]
+          config_obj[:obfuscator][:value_regex]     = FFI::MemoryPointer.from_string(obfuscator[:value_regex]) if obfuscator[:value_regex]
+          config_obj[:free_fn] = LibDDWAF::ObjectNoFree
+
+          @config = config_obj
+
+          diagnostics_obj = LibDDWAF::Object.new
+
+          @handle_obj = LibDDWAF.ddwaf_init(rule_obj, config_obj, diagnostics_obj)
+
+          @diagnostics = Converter.object_to_ruby(diagnostics_obj)
+
+          if @handle_obj.null?
+            raise LibDDWAF::Error.new('Could not create handle', diagnostics: @diagnostics)
+          end
+
+          validate!
+        ensure
+          LibDDWAF.ddwaf_object_free(diagnostics_obj) if diagnostics_obj
+          LibDDWAF.ddwaf_object_free(rule_obj) if rule_obj
+        end
+
+        def finalize
+          invalidate!
+
+          LibDDWAF.ddwaf_destroy(handle_obj)
+        end
+
+        def required_addresses
+          valid!
+
+          count = LibDDWAF::UInt32Ptr.new
+          list = LibDDWAF.ddwaf_known_addresses(handle_obj, count)
+
+          return [] if count == 0 # list is null
+
+          list.get_array_of_string(0, count[:value])
+        end
+
+        def merge(data)
+          data_obj = Converter.ruby_to_object(data, coerce: false)
+          diagnostics_obj = LibDDWAF::Object.new
+          new_handle = LibDDWAF.ddwaf_update(handle_obj, data_obj, diagnostics_obj)
+
+          return if new_handle.null?
+
+          diagnostics = Converter.object_to_ruby(diagnostics_obj)
+          new_from_handle(new_handle, diagnostics, config)
+        ensure
+          LibDDWAF.ddwaf_object_free(data_obj) if data_obj
+          LibDDWAF.ddwaf_object_free(diagnostics_obj) if diagnostics_obj
+        end
+
+        private
+
+        def new_from_handle(handle_object, diagnostics, config)
+          obj = Handle.allocate
+          obj.instance_variable_set(:@handle_obj, handle_object)
+          obj.instance_variable_set(:@diagnostics, diagnostics)
+          obj.instance_variable_set(:@config, config)
+          obj
+        end
+
+        def validate!
+          @valid = true
+        end
+
+        def invalidate!
+          @valid = false
+        end
+
+        def valid?
+          @valid
+        end
+
+        def valid!
+          return if valid?
+
+          raise LibDDWAF::Error, "Attempt to use an invalid instance: #{inspect}"
+        end
+      end
+    end
+  end
+end