libddwaf 1.15.0.0.0 → 1.18.0.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5c43525cce0eabb3c9e5f98ca93309313d81dceeb0f905b07ec98039dcff622e
-  data.tar.gz: 61db3b159cbebdfa9b93c6d09c974538765ef046077586550b14cfebcd219033
+  metadata.gz: 4fad2f4be2e60e15913e130d28130af2f3d3d6d40aea05dba4a1d3d967cc4c12
+  data.tar.gz: aac3e2f4ae75f5a9387341997ab07861f1b8ee8d0ae63cc6ad97bd99b421b132
 SHA512:
-  metadata.gz: fbda3101720816799e5857a4efaaf7d97522f085b3be2fbd10451856db83624270893700fe41f0eb0af3a9c6758557c230417f7688441d30ba98c2503df999c7
-  data.tar.gz: 796c08137efa8662676e83552cb0b37f75bd7f80ef2b6f73875c2c77ba28f2c2ca1705b515661ea3e96fc72c2df9ef6598dc49af22951df41f90a2a133c175f4
+  metadata.gz: 83b667e79adbefbf6d52c3dd425ff2bd973d1a9e9a32c3ca817e08963c86ab9bbf3002e54d7a57fbbfc6e86a0e6254350d6b02e700e4af84852ce8a9d1936ab6
+  data.tar.gz: e242033561aa9e4dfd3d66c44170ea5595f27499ee6fe30bfbff66bd7af61edb5c2986494bbb4b986a7bf4b005da243b9df66ce7d82c78bc8b215cc03f86913c

data/.github/actions/docker-build-ruby/action.yml

@@ -1,17 +1,12 @@
 name: Build docker image
 description:
-  Github Actions does not support setting the platform for the container yet.
-  This action builds the image for the specified architecture and libc.
+  This action builds the image for the specified ruby version and libc.
 
 inputs:
   ruby-version:
     description: Ruby version
     required: true
 
-  arch:
-    description: Build architecture
-    required: true
-
   libc:
     description: Which libc is used
     required: true
@@ -29,11 +24,6 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-      with:
-        platforms: ${{ inputs.arch }}
-
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
@@ -48,10 +38,9 @@ runs:
         tags: libddwaf-rb-test:latest
         cache-from: type=gha
         cache-to: type=gha,mode=max
-        platforms: linux/${{ inputs.arch }}
 
     - name: Set run-cmd output
       id: set-run-cmd
       shell: bash
       run: |
-        echo "run-cmd=docker run --platform linux/${{ inputs.arch }} -v gems:/usr/local/bundle -v ${{ github.workspace }}:/libddwaf-rb -w /libddwaf-rb libddwaf-rb-test:latest" >> "$GITHUB_OUTPUT"
+        echo "run-cmd=docker run -v gems:/usr/local/bundle -v ${{ github.workspace }}:/libddwaf-rb -w /libddwaf-rb libddwaf-rb-test:latest" >> "$GITHUB_OUTPUT"

data/.github/workflows/package.yml

@@ -7,17 +7,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
         ruby: ["3.3"]
-        arch: [amd64, arm64]
         libc: [gnu]
         include:
-          - arch: amd64
+          - os: ubuntu-24.04
             platform: x86_64-linux
-          - arch: arm64
+          - os: ubuntu-24.04-arm
             platform: aarch64-linux
 
-    name: Test build without fetching libddwaf (Ruby ${{ matrix.ruby }}, ${{ matrix.arch }}, ${{ matrix.libc }})
+    name: Test build without fetching libddwaf (Ruby ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -29,7 +28,6 @@ jobs:
         uses: ./.github/actions/docker-build-ruby
         with:
           ruby-version: ${{ matrix.ruby }}
-          arch: ${{ matrix.arch }}
           libc: ${{ matrix.libc }}
 
       - name: Bundle install
@@ -52,14 +50,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
         ruby: ["3.3", "9.4"]
-        arch: [amd64, arm64]
         libc: [gnu, musl]
         include:
-          - arch: amd64
+          - os: ubuntu-24.04
             platform: x86_64-linux:llvm
-          - arch: arm64
+          - os: ubuntu-24.04-arm
             platform: aarch64-linux:llvm
           - ruby: 3.3
             jruby: false
@@ -69,7 +66,7 @@ jobs:
           - ruby: 9.4
             libc: musl
 
-    name: Test gem build (${{ matrix.jruby == true && 'Jruby' || 'Ruby'}} ${{ matrix.ruby }}, ${{ matrix.arch }}, ${{ matrix.libc }})
+    name: Test gem build (${{ matrix.jruby == true && 'Jruby' || 'Ruby'}} ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -81,7 +78,6 @@ jobs:
         uses: ./.github/actions/docker-build-ruby
         with:
           ruby-version: ${{ matrix.ruby }}
-          arch: ${{ matrix.arch }}
           libc: ${{ matrix.libc }}
           jruby: ${{ matrix.jruby }}
 

data/.github/workflows/test.yml

@@ -7,17 +7,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
-        ruby: ["2.5", "2.6", "2.7", "3.0", "3.1", "3.2", "3.3"]
-        arch: [amd64, arm64]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
+        ruby: ["2.5", "2.6", "2.7", "3.0", "3.1", "3.2", "3.3", "3.4"]
         libc: [gnu, musl]
         include:
-          - arch: amd64
+          - os: ubuntu-24.04
             platform: x86_64-linux
-          - arch: arm64
+          - os: ubuntu-24.04-arm
             platform: aarch64-linux
 
-    name: Test (Ruby ${{ matrix.ruby }}, ${{ matrix.arch }}, ${{ matrix.libc }})
+    name: Test (Ruby ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -29,7 +28,6 @@ jobs:
         uses: ./.github/actions/docker-build-ruby
         with:
           ruby-version: ${{ matrix.ruby }}
-          arch: ${{ matrix.arch }}
           libc: ${{ matrix.libc }}
 
       - name: Bundle install
@@ -44,20 +42,22 @@ jobs:
       - name: Run specs
         run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec
 
+      - name: Run stress tests
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec:stress_tests
+
   test-jruby-linux:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
         jruby: ["9.3", "9.4"]
-        arch: [amd64, arm64]
         include:
-          - arch: amd64
+          - os: ubuntu-24.04
             platform: x86_64-linux
-          - arch: arm64
+          - os: ubuntu-24.04-arm
             platform: aarch64-linux
 
-    name: Test (Jruby ${{ matrix.jruby }}, ${{ matrix.arch }})
+    name: Test (Jruby ${{ matrix.jruby }}, ${{ matrix.os }})
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -70,7 +70,6 @@ jobs:
         with:
           ruby-version: ${{ matrix.jruby }}
           jruby: true
-          arch: ${{ matrix.arch }}
           libc: gnu
 
       - name: Bundle install
@@ -85,6 +84,9 @@ jobs:
       - name: Run specs
         run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec
 
+      - name: Run stress tests
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec:stress_tests
+
   test-darwin:
     strategy:
       fail-fast: false
@@ -116,3 +118,6 @@ jobs:
 
       - name: Run specs
         run: bundle exec rake spec
+
+      - name: Run stress tests
+        run: bundle exec rake spec:stress_tests

data/CHANGELOG.md

@@ -1,8 +1,14 @@
+# 2025-02-20 v.1.18.0.0.1
+
+- Fixed memory-leak in `Datadog::AppSec::WAF::Context#run` when non-empty ephemeral data passed
+
 # 2024-10-29 v.1.15.0.0.0
+
 - Update to libddwaf 1.15.0
 - Changed `Datadog::AppSec::WAF::Context#run` interface to accommodate ephemeral data ([Breaking change](https://github.com/DataDog/libddwaf/blob/master/CHANGELOG.md#v1150-unstable))
 
 # 2023-09-11 v.1.14.0.0.0
+
 - Update to libddwaf 1.14.0
 - Add support for `Float` and `Nil` scalar values when converting from ruby to WAF Object and vice versa.
 

data/lib/datadog/appsec/waf/context.rb

@@ -0,0 +1,126 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module WAF
+      # Ruby representation of the ddwaf_context in libddwaf
+      # See https://github.com/DataDog/libddwaf/blob/10e3a1dfc7bc9bb8ab11a09a9f8b6b339eaf3271/BINDING_IMPL_NOTES.md?plain=1#L125-L158
+      class Context
+        RESULT_CODE = {
+          ddwaf_ok: :ok,
+          ddwaf_match: :match,
+          ddwaf_err_internal: :err_internal,
+          ddwaf_err_invalid_object: :err_invalid_object,
+          ddwaf_err_invalid_argument: :err_invalid_argument
+        }.freeze
+
+        attr_reader :context_obj
+
+        def initialize(handle)
+          handle_obj = handle.handle_obj
+          retain(handle)
+
+          @context_obj = LibDDWAF.ddwaf_context_init(handle_obj)
+          raise LibDDWAF::Error, 'Could not create context' if @context_obj.null?
+
+          validate!
+        end
+
+        def finalize
+          invalidate!
+
+          retained.each do |retained_obj|
+            next unless retained_obj.is_a?(LibDDWAF::Object)
+
+            LibDDWAF.ddwaf_object_free(retained_obj)
+          end
+
+          retained.clear
+          LibDDWAF.ddwaf_context_destroy(context_obj)
+        end
+
+        def run(persistent_data, ephemeral_data, timeout = LibDDWAF::DDWAF_RUN_TIMEOUT)
+          valid!
+
+          persistent_data_obj = Converter.ruby_to_object(
+            persistent_data,
+            max_container_size: LibDDWAF::DDWAF_MAX_CONTAINER_SIZE,
+            max_container_depth: LibDDWAF::DDWAF_MAX_CONTAINER_DEPTH,
+            max_string_length: LibDDWAF::DDWAF_MAX_STRING_LENGTH,
+            coerce: false
+          )
+          if persistent_data_obj.null?
+            raise LibDDWAF::Error, "Could not convert persistent data: #{persistent_data.inspect}"
+          end
+
+          # retain C objects in memory for subsequent calls to run
+          retain(persistent_data_obj)
+
+          ephemeral_data_obj = Converter.ruby_to_object(
+            ephemeral_data,
+            max_container_size: LibDDWAF::DDWAF_MAX_CONTAINER_SIZE,
+            max_container_depth: LibDDWAF::DDWAF_MAX_CONTAINER_DEPTH,
+            max_string_length: LibDDWAF::DDWAF_MAX_STRING_LENGTH,
+            coerce: false
+          )
+          if ephemeral_data_obj.null?
+            raise LibDDWAF::Error, "Could not convert ephemeral data: #{ephemeral_data.inspect}"
+          end
+
+          result_obj = LibDDWAF::Result.new
+          raise LibDDWAF::Error, 'Could not create result object' if result_obj.null?
+
+          code = LibDDWAF.ddwaf_run(@context_obj, persistent_data_obj, ephemeral_data_obj, result_obj, timeout)
+
+          result = Result.new(
+            RESULT_CODE[code],
+            Converter.object_to_ruby(result_obj[:events]),
+            result_obj[:total_runtime],
+            result_obj[:timeout],
+            Converter.object_to_ruby(result_obj[:actions]),
+            Converter.object_to_ruby(result_obj[:derivatives])
+          )
+
+          [RESULT_CODE[code], result]
+        ensure
+          LibDDWAF.ddwaf_result_free(result_obj) if result_obj
+          LibDDWAF.ddwaf_object_free(ephemeral_data_obj) if ephemeral_data_obj
+        end
+
+        private
+
+        # FIXME: Rename into something which reflect that it's impossible to run
+        #        libddwaf on finalized context (closed)
+        def validate!
+          @valid = true
+        end
+
+        def invalidate!
+          @valid = false
+        end
+
+        def valid?
+          @valid
+        end
+
+        def valid!
+          return if valid?
+
+          raise LibDDWAF::Error, "Attempt to use an invalid instance: #{inspect}"
+        end
+
+        def retained
+          @retained ||= []
+        end
+
+        def retain(object)
+          retained << object
+        end
+
+        def release(object)
+          retained.delete(object)
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/waf/converter.rb

@@ -0,0 +1,172 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module WAF
+      # Module responsible for Ruby-to-C and C-to-Ruby conversions
+      module Converter
+        module_function
+
+        # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+        def ruby_to_object(val, max_container_size: nil, max_container_depth: nil, max_string_length: nil, coerce: true)
+          case val
+          when Array
+            obj = LibDDWAF::Object.new
+            res = LibDDWAF.ddwaf_object_array(obj)
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val}"
+            end
+
+            max_index = max_container_size - 1 if max_container_size
+            val.each.with_index do |e, i| # rubocop:disable Style/MultilineIfModifier
+              member = Converter.ruby_to_object(e,
+                                                max_container_size: max_container_size,
+                                                max_container_depth: (max_container_depth - 1 if max_container_depth),
+                                                max_string_length: max_string_length,
+                                                coerce: coerce)
+              e_res = LibDDWAF.ddwaf_object_array_add(obj, member)
+              raise LibDDWAF::Error, "Could not add to array object: #{e.inspect}" unless e_res
+
+              break val if max_index && i >= max_index
+            end unless max_container_depth == 0
+
+            obj
+          when Hash
+            obj = LibDDWAF::Object.new
+            res = LibDDWAF.ddwaf_object_map(obj)
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val}"
+            end
+
+            max_index = max_container_size - 1 if max_container_size
+            val.each.with_index do |e, i| # rubocop:disable Style/MultilineIfModifier
+              # for Steep, which doesn't handle |(k, v), i|
+              k, v = e[0], e[1] # rubocop:disable Style/ParallelAssignment
+
+              k = k.to_s[0, max_string_length] if max_string_length
+              member = Converter.ruby_to_object(v,
+                                                max_container_size: max_container_size,
+                                                max_container_depth: (max_container_depth - 1 if max_container_depth),
+                                                max_string_length: max_string_length,
+                                                coerce: coerce)
+              kv_res = LibDDWAF.ddwaf_object_map_addl(obj, k.to_s, k.to_s.bytesize, member)
+              unless kv_res
+                raise LibDDWAF::Error, "Could not add to map object: #{k.inspect} => #{v.inspect}"
+              end
+
+              break val if max_index && i >= max_index
+            end unless max_container_depth == 0
+
+            obj
+          when String
+            obj = LibDDWAF::Object.new
+            encoded_val = val.to_s.encode('utf-8', invalid: :replace, undef: :replace)
+            val = encoded_val[0, max_string_length] if max_string_length
+            str = val.to_s
+            res = LibDDWAF.ddwaf_object_stringl(obj, str, str.bytesize)
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when Symbol
+            obj = LibDDWAF::Object.new
+            val = val.to_s[0, max_string_length] if max_string_length
+            str = val.to_s
+            res = LibDDWAF.ddwaf_object_stringl(obj, str, str.bytesize)
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when Integer
+            obj = LibDDWAF::Object.new
+            res = if coerce
+                    LibDDWAF.ddwaf_object_string(obj, val.to_s)
+                  elsif val < 0
+                    LibDDWAF.ddwaf_object_signed(obj, val)
+                  else
+                    LibDDWAF.ddwaf_object_unsigned(obj, val)
+                  end
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when Float
+            obj = LibDDWAF::Object.new
+            res = if coerce
+                    LibDDWAF.ddwaf_object_string(obj, val.to_s)
+                  else
+                    LibDDWAF.ddwaf_object_float(obj, val)
+                  end
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when TrueClass, FalseClass
+            obj = LibDDWAF::Object.new
+            res = if coerce
+                    LibDDWAF.ddwaf_object_string(obj, val.to_s)
+                  else
+                    LibDDWAF.ddwaf_object_bool(obj, val)
+                  end
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          when NilClass
+            obj = LibDDWAF::Object.new
+            res = if coerce
+                    LibDDWAF.ddwaf_object_string(obj, '')
+                  else
+                    LibDDWAF.ddwaf_object_null(obj)
+                  end
+            if res.null?
+              raise LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+            end
+
+            obj
+          else
+            Converter.ruby_to_object('')
+          end
+        end
+        # rubocop:enable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
+
+        def object_to_ruby(obj)
+          case obj[:type]
+          when :ddwaf_obj_invalid, :ddwaf_obj_null
+            nil
+          when :ddwaf_obj_bool
+            obj[:valueUnion][:boolean]
+          when :ddwaf_obj_string
+            obj[:valueUnion][:stringValue].read_bytes(obj[:nbEntries])
+          when :ddwaf_obj_signed
+            obj[:valueUnion][:intValue]
+          when :ddwaf_obj_unsigned
+            obj[:valueUnion][:uintValue]
+          when :ddwaf_obj_float
+            obj[:valueUnion][:f64]
+          when :ddwaf_obj_array
+            (0...obj[:nbEntries]).each.with_object([]) do |i, a|
+              ptr = obj[:valueUnion][:array] + i * LibDDWAF::Object.size
+              e = Converter.object_to_ruby(LibDDWAF::Object.new(ptr))
+              a << e # steep:ignore
+            end
+          when :ddwaf_obj_map
+            (0...obj[:nbEntries]).each.with_object({}) do |i, h|
+              ptr = obj[:valueUnion][:array] + i * Datadog::AppSec::WAF::LibDDWAF::Object.size
+              o = Datadog::AppSec::WAF::LibDDWAF::Object.new(ptr)
+              l = o[:parameterNameLength]
+              k = o[:parameterName].read_bytes(l)
+              v = Converter.object_to_ruby(LibDDWAF::Object.new(ptr))
+              h[k] = v # steep:ignore
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/datadog/appsec/waf/handle.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+module Datadog
+  module AppSec
+    module WAF
+      # Ruby representation of the ddwaf_handle in libddwaf
+      # See https://github.com/DataDog/libddwaf/blob/10e3a1dfc7bc9bb8ab11a09a9f8b6b339eaf3271/BINDING_IMPL_NOTES.md?plain=1#L4-L19
+      class Handle
+        attr_reader :handle_obj, :diagnostics, :config
+
+        def initialize(rule, limits: {}, obfuscator: {})
+          rule_obj = Converter.ruby_to_object(rule)
+          if rule_obj.null? || rule_obj[:type] == :ddwaf_object_invalid
+            raise LibDDWAF::Error, "Could not convert object #{rule.inspect}"
+          end
+
+          config_obj = Datadog::AppSec::WAF::LibDDWAF::Config.new
+          if config_obj.null?
+            raise LibDDWAF::Error, 'Could not create config struct'
+          end
+
+          config_obj[:limits][:max_container_size]  = limits[:max_container_size]  || LibDDWAF::DEFAULT_MAX_CONTAINER_SIZE
+          config_obj[:limits][:max_container_depth] = limits[:max_container_depth] || LibDDWAF::DEFAULT_MAX_CONTAINER_DEPTH
+          config_obj[:limits][:max_string_length]   = limits[:max_string_length]   || LibDDWAF::DEFAULT_MAX_STRING_LENGTH
+          config_obj[:obfuscator][:key_regex]       = FFI::MemoryPointer.from_string(obfuscator[:key_regex])   if obfuscator[:key_regex]
+          config_obj[:obfuscator][:value_regex]     = FFI::MemoryPointer.from_string(obfuscator[:value_regex]) if obfuscator[:value_regex]
+          config_obj[:free_fn] = LibDDWAF::ObjectNoFree
+
+          @config = config_obj
+
+          diagnostics_obj = LibDDWAF::Object.new
+
+          @handle_obj = LibDDWAF.ddwaf_init(rule_obj, config_obj, diagnostics_obj)
+
+          @diagnostics = Converter.object_to_ruby(diagnostics_obj)
+
+          if @handle_obj.null?
+            raise LibDDWAF::Error.new('Could not create handle', diagnostics: @diagnostics)
+          end
+
+          validate!
+        ensure
+          LibDDWAF.ddwaf_object_free(diagnostics_obj) if diagnostics_obj
+          LibDDWAF.ddwaf_object_free(rule_obj) if rule_obj
+        end
+
+        def finalize
+          invalidate!
+
+          LibDDWAF.ddwaf_destroy(handle_obj)
+        end
+
+        def required_addresses
+          valid!
+
+          count = LibDDWAF::UInt32Ptr.new
+          list = LibDDWAF.ddwaf_known_addresses(handle_obj, count)
+
+          return [] if count == 0 # list is null
+
+          list.get_array_of_string(0, count[:value])
+        end
+
+        def merge(data)
+          data_obj = Converter.ruby_to_object(data, coerce: false)
+          diagnostics_obj = LibDDWAF::Object.new
+          new_handle = LibDDWAF.ddwaf_update(handle_obj, data_obj, diagnostics_obj)
+
+          return if new_handle.null?
+
+          diagnostics = Converter.object_to_ruby(diagnostics_obj)
+          new_from_handle(new_handle, diagnostics, config)
+        ensure
+          LibDDWAF.ddwaf_object_free(data_obj) if data_obj
+          LibDDWAF.ddwaf_object_free(diagnostics_obj) if diagnostics_obj
+        end
+
+        private
+
+        def new_from_handle(handle_object, diagnostics, config)
+          obj = Handle.allocate
+          obj.instance_variable_set(:@handle_obj, handle_object)
+          obj.instance_variable_set(:@diagnostics, diagnostics)
+          obj.instance_variable_set(:@config, config)
+          obj
+        end
+
+        def validate!
+          @valid = true
+        end
+
+        def invalidate!
+          @valid = false
+        end
+
+        def valid?
+          @valid
+        end
+
+        def valid!
+          return if valid?
+
+          raise LibDDWAF::Error, "Attempt to use an invalid instance: #{inspect}"
+        end
+      end
+    end
+  end
+end