libddwaf 1.18.0.0.0 → 1.18.0.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2cea26919b7498876af6b3517e509939b1dfc2bfac538dccf9d4f7d6ba02bb84
-  data.tar.gz: ec604e73b223f59abcc8d001a08f46ea7d130b2ecc9e4f672313b812e91e5016
+  metadata.gz: 4fad2f4be2e60e15913e130d28130af2f3d3d6d40aea05dba4a1d3d967cc4c12
+  data.tar.gz: aac3e2f4ae75f5a9387341997ab07861f1b8ee8d0ae63cc6ad97bd99b421b132
 SHA512:
-  metadata.gz: 706ca9b34d702e244d74b46f2ef5633de09f37b8b8cfa3591e4421417592a9034eeabde5358879a00b113acad38c04a2827418edf8b936f8af3302d8b902bd01
-  data.tar.gz: c4c0f294b8e4d9e173ed775d6b60ecf89ebeb97360dfd67bb6c8049582f5f9d3e5cd7bc3cf179ac319518bef11b38b1bfcb7e740e18281b14c22510ee763dfcc
+  metadata.gz: 83b667e79adbefbf6d52c3dd425ff2bd973d1a9e9a32c3ca817e08963c86ab9bbf3002e54d7a57fbbfc6e86a0e6254350d6b02e700e4af84852ce8a9d1936ab6
+  data.tar.gz: e242033561aa9e4dfd3d66c44170ea5595f27499ee6fe30bfbff66bd7af61edb5c2986494bbb4b986a7bf4b005da243b9df66ce7d82c78bc8b215cc03f86913c

data/.github/actions/docker-build-ruby/action.yml

@@ -1,17 +1,12 @@
 name: Build docker image
 description:
-  Github Actions does not support setting the platform for the container yet.
-  This action builds the image for the specified architecture and libc.
+  This action builds the image for the specified ruby version and libc.
 
 inputs:
   ruby-version:
     description: Ruby version
     required: true
 
-  arch:
-    description: Build architecture
-    required: true
-
   libc:
     description: Which libc is used
     required: true
@@ -29,11 +24,6 @@ outputs:
 runs:
   using: "composite"
   steps:
-    - name: Set up QEMU
-      uses: docker/setup-qemu-action@v3
-      with:
-        platforms: ${{ inputs.arch }}
-
     - name: Set up Docker Buildx
       uses: docker/setup-buildx-action@v3
 
@@ -48,10 +38,9 @@ runs:
         tags: libddwaf-rb-test:latest
         cache-from: type=gha
         cache-to: type=gha,mode=max
-        platforms: linux/${{ inputs.arch }}
 
     - name: Set run-cmd output
       id: set-run-cmd
       shell: bash
       run: |
-        echo "run-cmd=docker run --platform linux/${{ inputs.arch }} -v gems:/usr/local/bundle -v ${{ github.workspace }}:/libddwaf-rb -w /libddwaf-rb libddwaf-rb-test:latest" >> "$GITHUB_OUTPUT"
+        echo "run-cmd=docker run -v gems:/usr/local/bundle -v ${{ github.workspace }}:/libddwaf-rb -w /libddwaf-rb libddwaf-rb-test:latest" >> "$GITHUB_OUTPUT"

data/.github/workflows/package.yml

@@ -7,17 +7,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
         ruby: ["3.3"]
-        arch: [amd64, arm64]
         libc: [gnu]
         include:
-          - arch: amd64
+          - os: ubuntu-24.04
             platform: x86_64-linux
-          - arch: arm64
+          - os: ubuntu-24.04-arm
             platform: aarch64-linux
 
-    name: Test build without fetching libddwaf (Ruby ${{ matrix.ruby }}, ${{ matrix.arch }}, ${{ matrix.libc }})
+    name: Test build without fetching libddwaf (Ruby ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -29,7 +28,6 @@ jobs:
         uses: ./.github/actions/docker-build-ruby
         with:
           ruby-version: ${{ matrix.ruby }}
-          arch: ${{ matrix.arch }}
           libc: ${{ matrix.libc }}
 
       - name: Bundle install
@@ -52,14 +50,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
         ruby: ["3.3", "9.4"]
-        arch: [amd64, arm64]
         libc: [gnu, musl]
         include:
-          - arch: amd64
+          - os: ubuntu-24.04
             platform: x86_64-linux:llvm
-          - arch: arm64
+          - os: ubuntu-24.04-arm
             platform: aarch64-linux:llvm
           - ruby: 3.3
             jruby: false
@@ -69,7 +66,7 @@ jobs:
           - ruby: 9.4
             libc: musl
 
-    name: Test gem build (${{ matrix.jruby == true && 'Jruby' || 'Ruby'}} ${{ matrix.ruby }}, ${{ matrix.arch }}, ${{ matrix.libc }})
+    name: Test gem build (${{ matrix.jruby == true && 'Jruby' || 'Ruby'}} ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -81,7 +78,6 @@ jobs:
         uses: ./.github/actions/docker-build-ruby
         with:
           ruby-version: ${{ matrix.ruby }}
-          arch: ${{ matrix.arch }}
           libc: ${{ matrix.libc }}
           jruby: ${{ matrix.jruby }}
 

data/.github/workflows/test.yml

@@ -7,17 +7,16 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
-        ruby: ["2.5", "2.6", "2.7", "3.0", "3.1", "3.2", "3.3"]
-        arch: [amd64, arm64]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
+        ruby: ["2.5", "2.6", "2.7", "3.0", "3.1", "3.2", "3.3", "3.4"]
         libc: [gnu, musl]
         include:
-          - arch: amd64
+          - os: ubuntu-24.04
             platform: x86_64-linux
-          - arch: arm64
+          - os: ubuntu-24.04-arm
             platform: aarch64-linux
 
-    name: Test (Ruby ${{ matrix.ruby }}, ${{ matrix.arch }}, ${{ matrix.libc }})
+    name: Test (Ruby ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -29,7 +28,6 @@ jobs:
         uses: ./.github/actions/docker-build-ruby
         with:
           ruby-version: ${{ matrix.ruby }}
-          arch: ${{ matrix.arch }}
           libc: ${{ matrix.libc }}
 
       - name: Bundle install
@@ -44,20 +42,22 @@ jobs:
       - name: Run specs
         run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec
 
+      - name: Run stress tests
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec:stress_tests
+
   test-jruby-linux:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-24.04]
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
         jruby: ["9.3", "9.4"]
-        arch: [amd64, arm64]
         include:
-          - arch: amd64
+          - os: ubuntu-24.04
             platform: x86_64-linux
-          - arch: arm64
+          - os: ubuntu-24.04-arm
             platform: aarch64-linux
 
-    name: Test (Jruby ${{ matrix.jruby }}, ${{ matrix.arch }})
+    name: Test (Jruby ${{ matrix.jruby }}, ${{ matrix.os }})
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -70,7 +70,6 @@ jobs:
         with:
           ruby-version: ${{ matrix.jruby }}
           jruby: true
-          arch: ${{ matrix.arch }}
           libc: gnu
 
       - name: Bundle install
@@ -85,6 +84,9 @@ jobs:
       - name: Run specs
         run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec
 
+      - name: Run stress tests
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec:stress_tests
+
   test-darwin:
     strategy:
       fail-fast: false
@@ -116,3 +118,6 @@ jobs:
 
       - name: Run specs
         run: bundle exec rake spec
+
+      - name: Run stress tests
+        run: bundle exec rake spec:stress_tests

data/CHANGELOG.md

@@ -1,8 +1,14 @@
+# 2025-02-20 v.1.18.0.0.1
+
+- Fixed memory-leak in `Datadog::AppSec::WAF::Context#run` when non-empty ephemeral data passed
+
 # 2024-10-29 v.1.15.0.0.0
+
 - Update to libddwaf 1.15.0
 - Changed `Datadog::AppSec::WAF::Context#run` interface to accommodate ephemeral data ([Breaking change](https://github.com/DataDog/libddwaf/blob/master/CHANGELOG.md#v1150-unstable))
 
 # 2023-09-11 v.1.14.0.0.0
+
 - Update to libddwaf 1.14.0
 - Add support for `Float` and `Nil` scalar values when converting from ruby to WAF Object and vice versa.
 

data/lib/datadog/appsec/waf/context.rb

@@ -35,6 +35,7 @@ module Datadog
             LibDDWAF.ddwaf_object_free(retained_obj)
           end
 
+          retained.clear
           LibDDWAF.ddwaf_context_destroy(context_obj)
         end
 
@@ -83,10 +84,13 @@ module Datadog
           [RESULT_CODE[code], result]
         ensure
           LibDDWAF.ddwaf_result_free(result_obj) if result_obj
+          LibDDWAF.ddwaf_object_free(ephemeral_data_obj) if ephemeral_data_obj
         end
 
         private
 
+        # FIXME: Rename into something which reflect that it's impossible to run
+        #        libddwaf on finalized context (closed)
         def validate!
           @valid = true
         end

data/lib/datadog/appsec/waf/lib_ddwaf.rb

@@ -53,7 +53,7 @@ module Datadog
 
             cpu = case os_arch
                   when 'amd64' then 'x86_64'
-                  when 'aarch64' then 'aarch64'
+                  when 'aarch64' then local_os == 'darwin' ? 'arm64' : 'aarch64'
                   else raise Error, "unsupported JRuby os.arch: #{os_arch.inspect}"
                   end
 
@@ -95,7 +95,13 @@ module Datadog
         end
 
         def self.shared_lib_extname
-          Gem::Platform.local.os == 'darwin' ? '.dylib' : '.so'
+          if Gem::Platform.local.os == 'darwin'
+            '.dylib'
+          elsif Gem::Platform.local.os == 'java' && java.lang.System.get_property('os.name').match(/mac/i)
+            '.dylib'
+          else
+            '.so'
+          end
         end
 
         def self.shared_lib_path

data/lib/datadog/appsec/waf/version.rb

@@ -3,7 +3,7 @@ module Datadog
     module WAF
       module VERSION
         BASE_STRING = '1.18.0'
-        STRING = "#{BASE_STRING}.0.0"
+        STRING = "#{BASE_STRING}.0.1"
         MINIMUM_RUBY_VERSION = '2.5'
       end
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: libddwaf
 version: !ruby/object:Gem::Version
-  version: 1.18.0.0.0
+  version: 1.18.0.0.1
 platform: ruby
 authors:
 - Datadog, Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-11-12 00:00:00.000000000 Z
+date: 2025-02-20 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -93,7 +93,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: 2.0.0
 requirements: []
-rubygems_version: 3.5.17
+rubygems_version: 3.5.21
 signing_key:
 specification_version: 4
 summary: Datadog WAF