libddwaf 1.22.0.0.4 → 1.24.1.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 17e1bfe908662855aac5a61cc6b5f9ef05bc44322d0dff18e891f40ccf684ccc
-  data.tar.gz: 73b554d3cd9557e0250ec4702ef4fb6ad642444e8895a35039727ff5fe87935b
+  metadata.gz: 10d8d57e5c46bce6df51fd1b551831c8d4421144837498ce916c093c0b255b8e
+  data.tar.gz: d8fd00d07b23de9ff1af3be34b0344f0a1404db5da66e219e312a75d8d191942
 SHA512:
-  metadata.gz: f5a20e693fed0549315aed276f4c1d38708ab72f87c0a96ecad46b24aad291259fc3d42950627f1304da5979233b72599b9066fae7202c1bc2a6a4868f3a3b6c
-  data.tar.gz: 887bf54e294f45916d93bb34bf20a0078d7f8b16af0618f270c570072e8d964f49dbe0122e733652c071ea0907b563e0a419c45359fb85add32b5b0f0fbd1c4a
+  metadata.gz: 20d4c8ae3986514d5bf69d830a75468973e3688e971fe03068cd3451d58ddb0bf3a9e0ad86303b04c7e42cbef85dc9bf1e61e23e3db77a57374d30422c54b9c2
+  data.tar.gz: bd3c2665b3b5ab606ad59dc48e4eac7cd8f5568c38141d3cee0cddcbb2ba5681186174bbe1804657c47441a204297a1313a86fb3cf25274e398b857732382c77

data/.github/ISSUE_TEMPLATE/bug.md

@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: File a bug report
+title: ''
+labels: bug
+assignees: ''
+
+---
+
+**Current behaviour**
+<!-- What is be happening. -->
+
+**Expected behaviour**
+<!-- What should be happening. -->
+
+**Steps to reproduce**
+<!--
+  How can we reproduce this issue in order to diagnose it?
+  Code snippets, log messages, screenshots and sample apps are encouraged!
+-->
+
+**How does `libddwaf` help you?**
+<!-- Optionally, tell us why and how you're using ddtrace, and what your overall experience with it is! -->
+
+**Environment**
+
+* **libddwaf version:**
+* **libddwaf gem platform:**
+* **Ruby version:**
+* **Ruby platform:**
+* **Operating system:**
+

data/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,17 @@
+**What does this PR do?**
+<!-- A brief description of the change being made with this pull request. -->
+
+**Motivation**
+<!-- What inspired you to submit this pull request? -->
+
+**Additional Notes**
+<!-- Anything else we should know when reviewing? -->
+
+**How to test the change?**
+<!--
+Describe here how the change can be validated.
+You are strongly encouraged to provide automated tests for this PR.
+If this change cannot be feasibly tested, please explain why,
+unless the change does not modify code (e.g. only modifies docs, comments).
+-->
+

data/.github/actions/docker-build-ruby/Dockerfile

@@ -0,0 +1,5 @@
+ARG RUBY_VERSION
+
+FROM ruby:${RUBY_VERSION:-2.5}
+
+RUN gem update --system 3.3.27

data/.github/actions/docker-build-ruby/Dockerfile.alpine

@@ -0,0 +1,7 @@
+ARG RUBY_VERSION
+
+FROM ruby:${RUBY_VERSION:-2.5}-alpine
+
+RUN apk add --no-cache build-base git
+
+RUN gem update --system 3.3.27

data/.github/actions/docker-build-ruby/Dockerfile.jruby

@@ -0,0 +1,6 @@
+ARG RUBY_VERSION
+
+FROM jruby:${RUBY_VERSION:-9.2}
+
+RUN apt-get update
+RUN apt-get install -y build-essential git

data/.github/actions/docker-build-ruby/action.yml

@@ -0,0 +1,46 @@
+name: Build docker image
+description:
+  This action builds the image for the specified ruby version and libc.
+
+inputs:
+  ruby-version:
+    description: Ruby version
+    required: true
+
+  libc:
+    description: Which libc is used
+    required: true
+
+  jruby:
+    description: Whether to use JRuby
+    required: false
+    default: "false"
+
+outputs:
+  run-cmd:
+    description: Command to run the container
+    value: ${{ steps.set-run-cmd.outputs.run-cmd }}
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v3
+
+    - name: Build image
+      uses: docker/build-push-action@v6
+      with:
+        file: .github/actions/docker-build-ruby/Dockerfile${{ inputs.libc == 'musl' && '.alpine' || '' }}${{ inputs.jruby == 'true' && '.jruby' || '' }}
+        build-args: |
+          "RUBY_VERSION=${{ inputs.ruby-version }}"
+        push: false
+        load: true
+        tags: libddwaf-rb-test:latest
+        cache-from: type=gha
+        cache-to: type=gha,mode=max
+
+    - name: Set run-cmd output
+      id: set-run-cmd
+      shell: bash
+      run: |
+        echo "run-cmd=docker run -v gems:/usr/local/bundle -v ${{ github.workspace }}:/libddwaf-rb -w /libddwaf-rb libddwaf-rb-test:latest" >> "$GITHUB_OUTPUT"

data/.github/workflows/lint.yml

@@ -0,0 +1,34 @@
+name: Lint
+on:
+  - push
+
+jobs:
+  style-check:
+    name: Style check
+    runs-on: ubuntu-24.04
+    container:
+      image: ruby:3.3
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Bundle
+        run: bundle install
+
+      - name: Run standardrb
+        run: standardrb
+
+  type-check:
+    name: Type check
+    runs-on: ubuntu-24.04
+    container:
+      image: ruby:3.3
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+
+      - name: Bundle
+        run: bundle install
+
+      - name: Run Steep
+        run: bundle exec rake steep:check

data/.github/workflows/package.yml

@@ -0,0 +1,130 @@
+name: Package
+on:
+  - push
+
+jobs:
+  test-rake-build:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
+        ruby: ["3.3"]
+        libc: [gnu]
+        include:
+          - os: ubuntu-24.04
+            platform: x86_64-linux
+          - os: ubuntu-24.04-arm
+            platform: aarch64-linux
+
+    name: Test build without fetching libddwaf (Ruby ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build docker image
+        id: build-image
+        uses: ./.github/actions/docker-build-ruby
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          libc: ${{ matrix.libc }}
+
+      - name: Bundle install
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle install
+
+      - name: Build gem
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake build
+
+      - name: List artifact files
+        run: find .
+        working-directory: pkg
+
+      - name: Install gem
+        run: ${{ steps.build-image.outputs.run-cmd }} gem install --verbose pkg/*.gem
+
+      - name: Run smoke test
+        run: ${{ steps.build-image.outputs.run-cmd }} ruby -e 'begin require "libddwaf"; rescue LoadError => e; puts e.message; else fail "loaded when it should not"; end'
+
+  test-rake-binary:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
+        ruby: ["3.3", "9.4"]
+        libc: [gnu, musl]
+        include:
+          - os: ubuntu-24.04
+            platform: x86_64-linux:llvm
+          - os: ubuntu-24.04-arm
+            platform: aarch64-linux:llvm
+          - ruby: 3.3
+            jruby: false
+          - ruby: 9.4
+            jruby: true
+        exclude:
+          - ruby: 9.4
+            libc: musl
+
+    name: Test gem build (${{ matrix.jruby == true && 'Jruby' || 'Ruby'}} ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build docker image
+        id: build-image
+        uses: ./.github/actions/docker-build-ruby
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          libc: ${{ matrix.libc }}
+          jruby: ${{ matrix.jruby }}
+
+      - name: Bundle install
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle install
+
+      - name: Build binary gem
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake binary[${{ matrix.platform }}]
+
+      - name: List artifact files
+        run: find .
+        working-directory: pkg
+
+      - name: Install gem
+        run: ${{ steps.build-image.outputs.run-cmd }} gem install --verbose pkg/*.gem
+
+      - name: Run smoke test
+        run: ${{ steps.build-image.outputs.run-cmd }} ruby -r 'libddwaf' -e 'p Datadog::AppSec::WAF::LibDDWAF.ddwaf_get_version'
+
+  test-rake-binary-on-darwin:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15, macos-15-large]
+        include:
+          - os: macos-15
+            platform: arm64-darwin
+          - os: macos-15-large
+            platform: x86_64-darwin
+
+    name: Test gem build (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Bundle
+        run: bundle install
+
+      - name: Build binary gem
+        run: bundle exec rake binary[${{ matrix.platform }}]
+
+      - name: Install gem
+        run: gem install --verbose pkg/*.gem
+
+      - name: Run smoke test
+        run: ruby -r 'libddwaf' -e 'p Datadog::AppSec::WAF::LibDDWAF.ddwaf_get_version'

data/.github/workflows/test-for-memory-leaks.yml

@@ -0,0 +1,15 @@
+name: Test for memory leaks
+on: [push]
+jobs:
+  test-memcheck:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: ruby/setup-ruby@f41e084df884422b269f4c01c3748a9df4431a75 # v1.236.0
+        with:
+          ruby-version: "3.4"
+          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+          bundler: latest
+          cache-version: v1 # bump this to invalidate cache
+      - run: sudo apt-get update && (sudo apt-get install -y valgrind || sleep 5 && sudo apt-get install -y valgrind --no-install-recommends --no-install-suggests) && valgrind --version
+      - run: bundle exec rake binary spec:memory_leaks:all

data/.github/workflows/test.yml

@@ -0,0 +1,123 @@
+name: Test
+on:
+  - push
+
+jobs:
+  test-cruby-linux:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
+        ruby: ["2.5", "2.6", "2.7", "3.0", "3.1", "3.2", "3.3", "3.4"]
+        libc: [gnu, musl]
+        include:
+          - os: ubuntu-24.04
+            platform: x86_64-linux
+          - os: ubuntu-24.04-arm
+            platform: aarch64-linux
+
+    name: Test (Ruby ${{ matrix.ruby }}, ${{ matrix.os }}, ${{ matrix.libc }})
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build docker image
+        id: build-image
+        uses: ./.github/actions/docker-build-ruby
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          libc: ${{ matrix.libc }}
+
+      - name: Bundle install
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle install
+
+      - name: Fetch binary library
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake fetch[${{ matrix.platform }}]
+
+      - name: Extract binary library
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake extract[${{ matrix.platform }}]
+
+      - name: Run specs
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec
+
+      - name: Run stress tests
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec:stress_tests
+
+  test-jruby-linux:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-24.04, ubuntu-24.04-arm]
+        jruby: ["9.3", "9.4"]
+        include:
+          - os: ubuntu-24.04
+            platform: x86_64-linux
+          - os: ubuntu-24.04-arm
+            platform: aarch64-linux
+
+    name: Test (Jruby ${{ matrix.jruby }}, ${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build docker image
+        id: build-image
+        uses: ./.github/actions/docker-build-ruby
+        with:
+          ruby-version: ${{ matrix.jruby }}
+          jruby: true
+          libc: gnu
+
+      - name: Bundle install
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle install
+
+      - name: Fetch binary library
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake fetch[${{ matrix.platform }}]
+
+      - name: Extract binary library
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake extract[${{ matrix.platform }}]
+
+      - name: Run specs
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec
+
+      - name: Run stress tests
+        run: ${{ steps.build-image.outputs.run-cmd }} bundle exec rake spec:stress_tests
+
+  test-darwin:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15, macos-15-large]
+        include:
+          - os: macos-15
+            platform: arm64-darwin
+          - os: macos-15-large
+            platform: x86_64-darwin
+
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Bundle
+        run: bundle install
+
+      - name: Fetch binary library
+        run: bundle exec rake fetch[${{ matrix.platform }}]
+
+      - name: Extract binary library
+        run: bundle exec rake extract[${{ matrix.platform }}]
+
+      - name: Run specs
+        run: bundle exec rake spec
+
+      - name: Run stress tests
+        run: bundle exec rake spec:stress_tests

data/.gitignore

@@ -0,0 +1,10 @@
+/.envrc
+/vendor/bundle
+/vendor/libddwaf
+/pkg
+/tmp
+*.gem
+*.vim
+.ruby-version
+.github-token
+Gemfile.lock

data/.steepignore

@@ -0,0 +1,4 @@
+ffi/library.rbs:36:45 "Type `::FFI::DataConverter` is generic but used as a non generic type"
+ffi/struct.rbs:5:15 "Type application of `::FFI::Type::Mapped` doesn't satisfy the constraints"
+ffi/struct.rbs:23:29 "Type application of `::FFI::Type::Mapped` doesn't satisfy the constraints"
+ffi/auto_pointer.rbs:15:65 "Type application of `::FFI::AutoPointer::Releaser::_Proc` doesn't satisfy the constraints"

data/CHANGELOG.md

@@ -1,3 +1,24 @@
+# Unreleased v1.23.0.0.0
+
+## Added
+
+- Add `HandleBuilder` class for managing libddwaf configuration and building WAF handles
+- Add Error classes:
+  - `LibDDWAFError` for libddwaf errors
+  - `ConversionError` for conversion errors
+  - `InstanceFinalizedError` that is raised when attempting to run methods on finalized instances
+
+## Changed
+
+- Change `Handle` instantiation - now it should be done using `HandleBuilder#build_handle` method
+- Change `Context` instantiation - now is should be done using `Handle#build_context` method
+- Change configuration of Limits and obfuscation - it is now done when initializing `HandleBuilder`
+- Change `Context#run` to return a `Result` object instead of an tuple with code and result
+
+## Removed
+
+- Remove `WAF::Handle#merge` method - the configuration is now handled by `HandleBuilder`
+
 # 2025-02-20 v.1.18.0.0.1
 
 - Fixed memory-leak in `Datadog::AppSec::WAF::Context#run` when non-empty ephemeral data passed
@@ -12,7 +33,6 @@
 - Update to libddwaf 1.14.0
 - Add support for `Float` and `Nil` scalar values when converting from ruby to WAF Object and vice versa.
 
-
 # 2023-08-29 v.1.11.0.0.0
 
 - Update to libddwaf 1.11.0
@@ -21,7 +41,6 @@
 - Changed `Datadog::AppSec::WAF::Result#data` to `Datadog::AppSec::WAF::Result#events`. (Breaking change)
   The schema of the events variable can be found [here](https://github.com/DataDog/libddwaf/blob/master/schema/events.json)
 
-
 # 2023-08-28 v.1.10.0.0.0
 
 - Update to libddwaf 1.10.0

data/CONTRIBUTING.md

@@ -0,0 +1,84 @@
+# Contributing
+
+Community contributions to the Datadog bindings to libddwaf for Ruby are welcome! See below for some basic guidelines.
+
+## Want to request a new feature?
+
+Many great ideas for new features come from the community, and we'd be happy to consider yours!
+
+To share your request, you can [open a Github issue](https://github.com/DataDog/libddwaf-rb/issues/new) with the details about what you'd like to see. At a minimum, please provide:
+
+ - The goal of the new feature
+ - A description of how it might be used or behave
+ - Links to any important resources (e.g. Github repos, websites, screenshots, specifications, diagrams)
+
+Additionally, if you can, include:
+
+ - A description of how it could be accomplished
+ - Code snippets that might demonstrate its use or implementation
+ - Screenshots or mockups that visually demonstrate the feature
+ - Links to similar features that would serve as a good comparison
+ - (Any other details that would be useful for implementing this feature!)
+
+Feature requests will be reviewed and discussed.
+
+## Found a bug?
+
+For any urgent matters (such as outages) or issues concerning the Datadog service or UI, contact our support team via https://docs.datadoghq.com/help/ for direct, faster assistance.
+
+You may submit bug reports concerning the Datadog bindings to libddwaf for Ruby by [opening a Github issue](https://github.com/DataDog/libddwaf-rb/issues/new). At a minimum, please provide:
+
+ - A description of the problem
+ - Steps to reproduce
+ - Expected behavior
+ - Actual behavior
+ - Errors (with stack traces) or warnings received
+ - Any details you can share about your configuration including:
+    - Ruby version & platform
+    - `libddwaf` version
+    - Versions of any other relevant gems (or a `Gemfile.lock` if available)
+
+If at all possible, also provide:
+
+ - Logs from the application or other diagnostics
+ - Screenshots, links, or other visual aids that are publicly accessible
+ - Code sample or test that reproduces the problem
+ - An explanation of what causes the bug and/or how it can be fixed
+
+Reports that include rich detail are better, and ones with code that reproduce the bug are best. Bug requests will be triaged and reviewed by our collaborators.
+
+## Have a patch?
+
+We welcome code contributions to the library, which you can [submit as a pull request](https://github.com/DataDog/libddwaf-rb/pull/new/master). To create a pull request:
+
+1. **Fork the repository** from https://github.com/DataDog/libddwaf-rb
+2. **Make any changes** for your patch.
+3. **Write tests** that demonstrate how the feature works or how the bug is fixed.
+4. **Update any documentation** especially for new features.
+5. **Submit the pull request** from your fork back to the latest revision of the `master` branch on https://github.com/DataDog/libddwaf-rb.
+
+The pull request will be run through our CI pipeline, and a project member will review the changes with you. At a minimum, to be accepted and merged, pull requests must:
+
+ - Have a stated goal and detailed description of the changes made
+ - Include thorough test coverage and documentation, where applicable
+ - Pass all tests and code quality checks (linting/coverage) on CI
+ - Receive at least one approval from a project member with push permissions
+
+We also recommend that you share in your description:
+
+ - Any motivations or intent for the contribution
+ - Links to any issues/pull requests it might be related to
+ - Links to any webpages or other external resources that might be related to the change
+ - Screenshots, code samples, or other visual aids that demonstrate the changes or how they are implemented
+ - Benchmarks if the feature is anticipated to have performance implications
+ - Any limitations, constraints or risks that are important to consider
+
+Pull requests will be reviewed by our collaborators.
+
+For more information on common topics such as debugging locally, or how to write new integrations, check out [our development guide](https://github.com/DataDog/libddwaf-rb/blob/master/README.md#development). If at any point you have a question or need assistance with your pull request, feel free to mention a project member! We're always happy to help contributors with their pull requests.
+
+## Final word
+
+Many thanks to all of our contributors, and looking forward to seeing you on Github! :tada:
+
+ - Datadog Ruby Team

data/Dockerfile

@@ -0,0 +1,11 @@
+FROM ruby:3.4
+
+RUN apt-get update && apt-get install -y valgrind --no-install-recommends --no-install-suggests
+
+ADD . /libddwaf-rb
+
+WORKDIR /libddwaf-rb
+
+RUN bundle install
+
+CMD /bin/bash

data/Steepfile

@@ -0,0 +1,21 @@
+# D = Steep::Diagnostic
+
+target :lib do
+  signature "sig"
+
+  check "lib"
+  library "logger"
+  library "monitor" # needed by logger
+  library "json"
+
+  repo_path "vendor/rbs"
+  library "ffi"
+  library "jruby"
+  library "gem"
+
+  # configure_code_diagnostics(D::Ruby.strict)       # `strict` diagnostics setting
+  # configure_code_diagnostics(D::Ruby.lenient)      # `lenient` diagnostics setting
+  # configure_code_diagnostics do |hash|             # You can setup everything yourself
+  #   hash[D::Ruby::NoMethod] = :information
+  # end
+end