libddwaf 1.24.1.0.3-x86_64-linux → 1.24.1.2.0-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0ff271a51fe122fa5806e8a71a31d7b537d317920093c7bf1fb8c2e163de014
-  data.tar.gz: e1c7eea24f169c11a6960ada201e2584f8ead72253af1095e340c48c498f5f5e
+  metadata.gz: d892f66f76d045a95577522381ed1e44bc4131dbe178e022450ade4819a3fe4f
+  data.tar.gz: 3abfd65da9b22a2189c8ac749208c4e8624852f443c334fe3ba39cc16ba51731
 SHA512:
-  metadata.gz: 2ef4c314c0eb3c9cbecfccac36d1bbbc57762a6b28e2da80a9a0368c7a7e6a9d052fa4a2d82bf208a732da4d3581fab006e1762a78a67bd8dd3e029d0816d6c5
-  data.tar.gz: 8c7babbac0557f31944a781aeacc8109dc578f6569758f9d764fc2d77e2dd954b61c7524c05d6ad0553f08342d13d5c9ca679cca6ab5d7cfdf25d0c328c2c975
+  metadata.gz: 8f1d102f1e72b0f32973121bd6d415af19114d8936991ca678cc1db07925f7eff351d3fa1575655b3b491b633ab3390498fb49cf574dcd2f278f488bdb100515
+  data.tar.gz: e9e440ff07466240449683e7b68424bf4ea9d1c6ebf92350df70ebaae3192b7b2d7e856c00f08d777d9ca317059930ab959f2cb9f56e6d4f36f670e9e05d512c

data/CHANGELOG.md

@@ -1,4 +1,22 @@
-# Unreleased v1.23.0.0.0
+# Unreleased
+
+# 2025-09-02 v1.24.1.2.0
+
+## Added
+
+- Add `WAF::Result#input_truncated?` method that indicates that result is based on truncated input objects (see `LibDDWAF::Object#input_truncated?`)
+
+# 2025-08-15 v1.24.1.1.0
+
+## Added
+
+- Add `LibDDWAF::Object#input_truncated?` method that returns true if the input object was truncated during conversion to libddwaf object
+
+## Changed
+
+- Change `Handle#known_addresses` to cache the result
+
+# 2025-05-20 v1.24.1.0.0
 
 ## Added
 

data/lib/datadog/appsec/waf/context.rb

@@ -74,7 +74,7 @@ module Datadog
 
           code = LibDDWAF.ddwaf_run(@context_ptr, persistent_data_obj, ephemeral_data_obj, result_obj, timeout)
 
-          Result.new(
+          result = Result.new(
             RESULT_CODE[code],
             Converter.object_to_ruby(result_obj[:events]),
             result_obj[:total_runtime],
@@ -82,6 +82,12 @@ module Datadog
             Converter.object_to_ruby(result_obj[:actions]),
             Converter.object_to_ruby(result_obj[:derivatives])
           )
+
+          if persistent_data_obj.input_truncated? || ephemeral_data_obj.input_truncated?
+            result.mark_input_truncated!
+          end
+
+          result
         ensure
           LibDDWAF.ddwaf_result_free(result_obj) if result_obj
           LibDDWAF.ddwaf_object_free(ephemeral_data_obj) if ephemeral_data_obj

data/lib/datadog/appsec/waf/converter.rb

@@ -8,7 +8,7 @@ module Datadog
         module_function
 
         # standard:disable Metrics/MethodLength,Metrics/CyclomaticComplexity
-        def ruby_to_object(val, max_container_size: nil, max_container_depth: nil, max_string_length: nil, coerce: true)
+        def ruby_to_object(val, max_container_size: nil, max_container_depth: nil, max_string_length: nil, top_obj: nil, coerce: true)
           case val
           when Array
             obj = LibDDWAF::Object.new
@@ -16,19 +16,25 @@ module Datadog
             raise ConversionError, "Could not convert into object: #{val}" if res.null?
 
             max_index = max_container_size - 1 if max_container_size
-            unless max_container_depth == 0
+            if max_container_depth == 0
+              top_obj&.mark_as_input_truncated!
+            else
               val.each.with_index do |e, i|
                 member = Converter.ruby_to_object(
                   e,
                   max_container_size: max_container_size,
                   max_container_depth: (max_container_depth - 1 if max_container_depth),
                   max_string_length: max_string_length,
+                  top_obj: top_obj || obj,
                   coerce: coerce
                 )
                 e_res = LibDDWAF.ddwaf_object_array_add(obj, member)
                 raise ConversionError, "Could not add to array object: #{e.inspect}" unless e_res
 
-                break val if max_index && i >= max_index
+                if max_index && i >= max_index
+                  (top_obj || obj).mark_as_input_truncated!
+                  break val
+                end
               end
             end
 
@@ -39,24 +45,33 @@ module Datadog
             raise ConversionError, "Could not convert into object: #{val}" if res.null?
 
             max_index = max_container_size - 1 if max_container_size
-            unless max_container_depth == 0
+            if max_container_depth == 0
+              top_obj&.mark_as_input_truncated!
+            else
               val.each.with_index do |e, i|
                 # for Steep, which doesn't handle |(k, v), i|
                 k = e[0]
                 v = e[1]
 
-                k = k.to_s[0, max_string_length] if max_string_length
+                if max_string_length && k.length > max_string_length
+                  k = k.to_s[0, max_string_length]
+                  (top_obj || obj).mark_as_input_truncated!
+                end
                 member = Converter.ruby_to_object(
                   v,
                   max_container_size: max_container_size,
                   max_container_depth: (max_container_depth - 1 if max_container_depth),
                   max_string_length: max_string_length,
+                  top_obj: top_obj || obj,
                   coerce: coerce
                 )
                 kv_res = LibDDWAF.ddwaf_object_map_addl(obj, k.to_s, k.to_s.bytesize, member)
                 raise ConversionError, "Could not add to map object: #{k.inspect} => #{v.inspect}" unless kv_res
 
-                break val if max_index && i >= max_index
+                if max_index && i >= max_index
+                  (top_obj || obj).mark_as_input_truncated!
+                  break val
+                end
               end
             end
 
@@ -64,15 +79,21 @@ module Datadog
           when String
             obj = LibDDWAF::Object.new
             encoded_val = val.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace)
-            val = encoded_val[0, max_string_length] if max_string_length
-            str = val.to_s
+            if max_string_length && encoded_val.length > max_string_length
+              encoded_val = encoded_val[0, max_string_length]
+              (top_obj || obj).mark_as_input_truncated!
+            end
+            str = encoded_val.to_s
             res = LibDDWAF.ddwaf_object_stringl(obj, str, str.bytesize)
             raise ConversionError, "Could not convert into object: #{val.inspect}" if res.null?
 
             obj
           when Symbol
             obj = LibDDWAF::Object.new
-            val = val.to_s[0, max_string_length] if max_string_length
+            if max_string_length
+              val = val.to_s[0, max_string_length]
+              (top_obj || obj).mark_as_input_truncated!
+            end
             str = val.to_s
             res = LibDDWAF.ddwaf_object_stringl(obj, str, str.bytesize)
             raise ConversionError, "Could not convert into object: #{val.inspect}" if res.null?

data/lib/datadog/appsec/waf/handle.rb

@@ -37,6 +37,8 @@ module Datadog
         #
         # @return [Array<String>] the list of known addresses
         def known_addresses
+          return @known_addresses if defined?(@known_addresses)
+
           ensure_pointer_presence!
 
           count = LibDDWAF::UInt32Ptr.new
@@ -44,7 +46,7 @@ module Datadog
 
           return [] if count == 0 # list is null
 
-          list.get_array_of_string(0, count[:value])
+          @known_addresses = list.get_array_of_string(0, count[:value]).compact
         end
 
         private

data/lib/datadog/appsec/waf/lib_ddwaf.rb

@@ -136,6 +136,14 @@ module Datadog
             :valueUnion, ObjectValueUnion,
             :nbEntries, :uint64,
             :type, :ddwaf_obj_type
+
+          def input_truncated?
+            @input_truncated == true
+          end
+
+          def mark_as_input_truncated!
+            @input_truncated = true
+          end
         end
 
         typedef Object.by_ref, :ddwaf_object

data/lib/datadog/appsec/waf/result.rb

@@ -15,6 +15,15 @@ module Datadog
           @timeout = timeout
           @actions = actions
           @derivatives = derivatives
+          @input_truncated = false
+        end
+
+        def mark_input_truncated!
+          @input_truncated = true
+        end
+
+        def input_truncated?
+          @input_truncated
         end
 
         def to_h

data/lib/datadog/appsec/waf/version.rb

@@ -5,7 +5,7 @@ module Datadog
         BASE_STRING = "1.24.1"
         # NOTE: Every change to the `BASE_STRING` should be accompanied
         #       by a reset of the patch version in the `STRING` below.
-        STRING = "#{BASE_STRING}.0.3"
+        STRING = "#{BASE_STRING}.2.0"
         MINIMUM_RUBY_VERSION = "2.5"
       end
     end

data/lib/libddwaf.rb

@@ -1 +1,3 @@
+# frozen_string_literal: true
+
 require "datadog/appsec/waf"

data/sig/datadog/appsec/waf/converter.rbs

@@ -2,7 +2,7 @@ module Datadog
   module AppSec
     module WAF
       module Converter
-        def self.ruby_to_object: (top val, ?max_container_size: ::Integer?, ?max_container_depth: ::Integer?, ?max_string_length: ::Integer?, ?coerce: bool?) -> LibDDWAF::Object
+        def self.ruby_to_object: (top val, ?max_container_size: ::Integer?, ?max_container_depth: ::Integer?, ?max_string_length: ::Integer?, ?top_obj: LibDDWAF::Object?, ?coerce: bool?) -> LibDDWAF::Object
 
         def self.object_to_ruby: (LibDDWAF::Object obj) -> WAF::data
       end

data/sig/datadog/appsec/waf/handle.rbs

@@ -10,7 +10,7 @@ module Datadog
 
         def build_context: () -> Context
 
-        def known_addresses: () -> ::Array[::String?]
+        def known_addresses: () -> known_addresses
 
         private
 

data/sig/datadog/appsec/waf/lib_ddwaf.rbs

@@ -58,6 +58,9 @@ module Datadog
         end
 
         class Object < ::FFI::Struct[::FFI::AbstractMemory, untyped]
+          def input_truncated?: () -> bool
+
+          def mark_as_input_truncated!: () -> bool
         end
 
         # setters

data/sig/datadog/appsec/waf/result.rbs

@@ -14,6 +14,8 @@ module Datadog
 
         @derivatives: WAF::data
 
+        @input_truncated: bool
+
         attr_reader status: ::Symbol
 
         attr_reader events: WAF::data
@@ -27,6 +29,10 @@ module Datadog
         attr_reader derivatives: WAF::data
 
         def initialize: (::Symbol status, WAF::data events, ::Float total_runtime, bool timeout, WAF::data actions, WAF::data derivatives) -> void
+
+        def mark_input_truncated!: () -> bool
+
+        def input_truncated?: () -> bool
       end
     end
   end

data/sig/datadog/appsec/waf.rbs

@@ -2,6 +2,8 @@ module Datadog
   module AppSec
     module WAF
       type data = String | Symbol | Integer | Float | TrueClass | FalseClass | Array[data] | Hash[(String | Symbol | nil), data] | nil
+      type known_addresses = ::Array[::String]
+      type diagnostics = ::Hash[::String, untyped]
 
       def self.version: () -> ::String
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: libddwaf
 version: !ruby/object:Gem::Version
-  version: 1.24.1.0.3
+  version: 1.24.1.2.0
 platform: x86_64-linux
 authors:
 - Datadog, Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-07-23 00:00:00.000000000 Z
+date: 2025-09-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi