libddwaf 1.3.0.0.0 → 1.5.1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e8b78667a6dfc507d91c8336a177dd479ac79cb70bb4f1080d5ae6387205616f
-  data.tar.gz: f587ef6e280ccb7d82acc6075e1db5c45760edf724b2c19323872f5061ef8807
+  metadata.gz: 99c7eacaabd1402caa1dfe588cde91cb3b8999bfaf0ee4a9edf2fb640ce3497a
+  data.tar.gz: 75c8f2ce68fabb48b931ce3fcaad2b9b6c1309d35585e7940e3e94f87e80c805
 SHA512:
-  metadata.gz: 6294b519d6c4c0b79fabca6eae2d1495c312df079a5a54e6f30496715b722bd586fc281df70d04a0149c178984eb25ed563f98f7eedab207fc188d2ca88de889
-  data.tar.gz: f8b10e577377dfe4ad813c991aca6dbe4eacf1abe518f002ee52194bd9749605f8968fad5d88a5f6c8305a081681580f187b640257b51c103ede8e7ce49b7ada
+  metadata.gz: c49aaccb9d5ab4b8e9ab386233db336b2235649b2b03a430ad9623970313ad659f4b9e3e92ef93792d23550c48a28c0e0c53f99459372d9f7a22f4409e0c75a3
+  data.tar.gz: 607212389e499b3a79aeb12c88de8220184d668247e0508b1816adbfb2e3d2f1e06de875f25d0ef6e403cd127657240c75a052ad29ecddd63a419bc9d81225df

data/.github/workflows/lint.yml

@@ -0,0 +1,33 @@
+name: Lint
+on:
+  - push
+
+jobs:
+  style-check:
+    name: Style check
+    runs-on: ubuntu-20.04
+    container:
+      image: ruby:3.1
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Bundle
+        run: |
+          bundle install
+      - name: Run Rubocop
+        run: |
+          bundle exec rubocop -D
+  type-check:
+    name: Type check
+    runs-on: ubuntu-20.04
+    container:
+      image: ruby:3.1
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v2
+      - name: Bundle
+        run: |
+          bundle install
+      - name: Run Steep
+        run: |
+          bundle exec steep check

data/.github/workflows/package.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Bundle
         run: |
           bundle install
-      - name: Build package
+      - name: Build gem
         run: |
           bundle exec rake build
       - name: Upload gem
@@ -37,16 +37,24 @@ jobs:
         include:
           - os: ubuntu-20.04
             cpu: x86_64
-            platform: x86_64-linux
+            platform: x86_64-linux:llvm
+            artifact: x86_64-linux-llvm
           - os: ubuntu-20.04
             cpu: aarch64
-            platform: aarch64-linux
-          - os: macos-10.15
+            platform: aarch64-linux:llvm
+            artifact: aarch64-linux-llvm
+          - os: ubuntu-20.04
+            cpu: universal
+            platform: java
+            artifact: java
+          - os: macos-12
             cpu: x86_64
             platform: x86_64-darwin
-          - os: macos-10.15
+            artifact: x86_64-darwin
+          - os: macos-12
             cpu: arm64
             platform: arm64-darwin
+            artifact: arm64-darwin
     name: Build package (${{ matrix.platform }})
     runs-on: ${{ matrix.os }}
     steps:
@@ -58,19 +66,13 @@ jobs:
       - name: Bundle
         run: |
           bundle install
-      - name: Fetch binary library
-        run: |
-          bundle exec rake fetch[${{ matrix.platform }}]
-      - name: Extract binary library
-        run: |
-          bundle exec rake extract[${{ matrix.platform }}]
-      - name: Build package
+      - name: Build binary gem
         run: |
           bundle exec rake binary[${{ matrix.platform }}]
       - name: Upload gem
         uses: actions/upload-artifact@v2
         with:
-          name: libddwaf-${{ matrix.platform }}-${{ github.run_id }}-${{ github.sha }}
+          name: libddwaf-${{ matrix.artifact }}-${{ github.run_id }}-${{ github.sha }}
           path: pkg
   test-ruby:
     needs: package-ruby
@@ -121,28 +123,39 @@ jobs:
           - os: ubuntu-20.04
             cpu: x86_64
             platform: x86_64-linux
+            artifact: x86_64-linux-llvm
             image: ruby:2.6
             qemu: amd64
             libc: gnu
           - os: ubuntu-20.04
             cpu: aarch64
             platform: aarch64-linux
+            artifact: aarch64-linux-llvm
             image: ruby:2.6
             qemu: aarch64
             libc: gnu
           - os: ubuntu-20.04
             cpu: x86_64
             platform: x86_64-linux
+            artifact: x86_64-linux-llvm
             image: ruby:2.6-alpine
             qemu: amd64
             libc: musl
           - os: ubuntu-20.04
             cpu: aarch64
             platform: aarch64-linux
+            artifact: aarch64-linux-llvm
             image: ruby:2.6-alpine
             qemu: aarch64
             libc: musl
-    name: Test package (${{ matrix.platform }}-${{ matrix.libc }})
+          - os: ubuntu-20.04
+            cpu: x86_64
+            platform: java
+            artifact: java
+            image: jruby:9.3.0.0
+            qemu: amd64
+            libc: gnu
+    name: Test package (${{ matrix.platform }}, ${{ matrix.libc }}, ${{ matrix.cpu }})
     runs-on: ${{ matrix.os }}
     steps:
       - name: Enable ${{ matrix.qemu }} platform
@@ -160,7 +173,7 @@ jobs:
           echo "::set-output name=id::$(cat container_id)"
       - uses: actions/download-artifact@v2
         with:
-          name: libddwaf-${{ matrix.platform }}-${{ github.run_id }}-${{ github.sha }}
+          name: libddwaf-${{ matrix.artifact }}-${{ github.run_id }}-${{ github.sha }}
           path: pkg
       - name: List artifact files
         run: find .
@@ -172,17 +185,17 @@ jobs:
         run: docker exec -w "${PWD}" ${{ steps.container.outputs.id }} gem install --verbose pkg/*.gem
       - name: Run smoke test
         run: |
-          docker exec -w "${PWD}" ${{ steps.container.outputs.id }} ruby -r 'libddwaf' -e 'v = Datadog::AppSec::WAF::LibDDWAF::Version.new; Datadog::AppSec::WAF::LibDDWAF.ddwaf_get_version(v); p [v[:major], v[:minor], v[:patch]]'
+          docker exec -w "${PWD}" ${{ steps.container.outputs.id }} ruby -r 'libddwaf' -e 'p Datadog::AppSec::WAF::LibDDWAF.ddwaf_get_version'
   test-darwin:
     needs: package-binary
     strategy:
       fail-fast: false
       matrix:
         include:
-          - os: macos-10.15
+          - os: macos-12
             cpu: x86_64
             platform: x86_64-darwin
-        # - os: macos-11.0
+        # - os: macos-12
         #   cpu: arm64
         #   platform: arm64-darwin
     name: Test package (${{ matrix.platform }})
@@ -199,4 +212,4 @@ jobs:
         run: gem install --verbose pkg/*.gem
       - name: Run smoke test
         run: |
-          ruby -r 'libddwaf' -e 'v = Datadog::AppSec::WAF::LibDDWAF::Version.new; Datadog::AppSec::WAF::LibDDWAF.ddwaf_get_version(v); p [v[:major], v[:minor], v[:patch]]'
+          ruby -r 'libddwaf' -e 'p Datadog::AppSec::WAF::LibDDWAF.ddwaf_get_version'

data/.github/workflows/test.yml

@@ -137,21 +137,21 @@ jobs:
         # TODO: jruby images have no sudo so apt-get can't get a lock
         # - os: ubuntu-20.04
         #   cpu: x86_64
-        #   platform: x86_64-linux
-        #   image: jruby:9.3
+        #   platform: x86_64-linux-gnu
+        #   image: jruby:9.3.0.0
         #   qemu: amd64
         #   libc: gnu
         # - os: ubuntu-20.04
         #   cpu: x86_64
-        #   platform: x86_64-linux
-        #   image: jruby:9.2
+        #   platform: x86_64-linux-gnu
+        #   image: jruby:9.2.8.0
         #   qemu: amd64
         #   libc: gnu
         # - os: ubuntu-20.04
         #   cpu: x86_64
-        #   platform: x86_64-linux
-        #   image: jruby:9.1
-        #   qemu: amd64
+        #   platform: aarch64-linux-gnu
+        #   image: jruby:9.3.4.0
+        #   qemu: arm64
         #   libc: gnu
     name: Test (${{ matrix.image }}, ${{ matrix.cpu }})
     runs-on: ${{ matrix.os }}
@@ -196,13 +196,10 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          - os: macos-10.15
-            cpu: x86_64
-            platform: x86_64-darwin
-          - os: macos-11.0
+          - os: macos-12
             cpu: x86_64
             platform: x86_64-darwin
-        # - os: macos-11.0
+        # - os: macos-12
         #   cpu: arm64
         #   platform: arm64-darwin
     name: Test (${{ matrix.os }} ${{ matrix.cpu }})

data/CHANGELOG.md

@@ -0,0 +1,79 @@
+# 2023-02-01 v1.5.1.0.1
+
+- Fix incorrect size in input string limit
+- Fix object freeing on `update_rule_data` and `toggle_rules`
+
+# 2022-10-04 v1.5.1.0.0
+
+- Update to libddwaf 1.5.1
+- Add live rule data update API
+- Add live rule toggle API
+- Add libddwaf boolean type support
+- Add Ruby to libddwaf object conversion limits
+- Add Ruby to libddwaf object converter optional coercion of scalars to string
+- Add static type checking via RBS+Steep
+- Change version to return a string
+- Change free function to be passed as config instead of context init argument
+- Change result to include action list
+- Change return code from action to status
+- Change handle and context freeing model from GC-based to explicit
+- Fix double-free upon finalization of retained C objects
+- Fix context crash by retaining necessary C objects
+
+# 2022-05-20 v1.3.0.2.0
+
+- Fix multibyte string handling
+- Support JRuby
+
+# 2022-04-29 v1.3.0.1.0
+
+Promotion of v1.3.0.1.0.beta1 to stable
+
+# 2022-04-25 v1.3.0.1.0.beta1
+
+- Add obfuscator configuration
+- Add nested object limit configuration
+- Add report ruleset information
+
+# 2022-04-29 v1.3.0.0.0
+
+- Promote v1.3.0.0.0.beta1 to stable
+
+# 2022-04-20 v1.3.0.0.0.beta1
+
+- Update to libddwaf 1.3.0
+
+# 2022-03-18 v1.2.1.0.0.beta1
+
+- Update to libddwaf 1.2.1
+- Fix incorrect types for a few binding functions
+
+# 2022-03-04 v1.0.14.2.1.beta1
+
+- Fix incorrect return code
+- Fix passing nil in libddwaf object containers
+
+# 2022-02-07 v1.0.14.2.0.beta1
+
+- Change Datadog::Security to Datadog::AppSec
+
+# 2022-02-01 v1.0.14.1.0.beta2
+
+- Add support for Ruby 3.1
+
+# 2021-12-14 v1.0.14.1.0.beta1
+
+- Fix sequential runs on a single context by retaining C input data objects
+
+# 2021-11-24 v1.0.14.0.0.beta1
+
+- Update to libddwaf 1.0.14
+
+# 2021-11-24 v1.0.13.0.0.beta1
+
+- Add ruby platform fallback for unsupported platforms
+- Update to libddwaf 1.0.13
+
+# 2021-10-13 v1.0.12.0.0.beta1
+
+- Initial release

data/README.md

@@ -4,3 +4,121 @@
 
 For the libddwaf implementation, see this repository:
  - [``libddwaf``: libddwaf](https://github.com/DataDog/libddwaf.git)
+
+
+
+## Rake tasks
+
+### Outline
+
+A typical workflow is as follows:
+
+```
+rake fetch    # fetch prebuilt libddwaf binaries tarball in vendor/libddwaf
+rake extract  # extract downloaded tarball in vendor/libddwaf
+rake spec     # run rspec
+rake binary   # build the gem
+```
+
+Note that each depends on the previous one, but `fetch` and `extract` are lazy, which proves useful to produce manual builds.
+
+### Platform selection
+
+By default the above will automatically use the local Ruby platform.
+
+Since libddwaf binary builds are available upstream, it's possible to build gems for any platform on any other platform. To that end `fetch`, `extract`, and `binary` can take an argument to specify the Ruby platform for which these operations should apply:
+
+```
+rake fetch[x86_64-linux-musl]
+rake extract[x86_64-linux-musl]
+rake binary[x86_64-linux-musl]
+```
+
+Of course you can't force the platform for `rspec` since that requires running code; see the Docker section below for ways to achieve that.
+
+Note that zsh gives special meaning to brackets, therefore you may need to quote the argument:
+
+```
+rake 'fetch[x86_64-linux-musl]'
+```
+
+Available platforms are:
+
+```
+x86_64-linux-musl   # Alpine build: targets musl-based Linux
+x86_64-linux-gnu    # Debian build: targets glibc-based Linux
+x86_64-linux        # Portable build: targets multiple linux libc
+x86_64-darwin       # Darwin build: targets macOS
+aarch64-linux-musl  # Same as above, for ARMv8
+aarch64-linux-gnu   # Same as above, for ARMv8
+aarch64-linux       # Same as above, for ARMv8
+arm64-darwin        # Same as above, for Apple Silicon
+java                # JRuby build, universal
+```
+
+Note: since it is not (yet) possible to package gems for the `java` Ruby platform any other way than `java`, it has to package all the native architectures.
+
+In addition, options can be specified for the portable build:
+
+```
+rake binary[x86_64-linux:gnu+musl]  # Combined build: combine musl and glibc builds, selecting one at runtime
+rake binary[x86_64-linux:llvm]      # Hybrid build: linked to llvm static libs and built against a musl sysroot
+```
+
+See upstream libddwaf for details about the [hybrid portable build](https://github.com/DataDog/libddwaf/blob/master/docker/libddwaf/README.md).
+
+## Testing with Docker
+
+Unless using Docker for Mac, remember to enable foreign CPU emulation via QEMU:
+
+```
+# aarch64 on x86_64 hardware
+docker run --privileged --rm tonistiigi/binfmt --install arm64
+# x86_64 on aarch64 hardware
+docker run --privileged --rm tonistiigi/binfmt --install amd64
+```
+
+Then you can substitute e.g `--platform linux/x86_64` with `--platform linux/aarch64` below.
+
+### GNU (Debian)
+
+```
+# this is too old for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.1 sh -c 'rm -fv Gemfile.lock && gem install bundler -v "~> 1.17" && bundle install && bundle exec rake spec'
+# these are fine for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.2 sh -c 'rm -fv Gemfile.lock && gem install bundler -v "~> 1.17" && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.3 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.4 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.5 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.6 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.7 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.0 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.1 sh -c 'rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+```
+
+### musl (Alpine)
+
+```
+# these are too old for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.1-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler -v "~> 1.17" && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.2-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler -v "~> 1.17" && bundle install && bundle exec rake spec'
+# these are fine for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.3-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.4-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.5-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.6-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:2.7-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.0-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.1-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" ruby:3.1-alpine sh -c 'apk update && apk add build-base git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+```
+
+### JRuby
+
+```
+# these are too old for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" jruby:9.2.8.0 sh -c 'apt-get update && apt-get install -y build-essential git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" jruby:9.3.0.0 sh -c 'apt-get update && apt-get install -y build-essential git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+# this is fine for aarch64
+docker run --rm -it --platform linux/x86_64 -v "${PWD}":"${PWD}" -w "${PWD}" jruby:9.3.4.0 sh -c 'apt-get update && apt-get install -y build-essential git && rm -fv Gemfile.lock && gem install bundler:2.2.22 && bundle install && bundle exec rake spec'
+```

data/Steepfile

@@ -0,0 +1,22 @@
+# D = Steep::Diagnostic
+
+target :lib do
+  signature "sig"
+
+  check "lib"
+  library "rubygems"
+  library "logger"
+  library "monitor" # needed by logger
+  library "json"
+
+  repo_path "vendor/rbs"
+  library "ffi"
+  library "jruby"
+  library "gem"
+
+#   # configure_code_diagnostics(D::Ruby.strict)       # `strict` diagnostics setting
+#   # configure_code_diagnostics(D::Ruby.lenient)      # `lenient` diagnostics setting
+#   # configure_code_diagnostics do |hash|             # You can setup everything yourself
+#   #   hash[D::Ruby::NoMethod] = :information
+#   # end
+end

data/lib/datadog/appsec/waf/version.rb

@@ -2,8 +2,8 @@ module Datadog
   module AppSec
     module WAF
       module VERSION
-        BASE_STRING = '1.3.0'
-        STRING = "#{BASE_STRING}.0.0"
+        BASE_STRING = '1.5.1'
+        STRING = "#{BASE_STRING}.0.1"
         MINIMUM_RUBY_VERSION = '2.1'
       end
     end