libddwaf 1.9.0.0.1 → 1.14.0.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bd38633600d82ecc9166a86fe314f6704d9a0e18662989811d6a4031bf313647
-  data.tar.gz: aed657ca737793808c6400966b4a05c405ef16734e53d73e0eade264fa8d360d
+  metadata.gz: '058fd59aa02f0d4be3c917d5a01d68c868cb41b77c903ee28d7b2106e5945f02'
+  data.tar.gz: 5dcaa2c486a0de0ca591ca06775d29184b3a8d9f6da539fed1cfa583ad86db9e
 SHA512:
-  metadata.gz: ac2c774e31e97902a60296084de6304cfd6f8528fadf1013b73c8cbed52a538e4b20082c3f2e6085f16e32ca27d71b767cb2a1e8c01207c07776d991210faddc
-  data.tar.gz: 99446731f04d3fff037549cba900ea96eb904b3fc8f617b57c7d6b6ff8543d0d0903b3722c52df383362d972b0204b467d54e30b2a0b4e57aac30cae8d5ae7e9
+  metadata.gz: 0107d27ac04857784db5e789374a5b370d1afb92ec80cb31ed1289e154665c6216c20cbf7b4dc6a557db3cd14e65ebab38e4d52ed503f14b3c87d91b1869c32b
+  data.tar.gz: 5e7fe5e71a1a570705b5b950010e57b17c8c4bd1976fd7e97f35cc07eb7d0ac193198d52937950f88d609f4722b89551c4f79fe07dba11aaf2ef98cdbe54db07

data/CHANGELOG.md

@@ -1,3 +1,32 @@
+# 2023-09-11 v.1.14.0.0.0
+- Update to libddwaf 1.14.0
+- Add support for `Float` and `Nil` scalar values when converting from ruby to WAF Object and vice versa.
+
+
+# 2023-08-29 v.1.11.0.0.0
+
+- Update to libddwaf 1.11.0
+- Changed `Datadog::AppSec::WAF::Handle#ruleset_info` to `Datadog::AppSec::WAF::Handle#diagnostics``. (Breaking change)
+  The schema of the diagnostics variable can be found [here](https://github.com/DataDog/libddwaf/blob/master/schema/diagnostics.json)
+- Changed `Datadog::AppSec::WAF::Result#data` to `Datadog::AppSec::WAF::Result#events`. (Breaking change)
+  The schema of the events variable can be found [here](https://github.com/DataDog/libddwaf/blob/master/schema/events.json)
+
+
+# 2023-08-28 v.1.10.0.0.0
+
+- Update to libddwaf 1.10.0
+
+# 2023-06-13 v.1.9.0.0.1
+
+- Handle invalid encoding
+- Ensure strings passed to libddwaf are not clipped inside a code point
+- Ensure strings passed to libddwaf are UTF-8
+
+# 2023-05-17 v1.9.0.0.0
+
+- Update to libddwaf 1.9.0
+- Support [`custom_rules`](https://github.com/DataDog/libddwaf/pull/154)
+
 # 2023-03-03 v1.8.2.0.0
 
 - Update to libddwaf 1.8.2

data/Steepfile

@@ -4,7 +4,6 @@ target :lib do
   signature "sig"
 
   check "lib"
-  library "rubygems"
   library "logger"
   library "monitor" # needed by logger
   library "json"

data/lib/datadog/appsec/waf/version.rb

@@ -2,8 +2,8 @@ module Datadog
   module AppSec
     module WAF
       module VERSION
-        BASE_STRING = '1.9.0'
-        STRING = "#{BASE_STRING}.0.1"
+        BASE_STRING = '1.14.0'
+        STRING = "#{BASE_STRING}.0.0"
         MINIMUM_RUBY_VERSION = '2.1'
       end
     end

data/lib/datadog/appsec/waf.rb

@@ -8,10 +8,10 @@ module Datadog
     module WAF
       module LibDDWAF
         class Error < StandardError
-          attr_reader :ruleset_info
+          attr_reader :diagnostics
 
-          def initialize(msg, ruleset_info: nil)
-            @ruleset_info = ruleset_info
+          def initialize(msg, diagnostics: nil)
+            @diagnostics = diagnostics
           end
         end
 
@@ -111,7 +111,10 @@ module Datadog
                               :ddwaf_obj_string,   1 << 2,
                               :ddwaf_obj_array,    1 << 3,
                               :ddwaf_obj_map,      1 << 4,
-                              :ddwaf_obj_bool,     1 << 5
+                              :ddwaf_obj_bool,     1 << 5,
+                              :ddwaf_obj_float,    1 << 6,
+                              :ddwaf_obj_null,     1 << 7
+
         typedef DDWAF_OBJ_TYPE, :ddwaf_obj_type
 
         typedef :pointer, :charptr
@@ -140,7 +143,8 @@ module Datadog
                  :uintValue,   :uint64,
                  :intValue,    :int64,
                  :array,       :pointer,
-                 :boolean,     :bool
+                 :boolean,     :bool,
+                 :f64,         :double
         end
 
         class Object < ::FFI::Struct
@@ -159,11 +163,13 @@ module Datadog
         attach_function :ddwaf_object_string, [:ddwaf_object, :string], :ddwaf_object
         attach_function :ddwaf_object_stringl, [:ddwaf_object, :charptr, :size_t], :ddwaf_object
         attach_function :ddwaf_object_stringl_nc, [:ddwaf_object, :charptr, :size_t], :ddwaf_object
+        attach_function :ddwaf_object_string_from_unsigned, [:ddwaf_object, :uint64], :ddwaf_object
+        attach_function :ddwaf_object_string_from_signed, [:ddwaf_object, :int64], :ddwaf_object
         attach_function :ddwaf_object_unsigned, [:ddwaf_object, :uint64], :ddwaf_object
         attach_function :ddwaf_object_signed, [:ddwaf_object, :int64], :ddwaf_object
-        attach_function :ddwaf_object_unsigned_force, [:ddwaf_object, :uint64], :ddwaf_object
-        attach_function :ddwaf_object_signed_force, [:ddwaf_object, :int64], :ddwaf_object
         attach_function :ddwaf_object_bool, [:ddwaf_object, :bool], :ddwaf_object
+        attach_function :ddwaf_object_null, [:ddwaf_object], :ddwaf_object
+        attach_function :ddwaf_object_float, [:ddwaf_object, :double], :ddwaf_object
 
         attach_function :ddwaf_object_array, [:ddwaf_object], :ddwaf_object
         attach_function :ddwaf_object_array_add, [:ddwaf_object, :ddwaf_object], :bool
@@ -184,6 +190,7 @@ module Datadog
         attach_function :ddwaf_object_get_signed, [:ddwaf_object], :int64
         attach_function :ddwaf_object_get_index, [:ddwaf_object, :size_t], :ddwaf_object
         attach_function :ddwaf_object_get_bool, [:ddwaf_object], :bool
+        attach_function :ddwaf_object_get_float, [:ddwaf_object], :double
 
         ## freeers
 
@@ -216,20 +223,8 @@ module Datadog
 
         typedef Config.by_ref, :ddwaf_config
 
-        class RuleSetInfo < ::FFI::Struct
-          layout :loaded, :uint16,
-                 :failed, :uint16,
-                 :errors, Object,
-                 :version, :string
-        end
-
-        typedef RuleSetInfo.by_ref, :ddwaf_ruleset_info
-        RuleSetInfoNone = Datadog::AppSec::WAF::LibDDWAF::RuleSetInfo.new(::FFI::Pointer::NULL)
-
-        attach_function :ddwaf_ruleset_info_free, [:ddwaf_ruleset_info], :void
-
-        attach_function :ddwaf_init, [:ddwaf_rule, :ddwaf_config, :ddwaf_ruleset_info], :ddwaf_handle
-        attach_function :ddwaf_update, [:ddwaf_handle, :ddwaf_object, :ddwaf_ruleset_info], :ddwaf_handle
+        attach_function :ddwaf_init, [:ddwaf_rule, :ddwaf_config, :ddwaf_object], :ddwaf_handle
+        attach_function :ddwaf_update, [:ddwaf_handle, :ddwaf_object, :ddwaf_object], :ddwaf_handle
         attach_function :ddwaf_destroy, [:ddwaf_handle], :void
 
         attach_function :ddwaf_required_addresses, [:ddwaf_handle, UInt32Ptr], :charptrptr
@@ -250,16 +245,12 @@ module Datadog
         attach_function :ddwaf_context_init, [:ddwaf_handle], :ddwaf_context
         attach_function :ddwaf_context_destroy, [:ddwaf_context], :void
 
-        class ResultActions < ::FFI::Struct
-          layout :array, :charptrptr,
-                 :size,  :uint32
-        end
-
         class Result < ::FFI::Struct
-          layout :timeout,          :bool,
-                 :data,             :string,
-                 :actions,          ResultActions,
-                 :total_runtime,    :uint64
+          layout :timeout,       :bool,
+                 :events,        Object,
+                 :actions,       Object,
+                 :derivatives,   Object,
+                 :total_runtime, :uint64
         end
 
         typedef Result.by_ref, :ddwaf_result
@@ -297,7 +288,7 @@ module Datadog
         LibDDWAF.ddwaf_get_version
       end
 
-      # rubocop:disable Metrics/MethodLength
+      # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
       def self.ruby_to_object(val, max_container_size: nil, max_container_depth: nil, max_string_length: nil, coerce: true)
         case val
         when Array
@@ -375,9 +366,9 @@ module Datadog
           res = if coerce
                   LibDDWAF.ddwaf_object_string(obj, val.to_s)
                 elsif val < 0
-                  LibDDWAF.ddwaf_object_signed_force(obj, val)
+                  LibDDWAF.ddwaf_object_signed(obj, val)
                 else
-                  LibDDWAF.ddwaf_object_unsigned_force(obj, val)
+                  LibDDWAF.ddwaf_object_unsigned(obj, val)
                 end
           if res.null?
             fail LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
@@ -386,7 +377,11 @@ module Datadog
           obj
         when Float
           obj = LibDDWAF::Object.new
-          res = LibDDWAF.ddwaf_object_string(obj, val.to_s)
+          res = if coerce
+                  LibDDWAF.ddwaf_object_string(obj, val.to_s)
+                else
+                  LibDDWAF.ddwaf_object_float(obj, val)
+                end
           if res.null?
             fail LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
           end
@@ -403,16 +398,28 @@ module Datadog
             fail LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
           end
 
+          obj
+        when NilClass
+          obj = LibDDWAF::Object.new
+          res = if coerce
+                  LibDDWAF.ddwaf_object_string(obj, '')
+                else
+                  LibDDWAF.ddwaf_object_null(obj)
+                end
+          if res.null?
+            fail LibDDWAF::Error, "Could not convert into object: #{val.inspect}"
+          end
+
           obj
         else
           ruby_to_object(''.freeze)
         end
       end
-      # rubocop:enable Metrics/MethodLength
+      # rubocop:enable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity
 
       def self.object_to_ruby(obj)
         case obj[:type]
-        when :ddwaf_obj_invalid
+        when :ddwaf_obj_invalid, :ddwaf_obj_null
           nil
         when :ddwaf_obj_bool
           obj[:valueUnion][:boolean]
@@ -422,6 +429,8 @@ module Datadog
           obj[:valueUnion][:intValue]
         when :ddwaf_obj_unsigned
           obj[:valueUnion][:uintValue]
+        when :ddwaf_obj_float
+          obj[:valueUnion][:f64]
         when :ddwaf_obj_array
           (0...obj[:nbEntries]).each.with_object([]) do |i, a|
             ptr = obj[:valueUnion][:array] + i * LibDDWAF::Object.size
@@ -479,7 +488,7 @@ module Datadog
       }
 
       class Handle
-        attr_reader :handle_obj, :ruleset_info, :config
+        attr_reader :handle_obj, :diagnostics, :config
 
         def initialize(rule, limits: {}, obfuscator: {})
           rule_obj = Datadog::AppSec::WAF.ruby_to_object(rule)
@@ -501,24 +510,19 @@ module Datadog
 
           @config = config_obj
 
-          ruleset_info = LibDDWAF::RuleSetInfo.new
+          diagnostics_obj = Datadog::AppSec::WAF::LibDDWAF::Object.new
 
-          @handle_obj = Datadog::AppSec::WAF::LibDDWAF.ddwaf_init(rule_obj, config_obj, ruleset_info)
+          @handle_obj = Datadog::AppSec::WAF::LibDDWAF.ddwaf_init(rule_obj, config_obj, diagnostics_obj)
 
-          @ruleset_info = {
-            loaded: ruleset_info[:loaded],
-            failed: ruleset_info[:failed],
-            errors: WAF.object_to_ruby(ruleset_info[:errors]),
-            version: ruleset_info[:version],
-          }
+          @diagnostics = Datadog::AppSec::WAF.object_to_ruby(diagnostics_obj)
 
           if @handle_obj.null?
-            fail LibDDWAF::Error.new('Could not create handle', ruleset_info: @ruleset_info)
+            fail LibDDWAF::Error.new('Could not create handle', diagnostics: @diagnostics)
           end
 
           validate!
         ensure
-          Datadog::AppSec::WAF::LibDDWAF.ddwaf_ruleset_info_free(ruleset_info) if ruleset_info
+          Datadog::AppSec::WAF::LibDDWAF.ddwaf_object_free(diagnostics_obj) if diagnostics_obj
           Datadog::AppSec::WAF::LibDDWAF.ddwaf_object_free(rule_obj) if rule_obj
         end
 
@@ -541,29 +545,24 @@ module Datadog
 
         def merge(data)
           data_obj = Datadog::AppSec::WAF.ruby_to_object(data, coerce: false)
-          ruleset_info = LibDDWAF::RuleSetInfo.new
-          new_handle = Datadog::AppSec::WAF::LibDDWAF.ddwaf_update(handle_obj, data_obj, ruleset_info)
+          diagnostics_obj = LibDDWAF::Object.new
+          new_handle = Datadog::AppSec::WAF::LibDDWAF.ddwaf_update(handle_obj, data_obj, diagnostics_obj)
 
           return if new_handle.null?
 
-          info = {
-            loaded: ruleset_info[:loaded],
-            failed: ruleset_info[:failed],
-            errors: WAF.object_to_ruby(ruleset_info[:errors]),
-            version: ruleset_info[:version],
-          }
-          new_from_handle(new_handle, info, config)
+          diagnostics = Datadog::AppSec::WAF.object_to_ruby(diagnostics_obj)
+          new_from_handle(new_handle, diagnostics, config)
         ensure
           Datadog::AppSec::WAF::LibDDWAF.ddwaf_object_free(data_obj) if data_obj
-          Datadog::AppSec::WAF::LibDDWAF.ddwaf_ruleset_info_free(ruleset_info) if ruleset_info
+          Datadog::AppSec::WAF::LibDDWAF.ddwaf_object_free(diagnostics_obj) if diagnostics_obj
         end
 
         private
 
-        def new_from_handle(handle_object, info, config)
+        def new_from_handle(handle_object, diagnostics, config)
           obj = self.class.allocate
           obj.instance_variable_set(:@handle_obj, handle_object)
-          obj.instance_variable_set(:@ruleset_info, info)
+          obj.instance_variable_set(:@diagnostics, diagnostics)
           obj.instance_variable_set(:@config, config)
           obj
         end
@@ -588,14 +587,15 @@ module Datadog
       end
 
       class Result
-        attr_reader :status, :data, :total_runtime, :timeout, :actions
+        attr_reader :status, :events, :total_runtime, :timeout, :actions, :derivatives
 
-        def initialize(status, data, total_runtime, timeout, actions)
+        def initialize(status, events, total_runtime, timeout, actions, derivatives)
           @status = status
-          @data = data
+          @events = events
           @total_runtime = total_runtime
           @timeout = timeout
           @actions = actions
+          @derivatives = derivatives
         end
       end
 
@@ -636,7 +636,8 @@ module Datadog
           input_obj = Datadog::AppSec::WAF.ruby_to_object(input,
                                                           max_container_size: max_container_size,
                                                           max_container_depth: max_container_depth,
-                                                          max_string_length: max_string_length)
+                                                          max_string_length: max_string_length,
+                                                          coerce: false)
           if input_obj.null?
             fail LibDDWAF::Error, "Could not convert input: #{input.inspect}"
           end
@@ -651,18 +652,13 @@ module Datadog
 
           code = Datadog::AppSec::WAF::LibDDWAF.ddwaf_run(@context_obj, input_obj, result_obj, timeout)
 
-          actions = if result_obj[:actions][:size] > 0
-                      result_obj[:actions][:array].get_array_of_string(0, result_obj[:actions][:size])
-                    else
-                      []
-                    end
-
           result = Result.new(
             RESULT_CODE[code],
-            (JSON.parse(result_obj[:data]) if result_obj[:data] != nil),
+            Datadog::AppSec::WAF.object_to_ruby(result_obj[:events]),
             result_obj[:total_runtime],
             result_obj[:timeout],
-            actions,
+            Datadog::AppSec::WAF.object_to_ruby(result_obj[:actions]),
+            Datadog::AppSec::WAF.object_to_ruby(result_obj[:derivatives]),
           )
 
           [RESULT_CODE[code], result]

data/sig/datadog/appsec/waf.rbs

@@ -3,9 +3,9 @@ module Datadog
     module WAF
       module LibDDWAF
         class Error < StandardError
-          attr_reader ruleset_info: Hash[Symbol, untyped] | nil
+          attr_reader diagnostics: ::Datadog::AppSec::WAF::data
 
-          def initialize: (::String msg, ?ruleset_info: Hash[Symbol, untyped]?) -> void
+          def initialize: (::String msg, ?diagnostics: ::Datadog::AppSec::WAF::data?) -> void
         end
 
         extend ::FFI::Library
@@ -52,9 +52,11 @@ module Datadog
         def self.ddwaf_object_stringl_nc: (LibDDWAF::Object, ::String, ::Integer) -> ::FFI::Pointer
         def self.ddwaf_object_unsigned: (LibDDWAF::Object, ::Integer) -> ::FFI::Pointer
         def self.ddwaf_object_signed: (LibDDWAF::Object, ::Integer) -> ::FFI::Pointer
-        def self.ddwaf_object_unsigned_force: (LibDDWAF::Object, ::Integer) -> ::FFI::Pointer
-        def self.ddwaf_object_signed_force: (LibDDWAF::Object, ::Integer) -> ::FFI::Pointer
+        def self.ddwaf_object_string_from_unsigned: (LibDDWAF::Object, ::Integer) -> ::FFI::Pointer
+        def self.ddwaf_object_string_from_signed: (LibDDWAF::Object, ::Integer) -> ::FFI::Pointer
         def self.ddwaf_object_bool: (LibDDWAF::Object, bool) -> ::FFI::Pointer
+        def self.ddwaf_object_float: (LibDDWAF::Object, ::Float) -> ::FFI::Pointer
+        def self.ddwaf_object_null: (LibDDWAF::Object) -> ::FFI::Pointer
 
         def self.ddwaf_object_array: (LibDDWAF::Object) -> ::FFI::Pointer
         def self.ddwaf_object_array_add: (LibDDWAF::Object, LibDDWAF::Object) -> bool
@@ -75,6 +77,7 @@ module Datadog
         def self.ddwaf_object_get_signed: (LibDDWAF::Object, SizeTPtr) -> ::Integer
         def self.ddwaf_object_get_index: (LibDDWAF::Object, ::Integer) -> LibDDWAF::Object
         def self.ddwaf_object_get_bool: (LibDDWAF::Object) -> bool
+        def self.ddwaf_object_get_float: (LibDDWAF::Object) -> ::Float
 
         # freeers
 
@@ -93,15 +96,8 @@ module Datadog
           end
         end
 
-        class RuleSetInfo < ::FFI::Struct
-        end
-
-        RuleSetInfoNone: ::Datadog::AppSec::WAF::LibDDWAF::RuleSetInfo
-
-        def self.ddwaf_ruleset_info_free: (RuleSetInfo) -> void
-
-        def self.ddwaf_init: (top, Config, RuleSetInfo) -> ::FFI::Pointer
-        def self.ddwaf_update: (::FFI::Pointer, LibDDWAF::Object, RuleSetInfo) -> ::FFI::Pointer
+        def self.ddwaf_init: (top, Config, Object) -> ::FFI::Pointer
+        def self.ddwaf_update: (::FFI::Pointer, LibDDWAF::Object, LibDDWAF::Object) -> ::FFI::Pointer
         def self.ddwaf_destroy: (::FFI::Pointer) -> void
 
         def self.ddwaf_required_addresses: (::FFI::Pointer, UInt32Ptr) -> ::FFI::Pointer
@@ -116,9 +112,6 @@ module Datadog
         def self.ddwaf_context_init: (::FFI::Pointer) -> ::FFI::Pointer
         def self.ddwaf_context_destroy: (::FFI::Pointer) -> void
 
-        class ResultActions < ::FFI::Struct
-        end
-
         class Result < ::FFI::Struct
         end
 
@@ -149,9 +142,9 @@ module Datadog
 
       def self.version: () -> ::String
 
-      type data = String | Symbol | Integer | Float | TrueClass | FalseClass | Array[data] | Hash[String | Symbol, data] | nil
+      type data = String | Symbol | Integer | Float | TrueClass | FalseClass | Array[data] | Hash[(String | Symbol | nil), data] | nil
 
-      def self.ruby_to_object: (data val, ?max_container_size: ::Integer?, ?max_container_depth: ::Integer?, ?max_string_length: ::Integer?, ?coerce: bool?) -> ::Datadog::AppSec::WAF::LibDDWAF::Object
+      def self.ruby_to_object: (top val, ?max_container_size: ::Integer?, ?max_container_depth: ::Integer?, ?max_string_length: ::Integer?, ?coerce: bool?) -> ::Datadog::AppSec::WAF::LibDDWAF::Object
       def self.object_to_ruby: (::Datadog::AppSec::WAF::LibDDWAF::Object obj) -> data
 
       self.@logger: ::Logger
@@ -165,35 +158,34 @@ module Datadog
 
       class Handle
         attr_reader handle_obj: ::FFI::Pointer
-        attr_reader ruleset_info: Hash[Symbol, untyped]
+        attr_reader diagnostics: data
         attr_reader config: WAF::LibDDWAF::Config
 
         def initialize: (data rule, ?limits: ::Hash[::Symbol, ::Integer], ?obfuscator: ::Hash[::Symbol, ::String]) -> void
         def finalize: () -> untyped
         def required_addresses: () -> ::Array[::String]
-        def update: (untyped data) -> Handle
+        def merge: (untyped data) -> Handle?
 
         private
 
         @valid: bool
 
-        def new_from_handle: (::FFI::Pointer handle_object, Hash[Symbol, untyped] info, WAF::LibDDWAF::Config config) -> untyped
+        def new_from_handle: (::FFI::Pointer handle_object, data diagnostics, WAF::LibDDWAF::Config config) -> untyped
         def validate!: () -> void
         def invalidate!: () -> void
         def valid?: () -> (nil | bool)
         def valid!: () -> void
       end
 
-      type result_data = Array[untyped] | nil
-
       class Result
         attr_reader status: ::Symbol
-        attr_reader data: untyped
+        attr_reader events: data
         attr_reader total_runtime: ::Float
         attr_reader timeout: bool
-        attr_reader actions: ::Array[::String]
+        attr_reader actions: data
+        attr_reader derivatives: data
 
-        def initialize: (::Symbol, result_data, ::Float, bool, ::Array[::String]) -> void
+        def initialize: (::Symbol, data, ::Float, bool, data, data) -> void
       end
 
       class Context

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: libddwaf
 version: !ruby/object:Gem::Version
-  version: 1.9.0.0.1
+  version: 1.14.0.0.0
 platform: ruby
 authors:
 - Datadog, Inc.
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-06-13 00:00:00.000000000 Z
+date: 2023-09-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi