Update libddwaf gem to v1.15.0.0.0 #4052

y9v · 2024-10-31T11:16:07Z

What does this PR do?
It updates libddwaf dependency to v1.15.0.0.0. Since it had breaking changes, this PR also addresses it.

Motivation:
We have to update libddwaf gem to use the latest libddwaf binary (which is already at 1.20). This is the first step.

Change log entry
This should be considered internal change.

Additional Notes:
None

How to test the change?
Specs for appsec, and local testing for our appsec integrations.

…uns/11611017851

codecov-commenter · 2024-10-31T11:52:24Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 97.72%. Comparing base (d361376) to head (d5c46a7).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4052      +/-   ##
==========================================
- Coverage   97.73%   97.72%   -0.01%     
==========================================
  Files        1338     1338              
  Lines       80245    80248       +3     
  Branches     4014     4016       +2     
==========================================
  Hits        78426    78426              
- Misses       1819     1822       +3

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

pr-commenter · 2024-10-31T12:02:31Z

Benchmarks

Benchmark execution time: 2024-10-31 13:29:17

Comparing candidate commit d5c46a7 in PR branch appsec-update-libddwaf-to-1-15 with baseline commit d361376 in branch master.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 29 metrics, 2 unstable metrics.

Strech

👏🏼 Very nice, left a few comments

Strech · 2024-10-31T11:54:52Z

vendor/rbs/libddwaf-stub/0/datadog/appsec/waf.rbs

@@ -0,0 +1,137 @@
+module Datadog
+  module AppSec
+    # rubocop:disable Metrics/ModuleLength


Suggested change

# rubocop:disable Metrics/ModuleLength

Strech · 2024-10-31T11:55:02Z

vendor/rbs/libddwaf-stub/0/datadog/appsec/waf.rbs

+  module AppSec
+    # rubocop:disable Metrics/ModuleLength
+    module WAF
+      # retain logging proc if set properly


Suggested change

# retain logging proc if set properly

Strech · 2024-10-31T11:55:12Z

vendor/rbs/libddwaf-stub/0/datadog/appsec/waf.rbs

+
+      def self.version: () -> untyped
+
+      # rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity


Suggested change

# rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity

Strech · 2024-10-31T11:57:00Z

sig/datadog/appsec/processor/context.rbs

@@ -30,15 +30,15 @@ module Datadog

        def initialize: (WAF::Handle handle, telemetry: Core::Telemetry::Component) -> void

-        def run: (Hash[untyped, untyped] input, ?::Integer timeout) -> WAF::Result
+        def run: (Hash[untyped, untyped] persistent_data, Hash[untyped, untyped] ephemeral_data, ?::Integer timeout) -> WAF::Result


WDYT if we extract waf_data as a type?

type waf_data = Hash[untyped, untyped]

Suggested change

def run: (Hash[untyped, untyped] persistent_data, Hash[untyped, untyped] ephemeral_data, ?::Integer timeout) -> WAF::Result

def run: (waf_data persistent_data, waf_data ephemeral_data, ?::Integer timeout) -> WAF::Result

Strech · 2024-10-31T11:57:56Z

sig/datadog/appsec/processor/context.rbs


        def extract_schema: () -> WAF::Result?

        def finalize: () -> void

        private

-        def try_run: (Hash[untyped, untyped] input, ::Integer timeout) -> [::Symbol, WAF::Result]
+        def try_run: (Hash[untyped, untyped] persistent_data, Hash[untyped, untyped] ephemeral_data, ::Integer timeout) -> [::Symbol, WAF::Result]


Suggested change

def try_run: (Hash[untyped, untyped] persistent_data, Hash[untyped, untyped] ephemeral_data, ::Integer timeout) -> [::Symbol, WAF::Result]

def try_run: (waf_data persistent_data, waf_data ephemeral_data, ::Integer timeout) -> [::Symbol, WAF::Result]

Strech · 2024-10-31T11:59:05Z

lib/datadog/appsec/processor/context.rb

            next false if v.is_a?(TrueClass) || v.is_a?(FalseClass)

            v.nil? ? true : v.empty?
          end

-          _code, result = try_run(input, timeout)
+          ephemeral_data.reject! do |_, v|


Totally agree with duplication because it should not be the part of the Context here and should be moved into WAF::Context in the future

Strech · 2024-10-31T12:01:55Z

lib/datadog/appsec/contrib/graphql/reactive/multiplex.rb

-                waf_args = {
+                waf_persistent_data = {
                  'graphql.server.all_resolvers' => arguments
                }

                waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(waf_args, waf_timeout)
+                result = waf_context.run(waf_persistent_data, {}, waf_timeout)


Maybe it's too much, but I would throw that suggestion anyway, WDYT if we name it like this?

Suggested change

waf_args = {

waf_persistent_data = {

'graphql.server.all_resolvers' => arguments

}

waf_timeout = Datadog.configuration.appsec.waf_timeout

result = waf_context.run(waf_args, waf_timeout)

result = waf_context.run(waf_persistent_data, {}, waf_timeout)

ephemeral_data = {}

persistent_data = {

'graphql.server.all_resolvers' => arguments

}

timeout = Datadog.configuration.appsec.waf_timeout

result = waf_context.run(persistent_data, ephemeral_data, timeout)

P.S I also think that we can drop waf_ prefix everywhere, because it's obvious.

thanks! fixed all of this in d5c46a7

y9v self-assigned this Oct 31, 2024

y9v requested review from a team as code owners October 31, 2024 11:16

y9v force-pushed the appsec-update-libddwaf-to-1-15 branch from 29e908d to 71e804f Compare October 31, 2024 11:21

Update libddwaf gem to v1.15.0.0.0

f7a94ce

y9v force-pushed the appsec-update-libddwaf-to-1-15 branch from 71e804f to f7a94ce Compare October 31, 2024 11:23

[🤖] Lock Dependency: https://github.com/DataDog/dd-trace-rb/actions/r…

40759e1

…uns/11611017851

Strech approved these changes Oct 31, 2024

View reviewed changes

Improve naming for persistent_data arg for appsec waf

d5c46a7

y9v merged commit 421a1cb into master Oct 31, 2024
278 of 280 checks passed

y9v deleted the appsec-update-libddwaf-to-1-15 branch October 31, 2024 16:02

github-actions bot added this to the 2.5.0 milestone Oct 31, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update libddwaf gem to v1.15.0.0.0 #4052

Update libddwaf gem to v1.15.0.0.0 #4052

y9v commented Oct 31, 2024

codecov-commenter commented Oct 31, 2024 •

edited

Loading

pr-commenter bot commented Oct 31, 2024 •

edited

Loading

Strech left a comment

Strech Oct 31, 2024

Strech Oct 31, 2024

Strech Oct 31, 2024

Strech Oct 31, 2024

Strech Oct 31, 2024

Strech Oct 31, 2024

Strech Oct 31, 2024

y9v Oct 31, 2024


		def self.version: () -> untyped

		# rubocop:disable Metrics/MethodLength,Metrics/CyclomaticComplexity,Metrics/PerceivedComplexity

	def run: (Hash[untyped, untyped] persistent_data, Hash[untyped, untyped] ephemeral_data, ?::Integer timeout) -> WAF::Result
	def run: (waf_data persistent_data, waf_data ephemeral_data, ?::Integer timeout) -> WAF::Result

	def try_run: (Hash[untyped, untyped] persistent_data, Hash[untyped, untyped] ephemeral_data, ::Integer timeout) -> [::Symbol, WAF::Result]
	def try_run: (waf_data persistent_data, waf_data ephemeral_data, ::Integer timeout) -> [::Symbol, WAF::Result]

Update libddwaf gem to v1.15.0.0.0 #4052

Update libddwaf gem to v1.15.0.0.0 #4052

Conversation

y9v commented Oct 31, 2024

codecov-commenter commented Oct 31, 2024 • edited Loading

Codecov Report

pr-commenter bot commented Oct 31, 2024 • edited Loading

Benchmarks

Strech left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov-commenter commented Oct 31, 2024 •

edited

Loading

pr-commenter bot commented Oct 31, 2024 •

edited

Loading