Skip to content

Commit 9d29314

Browse files
CarlesDDCarlesDD
authored
Updatelibddwaf to v1.26.0 (#143)
1 parent 1232598 commit 9d29314

File tree

6 files changed

+128
-39
lines changed

6 files changed

+128
-39
lines changed

‎index.d.ts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,13 +30,14 @@ type TruncationMetrics = {
3030

3131
type result = {
3232
timeout: boolean;
33-
totalRuntime?: number;
33+
duration?: number;
3434
events?: object[]; // https://github.com/DataDog/libddwaf/blob/master/schema/events.json
3535
status?: 'match'; // TODO: remove this if new statuses are never added
3636
actions?: object[];
37-
derivatives?: object;
37+
attributes?: object;
3838
metrics?: TruncationMetrics;
3939
errorCode?: number;
40+
keep?: boolean;
4041
}
4142

4243
type payload = {

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"version": "9.0.0",
44
"description": "Node.js bindings for libddwaf",
55
"main": "index.js",
6-
"libddwaf_version": "1.24.1",
6+
"libddwaf_version": "1.26.0",
77
"scripts": {
88
"install": "exit 0",
99
"rebuild": "node-gyp rebuild",

‎src/convert.cpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -244,7 +244,7 @@ ddwaf_object* to_ddwaf_object(
244244
return ddwaf_object_invalid(object);
245245
}
246246

247-
Napi::Value from_ddwaf_object(ddwaf_object *object, Napi::Env env) {
247+
Napi::Value from_ddwaf_object(const ddwaf_object *object, Napi::Env env) {
248248
DDWAF_OBJ_TYPE type = object->type;
249249

250250
Napi::Value result;
@@ -268,7 +268,7 @@ Napi::Value from_ddwaf_object(ddwaf_object *object, Napi::Env env) {
268268
}
269269

270270
for (uint32_t i = 0; i < object->nbEntries; ++i) {
271-
ddwaf_object* e = &object->array[i];
271+
const ddwaf_object* e = &object->array[i];
272272
Napi::Value v = from_ddwaf_object(e, env);
273273
arr[i] = v;
274274
}
@@ -280,7 +280,7 @@ Napi::Value from_ddwaf_object(ddwaf_object *object, Napi::Env env) {
280280
Napi::Object obj = Napi::Object::New(env);
281281

282282
for (uint32_t i = 0; i < object->nbEntries; ++i) {
283-
ddwaf_object* e = &object->array[i];
283+
const ddwaf_object* e = &object->array[i];
284284
Napi::String k = Napi::String::New(env, e->parameterName, e->parameterNameLength);
285285
if (env.IsExceptionPending()) {
286286
mlog("Exception pending");

‎src/convert.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,6 @@ ddwaf_object* to_ddwaf_object(
2121
WAFTruncationMetrics *metrics
2222
);
2323

24-
Napi::Value from_ddwaf_object(ddwaf_object *object, Napi::Env env);
24+
Napi::Value from_ddwaf_object(const ddwaf_object *object, Napi::Env env);
2525

2626
#endif // SRC_CONVERT_H_

‎src/main.cpp‎

Lines changed: 69 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,13 @@
1515
#include "src/log.h"
1616
#include "src/convert.h"
1717

18+
// libddwaf result field name constants
19+
constexpr size_t EVENTS_LEN = 6;
20+
constexpr size_t ACTIONS_LEN = 7;
21+
constexpr size_t ATTRIBUTES_LEN = 10;
22+
constexpr size_t KEEP_LEN = 4;
23+
constexpr size_t DURATION_LEN = 8;
24+
constexpr size_t TIMEOUT_LEN = 7;
1825

1926
Napi::Object DDWAF::Init(Napi::Env env, Napi::Object exports) {
2027
mlog("Setting up class DDWAF");
@@ -415,7 +422,7 @@ Napi::Value DDWAFContext::run(const Napi::CallbackInfo& info) {
415422
to_ddwaf_object(ddwafEphemeral, env, ephemeral, 0, true, false, JsSet::Create(env), &this->_metrics);
416423
}
417424

418-
ddwaf_result result;
425+
ddwaf_object result;
419426

420427
DDWAF_RET_CODE code = ddwaf_run(
421428
this->_context,
@@ -450,32 +457,82 @@ Napi::Value DDWAFContext::run(const Napi::CallbackInfo& info) {
450457
case DDWAF_ERR_INVALID_OBJECT:
451458
case DDWAF_ERR_INVALID_ARGUMENT:
452459
res.Set("errorCode", Napi::Number::New(env, code));
453-
ddwaf_result_free(&result);
460+
ddwaf_object_free(&result);
454461
return res;
455462
default:
456463
break;
457464
}
458-
// there is no error. We need to collect perf data
465+
466+
// No error. Collect result data and return
467+
468+
const ddwaf_object *events = nullptr, *actions = nullptr, *attributes = nullptr,
469+
*keep = nullptr, *duration = nullptr, *run_timeout = nullptr;
470+
471+
for (size_t i = 0; i < ddwaf_object_size(&result); ++i) {
472+
const ddwaf_object *child = ddwaf_object_get_index(&result, i);
473+
if (child == nullptr) {
474+
mlog("ddwaf result child is null")
475+
continue;
476+
}
477+
478+
size_t length = 0;
479+
const char *key = ddwaf_object_get_key(child, &length);
480+
if (key == nullptr) {
481+
mlog("ddwaf result key is null")
482+
continue;
483+
}
484+
485+
if (length == EVENTS_LEN && memcmp(key, "events", EVENTS_LEN) == 0) {
486+
events = child;
487+
} else if (length == ACTIONS_LEN && memcmp(key, "actions", ACTIONS_LEN) == 0) {
488+
actions = child;
489+
} else if (length == ATTRIBUTES_LEN && memcmp(key, "attributes", ATTRIBUTES_LEN) == 0) {
490+
attributes = child;
491+
} else if (length == KEEP_LEN && memcmp(key, "keep", KEEP_LEN) == 0) {
492+
keep = child;
493+
} else if (length == DURATION_LEN && memcmp(key, "duration", DURATION_LEN) == 0) {
494+
duration = child;
495+
} else if (length == TIMEOUT_LEN && memcmp(key, "timeout", TIMEOUT_LEN) == 0) {
496+
run_timeout = child;
497+
}
498+
}
459499

460500
mlog("Set timeout");
461-
res.Set("timeout", Napi::Boolean::New(env, result.timeout));
501+
if (run_timeout && run_timeout->type == DDWAF_OBJ_BOOL) {
502+
res.Set("timeout", Napi::Boolean::New(env, run_timeout->boolean));
503+
}
462504

463-
if (result.total_runtime) {
464-
mlog("Set total_runtime");
465-
res.Set("totalRuntime", Napi::Number::New(env, result.total_runtime));
505+
if (duration && duration->type == DDWAF_OBJ_UNSIGNED && duration->uintValue > 0) {
506+
mlog("Set duration");
507+
res.Set("duration", Napi::Number::New(env, duration->uintValue));
466508
}
467509

468-
if (ddwaf_object_size(&result.derivatives)) {
469-
res.Set("derivatives", from_ddwaf_object(&result.derivatives, env));
510+
if (attributes && ddwaf_object_size(attributes) > 0) {
511+
mlog("Set attributes");
512+
res.Set("attributes", from_ddwaf_object(attributes, env));
470513
}
471514

472515
if (code == DDWAF_MATCH) {
516+
mlog("ddwaf result is a match")
473517
res.Set("status", Napi::String::New(env, "match"));
474-
res.Set("events", from_ddwaf_object(&result.events, env));
475-
res.Set("actions", from_ddwaf_object(&result.actions, env));
518+
519+
if (events) {
520+
mlog("Set events")
521+
res.Set("events", from_ddwaf_object(events, env));
522+
}
523+
524+
if (actions) {
525+
mlog("Set actions")
526+
res.Set("actions", from_ddwaf_object(actions, env));
527+
}
528+
}
529+
530+
if (keep && keep->type == DDWAF_OBJ_BOOL) {
531+
mlog("Set keep")
532+
res.Set("keep", Napi::Boolean::New(env, keep->boolean));
476533
}
477534

478-
ddwaf_result_free(&result);
535+
ddwaf_object_free(&result);
479536

480537
return res;
481538
}

‎test/index.js‎

Lines changed: 51 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -787,7 +787,7 @@ describe('DDWAF', () => {
787787
assert.strictEqual(result.events[0].rule_matches[0].parameters[0].highlight[0], '<Redacted>')
788788
})
789789

790-
it('should collect derivatives information when a rule match', () => {
790+
it('should collect result attributes information when a rule match', () => {
791791
const waf = new DDWAF(processor, 'processor_rules')
792792

793793
const context = waf.createContext()
@@ -805,7 +805,7 @@ describe('DDWAF', () => {
805805
}, TIMEOUT)
806806

807807
assert.strictEqual(result.status, 'match')
808-
assert.deepStrictEqual(result.derivatives, { 'server.request.body.schema': [8] })
808+
assert.deepStrictEqual(result.attributes, { 'server.request.body.schema': [8] })
809809

810810
context.dispose()
811811
assert(context.disposed)
@@ -814,7 +814,7 @@ describe('DDWAF', () => {
814814
assert(waf.disposed)
815815
})
816816

817-
it('should collect derivatives information when a rule does not match', () => {
817+
it('should collect result attributes information when a rule does not match', () => {
818818
const waf = new DDWAF(processor, 'processor_rules')
819819
const context = waf.createContext()
820820

@@ -830,7 +830,7 @@ describe('DDWAF', () => {
830830
}
831831
}, TIMEOUT)
832832

833-
assert.deepStrictEqual(result.derivatives, { 'server.request.body.schema': [8] })
833+
assert.deepStrictEqual(result.attributes, { 'server.request.body.schema': [8] })
834834

835835
context.dispose()
836836
assert(context.disposed)
@@ -839,7 +839,7 @@ describe('DDWAF', () => {
839839
assert(waf.disposed)
840840
})
841841

842-
it('should collect all derivatives types', () => {
842+
it('should collect all result attributes types', () => {
843843
const waf = new DDWAF(processor, 'processor_rules')
844844
const context = waf.createContext()
845845

@@ -870,7 +870,7 @@ describe('DDWAF', () => {
870870
}
871871
}, TIMEOUT)
872872

873-
assert.deepStrictEqual(result.derivatives, {
873+
assert.deepStrictEqual(result.attributes, {
874874
'server.request.body.schema': [
875875
{
876876
null: [1],
@@ -898,7 +898,7 @@ describe('DDWAF', () => {
898898
assert(waf.disposed)
899899
})
900900

901-
it('should collect derivatives in two consecutive calls', () => {
901+
it('should collect result attributes in two consecutive calls', () => {
902902
const waf = new DDWAF(processor, 'processor_rules')
903903
const context = waf.createContext()
904904

@@ -911,7 +911,7 @@ describe('DDWAF', () => {
911911
}
912912
}, TIMEOUT)
913913

914-
assert.strictEqual(result.derivatives, undefined)
914+
assert.strictEqual(result.attributes, undefined)
915915

916916
result = context.run({
917917
persistent: {
@@ -922,15 +922,15 @@ describe('DDWAF', () => {
922922
}
923923
}, TIMEOUT)
924924

925-
assert.deepStrictEqual(result.derivatives, { 'server.request.body.schema': [8] })
925+
assert.deepStrictEqual(result.attributes, { 'server.request.body.schema': [8] })
926926

927927
result = context.run({
928928
persistent: {
929929
'server.request.query': ''
930930
}
931931
}, TIMEOUT)
932932

933-
assert.deepStrictEqual(result.derivatives, { 'server.request.query.schema': [8] })
933+
assert.deepStrictEqual(result.attributes, { 'server.request.query.schema': [8] })
934934

935935
context.dispose()
936936
assert(context.disposed)
@@ -939,6 +939,37 @@ describe('DDWAF', () => {
939939
assert(waf.disposed)
940940
})
941941

942+
it('should include keep field in result object', () => {
943+
const waf = new DDWAF(rules, 'recommended')
944+
const context = waf.createContext()
945+
946+
// Non-match result
947+
let result = context.run({
948+
persistent: {
949+
'server.request.headers.no_cookies': 'normal_value'
950+
}
951+
}, TIMEOUT)
952+
953+
assert.strictEqual(result.timeout, false)
954+
assert.strictEqual(typeof result.keep, 'boolean')
955+
assert.strictEqual(result.keep, false)
956+
957+
// Match result
958+
result = context.run({
959+
persistent: {
960+
'server.request.headers.no_cookies': 'value_attack'
961+
}
962+
}, TIMEOUT)
963+
964+
assert.strictEqual(result.timeout, false)
965+
assert.strictEqual(result.status, 'match')
966+
assert.strictEqual(typeof result.keep, 'boolean')
967+
assert.strictEqual(result.keep, true)
968+
969+
context.dispose()
970+
waf.dispose()
971+
})
972+
942973
describe('Action semantics', () => {
943974
it('should support action definition in initialisation', () => {
944975
const waf = new DDWAF(rules, 'recommended')
@@ -1067,7 +1098,7 @@ describe('limit tests', () => {
10671098
}
10681099
}, TIMEOUT)
10691100

1070-
assert.deepStrictEqual(result.derivatives, {
1101+
assert.deepStrictEqual(result.attributes, {
10711102
'server.request.body.schema': [
10721103
{
10731104
mail: [8],
@@ -1098,7 +1129,7 @@ describe('limit tests', () => {
10981129
}
10991130
}, TIMEOUT)
11001131

1101-
assert.deepStrictEqual(result.derivatives, {
1132+
assert.deepStrictEqual(result.attributes, {
11021133
'server.request.body.schema': [
11031134
{
11041135
mail: [8],
@@ -1124,7 +1155,7 @@ describe('limit tests', () => {
11241155
}
11251156
}, TIMEOUT)
11261157

1127-
assert.deepStrictEqual(result.derivatives, {
1158+
assert.deepStrictEqual(result.attributes, {
11281159
'server.request.body.schema': [[[0]], { len: 3 }]
11291160
})
11301161
})
@@ -1144,7 +1175,7 @@ describe('limit tests', () => {
11441175
}
11451176
}, TIMEOUT)
11461177

1147-
assert.deepStrictEqual(result.derivatives, {
1178+
assert.deepStrictEqual(result.attributes, {
11481179
'server.request.body.schema': [[[{ payload: [0] }]], { len: 3 }]
11491180
})
11501181
})
@@ -1166,7 +1197,7 @@ describe('limit tests', () => {
11661197
}
11671198
}, TIMEOUT)
11681199

1169-
assert.deepStrictEqual(result.derivatives, {
1200+
assert.deepStrictEqual(result.attributes, {
11701201
'server.request.body.schema': [
11711202
[[{ mail: [8], key: [8] }]],
11721203
{ len: 4 }
@@ -1194,7 +1225,7 @@ describe('limit tests', () => {
11941225
}
11951226
}, TIMEOUT)
11961227

1197-
assert.deepStrictEqual(result.derivatives, {
1228+
assert.deepStrictEqual(result.attributes, {
11981229
'server.request.body.schema': [
11991230
{
12001231
prop1: [{ mail: [8], key: [8] }],
@@ -1331,7 +1362,7 @@ describe('limit tests', () => {
13311362
}
13321363
}, TIMEOUT)
13331364

1334-
assert.deepStrictEqual(result.derivatives, {
1365+
assert.deepStrictEqual(result.attributes, {
13351366
'server.request.body.schema': [
13361367
[
13371368
[
@@ -1374,7 +1405,7 @@ describe('limit tests', () => {
13741405
}
13751406
}, TIMEOUT)
13761407

1377-
assert.deepStrictEqual(result.derivatives, {
1408+
assert.deepStrictEqual(result.attributes, {
13781409
'server.request.body.schema': [
13791410
{
13801411
c: [8],
@@ -1419,7 +1450,7 @@ describe('limit tests', () => {
14191450
}
14201451
}, TIMEOUT)
14211452

1422-
assert.deepStrictEqual(result.derivatives, {
1453+
assert.deepStrictEqual(result.attributes, {
14231454
'server.request.body.schema': [
14241455
{
14251456
a: [16],
@@ -1451,7 +1482,7 @@ describe('limit tests', () => {
14511482
}
14521483
}, TIMEOUT)
14531484

1454-
assert.deepStrictEqual(result.derivatives, {
1485+
assert.deepStrictEqual(result.attributes, {
14551486
'server.request.body.schema': [
14561487
{
14571488
a: [0],

0 commit comments

Comments
 (0)