From c74e9d1bab7e57bb237b784221817780bf7216e6 Mon Sep 17 00:00:00 2001 From: "sezen.leblay" Date: Fri, 6 Jun 2025 09:23:16 +0200 Subject: [PATCH 1/2] Upgrade libddwaf to 1.25.1 --- .github/workflows/actions.yml | 2 +- build.gradle | 2 +- libddwaf | 2 +- src/main/c/waf_jni.c | 58 ++++++++++++------- src/main/java/com/datadog/ddwaf/Waf.java | 2 +- .../com/datadog/ddwaf/ObfuscationTests.groovy | 2 +- 6 files changed, 41 insertions(+), 27 deletions(-) diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml index 6e368c8e..96384759 100644 --- a/.github/workflows/actions.yml +++ b/.github/workflows/actions.yml @@ -11,7 +11,7 @@ defaults: env: buildType: RelWithDebInfo tempdir: ${{ github.workspace }}/build - libddwafVersion: 1.24.1 + libddwafVersion: 1.25.1 jobs: Spotless: name: spotless diff --git a/build.gradle b/build.gradle index 83891efd..7490e0ab 100644 --- a/build.gradle +++ b/build.gradle @@ -36,7 +36,7 @@ repositories { } group 'io.sqreen' -version '14.1.0' +version '15.0.0' sourceCompatibility = 1.8 targetCompatibility = 1.8 diff --git a/libddwaf b/libddwaf index f2d2e899..e8fb3cf8 160000 --- a/libddwaf +++ b/libddwaf @@ -1 +1 @@ -Subproject commit f2d2e899a2972e24bfee29391d6bc37b147e44e9 +Subproject commit e8fb3cf8cb03e8f3679c207d0afb5f93e546aaec diff --git a/src/main/c/waf_jni.c b/src/main/c/waf_jni.c index 68f80064..0481ac4e 100644 --- a/src/main/c/waf_jni.c +++ b/src/main/c/waf_jni.c @@ -85,13 +85,13 @@ static int64_t get_remaining_budget(struct timespec start, struct timespec end, static void _throw_pwaf_exception(JNIEnv *env, DDWAF_RET_CODE retcode); static void _throw_pwaf_timeout_exception(JNIEnv *env); static void _update_metrics(JNIEnv *env, jobject metrics_obj, - const ddwaf_result *ret); + const ddwaf_object *ret); static bool _convert_ddwaf_config_checked(JNIEnv *env, jobject jconfig, ddwaf_config *out_config); static void _dispose_of_ddwaf_config(ddwaf_config *cfg); static jobject _create_result_checked(JNIEnv *env, DDWAF_RET_CODE code, - const ddwaf_result *ret); -static inline bool _has_derivative(const ddwaf_result *res); + const ddwaf_object *ret); +static inline bool _has_derivative(const ddwaf_object *res); #define MAX_DEPTH_UPPER_LIMIT ((uint32_t) 32) @@ -453,7 +453,7 @@ static jobject _run_waf_context_common(JNIEnv *env, jobject this, ddwaf_object *ephemeral_input_ptr = NULL; struct _limits limits; - ddwaf_result ret; + ddwaf_object ret; struct timespec start; if (!_get_time_checked(env, &start)) { @@ -534,8 +534,9 @@ static jobject _run_waf_context_common(JNIEnv *env, jobject this, DDWAF_RET_CODE ret_code = ddwaf_run(context, persistent_input_ptr, ephemeral_input_ptr, &ret, run_budget); - - if (ret.timeout) { + const ddwaf_object *timeout = ddwaf_object_find(&ret, "timeout", 7); + if (timeout != NULL && timeout->type == DDWAF_OBJ_BOOL && + ddwaf_object_get_bool(timeout)) { _throw_pwaf_timeout_exception(env); goto freeRet; } @@ -562,7 +563,7 @@ static jobject _run_waf_context_common(JNIEnv *env, jobject this, freeRet: _update_metrics(env, metrics_obj, &ret); - ddwaf_result_free(&ret); + ddwaf_object_free(&ret); return result; @@ -2026,7 +2027,7 @@ static void _throw_pwaf_timeout_exception(JNIEnv *env) } static void _update_metrics(JNIEnv *env, jobject metrics_obj, - const ddwaf_result *ret) + const ddwaf_object *ret) { // save exception if any jthrowable earlier_exc = JNI(ExceptionOccurred); @@ -2036,8 +2037,13 @@ static void _update_metrics(JNIEnv *env, jobject metrics_obj, // metrics update if (!JNI(IsSameObject, metrics_obj, NULL)) { - // we don't know the total time then - metrics_update_checked(env, metrics_obj, 0, (jlong) ret->total_runtime); + // Get duration from the ddwaf_object structure + const ddwaf_object *duration_obj = ddwaf_object_find(ret, "duration", 8); + jlong duration = 0; + if (duration_obj != NULL && duration_obj->type == DDWAF_OBJ_UNSIGNED) { + duration = (jlong) ddwaf_object_get_unsigned(duration_obj); + } + metrics_update_checked(env, metrics_obj, 0, duration); } if (earlier_exc) { @@ -2128,18 +2134,21 @@ static void _dispose_of_ddwaf_config(ddwaf_config *cfg) } static jobject _create_result_checked(JNIEnv *env, DDWAF_RET_CODE code, - const ddwaf_result *ret) + const ddwaf_object *ret) { if (code == DDWAF_OK && !_has_derivative(ret)) { return _result_with_data_ok_null; } + // Get actions from the new ddwaf_object structure + const ddwaf_object *actions_obj = ddwaf_object_find(ret, "actions", 7); jobject actions_jmap; bool del_actions_jmap = false; - if (ret->actions.type != DDWAF_OBJ_MAP || ret->actions.nbEntries == 0) { + if (actions_obj == NULL || actions_obj->type != DDWAF_OBJ_MAP || + ddwaf_object_size(actions_obj) == 0) { actions_jmap = _result_with_data_empty_map; } else { - actions_jmap = convert_ddwaf_object_to_jobject(env, &ret->actions); + actions_jmap = convert_ddwaf_object_to_jobject(env, actions_obj); if (!actions_jmap) { java_wrap_exc("%s", "Error creating actions map"); return NULL; @@ -2147,9 +2156,12 @@ static jobject _create_result_checked(JNIEnv *env, DDWAF_RET_CODE code, del_actions_jmap = true; } + // Get events from the new ddwaf_object structure + const ddwaf_object *events_obj = ddwaf_object_find(ret, "events", 6); jstring data_obj = NULL; - if (ret->events.type == DDWAF_OBJ_ARRAY && ret->events.nbEntries > 0) { - struct json_segment *seg = output_convert_json(&ret->events); + if (events_obj != NULL && events_obj->type == DDWAF_OBJ_ARRAY && + ddwaf_object_size(events_obj) > 0) { + struct json_segment *seg = output_convert_json(events_obj); if (!seg) { JNI(ThrowNew, jcls_iae, "failed converting events array to json"); goto err; @@ -2163,11 +2175,12 @@ static jobject _create_result_checked(JNIEnv *env, DDWAF_RET_CODE code, } } + // Get attributes (formerly derivatives) from the new ddwaf_object structure + const ddwaf_object *attributes_obj = ddwaf_object_find(ret, "attributes", 10); jobject derivatives = NULL; - if (ret->derivatives.type == DDWAF_OBJ_MAP && - ret->derivatives.nbEntries > 0) { - derivatives = - output_convert_derivatives_checked(env, &ret->derivatives); + if (attributes_obj != NULL && attributes_obj->type == DDWAF_OBJ_MAP && + ddwaf_object_size(attributes_obj) > 0) { + derivatives = output_convert_derivatives_checked(env, attributes_obj); if (!derivatives) { java_wrap_exc("%s", "Failed encoding inferred derivatives"); goto err; @@ -2191,8 +2204,9 @@ static jobject _create_result_checked(JNIEnv *env, DDWAF_RET_CODE code, return NULL; } -static inline bool _has_derivative(const ddwaf_result *res) +static inline bool _has_derivative(const ddwaf_object *res) { - return res->derivatives.type == DDWAF_OBJ_MAP && - res->derivatives.nbEntries > 0; + const ddwaf_object *attributes_obj = ddwaf_object_find(res, "attributes", 10); + return attributes_obj != NULL && attributes_obj->type == DDWAF_OBJ_MAP && + ddwaf_object_size(attributes_obj) > 0; } diff --git a/src/main/java/com/datadog/ddwaf/Waf.java b/src/main/java/com/datadog/ddwaf/Waf.java index 26ef7343..b500d44b 100644 --- a/src/main/java/com/datadog/ddwaf/Waf.java +++ b/src/main/java/com/datadog/ddwaf/Waf.java @@ -20,7 +20,7 @@ import org.slf4j.LoggerFactory; public final class Waf { - public static final String LIB_VERSION = "1.24.1"; + public static final String LIB_VERSION = "1.25.1"; private static final Logger LOGGER = LoggerFactory.getLogger(Waf.class); static final boolean EXIT_ON_LEAK; diff --git a/src/test/groovy/com/datadog/ddwaf/ObfuscationTests.groovy b/src/test/groovy/com/datadog/ddwaf/ObfuscationTests.groovy index 080a71cd..83e1fcef 100644 --- a/src/test/groovy/com/datadog/ddwaf/ObfuscationTests.groovy +++ b/src/test/groovy/com/datadog/ddwaf/ObfuscationTests.groovy @@ -49,7 +49,7 @@ class ObfuscationTests implements WafTrait { def json = slurper.parseText(awd.data) assert json[0].rule_matches[0]['parameters'][0].key_path == ['user-agent', '0'] - assert json[0].rule_matches[0]['parameters'][0].value == '' + assert json[0].rule_matches[0]['parameters'][0].value == 'Arachni/v1 password=' assert json[0].rule_matches[0]['parameters'][0].highlight == [''] } From 41c83b35d745a9626a353513e88d7411c589b85e Mon Sep 17 00:00:00 2001 From: "sezen.leblay" Date: Wed, 25 Jun 2025 11:09:08 +0200 Subject: [PATCH 2/2] clang --- src/main/c/waf_jni.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/main/c/waf_jni.c b/src/main/c/waf_jni.c index 0481ac4e..1aca0656 100644 --- a/src/main/c/waf_jni.c +++ b/src/main/c/waf_jni.c @@ -2038,7 +2038,8 @@ static void _update_metrics(JNIEnv *env, jobject metrics_obj, // metrics update if (!JNI(IsSameObject, metrics_obj, NULL)) { // Get duration from the ddwaf_object structure - const ddwaf_object *duration_obj = ddwaf_object_find(ret, "duration", 8); + const ddwaf_object *duration_obj = + ddwaf_object_find(ret, "duration", 8); jlong duration = 0; if (duration_obj != NULL && duration_obj->type == DDWAF_OBJ_UNSIGNED) { duration = (jlong) ddwaf_object_get_unsigned(duration_obj); @@ -2176,7 +2177,8 @@ static jobject _create_result_checked(JNIEnv *env, DDWAF_RET_CODE code, } // Get attributes (formerly derivatives) from the new ddwaf_object structure - const ddwaf_object *attributes_obj = ddwaf_object_find(ret, "attributes", 10); + const ddwaf_object *attributes_obj = + ddwaf_object_find(ret, "attributes", 10); jobject derivatives = NULL; if (attributes_obj != NULL && attributes_obj->type == DDWAF_OBJ_MAP && ddwaf_object_size(attributes_obj) > 0) { @@ -2206,7 +2208,8 @@ static jobject _create_result_checked(JNIEnv *env, DDWAF_RET_CODE code, static inline bool _has_derivative(const ddwaf_object *res) { - const ddwaf_object *attributes_obj = ddwaf_object_find(res, "attributes", 10); + const ddwaf_object *attributes_obj = + ddwaf_object_find(res, "attributes", 10); return attributes_obj != NULL && attributes_obj->type == DDWAF_OBJ_MAP && ddwaf_object_size(attributes_obj) > 0; }