Skip to content

Commit 3224607

Browse files
ValentinZakharovValentinZakharov
committed
Replaced transient with ephemeral addresses
1 parent a786410 commit 3224607

5 files changed

Lines changed: 52 additions & 14 deletions

File tree

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/AppSecRequestContext.java‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@
22

33
import com.datadog.appsec.event.data.Address;
44
import com.datadog.appsec.event.data.DataBundle;
5-
import com.datadog.appsec.event.data.KnownAddresses;
65
import com.datadog.appsec.report.AppSecEvent;
76
import com.datadog.appsec.util.StandardizedLogging;
87
import datadog.trace.api.http.StoredBodySupplier;
@@ -74,6 +73,7 @@ public class AppSecRequestContext implements DataBundle, Closeable {
7473
private boolean rawReqBodyPublished;
7574
private boolean convertedReqBodyPublished;
7675
private boolean respDataPublished;
76+
private boolean pathParamsPublished;
7777
private Map<String, String> apiSchemas;
7878

7979
// should be guarded by this
@@ -327,7 +327,11 @@ public void setReqDataPublished(boolean reqDataPublished) {
327327
}
328328

329329
public boolean isPathParamsPublished() {
330-
return persistentData.containsKey(KnownAddresses.REQUEST_PATH_PARAMS);
330+
return pathParamsPublished;
331+
}
332+
333+
public void setPathParamsPublished(boolean pathParamsPublished) {
334+
this.pathParamsPublished = pathParamsPublished;
331335
}
332336

333337
public boolean isRawReqBodyPublished() {

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/GatewayBridge.java‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -216,14 +216,10 @@ public void init() {
216216
EVENTS.requestPathParams(),
217217
(ctx_, data) -> {
218218
AppSecRequestContext ctx = ctx_.getData(RequestContextSlot.APPSEC);
219-
if (ctx == null) {
220-
return NoopFlow.INSTANCE;
221-
}
222-
223-
if (ctx.isPathParamsPublished()) {
224-
log.debug("Second or subsequent publication of request params");
219+
if (ctx == null || ctx.isPathParamsPublished()) {
225220
return NoopFlow.INSTANCE;
226221
}
222+
ctx.setPathParamsPublished(true);
227223

228224
while (true) {
229225
DataSubscriberInfo subInfo = pathParamsSubInfo;

‎dd-java-agent/appsec/src/main/java/com/datadog/appsec/powerwaf/PowerWAFModule.java‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -511,8 +511,7 @@ private Powerwaf.ResultWithData doRunPowerwaf(
511511
PowerwafMetrics metrics = reqCtx.getWafMetrics();
512512

513513
if (isTransient) {
514-
DataBundle bundle = DataBundle.unionOf(newData, reqCtx);
515-
return runPowerwafTransient(metrics, bundle, ctxAndAddr);
514+
return runPowerwafTransient(additive, metrics, newData, ctxAndAddr);
516515
} else {
517516
return runPowerwafAdditive(additive, metrics, newData, ctxAndAddr);
518517
}
@@ -527,9 +526,9 @@ private Powerwaf.ResultWithData runPowerwafAdditive(
527526
}
528527

529528
private Powerwaf.ResultWithData runPowerwafTransient(
530-
PowerwafMetrics metrics, DataBundle bundle, CtxAndAddresses ctxAndAddr)
529+
Additive additive, PowerwafMetrics metrics, DataBundle bundle, CtxAndAddresses ctxAndAddr)
531530
throws AbstractPowerwafException {
532-
return ctxAndAddr.ctx.runRules(
531+
return additive.runEphemeral(
533532
new DataBundleMapWrapper(ctxAndAddr.addressesOfInterest, bundle), LIMITS, metrics);
534533
}
535534

‎dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/gateway/GatewayBridgeSpecification.groovy‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import com.datadog.appsec.event.EventDispatcher
66
import com.datadog.appsec.event.EventProducerService
77
import com.datadog.appsec.event.data.DataBundle
88
import com.datadog.appsec.event.data.KnownAddresses
9-
import com.datadog.appsec.event.data.SingletonDataBundle
109
import com.datadog.appsec.report.AppSecEvent
1110
import com.datadog.appsec.report.AppSecEventWrapper
1211
import datadog.trace.api.internal.TraceSegment
@@ -380,8 +379,10 @@ class GatewayBridgeSpecification extends DDSpecification {
380379
void 'path params is not published twice'() {
381380
Flow flow
382381

382+
setup:
383+
pathParamsCB.apply(ctx, [a: 'b'])
384+
383385
when:
384-
arCtx.addAll(new SingletonDataBundle(KnownAddresses.REQUEST_PATH_PARAMS, [a: 'b']))
385386
flow = pathParamsCB.apply(ctx, [c: 'd'])
386387

387388
then:

‎dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/powerwaf/PowerWAFModuleSpecification.groovy‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1273,6 +1273,44 @@ class PowerWAFModuleSpecification extends DDSpecification {
12731273
ret.isEmpty()
12741274
}
12751275

1276+
void 'ephemeral and persistent addresses'() {
1277+
setupWithStubConfigService()
1278+
ChangeableFlow flow = Mock()
1279+
1280+
when:
1281+
def transientBundle = MapDataBundle.of(
1282+
KnownAddresses.REQUEST_BODY_OBJECT,
1283+
'/cybercop'
1284+
)
1285+
dataListener.onDataAvailable(flow, ctx, transientBundle, false)
1286+
1287+
then:
1288+
1 * ctx.getOrCreateAdditive(_, true) >> {
1289+
pwafAdditive = it[0].openAdditive() }
1290+
1 * ctx.reportEvents(_ as Collection<AppSecEvent>) >> {
1291+
it[0].iterator().next().ruleMatches[0].parameters[0].value == '/cybercop'
1292+
}
1293+
1 * ctx.getWafMetrics()
1294+
1 * flow.isBlocking()
1295+
0 * _
1296+
1297+
when:
1298+
dataListener.onDataAvailable(flow, ctx, ATTACK_BUNDLE, false)
1299+
ctx.closeAdditive()
1300+
1301+
then:
1302+
1 * ctx.getOrCreateAdditive(_, true) >> {
1303+
pwafAdditive }
1304+
1 * flow.setAction({ it.blocking })
1305+
1 * ctx.reportEvents(_ as Collection<AppSecEvent>) >> {
1306+
it[0].iterator().next().ruleMatches[0].parameters[0].value == 'user-to-block-1'
1307+
}
1308+
1 * ctx.getWafMetrics()
1309+
1 * ctx.closeAdditive()
1310+
1 * flow.isBlocking()
1311+
0 * _
1312+
}
1313+
12761314
/**
12771315
* This test simulates double REQUEST_END with increasing interval
12781316
* The race condition shouldn't happen when closing Additive

0 commit comments

Comments
 (0)