Skip to content

Commit 27f1648

Browse files
PROFeNoMPROFeNoM
authored
Merge branch 'master' into alex/APMS-17909_guzzle-fix
2 parents ca3cf29 + 575faf4 commit 27f1648

57 files changed

Lines changed: 909 additions & 274 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitlab/dockerhub-login.sh‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#!/bin/sh
2+
3+
set -e
4+
5+
export VAULT_VERSION="1.20.0"
6+
7+
echo "=== Setting up Docker Hub authentication ==="
8+
9+
# Determine architecture for binary downloads
10+
arch="$(uname -m)"
11+
case "${arch}" in
12+
x86_64)
13+
vault_arch="amd64"
14+
;;
15+
aarch64|arm64)
16+
vault_arch="arm64"
17+
;;
18+
*)
19+
echo "Warning: Unsupported architecture: ${arch}. Skipping Docker Hub authentication." >&2
20+
exit 0
21+
;;
22+
esac
23+
24+
# Install jq if not already available
25+
if ! command -v jq > /dev/null 2>&1; then
26+
echo "Installing jq..."
27+
28+
jq_path="/tmp/jq"
29+
30+
if ! curl -L --fail "https://github.com/jqlang/jq/releases/latest/download/jq-linux-${vault_arch}" \
31+
--output "${jq_path}"; then
32+
echo "Warning: Failed to download jq. Skipping Docker Hub authentication." >&2
33+
exit 0
34+
fi
35+
36+
chmod +x "${jq_path}"
37+
export PATH="/tmp:${PATH}"
38+
fi
39+
40+
# Install Vault if not already available
41+
vault_cmd="vault"
42+
if ! command -v vault > /dev/null 2>&1; then
43+
echo "Installing Vault CLI..."
44+
45+
vault_path="/tmp/vault"
46+
vault_zip="${vault_path}.zip"
47+
48+
if ! curl -L --fail "https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_${vault_arch}.zip" \
49+
--output "${vault_zip}"; then
50+
echo "Warning: Failed to download Vault. Skipping Docker Hub authentication." >&2
51+
exit 0
52+
fi
53+
54+
if ! unzip -q "${vault_zip}" -d /tmp; then
55+
echo "Warning: Failed to extract Vault. Skipping Docker Hub authentication." >&2
56+
exit 0
57+
fi
58+
59+
chmod +x "${vault_path}"
60+
rm -f "${vault_zip}"
61+
62+
vault_cmd="${vault_path}"
63+
fi
64+
65+
# Fetch Docker Hub credentials from Vault
66+
echo "Fetching Docker Hub credentials from Vault..."
67+
vaultoutput="$("${vault_cmd}" kv get --format=json kv/k8s/gitlab-runner/dd-trace-php/dockerhub)" || {
68+
echo "Warning: Failed to fetch Docker Hub credentials from Vault. Skipping Docker Hub authentication." >&2
69+
exit 0
70+
}
71+
72+
user="$(echo "$vaultoutput" | jq -r '.data.data.user')"
73+
token="$(echo "$vaultoutput" | jq -r '.data.data.token')"
74+
75+
if [ -z "${user}" ] || [ -z "${token}" ] || [ "${user}" = "null" ] || [ "${token}" = "null" ]; then
76+
echo "Warning: Docker Hub credentials are empty or invalid. Skipping Docker Hub authentication." >&2
77+
exit 0
78+
fi
79+
80+
echo "Docker Hub user: ${user}"
81+
echo "Logging in to Docker Hub..."
82+
if ! echo "${token}" | docker login -u "${user}" --password-stdin docker.io; then
83+
echo "Warning: Failed to login to Docker Hub. Continuing without authentication." >&2
84+
exit 0
85+
fi
86+
87+
echo "=== Docker Hub authentication successful ==="

‎.gitlab/generate-appsec.php‎

Lines changed: 4 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -62,21 +62,8 @@
6262
image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/docker:24.0.4-gbi-focal
6363
before_script:
6464
<?php echo $ecrLoginSnippet, "\n"; ?>
65-
- |
66-
echo "Logging in to Docker Hub"
67-
if [ "$CI_REGISTRY_USER" = "" ]; then
68-
echo "Fetching Docker Hub credentials from vault"
69-
vaultoutput=$(vault kv get --format=json kv/k8s/gitlab-runner/dd-trace-php/dockerhub)
70-
user=$(echo "$vaultoutput" | jq -r .data.data.user)
71-
token=$(echo "$vaultoutput" | jq -r .data.data.token)
72-
else
73-
user="$CI_REGISTRY_USER"
74-
token="$CI_REGISTRY_TOKEN"
75-
fi
76-
77-
echo "Docker Hub user: $user"
78-
docker login -u "$user" -p "$token" docker.io
79-
- apt update && apt install -y default-jre
65+
<?php dockerhub_login() ?>
66+
- apt update && apt install -y openjdk-17-jre
8067

8168
"test appsec extension":
8269
stage: test
@@ -141,8 +128,9 @@
141128
- test8.5-release-zts
142129
before_script:
143130
<?php echo $ecrLoginSnippet, "\n"; ?>
131+
<?php dockerhub_login() ?>
144132
script:
145-
- apt update && apt install -y default-jre
133+
- apt update && apt install -y openjdk-17-jre
146134
- find "$CI_PROJECT_DIR"/appsec/tests/integration/build || true
147135
- |
148136
cd appsec/tests/integration

‎.gitlab/generate-common.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,6 @@
3131

3232
function unset_dd_runner_env_vars() {
3333
?>
34-
3534
# DD env vars auto-added to GitLab runners for infra purposes
3635
- unset DD_SERVICE
3736
- unset DD_ENV
@@ -40,6 +39,12 @@ function unset_dd_runner_env_vars() {
4039
<?php
4140
}
4241

42+
function dockerhub_login() {
43+
?>
44+
- if command -v docker > /dev/null 2>&1; then .gitlab/dockerhub-login.sh; fi
45+
<?php
46+
}
47+
4348
?>
4449
default:
4550
retry:

‎.gitlab/generate-package.php‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -753,6 +753,7 @@
753753
RUST_BACKTRACE: 1
754754
DOCKER_COMPOSE_DOWNLOAD_NAME: docker-compose-linux-x86_64
755755
before_script:
756+
<?php dockerhub_login() ?>
756757
- apt install -y php git make curl
757758
- curl -L --fail https://github.com/docker/compose/releases/download/v2.36.0/${DOCKER_COMPOSE_DOWNLOAD_NAME} -o /usr/local/bin/docker-compose
758759
- chmod +x /usr/local/bin/docker-compose
@@ -833,6 +834,7 @@
833834
KUBERNETES_MEMORY_LIMIT: 4Gi
834835
RUST_BACKTRACE: 1
835836
before_script:
837+
<?php dockerhub_login() ?>
836838
- apt install -y make
837839
- mkdir build
838840
- mv packages build
@@ -897,6 +899,7 @@
897899
# - symfony_no_ddtrace
898900
# - symfony
899901
before_script:
902+
<?php dockerhub_login() ?>
900903
- apt install -y make curl
901904
- curl -L --fail https://github.com/docker/compose/releases/download/v2.36.0/docker-compose-linux-x86_64 -o /usr/local/bin/docker-compose
902905
- chmod +x /usr/local/bin/docker-compose
@@ -959,6 +962,7 @@
959962
- job: datadog-setup.php
960963
artifacts: true
961964
before_script: &verify_alpine_before_script
965+
<?php dockerhub_login() ?>
962966
- mkdir build
963967
- mv packages build
964968
- apk add --no-cache ca-certificates # see https://support.circleci.com/hc/en-us/articles/360016505753-Resolve-Certificate-Signed-By-Unknown-Authority-error-in-Alpine-images?flash_digest=39b76521a337cecacac0cc10cb28f3747bb5fc6a
@@ -987,6 +991,7 @@
987991
- job: datadog-setup.php
988992
artifacts: true
989993
before_script:
994+
<?php dockerhub_login() ?>
990995
- mkdir build
991996
- mv packages build
992997
- '# Fix yum config, as centos 7 is EOL and mirrorlist.centos.org does not resolve anymore - https://serverfault.com/a/1161847'
@@ -1012,6 +1017,7 @@
10121017
- job: datadog-setup.php
10131018
artifacts: true
10141019
before_script:
1020+
<?php dockerhub_login() ?>
10151021
- mkdir build
10161022
- mv packages build
10171023
- apt update
@@ -1125,6 +1131,7 @@
11251131
- !reference [.services, request-replayer]
11261132
- !reference [.services, httpbin-integration]
11271133
before_script:
1134+
<?php dockerhub_login() ?>
11281135
- switch-php debug
11291136
script:
11301137
- sudo dpkg -i packages/*amd64*.deb
@@ -1161,6 +1168,7 @@
11611168
- job: "prepare code"
11621169
artifacts: true
11631170
before_script:
1171+
<?php dockerhub_login() ?>
11641172
- |
11651173
# Setup cache dirs
11661174
mkdir -p $PIP_CACHE_DIR

‎.gitlab/generate-tracer.php‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ function sidecar_logs() {
3333
<?php
3434
}
3535

36-
function before_script_steps() {
36+
function before_script_steps($with_docker_auth = false) {
37+
if ($with_docker_auth) dockerhub_login();
3738
unset_dd_runner_env_vars();
3839
?>
3940

@@ -211,7 +212,7 @@ function before_script_steps() {
211212
HTTPBIN_HOSTNAME: httpbin-integration
212213
HTTPBIN_PORT: 8080
213214
before_script:
214-
<?php before_script_steps() ?>
215+
<?php before_script_steps(true) ?>
215216
- .gitlab/wait-for-service-ready.sh
216217

217218
.asan_test:
@@ -498,7 +499,7 @@ function before_script_steps() {
498499
SWITCH_PHP_VERSION: debug
499500
COMPOSER_VERSION: 2
500501
before_script:
501-
<?php before_script_steps() ?>
502+
<?php before_script_steps(true) ?>
502503
- if [[ "$MAKE_TARGET" != "test_composer" ]] || ! [[ "$PHP_MAJOR_MINOR" =~ 8.[01] ]]; then sudo composer self-update --$COMPOSER_VERSION --no-interaction; fi
503504
- COMPOSER_MEMORY_LIMIT=-1 composer update --no-interaction # disable composer memory limit completely
504505
- make composer_tests_update

‎CHANGELOG.md‎

Lines changed: 30 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,38 +1,39 @@
11
Changelog for older versions can be found in our [release page](https://github.com/DataDog/dd-trace-php/releases).
22

33
## All products
4-
- Add PHP 8.5 support #3400
5-
6-
## Tracer
7-
### Added
8-
- Implement APM endpoint resource renaming #3415
9-
- Enable dynamic configuration for debugger-related products #3476
10-
11-
### Fixed
12-
- Collect incompletely fetched CurlMulti handles upon destruction #3469
13-
- Safeguard proc_get_span in case proc_assoc_span is not happening #3471
14-
- Skip SSI injector in installer for accurate ini-dir readings #3472
15-
- Make stub file compatible with php 8.4+ parser #3475
16-
- Fix function resolver on PHP 8.0 and PHP 8.1 for targets without HAVE_GCC_GLOBAL_REGS and with active JIT #3482
17-
- Support ENOENT as shm_open failure mode DataDog/libdatadog#1315
18-
- This fixes a failure mode present on some serverless runtimes.
19-
204
### Internal
21-
- Add crashtracker support for the sidecar #3453
22-
- Strip error messages from hook telemetry #3449
23-
- Collect runtime crash frames #3479
24-
- Use a dedicated endpoint for enriched logs DataDog/libdatadog#1338
5+
- bump tracing-core from 0.1.33 to 0.1.35 #3516
256

26-
## Profiling
7+
## Tracer
278
### Internal
28-
- Cleanup I/O profiling code #3406
29-
- Upgrade to libdatadog v23, profiling uses zstd now #3470
30-
- Switch panics to abort #3474
9+
- Const-ify some logging thread-local variables #3513
10+
### Fixed
11+
- Avoid curl's `getenv` calls #3528
12+
- `code_origin_for_spans_enabled` naming inconsistency #3494
13+
- Add `NULL` guard clause in sidecar reconnect callback #3499
3114

32-
## Application Security Management
15+
## Profiler
3316
### Added
34-
- Print block_id #3444
35-
17+
- Detect parallel threads #3515
3618
### Changed
37-
- Upgrade libddwaf and rules #3438
38-
- Adapt security_response_id to latest #3480
19+
- Speedup hot path in allocator #3505
20+
### Fixed
21+
- Fixed asserting length of INI #3508
22+
23+
## AppSec
24+
### Added
25+
- Minify blocking json message #3502
26+
- Add Custom Data Classification #3524
27+
- Add metrics for extension connections #3527
28+
### Fixed
29+
- Amend string on request abort #3506
30+
- Fix accessing to incorrectly hardcoded `$_GET` #3501
31+
- Amend issue where `security_response_id` is being release before displaying it #3493
32+
- AppSec helper: add send timeouts #3518
33+
- Minor fixes and improvements to file descriptor reclamation #3526
34+
- LaravelIntegration: be more defensive #3503
35+
- Fix `duration_ext` metric #3507
36+
- Fix segfault iterating mapping #3517
37+
- Fix double end hook run/segfault when blocking in PHP 7.x #3490
38+
- Fix `_iovec_writer_flush` and enforce limits on `$_POST` #3495
39+
- Clear `client_ip` on `request_init` #3496

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
1.14.0
1+
1.15.0

‎appsec/.clang-tidy‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
# readability-function-cognitive-complexity temporarily disabled until clang-tidy is fixed
33
# right now emalloc causes it to misbehave
4-
Checks: '*,-bugprone-reserved-identifier,-hicpp-signed-bitwise,-llvmlibc-restrict-system-libc-headers,-altera-unroll-loops,-hicpp-named-parameter,-cert-dcl37-c,-cert-dcl51-cpp,-read,-cppcoreguidelines-init-variables,-cppcoreguidelines-avoid-non-const-global-variables,-altera-id-dependent-backward-branch,-performance-no-int-to-ptr,-altera-struct-pack-align,-google-readability-casting,-modernize-use-trailing-return-type,-llvmlibc-implementation-in-namespace,-llvmlibc-callee-namespace,-cppcoreguidelines-pro-bounds-pointer-arithmetic,-fuchsia-default-arguments-declarations,-fuchsia-overloaded-operator,-cppcoreguidelines-pro-type-union-access,-fuchsia-default-arguments-calls,-cppcoreguidelines-non-private-member-variables-in-classes,-misc-non-private-member-variables-in-classes,-google-readability-todo,-llvm-header-guard,-readability-function-cognitive-complexity,-readability-identifier-length,-modernize-macro-to-enum,-misc-include-cleaner,-bugprone-empty-catch,-cppcoreguidelines-avoid-do-while,-hicpp-no-array-decay'
4+
Checks: '*,-bugprone-reserved-identifier,-hicpp-signed-bitwise,-llvmlibc-restrict-system-libc-headers,-altera-unroll-loops,-hicpp-named-parameter,-cert-dcl37-c,-cert-dcl51-cpp,-read,-cppcoreguidelines-init-variables,-cppcoreguidelines-avoid-non-const-global-variables,-altera-id-dependent-backward-branch,-performance-no-int-to-ptr,-altera-struct-pack-align,-google-readability-casting,-modernize-use-trailing-return-type,-llvmlibc-implementation-in-namespace,-llvmlibc-callee-namespace,-cppcoreguidelines-pro-bounds-pointer-arithmetic,-fuchsia-default-arguments-declarations,-fuchsia-overloaded-operator,-cppcoreguidelines-pro-type-union-access,-fuchsia-default-arguments-calls,-cppcoreguidelines-non-private-member-variables-in-classes,-misc-non-private-member-variables-in-classes,-google-readability-todo,-llvm-header-guard,-readability-function-cognitive-complexity,-readability-identifier-length,-modernize-macro-to-enum,-misc-include-cleaner,-bugprone-empty-catch,-cppcoreguidelines-avoid-do-while,-hicpp-no-array-decay,-llvmlibc-*'
55
WarningsAsErrors: '*'
66
HeaderFilterRegex: ''
77
CheckOptions:

‎appsec/run-tests-internal.php‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -845,19 +845,19 @@ function write_information()
845845
$info_params = array();
846846
settings2array($ini_overwrites, $info_params);
847847
$info_params = settings2params($info_params);
848-
$php_info = `$php $pass_options $info_params $no_file_cache "$info_file"`;
849-
define('TESTED_PHP_VERSION', `$php -n -r "echo PHP_VERSION;"`);
848+
$php_info = shell_exec("$php $pass_options $info_params $no_file_cache \"$info_file\"");
849+
define('TESTED_PHP_VERSION', shell_exec("$php -n -r \"echo PHP_VERSION;\""));
850850

851851
if ($php_cgi && $php != $php_cgi) {
852-
$php_info_cgi = `$php_cgi $pass_options $info_params $no_file_cache -q "$info_file"`;
852+
$php_info_cgi = shell_exec("$php_cgi $pass_options $info_params $no_file_cache -q \"$info_file\"");
853853
$php_info_sep = "\n---------------------------------------------------------------------";
854854
$php_cgi_info = "$php_info_sep\nPHP : $php_cgi $php_info_cgi$php_info_sep";
855855
} else {
856856
$php_cgi_info = '';
857857
}
858858

859859
if ($phpdbg) {
860-
$phpdbg_info = `$phpdbg $pass_options $info_params $no_file_cache -qrr "$info_file"`;
860+
$phpdbg_info = shell_exec("$phpdbg $pass_options $info_params $no_file_cache -qrr \"$info_file\"");
861861
$php_info_sep = "\n---------------------------------------------------------------------";
862862
$phpdbg_info = "$php_info_sep\nPHP : $phpdbg $phpdbg_info$php_info_sep";
863863
} else {
@@ -872,7 +872,7 @@ function write_information()
872872
// load list of enabled extensions
873873
save_text($info_file,
874874
'<?php echo str_replace("Zend OPcache", "opcache", implode(",", get_loaded_extensions())); ?>');
875-
$exts_to_test = explode(',', `$php $pass_options $info_params $no_file_cache "$info_file"`);
875+
$exts_to_test = explode(',', shell_exec("$php $pass_options $info_params $no_file_cache \"$info_file\""));
876876
// check for extensions that need special handling and regenerate
877877
$info_params_ex = array(
878878
'session' => array('session.auto_start=0'),
@@ -2171,9 +2171,9 @@ function run_test($php, $file, array $env)
21712171
$ext_params = array();
21722172
settings2array($ini_overwrites, $ext_params);
21732173
$ext_params = settings2params($ext_params);
2174-
$ext_dir = `$php $pass_options $extra_options $ext_params $no_file_cache -d display_errors=0 -r "echo ini_get('extension_dir');"`;
2174+
$ext_dir = shell_exec("$php $pass_options $extra_options $ext_params $no_file_cache -d display_errors=0 -r \"echo ini_get('extension_dir');\"");
21752175
$extensions = preg_split("/[\n\r]+/", trim($section_text['EXTENSIONS']));
2176-
$loaded = explode(",", `$php $pass_options $extra_options $ext_params $no_file_cache -d display_errors=0 -r "echo implode(',', get_loaded_extensions());"`);
2176+
$loaded = explode(",", shell_exec("$php $pass_options $extra_options $ext_params $no_file_cache -d display_errors=0 -r \"echo implode(',', get_loaded_extensions());\""));
21772177
$ext_prefix = IS_WINDOWS ? "php_" : "";
21782178
foreach ($extensions as $req_ext) {
21792179
if (!in_array($req_ext, $loaded)) {
@@ -3403,7 +3403,7 @@ function show_result(
34033403
$tested,
34043404
$tested_file,
34053405
$extra = '',
3406-
array $temp_filenames = null
3406+
$temp_filenames = null
34073407
) {
34083408
global $SHOW_ONLY_GROUPS, $colorize;
34093409

0 commit comments

Comments
 (0)