Merge pull request #3780 from DataDog/glopes/helper-on-85

cataphract · web-flow · commit df435879f70c · 2026-04-13T10:04:53.000+01:00
Enable rust helper on PHP 8.5
diff --git a/.gitlab/generate-appsec.php b/.gitlab/generate-appsec.php
@@ -191,7 +191,6 @@
           - test8.1-release
           - test8.3-debug
           - test8.4-release-zts
-          - test8.5-release-musl
 
 "helper-rust build and test":
   stage: test
diff --git a/appsec/src/extension/configuration.h b/appsec/src/extension/configuration.h
@@ -28,7 +28,11 @@ extern bool runtime_config_first_init;
 
 #define DD_BASE(path) "/opt/datadog-php/" path
 
+#if PHP_VERSION_ID >= 80500
+#define DD_APPSEC_HELPER_RUST_REDIRECTION_DEFAULT "true"
+#else
 #define DD_APPSEC_HELPER_RUST_REDIRECTION_DEFAULT "false"
+#endif
 
 // clang-format off
 #define DD_CONFIGURATION_GENERAL \
diff --git a/appsec/tests/integration/build.gradle b/appsec/tests/integration/build.gradle
@@ -639,6 +639,9 @@ def runMainTask = { String phpVersion, String variant ->
             dependsOn 'buildHelperRustWithCoverage'
         } else if (project.hasProperty('useHelperRust')) {
             dependsOn 'buildHelperRust'
+        } else if (phpVersion == '8.5') {
+            // PHP 8.5+ uses Rust helper by default via DD_APPSEC_HELPER_RUST_REDIRECTION
+            dependsOn 'buildHelperRust'
         }
     }
 }
@@ -710,6 +713,9 @@ def runMainTask = { String phpVersion, String variant ->
             dependsOn 'buildHelperRustWithCoverage'
         } else if (project.hasProperty('useHelperRust')) {
             dependsOn 'buildHelperRust'
+        } else if (phpVersion == '8.5') {
+            // PHP 8.5+ uses Rust helper by default via DD_APPSEC_HELPER_RUST_REDIRECTION
+            dependsOn 'buildHelperRust'
         }
 
         if (phpVersion in ['7.0', '7.1']) {
diff --git a/appsec/tests/integration/src/main/groovy/com/datadog/appsec/php/docker/AppSecContainer.groovy b/appsec/tests/integration/src/main/groovy/com/datadog/appsec/php/docker/AppSecContainer.groovy
@@ -491,6 +491,11 @@ class AppSecContainer<SELF extends AppSecContainer<SELF>> extends GenericContain
                 }
             }
             withEnv 'USE_HELPER_RUST', '1'
+        } else {
+            // Mount helper-rust volume so enable_extensions.sh can copy the binary
+            // for the redirection mechanism (DD_APPSEC_HELPER_RUST_REDIRECTION
+            // defaults to true on PHP 8.5+)
+            addVolumeMount('php-helper-rust', '/helper-rust')
         }
 
         String fullWorkVolume = "php-workvol-$workVolume-$phpVersion-$phpVariant"
diff --git a/appsec/tests/integration/src/test/bin/enable_extensions.sh b/appsec/tests/integration/src/test/bin/enable_extensions.sh
@@ -11,6 +11,11 @@ HELPER_PATH=/appsec/libddappsec-helper.so
 if [[ -n $USE_HELPER_RUST ]]; then
   echo "Using Rust helper" >&2
   HELPER_PATH=/helper-rust/libddappsec-helper.so
+elif [[ -f /helper-rust/libddappsec-helper.so ]]; then
+  # Copy Rust helper for the redirection mechanism
+  # (DD_APPSEC_HELPER_RUST_REDIRECTION defaults to true on PHP >= 8.5)
+  ln -sf /helper-rust/libddappsec-helper.so \
+    "$(dirname "$HELPER_PATH")/libddappsec-helper-rust.so"
 fi
 
 if [[ -n $USE_SSI ]]; then
diff --git a/appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/CommonTests.groovy b/appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/CommonTests.groovy
@@ -863,4 +863,34 @@ trait CommonTests {
         assert span.metrics."_dd.appsec.trace.integer" == 1729
         assert span.meta."_dd.appsec.trace.agent" == "TraceTagging/v4"
     }
+
+    @Test
+    void 'helper runtime default matches PHP version'() {
+        // This test verifies the default helper selection; skip when explicitly overridden
+        org.junit.jupiter.api.Assumptions.assumeTrue(
+            System.getProperty('USE_HELPER_RUST') == null,
+            'Skipped: helper explicitly overridden via -PuseHelperRust')
+
+        def trace = container.traceFromRequest('/phpinfo.php') { HttpResponse<InputStream> resp ->
+            assert resp.statusCode() == 200
+            def content = resp.body().text
+
+            if (TestParams.phpVersionAtLeast('8.5')) {
+                assert content.contains('Yes (Rust)') :
+                    "PHP >= 8.5 should use Rust helper by default"
+            } else {
+                assert content.contains('Yes (C++)') :
+                    "PHP < 8.5 should use C++ helper by default"
+            }
+        }
+
+        Span span = trace.first()
+        if (TestParams.phpVersionAtLeast('8.5')) {
+            assert span.meta."_dd.appsec.helper_runtime" == 'rust' :
+                "PHP >= 8.5 should report helper_runtime=rust in span"
+        } else {
+            assert span.meta."_dd.appsec.helper_runtime" == null :
+                "PHP < 8.5 should not set helper_runtime span tag"
+        }
+    }
 }
diff --git a/metadata/supported-configurations.json b/metadata/supported-configurations.json
@@ -104,9 +104,9 @@
     ],
     "DD_APPSEC_HELPER_RUST_REDIRECTION": [
       {
-        "implementation": "A",
+        "implementation": "B",
         "type": "boolean",
-        "default": "false"
+        "default": "true"
       }
     ],
     "DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML": [

Original file line number	Diff line number	Diff line change
`@@ -639,6 +639,9 @@ def runMainTask = { String phpVersion, String variant ->`
`639`	`639`	`dependsOn 'buildHelperRustWithCoverage'`
`640`	`640`	`} else if (project.hasProperty('useHelperRust')) {`
`641`	`641`	`dependsOn 'buildHelperRust'`
	`642`	`+ } else if (phpVersion == '8.5') {`
	`643`	`+ // PHP 8.5+ uses Rust helper by default via DD_APPSEC_HELPER_RUST_REDIRECTION`
	`644`	`+ dependsOn 'buildHelperRust'`
`642`	`645`	`}`
`643`	`646`	`}`
`644`	`647`	`}`
`@@ -710,6 +713,9 @@ def runMainTask = { String phpVersion, String variant ->`
`710`	`713`	`dependsOn 'buildHelperRustWithCoverage'`
`711`	`714`	`} else if (project.hasProperty('useHelperRust')) {`
`712`	`715`	`dependsOn 'buildHelperRust'`
	`716`	`+ } else if (phpVersion == '8.5') {`
	`717`	`+ // PHP 8.5+ uses Rust helper by default via DD_APPSEC_HELPER_RUST_REDIRECTION`
	`718`	`+ dependsOn 'buildHelperRust'`
`713`	`719`	`}`
`714`	`720`
`715`	`721`	`if (phpVersion in ['7.0', '7.1']) {`
Original file line number	Diff line number	Diff line change
`@@ -491,6 +491,11 @@ class AppSecContainer<SELF extends AppSecContainer<SELF>> extends GenericContain`
`491`	`491`	`}`
`492`	`492`	`}`
`493`	`493`	`withEnv 'USE_HELPER_RUST', '1'`
	`494`	`+ } else {`
	`495`	`+ // Mount helper-rust volume so enable_extensions.sh can copy the binary`
	`496`	`+ // for the redirection mechanism (DD_APPSEC_HELPER_RUST_REDIRECTION`
	`497`	`+ // defaults to true on PHP 8.5+)`
	`498`	`+ addVolumeMount('php-helper-rust', '/helper-rust')`
`494`	`499`	`}`
`495`	`500`
`496`	`501`	`String fullWorkVolume = "php-workvol-$workVolume-$phpVersion-$phpVariant"`
Original file line number	Diff line number	Diff line change
`@@ -104,9 +104,9 @@`
`104`	`104`	`],`
`105`	`105`	`"DD_APPSEC_HELPER_RUST_REDIRECTION": [`
`106`	`106`	`{`
`107`		`- "implementation": "A",`
	`107`	`+ "implementation": "B",`
`108`	`108`	`"type": "boolean",`
`109`		`- "default": "false"`
	`109`	`+ "default": "true"`
`110`	`110`	`}`
`111`	`111`	`],`
`112`	`112`	`"DD_APPSEC_HTTP_BLOCKED_TEMPLATE_HTML": [`