feat(libddwaf): bump to 1.20.1 (#2913)

---------

Signed-off-by: Alexandre Rulleau <alexandre.rulleau@datadoghq.com>
Co-authored-by: Anil Mahtani <929854+Anilm3@users.noreply.github.com>
Co-authored-by: Gustavo Lopes <mail@geleia.net>

Author: 3 people

appsec/tests/helper/client_test.cpp

@@ -155,7 +155,7 @@ TEST(ClientTest, ClientInit)
     EXPECT_STREQ(msg_res->status.c_str(), "ok");
     EXPECT_EQ(msg_res->meta.size(), 2);
     EXPECT_STREQ(
-        msg_res->meta[std::string(tag::waf_version)].c_str(), "1.18.0");
+        msg_res->meta[std::string(tag::waf_version)].c_str(), "1.20.1");
     EXPECT_STREQ(
         msg_res->meta[std::string(tag::event_rules_errors)].c_str(), "{}");
 
@@ -264,7 +264,7 @@ TEST(ClientTest, ClientInitInvalidRules)
     EXPECT_STREQ(msg_res->status.c_str(), "ok");
     EXPECT_EQ(msg_res->meta.size(), 2);
     EXPECT_STREQ(
-        msg_res->meta[std::string(tag::waf_version)].c_str(), "1.18.0");
+        msg_res->meta[std::string(tag::waf_version)].c_str(), "1.20.1");
 
     rapidjson::Document doc;
     doc.Parse(msg_res->meta[std::string(tag::event_rules_errors)]);
@@ -637,8 +637,8 @@ TEST(ClientTest, EventWithMultipleActions)
         EXPECT_EQ(msg_res->actions.size(),
             3); // Block is not generated since there is a redirect
         EXPECT_STREQ(msg_res->actions[0].verdict.c_str(), "redirect");
-        EXPECT_STREQ(
-            msg_res->actions[0].parameters["location"].c_str(), "localhost");
+        EXPECT_STREQ(msg_res->actions[0].parameters["location"].c_str(),
+            "https://localhost");
         EXPECT_STREQ(
             msg_res->actions[0].parameters["status_code"].c_str(), "303");
         EXPECT_STREQ(msg_res->actions[1].verdict.c_str(),

appsec/tests/helper/engine_test.cpp

@@ -4,14 +4,13 @@
 // This product includes software developed at Datadog
 // (https://www.datadoghq.com/). Copyright 2021 Datadog, Inc.
 #include "common.hpp"
-#include "json_helper.hpp"
 #include <engine.hpp>
 #include <memory>
 #include <rapidjson/document.h>
 #include <subscriber/waf.hpp>
 
 const std::string waf_rule =
-    R"({"version":"2.1","rules":[{"id":"1","name":"rule1","tags":{"type":"flow1","category":"category1"},"conditions":[{"operator":"match_regex","parameters":{"inputs":[{"address":"arg1","key_path":[]}],"regex":"^string.*"}},{"operator":"match_regex","parameters":{"inputs":[{"address":"arg2","key_path":[]}],"regex":".*"}}]}]})";
+    R"({"version":"2.1","rules":[{"id":"1","name":"rule1","tags":{"type":"flow1","category":"category1"},"conditions":[{"operator":"match_regex","parameters":{"inputs":[{"address":"arg1","key_path":[]}],"regex":"^string.*"}},{"operator":"match_regex","parameters":{"inputs":[{"address":"arg2","key_path":[]}],"regex":".*"}}]},{"id":"2","name":"rule2","tags":{"type":"flow2","category":"category2"},"conditions":[{"operator":"match_regex","parameters":{"inputs":[{"address":"arg3","key_path":[]}],"regex":"^string.*"}}]}]})";
 const std::string waf_rule_with_data =
     R"({"version":"2.1","rules":[{"id":"blk-001-001","name":"Block IP Addresses","tags":{"type":"block_ip","category":"security_response"},"conditions":[{"parameters":{"inputs":[{"address":"http.client_ip"}],"data":"blocked_ips"},"operator":"ip_match"}],"transformers":[],"on_match":["block"]}]})";
 
@@ -704,7 +703,7 @@ TEST(EngineTest, WafSubscriptorUpdateRuleOverrideAndActions)
             R"({"rules_override": [{"rules_target":[{"rule_id":"1"}],
              "on_match": ["redirect"]}], "actions": [{"id": "redirect",
              "type": "redirect_request", "parameters": {"status_code": "303",
-             "location": "localhost"}}]})");
+             "location": "https://localhost"}}]})");
         e->update(update, meta, metrics);
     }
 

appsec/tests/helper/main.cpp

@@ -190,7 +190,7 @@ std::string create_sample_rules_ok()
       "id": "redirect",
       "type": "redirect_request",
       "parameters": {
-        "location": "localhost"
+        "location": "https://localhost"
       }
     }
   ]

appsec/tests/helper/remote_config/listeners/engine_listener_test.cpp

@@ -6,18 +6,16 @@
 
 #include "../../common.hpp"
 #include "../mocks.hpp"
-#include "base64.h"
 #include "engine.hpp"
 #include "json_helper.hpp"
 #include "remote_config/exception.hpp"
 #include "remote_config/listeners/engine_listener.hpp"
-#include "remote_config/product.hpp"
 #include "subscriber/waf.hpp"
 #include <memory>
 #include <rapidjson/writer.h>
 
 const std::string waf_rule =
-    R"({"version":"2.1","rules":[{"id":"1","name":"rule1","tags":{"type":"flow1","category":"category1"},"conditions":[{"operator":"match_regex","parameters":{"inputs":[{"address":"arg1","key_path":[]}],"regex":".*"}}]}]})";
+    R"({"version":"2.1","rules":[{"id":"1","name":"rule1","tags":{"type":"flow1","category":"category1"},"conditions":[{"operator":"match_regex","parameters":{"inputs":[{"address":"arg1","key_path":[]}],"regex":".*"}}]},{"id":"2","name":"rule2","tags":{"type":"flow2","category":"category2"},"conditions":[{"operator":"match_regex","parameters":{"inputs":[{"address":"dummy","key_path":[]}],"regex":".*"}}]}]})";
 
 namespace dds::remote_config {
 
@@ -978,7 +976,7 @@ TEST(RemoteConfigEngineListener, EngineRuleOverrideAndActionsUpdate)
     }
     const std::string update =
         R"({"actions": [{"id": "redirect", "type": "redirect_request", "parameters":
-            {"status_code": "303", "location": "localhost"}}],"rules_override":
+            {"status_code": "303", "location": "https://localhost"}}],"rules_override":
             [{"rules_target": [{"rule_id": "1"}], "on_match": ["redirect"]}]})";
 
     listener.on_update(get_config("ASM", update));

appsec/tests/helper/waf_test.cpp

@@ -48,7 +48,7 @@ TEST(WafTest, InitWithInvalidRules)
         waf::instance::from_settings(cs, ruleset, meta, metrics)};
 
     EXPECT_EQ(meta.size(), 2);
-    EXPECT_STREQ(meta[std::string(tag::waf_version)].c_str(), "1.18.0");
+    EXPECT_STREQ(meta[std::string(tag::waf_version)].c_str(), "1.20.1");
 
     rapidjson::Document doc;
     doc.Parse(meta[std::string(tag::event_rules_errors)]);

appsec/tests/integration/build.gradle

@@ -333,7 +333,6 @@ def buildAppSecTask = { String version, String variant ->
                         cmake -DCMAKE_BUILD_TYPE=RelWithDebInfo \\
                               -DCMAKE_INSTALL_PREFIX=/appsec \\
                               -DDD_APPSEC_ENABLE_PATCHELF_LIBC=ON \\
-                              -DCMAKE_TOOLCHAIN_FILE=/build/Toolchain.cmake \\
                               -DDD_APPSEC_TESTING=ON /project/appsec
                     make -j extension ddappsec-helper && \\
                         touch ddappsec.so libddappsec-helper.so

appsec/tests/integration/gradle/images.gradle

@@ -11,6 +11,7 @@ def phpVersions = [
         '8.1': '8.1.26',
         '8.2': '8.2.13',
         '8.3': '8.3.0',
+        '8.4': '8.4.0',
 ]
 
 def arch = System.getProperty('os.arch')

appsec/tests/integration/src/docker/apache2-fpm/Dockerfile

@@ -3,8 +3,10 @@ ARG VARIANT
 FROM datadog/dd-appsec-php-ci:php-$PHP_VERSION-$VARIANT
 
 RUN apt-get update && apt-get install -y \
-	apache2 \
-	&& rm -rf /var/lib/apt/lists/*
+    apache2 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN usermod -a -G linux_users www-data
 
 RUN rm -rf /var/www/html
 RUN sed -i '/<Directory \/var\/www\/>/,/<\/Directory>/s/AllowOverride None/AllowOverride All/' /etc/apache2/apache2.conf

appsec/tests/integration/src/docker/apache2-mod/Dockerfile

@@ -3,8 +3,10 @@ ARG VARIANT
 FROM datadog/dd-appsec-php-ci:php-$PHP_VERSION-$VARIANT
 
 RUN apt-get update && apt-get install -y \
-	apache2 \
-	&& rm -rf /var/lib/apt/lists/*
+    apache2 \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN usermod -a -G linux_users www-data
 
 RUN rm -rf /var/www/html
 RUN sed -i 's@/var/www/html@/var/www/public@' /etc/apache2/sites-available/000-default.conf

appsec/tests/integration/src/docker/nginx-fpm/Dockerfile

@@ -4,8 +4,10 @@ ARG VARIANT
 FROM datadog/dd-appsec-php-ci:php-$PHP_VERSION-$VARIANT
 
 RUN apt-get update && apt-get install -y \
-	nginx \
-	&& rm -rf /var/lib/apt/lists/*
+    nginx \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN usermod -a -G linux_users www-data
 
 RUN rm -rf /var/www/html