Skip to content

Commit

Permalink
Merge branch 'master' into anilm3/waf_builder
Browse files Browse the repository at this point in the history
  • Loading branch information
@Anilm3
Anilm3 authored Jan 23, 2025
2 parents 0f0df28 + 73ad8e7 commit e2b36fe
Show file tree
Hide file tree
Showing 5 changed files with 81 additions and 33 deletions.
2 changes: 1 addition & 1 deletion fuzzer/http_endpoint_fingerprint/src/main.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ extern "C" int LLVMFuzzerTestOneInput(const uint8_t *bytes, size_t size)
processor_cache cache;
ddwaf::timer deadline{2s};
auto [output, attr] = gen.eval_impl({{}, {}, false, buffer.get<std::string_view>()},
{{}, {}, false, buffer.get<std::string_view>()}, {{}, {}, false, &query},
{{}, {}, false, buffer.get<std::string_view>()}, {{{}, {}, false, &query}},
{{{}, {}, false, &body}}, cache, deadline);

ddwaf_object_free(&query);
Expand Down
4 changes: 2 additions & 2 deletions src/processor/fingerprint.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -553,7 +553,7 @@ std::pair<header_type, unsigned> get_header_type_and_index(std::string_view head
// NOLINTNEXTLINE(readability-convert-member-functions-to-static)
std::pair<ddwaf_object, object_store::attribute> http_endpoint_fingerprint::eval_impl(
const unary_argument<std::string_view> &method, const unary_argument<std::string_view> &uri_raw,
const unary_argument<const ddwaf_object *> &query,
const optional_argument<const ddwaf_object *> &query,
const optional_argument<const ddwaf_object *> &body, processor_cache &cache,
ddwaf::timer &deadline) const
{
Expand All @@ -573,7 +573,7 @@ std::pair<ddwaf_object, object_store::attribute> http_endpoint_fingerprint::eval
try {
res = generate_fragment_cached("http", cache.fingerprint.fragment_fields,
string_field{method.value}, string_hash_field{stripped_uri},
key_hash_field{query.value}, optional_generator<key_hash_field>{body});
optional_generator<key_hash_field>{query}, optional_generator<key_hash_field>{body});
} catch (const std::out_of_range &e) {
DDWAF_WARN("Failed to generate http endpoint fingerprint: {}", e.what());
}
Expand Down
2 changes: 1 addition & 1 deletion src/processor/fingerprint.hpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ class http_endpoint_fingerprint : public structured_processor<http_endpoint_fing
std::pair<ddwaf_object, object_store::attribute> eval_impl(
const unary_argument<std::string_view> &method,
const unary_argument<std::string_view> &uri_raw,
const unary_argument<const ddwaf_object *> &query,
const optional_argument<const ddwaf_object *> &query,
const optional_argument<const ddwaf_object *> &body, processor_cache &cache,
ddwaf::timer &deadline) const;
};
Expand Down
76 changes: 62 additions & 14 deletions tests/integration/processors/fingerprint/test.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -144,10 +144,6 @@ TEST(TestFingerprintIntegration, PostprocessorRegeneration)
ddwaf_object map = DDWAF_OBJECT_MAP;
ddwaf_object settings = DDWAF_OBJECT_MAP;

ddwaf_object query = DDWAF_OBJECT_MAP;
ddwaf_object_map_add(&query, "key", ddwaf_object_invalid(&tmp));
ddwaf_object_map_add(&map, "server.request.query", &query);

ddwaf_object_map_add(
&map, "server.request.uri.raw", ddwaf_object_string(&tmp, "/path/to/resource/?key="));
ddwaf_object_map_add(&map, "server.request.method", ddwaf_object_string(&tmp, "PuT"));
Expand Down Expand Up @@ -188,7 +184,7 @@ TEST(TestFingerprintIntegration, PostprocessorRegeneration)
EXPECT_EQ(ddwaf_object_size(&out.derivatives), 3);

auto derivatives = test::object_to_map(out.derivatives);
EXPECT_STRV(derivatives["_dd.appsec.fp.http.endpoint"], "http-put-729d56c3-2c70e12b-");
EXPECT_STRV(derivatives["_dd.appsec.fp.http.endpoint"], "http-put-729d56c3--");
EXPECT_STRV(derivatives["_dd.appsec.fp.http.header"], "hdr-1111111111-a441b15f-0-");
EXPECT_STRV(derivatives["_dd.appsec.fp.http.network"], "net-1-1111111111");

Expand All @@ -210,6 +206,27 @@ TEST(TestFingerprintIntegration, PostprocessorRegeneration)

EXPECT_EQ(ddwaf_object_size(&out.derivatives), 1);

auto derivatives = test::object_to_map(out.derivatives);
EXPECT_STRV(derivatives["_dd.appsec.fp.http.endpoint"], "http-put-729d56c3--2c70e12b");

ddwaf_result_free(&out);
}

{
ddwaf_object tmp;

ddwaf_object map = DDWAF_OBJECT_MAP;

ddwaf_object query = DDWAF_OBJECT_MAP;
ddwaf_object_map_add(&query, "key", ddwaf_object_invalid(&tmp));
ddwaf_object_map_add(&map, "server.request.query", &query);

ddwaf_result out;
ASSERT_EQ(ddwaf_run(context, &map, nullptr, &out, LONG_TIME), DDWAF_OK);
EXPECT_FALSE(out.timeout);

EXPECT_EQ(ddwaf_object_size(&out.derivatives), 1);

auto derivatives = test::object_to_map(out.derivatives);
EXPECT_STRV(
derivatives["_dd.appsec.fp.http.endpoint"], "http-put-729d56c3-2c70e12b-2c70e12b");
Expand Down Expand Up @@ -469,10 +486,6 @@ TEST(TestFingerprintIntegration, PreprocessorRegeneration)
ddwaf_object map = DDWAF_OBJECT_MAP;
ddwaf_object settings = DDWAF_OBJECT_MAP;

ddwaf_object query = DDWAF_OBJECT_MAP;
ddwaf_object_map_add(&query, "key", ddwaf_object_invalid(&tmp));
ddwaf_object_map_add(&map, "server.request.query", &query);

ddwaf_object_map_add(
&map, "server.request.uri.raw", ddwaf_object_string(&tmp, "/path/to/resource/?key="));
ddwaf_object_map_add(&map, "server.request.method", ddwaf_object_string(&tmp, "PuT"));
Expand Down Expand Up @@ -538,6 +551,24 @@ TEST(TestFingerprintIntegration, PreprocessorRegeneration)
ddwaf_result_free(&out);
}

{
ddwaf_object tmp;

ddwaf_object map = DDWAF_OBJECT_MAP;

ddwaf_object query = DDWAF_OBJECT_MAP;
ddwaf_object_map_add(&query, "key", ddwaf_object_invalid(&tmp));
ddwaf_object_map_add(&map, "server.request.query", &query);

ddwaf_result out;
ASSERT_EQ(ddwaf_run(context, &map, nullptr, &out, LONG_TIME), DDWAF_OK);
EXPECT_FALSE(out.timeout);

EXPECT_EQ(ddwaf_object_size(&out.derivatives), 0);

ddwaf_result_free(&out);
}

{
ddwaf_object tmp;

Expand Down Expand Up @@ -816,10 +847,6 @@ TEST(TestFingerprintIntegration, ProcessorRegeneration)
ddwaf_object map = DDWAF_OBJECT_MAP;
ddwaf_object settings = DDWAF_OBJECT_MAP;

ddwaf_object query = DDWAF_OBJECT_MAP;
ddwaf_object_map_add(&query, "key", ddwaf_object_invalid(&tmp));
ddwaf_object_map_add(&map, "server.request.query", &query);

ddwaf_object_map_add(
&map, "server.request.uri.raw", ddwaf_object_string(&tmp, "/path/to/resource/?key="));
ddwaf_object_map_add(&map, "server.request.method", ddwaf_object_string(&tmp, "PuT"));
Expand Down Expand Up @@ -884,13 +911,34 @@ TEST(TestFingerprintIntegration, ProcessorRegeneration)
EXPECT_EQ(ddwaf_object_size(&out.derivatives), 3);

auto derivatives = test::object_to_map(out.derivatives);
EXPECT_STRV(derivatives["_dd.appsec.fp.http.endpoint"], "http-put-729d56c3-2c70e12b-");
EXPECT_STRV(derivatives["_dd.appsec.fp.http.endpoint"], "http-put-729d56c3--");
EXPECT_STRV(derivatives["_dd.appsec.fp.http.header"], "hdr-1111111111-a441b15f-0-");
EXPECT_STRV(derivatives["_dd.appsec.fp.http.network"], "net-1-1111111111");

ddwaf_result_free(&out);
}

{
ddwaf_object tmp;

ddwaf_object map = DDWAF_OBJECT_MAP;

ddwaf_object query = DDWAF_OBJECT_MAP;
ddwaf_object_map_add(&query, "key", ddwaf_object_invalid(&tmp));
ddwaf_object_map_add(&map, "server.request.query", &query);

ddwaf_result out;
ASSERT_EQ(ddwaf_run(context, &map, nullptr, &out, LONG_TIME), DDWAF_OK);
EXPECT_FALSE(out.timeout);

EXPECT_EQ(ddwaf_object_size(&out.derivatives), 1);

auto derivatives = test::object_to_map(out.derivatives);
EXPECT_STRV(derivatives["_dd.appsec.fp.http.endpoint"], "http-put-729d56c3-2c70e12b-");

ddwaf_result_free(&out);
}

{
ddwaf_object tmp;

Expand Down
30 changes: 15 additions & 15 deletions tests/unit/processor/fingerprint_test.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ TEST(TestHttpEndpointFingerprint, Basic)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down Expand Up @@ -70,7 +70,7 @@ TEST(TestHttpEndpointFingerprint, EmptyQuery)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down Expand Up @@ -101,7 +101,7 @@ TEST(TestHttpEndpointFingerprint, EmptyBody)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand All @@ -126,7 +126,7 @@ TEST(TestHttpEndpointFingerprint, EmptyEverything)
ddwaf::timer deadline{2s};
processor_cache cache;
auto [output, attr] = gen.eval_impl({{}, {}, false, ""}, {{}, {}, false, ""},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down Expand Up @@ -161,7 +161,7 @@ TEST(TestHttpEndpointFingerprint, KeyConsistency)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down Expand Up @@ -196,7 +196,7 @@ TEST(TestHttpEndpointFingerprint, InvalidQueryType)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down Expand Up @@ -231,7 +231,7 @@ TEST(TestHttpEndpointFingerprint, InvalidBodyType)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down Expand Up @@ -266,7 +266,7 @@ TEST(TestHttpEndpointFingerprint, InvalidQueryAndBodyType)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down Expand Up @@ -301,7 +301,7 @@ TEST(TestHttpEndpointFingerprint, UriRawConsistency)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand All @@ -316,7 +316,7 @@ TEST(TestHttpEndpointFingerprint, UriRawConsistency)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever#fragment"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand All @@ -330,7 +330,7 @@ TEST(TestHttpEndpointFingerprint, UriRawConsistency)
ddwaf::timer deadline{2s};
processor_cache cache;
auto [output, attr] = gen.eval_impl({{}, {}, false, "GET"},
{{}, {}, false, "/path/to/whatever?param=hello#fragment"}, {{}, {}, false, &query},
{{}, {}, false, "/path/to/whatever?param=hello#fragment"}, {{{}, {}, false, &query}},
{{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);
Expand All @@ -346,7 +346,7 @@ TEST(TestHttpEndpointFingerprint, UriRawConsistency)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand All @@ -361,7 +361,7 @@ TEST(TestHttpEndpointFingerprint, UriRawConsistency)
processor_cache cache;
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/PaTh/To/WhAtEVER"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down Expand Up @@ -392,7 +392,7 @@ TEST(TestHttpEndpointFingerprint, Regeneration)
ddwaf::timer deadline{2s};
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, std::nullopt, cache, deadline);
{{{}, {}, false, &query}}, std::nullopt, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand All @@ -414,7 +414,7 @@ TEST(TestHttpEndpointFingerprint, Regeneration)
ddwaf::timer deadline{2s};
auto [output, attr] =
gen.eval_impl({{}, {}, false, "GET"}, {{}, {}, false, "/path/to/whatever?param=hello"},
{{}, {}, false, &query}, {{{}, {}, false, &body}}, cache, deadline);
{{{}, {}, false, &query}}, {{{}, {}, false, &body}}, cache, deadline);
EXPECT_EQ(output.type, DDWAF_OBJ_STRING);
EXPECT_EQ(attr, object_store::attribute::none);

Expand Down

0 comments on commit e2b36fe

Please sign in to comment.