Replace direct AppSec::Processor::Context calls

DataDog · Jan 10, 2025 · 2f21fa1 · 2f21fa1
1 parent fae2610
commit 2f21fa1
Show file tree

Hide file tree

Showing 28 changed files with 140 additions and 140 deletions.
diff --git a/lib/datadog/appsec/context.rb b/lib/datadog/appsec/context.rb
@@ -7,10 +7,10 @@ module AppSec
     class Context
       ActiveContextError = Class.new(StandardError)
 
-      # XXX: Continue from here:
-      #        1. Replace naming of processor_context into waf_runner
-      #        2. Replace calls of waf run
-      attr_reader :trace, :span, :processor_context
+      attr_reader :trace, :span
+
+      # NOTE: This is an intermediate state and will be changed
+      attr_reader :waf_runner
 
       class << self
         def activate(context)
@@ -36,9 +36,6 @@ def initialize(trace, span, security_engine)
         @span = span
         @security_engine = security_engine
         @waf_runner = security_engine.new_context
-
-        # FIXME: Left for compatibility now
-        @processor_context = @waf_runner
       end
 
       def run_waf(persistent_data, ephemeral_data, timeout = WAF::LibDDWAF::DDWAF_RUN_TIMEOUT)

diff --git a/lib/datadog/appsec/contrib/active_record/instrumentation.rb b/lib/datadog/appsec/contrib/active_record/instrumentation.rb
@@ -23,7 +23,7 @@ def detect_sql_injection(sql, adapter_name)
             }
 
             waf_timeout = Datadog.configuration.appsec.waf_timeout
-            result = context.processor_context.run({}, ephemeral_data, waf_timeout)
+            result = context.run_rasp(Ext::RASP_SQLI, {}, ephemeral_data, waf_timeout)
 
             if result.status == :match
               Datadog::AppSec::Event.tag_and_keep!(context, result)
@@ -35,7 +35,7 @@ def detect_sql_injection(sql, adapter_name)
                 sql: sql,
                 actions: result.actions
               }
-              context.processor_context.events << event
+              context.waf_runner.events << event
             end
           end
 

diff --git a/lib/datadog/appsec/contrib/graphql/gateway/watcher.rb b/lib/datadog/appsec/contrib/graphql/gateway/watcher.rb
@@ -28,7 +28,7 @@ def watch_multiplex(gateway = Instrumentation.gateway)
                   engine = AppSec::Reactive::Engine.new
 
                   if context
-                    GraphQL::Reactive::Multiplex.subscribe(engine, context.processor_context) do |result|
+                    GraphQL::Reactive::Multiplex.subscribe(engine, context) do |result|
                       event = {
                         waf_result: result,
                         trace: context.trace,
@@ -38,7 +38,7 @@ def watch_multiplex(gateway = Instrumentation.gateway)
                       }
 
                       Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.processor_context.events << event
+                      context.waf_runner.events << event
                     end
 
                     block = GraphQL::Reactive::Multiplex.publish(engine, gateway_multiplex)

diff --git a/lib/datadog/appsec/contrib/graphql/reactive/multiplex.rb b/lib/datadog/appsec/contrib/graphql/reactive/multiplex.rb
@@ -20,7 +20,7 @@ def self.publish(engine, gateway_multiplex)
               end
             end
 
-            def self.subscribe(engine, waf_context)
+            def self.subscribe(engine, context)
               engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 arguments = values[0]
@@ -30,7 +30,7 @@ def self.subscribe(engine, waf_context)
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
                 next if result.status != :match
 

diff --git a/lib/datadog/appsec/contrib/rack/gateway/watcher.rb b/lib/datadog/appsec/contrib/rack/gateway/watcher.rb
@@ -29,7 +29,7 @@ def watch_request(gateway = Instrumentation.gateway)
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
                   engine = AppSec::Reactive::Engine.new
 
-                  Rack::Reactive::Request.subscribe(engine, context.processor_context) do |result|
+                  Rack::Reactive::Request.subscribe(engine, context) do |result|
                     if result.status == :match
                       # TODO: should this hash be an Event instance instead?
                       event = {
@@ -43,7 +43,7 @@ def watch_request(gateway = Instrumentation.gateway)
                       # We want to keep the trace in case of security event
                       context.trace.keep! if context.trace
                       Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.processor_context.events << event
+                      context.waf_runner.events << event
                     end
                   end
 
@@ -67,7 +67,7 @@ def watch_response(gateway = Instrumentation.gateway)
                   context = gateway_response.context
                   engine = AppSec::Reactive::Engine.new
 
-                  Rack::Reactive::Response.subscribe(engine, context.processor_context) do |result|
+                  Rack::Reactive::Response.subscribe(engine, context) do |result|
                     if result.status == :match
                       # TODO: should this hash be an Event instance instead?
                       event = {
@@ -81,7 +81,7 @@ def watch_response(gateway = Instrumentation.gateway)
                       # We want to keep the trace in case of security event
                       context.trace.keep! if context.trace
                       Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.processor_context.events << event
+                      context.waf_runner.events << event
                     end
                   end
 
@@ -105,7 +105,7 @@ def watch_request_body(gateway = Instrumentation.gateway)
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
                   engine = AppSec::Reactive::Engine.new
 
-                  Rack::Reactive::RequestBody.subscribe(engine, context.processor_context) do |result|
+                  Rack::Reactive::RequestBody.subscribe(engine, context) do |result|
                     if result.status == :match
                       # TODO: should this hash be an Event instance instead?
                       event = {
@@ -119,7 +119,7 @@ def watch_request_body(gateway = Instrumentation.gateway)
                       # We want to keep the trace in case of security event
                       context.trace.keep! if context.trace
                       Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.processor_context.events << event
+                      context.waf_runner.events << event
                     end
                   end
 

diff --git a/lib/datadog/appsec/contrib/rack/reactive/request.rb b/lib/datadog/appsec/contrib/rack/reactive/request.rb
@@ -30,7 +30,7 @@ def self.publish(engine, gateway_request)
               end
             end
 
-            def self.subscribe(engine, waf_context)
+            def self.subscribe(engine, context)
               engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
 
@@ -53,7 +53,7 @@ def self.subscribe(engine, waf_context)
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
                 next if result.status != :match
 

diff --git a/lib/datadog/appsec/contrib/rack/reactive/request_body.rb b/lib/datadog/appsec/contrib/rack/reactive/request_body.rb
@@ -21,7 +21,7 @@ def self.publish(engine, gateway_request)
               end
             end
 
-            def self.subscribe(engine, waf_context)
+            def self.subscribe(engine, context)
               engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 body = values[0]
@@ -31,7 +31,7 @@ def self.subscribe(engine, waf_context)
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
                 next if result.status != :match
 

diff --git a/lib/datadog/appsec/contrib/rack/reactive/response.rb b/lib/datadog/appsec/contrib/rack/reactive/response.rb
@@ -22,7 +22,7 @@ def self.publish(engine, gateway_response)
               end
             end
 
-            def self.subscribe(engine, waf_context)
+            def self.subscribe(engine, context)
               engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
 
@@ -37,7 +37,7 @@ def self.subscribe(engine, waf_context)
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
                 next if result.status != :match
 

diff --git a/lib/datadog/appsec/contrib/rack/request_middleware.rb b/lib/datadog/appsec/contrib/rack/request_middleware.rb
@@ -94,22 +94,22 @@ def call(env)
 
             _response_return, response_response = Instrumentation.gateway.push('rack.response', gateway_response)
 
-            result = ctx.processor_context.extract_schema
+            result = ctx.waf_runner.extract_schema
 
             if result
-              ctx.processor_context.events << {
+              ctx.waf_runner.events << {
                 trace: ctx.trace,
                 span: ctx.span,
                 waf_result: result,
               }
             end
 
-            ctx.processor_context.events.each do |e|
+            ctx.waf_runner.events.each do |e|
               e[:response] ||= gateway_response
               e[:request]  ||= gateway_request
             end
 
-            AppSec::Event.record(ctx.span, *ctx.processor_context.events)
+            AppSec::Event.record(ctx.span, *ctx.waf_runner.events)
 
             if response_response
               blocked_event = response_response.find { |action, _options| action == :block }
@@ -209,7 +209,7 @@ def add_request_tags(context, env)
 
           def add_waf_runtime_tags(context)
             span = context.span
-            context = context.processor_context
+            context = context.waf_runner
 
             return unless span && context
 

diff --git a/lib/datadog/appsec/contrib/rails/gateway/watcher.rb b/lib/datadog/appsec/contrib/rails/gateway/watcher.rb
@@ -25,7 +25,7 @@ def watch_request_action(gateway = Instrumentation.gateway)
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
                   engine = AppSec::Reactive::Engine.new
 
-                  Rails::Reactive::Action.subscribe(engine, context.processor_context) do |result|
+                  Rails::Reactive::Action.subscribe(engine, context) do |result|
                     if result.status == :match
                       # TODO: should this hash be an Event instance instead?
                       event = {
@@ -39,7 +39,7 @@ def watch_request_action(gateway = Instrumentation.gateway)
                       # We want to keep the trace in case of security event
                       context.trace.keep! if context.trace
                       Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.processor_context.events << event
+                      context.waf_runner.events << event
                     end
                   end
 

diff --git a/lib/datadog/appsec/contrib/rails/reactive/action.rb b/lib/datadog/appsec/contrib/rails/reactive/action.rb
@@ -25,7 +25,7 @@ def self.publish(engine, gateway_request)
               end
             end
 
-            def self.subscribe(engine, waf_context)
+            def self.subscribe(engine, context)
               engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 body = values[0]
@@ -37,7 +37,7 @@ def self.subscribe(engine, waf_context)
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
                 next if result.status != :match
 

diff --git a/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb b/lib/datadog/appsec/contrib/sinatra/gateway/watcher.rb
@@ -27,7 +27,7 @@ def watch_request_dispatch(gateway = Instrumentation.gateway)
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
                   engine = AppSec::Reactive::Engine.new
 
-                  Rack::Reactive::RequestBody.subscribe(engine, context.processor_context) do |result|
+                  Rack::Reactive::RequestBody.subscribe(engine, context) do |result|
                     if result.status == :match
                       # TODO: should this hash be an Event instance instead?
                       event = {
@@ -41,7 +41,7 @@ def watch_request_dispatch(gateway = Instrumentation.gateway)
                       # We want to keep the trace in case of security event
                       context.trace.keep! if context.trace
                       Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.processor_context.events << event
+                      context.waf_runner.events << event
                     end
                   end
 
@@ -65,7 +65,7 @@ def watch_request_routed(gateway = Instrumentation.gateway)
                   context = gateway_request.env[Datadog::AppSec::Ext::CONTEXT_KEY]
                   engine = AppSec::Reactive::Engine.new
 
-                  Sinatra::Reactive::Routed.subscribe(engine, context.processor_context) do |result|
+                  Sinatra::Reactive::Routed.subscribe(engine, context) do |result|
                     if result.status == :match
                       # TODO: should this hash be an Event instance instead?
                       event = {
@@ -79,7 +79,7 @@ def watch_request_routed(gateway = Instrumentation.gateway)
                       # We want to keep the trace in case of security event
                       context.trace.keep! if context.trace
                       Datadog::AppSec::Event.tag_and_keep!(context, result)
-                      context.processor_context.events << event
+                      context.waf_runner.events << event
                     end
                   end
 

diff --git a/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb b/lib/datadog/appsec/contrib/sinatra/reactive/routed.rb
@@ -22,7 +22,7 @@ def self.publish(engine, data)
               end
             end
 
-            def self.subscribe(engine, waf_context)
+            def self.subscribe(engine, context)
               engine.subscribe(*ADDRESSES) do |*values|
                 Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
                 path_params = values[0]
@@ -32,7 +32,7 @@ def self.subscribe(engine, waf_context)
                 }
 
                 waf_timeout = Datadog.configuration.appsec.waf_timeout
-                result = waf_context.run(persistent_data, {}, waf_timeout)
+                result = context.run_waf(persistent_data, {}, waf_timeout)
 
                 next if result.status != :match
 

diff --git a/lib/datadog/appsec/ext.rb b/lib/datadog/appsec/ext.rb
@@ -3,6 +3,7 @@
 module Datadog
   module AppSec
     module Ext
+      RASP_SQLI = :sql_injection
       INTERRUPT = :datadog_appsec_interrupt
       CONTEXT_KEY = 'datadog.appsec.context'
       ACTIVE_CONTEXT_KEY = :datadog_appsec_active_context

diff --git a/lib/datadog/appsec/monitor/gateway/watcher.rb b/lib/datadog/appsec/monitor/gateway/watcher.rb
@@ -23,7 +23,7 @@ def watch_user_id(gateway = Instrumentation.gateway)
                 context = Datadog::AppSec.active_context
                 engine = AppSec::Reactive::Engine.new
 
-                Monitor::Reactive::SetUser.subscribe(engine, context.processor_context) do |result|
+                Monitor::Reactive::SetUser.subscribe(engine, context) do |result|
                   if result.status == :match
                     # TODO: should this hash be an Event instance instead?
                     event = {
@@ -37,7 +37,7 @@ def watch_user_id(gateway = Instrumentation.gateway)
                     # We want to keep the trace in case of security event
                     context.trace.keep! if context.trace
                     Datadog::AppSec::Event.tag_and_keep!(context, result)
-                    context.processor_context.events << event
+                    context.waf_runner.events << event
                   end
                 end
 

diff --git a/lib/datadog/appsec/monitor/reactive/set_user.rb b/lib/datadog/appsec/monitor/reactive/set_user.rb
@@ -19,7 +19,7 @@ def self.publish(engine, user)
             end
           end
 
-          def self.subscribe(engine, waf_context)
+          def self.subscribe(engine, context)
             engine.subscribe(*ADDRESSES) do |*values|
               Datadog.logger.debug { "reacted to #{ADDRESSES.inspect}: #{values.inspect}" }
 
@@ -30,7 +30,7 @@ def self.subscribe(engine, waf_context)
               }
 
               waf_timeout = Datadog.configuration.appsec.waf_timeout
-              result = waf_context.run(persistent_data, {}, waf_timeout)
+              result = context.run_waf(persistent_data, {}, waf_timeout)
 
               next if result.status != :match