pr

Author: sezen-datadog

dd-java-agent/appsec/src/main/java/com/datadog/appsec/gateway/AppSecRequestContext.java

@@ -77,9 +77,9 @@ public class AppSecRequestContext implements DataBundle, Closeable {
   public static final Set<String> RESPONSE_HEADERS_ALLOW_LIST =
       new TreeSet<>(
           Arrays.asList("content-length", "content-type", "content-encoding", "content-language"));
-  private static final int DD_WAF_RUN_INTERNAL_ERROR = -3;
-  private static final int DD_WAF_RUN_INVALID_OBJECT_ERROR = -2;
-  private static final int DD_WAF_RUN_INVALID_ARGUMENT_ERROR = -1;
+  public static final int DD_WAF_RUN_INTERNAL_ERROR = -3;
+  public static final int DD_WAF_RUN_INVALID_OBJECT_ERROR = -2;
+  public static final int DD_WAF_RUN_INVALID_ARGUMENT_ERROR = -1;
 
   static {
     REQUEST_HEADERS_ALLOW_LIST.addAll(DEFAULT_REQUEST_HEADERS_ALLOW_LIST);

dd-java-agent/appsec/src/test/groovy/com/datadog/appsec/gateway/AppSecRequestContextSpecification.groovy

@@ -293,14 +293,14 @@ class AppSecRequestContextSpecification extends DDSpecification {
 
   def "test increase and get RaspErrors"() {
     when:
-    ctx.increaseRaspErrorCode(-3)
-    ctx.increaseRaspErrorCode(-3)
-    ctx.increaseRaspErrorCode(-2)
+    ctx.increaseRaspErrorCode(AppSecRequestContext.DD_WAF_RUN_INTERNAL_ERROR)
+    ctx.increaseRaspErrorCode(AppSecRequestContext.DD_WAF_RUN_INTERNAL_ERROR)
+    ctx.increaseRaspErrorCode(AppSecRequestContext.DD_WAF_RUN_INVALID_OBJECT_ERROR)
 
     then:
-    ctx.getRaspError(-3) == 2
-    ctx.getRaspError(-2) == 1
-    ctx.getRaspError(-1) == 0
+    ctx.getRaspError(AppSecRequestContext.DD_WAF_RUN_INTERNAL_ERROR) == 2
+    ctx.getRaspError(AppSecRequestContext.DD_WAF_RUN_INVALID_OBJECT_ERROR) == 1
+    ctx.getRaspError(AppSecRequestContext.DD_WAF_RUN_INVALID_ARGUMENT_ERROR) == 0
     ctx.getRaspError(0) == 0
   }
 }

internal-api/src/test/groovy/datadog/trace/api/telemetry/WafMetricCollectorTest.groovy

@@ -8,6 +8,9 @@ import java.util.concurrent.TimeUnit
 
 class WafMetricCollectorTest extends DDSpecification {
 
+  public static final int DD_WAF_RUN_INTERNAL_ERROR = -3
+  public static final int DD_WAF_RUN_INVALID_OBJECT_ERROR = -2
+
   def "no metrics - drain empty list"() {
     when:
     WafMetricCollector.get().prepareMetrics()
@@ -32,8 +35,8 @@ class WafMetricCollectorTest extends DDSpecification {
     WafMetricCollector.get().raspRuleMatch(RuleType.SQL_INJECTION)
     WafMetricCollector.get().raspRuleEval(RuleType.SQL_INJECTION)
     WafMetricCollector.get().raspTimeout(RuleType.SQL_INJECTION)
-    WafMetricCollector.get().raspErrorCode(RuleType.SHELL_INJECTION, -3)
-    WafMetricCollector.get().raspErrorCode(RuleType.SQL_INJECTION, -2)
+    WafMetricCollector.get().raspErrorCode(RuleType.SHELL_INJECTION, DD_WAF_RUN_INTERNAL_ERROR)
+    WafMetricCollector.get().raspErrorCode(RuleType.SQL_INJECTION, DD_WAF_RUN_INVALID_OBJECT_ERROR)
 
     WafMetricCollector.get().prepareMetrics()
 
@@ -144,15 +147,20 @@ class WafMetricCollectorTest extends DDSpecification {
       'rule_type:command_injection',
       'rule_variant:shell',
       'event_rules_version:rules.3',
-      'waf_error:-3'
+      'waf_error:' + DD_WAF_RUN_INTERNAL_ERROR
     ].toSet()
 
     def raspInvalidObjectCode = (WafMetricCollector.RaspError)metrics[11]
     raspInvalidObjectCode.type == 'count'
     raspInvalidObjectCode.value == 1
     raspInvalidObjectCode.namespace == 'appsec'
     raspInvalidObjectCode.metricName == 'rasp.error'
-    raspInvalidObjectCode.tags.toSet() == ['rule_type:sql_injection', 'waf_version:waf_ver1', 'waf_error:-2'].toSet()
+    raspInvalidObjectCode.tags.toSet() == [
+      'rule_type:sql_injection',
+      'waf_version:waf_ver1',
+      'waf_error:' + DD_WAF_RUN_INVALID_OBJECT_ERROR
+    ]
+    .toSet()
   }
 
   def "overflowing WafMetricCollector does not crash"() {
@@ -326,7 +334,7 @@ class WafMetricCollectorTest extends DDSpecification {
     WafMetricCollector.get().raspRuleMatch(ruleType)
     WafMetricCollector.get().raspRuleEval(ruleType)
     WafMetricCollector.get().raspTimeout(ruleType)
-    WafMetricCollector.get().raspErrorCode(ruleType, -3)
+    WafMetricCollector.get().raspErrorCode(ruleType, DD_WAF_RUN_INTERNAL_ERROR)
     WafMetricCollector.get().prepareMetrics()
 
     then:
@@ -378,7 +386,7 @@ class WafMetricCollectorTest extends DDSpecification {
       'rule_type:command_injection',
       'rule_variant:' + ruleType.variant,
       'event_rules_version:rules.1',
-      'waf_error:-3'
+      'waf_error:' + DD_WAF_RUN_INTERNAL_ERROR
     ].toSet()
 
     where: