Skip to content

feat(appsec): enable request blocking #630

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

florentinl
Copy link
Contributor

What does this PR do?

This PR enables Appsec to block request if they are deemed dangerous by the in-app WAF.

There are three cases:

  • Blocking before executing the wrapped function, after calling asm_start_request
  • Blocking during execution of the wrapped function, by raising a BlockingException
  • Blocking after execution of the function, after calling asm_start_response

Motivation

Expand the capabilities of Appsec inside the datadog-lambda-python layer.

Testing Guidelines

I added unit tests to both test_asm.py and test_wrapper.py to ensure requests are blocked only if necessary and at the right stage.

Integration tests will be run as part of the system-test, APPSEC_BLOCKING scenario.

Types of Changes

  • Bug fix
  • New feature
  • Breaking change
  • Misc (docs, refactoring, dependency upgrade, etc.)

Check all that apply

  • This PR's description is comprehensive
  • This PR contains breaking changes that are documented in the description
  • This PR introduces new APIs or parameters that are documented and unlikely to change in the foreseeable future
  • This PR impacts documentation, and it has been updated (or a ticket has been logged)
  • This PR's changes are covered by the automated tests
  • This PR collects user input/sensitive content into Datadog
  • This PR passes the integration tests (ask a Datadog member to run the tests)

@florentinl florentinl requested review from a team as code owners July 10, 2025 09:27
@florentinl florentinl marked this pull request as draft July 10, 2025 09:27
@florentinl florentinl marked this pull request as ready for review July 10, 2025 09:33
Comment on lines 135 to 139
try:
encoded_query = urllib.parse.urlencode(parsed_query, doseq=True)
except Exception:
pass
raw_uri += "?" + encoded_query # type: ignore
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here's one way to better handle this.

Suggested change
try:
encoded_query = urllib.parse.urlencode(parsed_query, doseq=True)
except Exception:
pass
raw_uri += "?" + encoded_query # type: ignore
try:
encoded_query = urllib.parse.urlencode(parsed_query, doseq=True)
raw_uri += "?" + encoded_query # type: ignore
except Exception:
pass

Copy link
Contributor

@purple4reina purple4reina left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One small issue to fix.

@florentinl florentinl force-pushed the florentinl/APPSEC-58224/block-requests branch from ce71536 to c3fb11f Compare July 11, 2025 11:49
@florentinl florentinl force-pushed the florentinl/APPSEC-58224/block-requests branch from c3fb11f to 06c1e34 Compare July 11, 2025 12:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants