Skip to content

Unify truncation limits between ObjectIntrospection and WAFModule #9168

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jul 15, 2025
Merged

Unify truncation limits between ObjectIntrospection and WAFModule #9168

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions dd-java-agent/appsec/src/main/java/com/datadog/appsec/ddwaf/WAFModule.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,9 +69,9 @@
public class WAFModule implements AppSecModule {
private static final Logger log = LoggerFactory.getLogger(WAFModule.class);

private static final int MAX_DEPTH = 10;
private static final int MAX_ELEMENTS = 150;
private static final int MAX_STRING_SIZE = 4096;
public static final int MAX_DEPTH = 20;
public static final int MAX_ELEMENTS = 256;
public static final int MAX_STRING_SIZE = 4096;
private static volatile Waf.Limits LIMITS;
private static final Class<?> PROXY_CLASS =
Proxy.getProxyClass(WAFModule.class.getClassLoader(), Set.class);
Expand Down
12 changes: 7 additions & 5 deletions dd-java-agent/appsec/src/main/java/com/datadog/appsec/event/data/ObjectIntrospection.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
package com.datadog.appsec.event.data;

import static com.datadog.appsec.ddwaf.WAFModule.MAX_DEPTH;
import static com.datadog.appsec.ddwaf.WAFModule.MAX_ELEMENTS;
import static com.datadog.appsec.ddwaf.WAFModule.MAX_STRING_SIZE;

import com.datadog.appsec.gateway.AppSecRequestContext;
import datadog.environment.JavaVirtualMachine;
import datadog.trace.api.telemetry.WafMetricCollector;
Expand All @@ -20,9 +24,7 @@
import org.slf4j.LoggerFactory;

public final class ObjectIntrospection {
private static final int MAX_DEPTH = 20;
private static final int MAX_ELEMENTS = 256;
private static final int MAX_STRING_LENGTH = 4096;

private static final Logger log = LoggerFactory.getLogger(ObjectIntrospection.class);

private static final Method trySetAccessible;
Expand Down Expand Up @@ -337,9 +339,9 @@ private static boolean setAccessible(Field field) {
}

private static String checkStringLength(final String str, final State state) {
if (str.length() > MAX_STRING_LENGTH) {
if (str.length() > MAX_STRING_SIZE) {
state.stringTooLong = true;
return str.substring(0, MAX_STRING_LENGTH);
return str.substring(0, MAX_STRING_SIZE);
}
return str;
}
Expand Down
15 changes: 9 additions & 6 deletions ...sec/src/test/groovy/com/datadog/appsec/event/data/ObjectIntrospectionSpecification.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,9 @@ import spock.lang.Shared

import java.nio.CharBuffer

import static com.datadog.appsec.ddwaf.WAFModule.MAX_DEPTH
import static com.datadog.appsec.ddwaf.WAFModule.MAX_ELEMENTS
import static com.datadog.appsec.ddwaf.WAFModule.MAX_STRING_SIZE
import static com.datadog.appsec.event.data.ObjectIntrospection.convert

class ObjectIntrospectionSpecification extends DDSpecification {
Expand Down Expand Up @@ -381,7 +384,7 @@ class ObjectIntrospectionSpecification extends DDSpecification {

void 'jackson string truncation'() {
setup:
final longString = 'A' * (ObjectIntrospection.MAX_STRING_LENGTH + 1)
final longString = 'A' * (MAX_STRING_SIZE + 1)
final jsonInput = '{"long": "' + longString + '"}'

when:
Expand All @@ -390,14 +393,14 @@ class ObjectIntrospectionSpecification extends DDSpecification {
then:
1 * ctx.setWafTruncated()
1 * wafMetricCollector.wafInputTruncated(true, false, false)
result["long"].length() <= ObjectIntrospection.MAX_STRING_LENGTH
result["long"].length() <= MAX_STRING_SIZE
}

void 'jackson with deep nesting triggers depth limit'() {
setup:
// Create deeply nested JSON
final json = JsonOutput.toJson(
(1..(ObjectIntrospection.MAX_DEPTH + 1)).inject([:], { result, i -> [("child_$i".toString()) : result] })
(1..(MAX_DEPTH + 1)).inject([:], { result, i -> [("child_$i".toString()) : result] })
)

when:
Expand All @@ -407,13 +410,13 @@ class ObjectIntrospectionSpecification extends DDSpecification {
// Should truncate at max depth and set truncation flag
1 * ctx.setWafTruncated()
1 * wafMetricCollector.wafInputTruncated(false, false, true)
countNesting(result as Map, 0) <= ObjectIntrospection.MAX_DEPTH
countNesting(result as Map, 0) <= MAX_DEPTH
}

void 'jackson with large arrays triggers element limit'() {
setup:
// Create large array
final largeArray = (1..(ObjectIntrospection.MAX_ELEMENTS + 1)).toList()
final largeArray = (1..(MAX_ELEMENTS + 1)).toList()
final json = new JsonBuilder(largeArray).toString()

when:
Expand All @@ -423,7 +426,7 @@ class ObjectIntrospectionSpecification extends DDSpecification {
// Should truncate and set truncation flag
1 * ctx.setWafTruncated()
1 * wafMetricCollector.wafInputTruncated(false, true, false)
result.size() <= ObjectIntrospection.MAX_ELEMENTS
result.size() <= MAX_ELEMENTS
}

void 'jackson number type variations'() {
Expand Down
Loading