Unify roadrunner

appsec/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/RoadRunnerTests.groovy

@@ -39,8 +39,7 @@ class RoadRunnerTests implements WorkerStrategyTests {
                     baseTag: 'php',
                     phpVersion: phpVersion,
                     phpVariant: variant,
-                    www: 'roadrunner',
-                    www_src: '_handlers',
+                    www: '../../../tests/Frameworks/Roadrunner/Version_2',
             ).withEnv 'DD_REMOTE_CONFIG_ENABLED', 'false'
 
     @BeforeAll

tests/Frameworks/Roadrunner/Version_2/composer.json

@@ -1,6 +1,12 @@
 {
-    "require": {
-        "spiral/roadrunner-http": "^2.1",
-        "nyholm/psr7": "^1.5"
+  "require": {
+    "spiral/roadrunner": "2.12.3",
+    "nyholm/psr7": "^1.0"
+  },
+  "autoload": {
+    "psr-4": {
+      "App\\": "src/",
+      "Adapters\\": "adapters/"
     }
+  }
 }

appsec/tests/integration/src/test/www/roadrunner/run.sh → tests/Frameworks/Roadrunner/Version_2/run.sh

@@ -29,4 +29,3 @@ echo datadog.trace.cli_enabled=true >> /etc/php/php.ini
 ./rr serve >> /tmp/logs/rr.log 2>&1 &
 
 tail -n +1 -F "${LOGS_PHP[@]}"
-

tests/Frameworks/Roadrunner/Version_2/src/HomePageHandler.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App;
+
+use Nyholm\Psr7\Response;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+
+class HomePageHandler
+{
+    public function handle(ServerRequestInterface $req): ResponseInterface
+    {
+        $qp = $req->getQueryParams();
+        if (isset($qp['user']) && extension_loaded('ddappsec')) {
+            \datadog\appsec\track_user_login_success_event(
+                $qp['user'],
+                [
+                    'email' => 'jean.example@example.com',
+                    'session_id' => '987654321',
+                    'role' => 'admin'
+                ]
+            );
+        }
+
+        $status = 200;
+        if (isset($qp['status'])) {
+            $status = (int) $qp['status'];
+        }
+        return new Response(
+            $status,
+            ['Content-Type' => 'text/plain'],
+            "Hello world!"
+        );
+    }
+}

tests/Frameworks/Roadrunner/Version_2/src/JsonHandler.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App;
+
+use Nyholm\Psr7\Response;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+
+class JsonHandler
+{
+    public function handle(ServerRequestInterface $req): ResponseInterface
+    {
+        $qp = $req->getQueryParams();
+        if (isset($qp['block'])) {
+            $poison = 'block_this';
+        } else {
+            $poison = 'poison';
+        }
+        return new Response(
+            200,
+            ['Content-Type' => 'application/json'],
+            json_encode(['message' => ['Hello world!', 42, true, $poison]])
+        );
+    }
+}

tests/Frameworks/Roadrunner/Version_2/src/PhpInfoHandler.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App;
+
+use Nyholm\Psr7\Response;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+
+class PhpInfoHandler
+{
+    public function handle(ServerRequestInterface $request): ResponseInterface
+    {
+        \ob_start();
+        phpinfo();
+        $phpinfo = \ob_get_clean();
+
+        return new Response(
+            200,
+            ['Content-Type' => 'text/html'],
+            $phpinfo
+        );
+    }
+}

tests/Frameworks/Roadrunner/Version_2/src/PostRespondRaspHandler.php

@@ -0,0 +1,29 @@
+<?php
+
+namespace App;
+
+use Nyholm\Psr7\Response;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+
+class PostRespondRaspHandler
+{
+    public function handle(ServerRequestInterface $req): ResponseInterface
+    {
+        // Schedule RASP instrumentation to run after respond() returns, which is
+        // after ddappsec's request_shutdown has been sent. The evaluations cannot
+        // happen at that point, so each must be accounted for under RFC-1012's
+        // appsec.rasp.rule.skipped instead.
+        //
+        // The first call carries no rule variant, the second one does, so the test
+        // can check that rule_variant is only tagged when present.
+        // The ssrf address is a closed local port: the RASP push happens in a pre-hook,
+        // before any I/O, so no reachable host is needed and this fails instantly rather
+        // than stalling the worker between requests for the connect timeout.
+        $GLOBALS['_rr_post_respond'] = static function () {
+            @fopen('../etc/passwd', 'r');
+            @fopen('http://127.0.0.1:1/', 'r');
+        };
+        return new Response(200, ['Content-Type' => 'text/plain'], 'OK');
+    }
+}

tests/Frameworks/Roadrunner/Version_2/src/PostRespondTrackUserHandler.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App;
+
+use Nyholm\Psr7\Response;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+
+class PostRespondTrackUserHandler
+{
+    public function handle(ServerRequestInterface $req): ResponseInterface
+    {
+        // Schedule track_user_login_success() to run after respond() returns.
+        // worker.php consumes this callback after respond(), which is after
+        // ddappsec's request_shutdown has been sent. track_user_login_success
+        // is another RequestExec sender, so if it still reaches the helper
+        // (socket open, active=true) it sends RequestExec into the outer loop.
+        $GLOBALS['_rr_post_respond'] = static function () {
+            \datadog\appsec\v2\track_user_login_success('test-user', true);
+        };
+        return new Response(200, ['Content-Type' => 'text/plain'], 'OK');
+    }
+}

tests/Frameworks/Roadrunner/Version_2/src/Router.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App;
+
+class Router {
+    private array $routes = [];
+
+    public function addRoute($path, $handler): void
+    {
+        $this->routes[$path] = $handler;
+    }
+
+    public function getHandler($path) {
+        return $this->routes[$path] ?? null;
+    }
+}

tests/Frameworks/Roadrunner/Version_2/src/XmlHandler.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App;
+
+use Nyholm\Psr7\Response;
+use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
+
+class XmlHandler
+{
+    public function handle(ServerRequestInterface $request): ResponseInterface
+    {
+        $c = <<<XML
+<?xml version="1.0" encoding="UTF-8"?>
+<note foo="bar">
+  <from>Jean</from>
+  poison
+</note>
+XML;
+
+        return new Response(
+            200,
+            ['Content-Type' => 'application/xml'],
+            $c
+        );
+    }
+}

tests/Frameworks/Roadrunner/Version_2/worker.php

@@ -2,32 +2,50 @@
 
 require __DIR__ . '/vendor/autoload.php';
 
-use Nyholm\Psr7\Response;
-use Nyholm\Psr7\Factory\Psr17Factory;
-
-use Spiral\RoadRunner\Worker;
-use Spiral\RoadRunner\Http\PSR7Worker;
-
-
-$worker = Worker::create();
-$factory = new Psr17Factory();
-$psr7 = new PSR7Worker($worker, $factory, $factory, $factory);
-
-while (true) {
+use Spiral\RoadRunner;
+use Spiral\RoadRunner\Http\HttpWorker;
+
+$worker = RoadRunner\Worker::create();
+$httpWorker = new HttpWorker($worker);
+
+$router = new \App\Router();
+$router->addRoute('/', new \App\HomePageHandler());
+// default path TelemetryHelpers uses to flush non-request-bound telemetry
+$router->addRoute('/hello.php', new \App\HomePageHandler());
+$router->addRoute('/json', new \App\JsonHandler());
+$router->addRoute('/xml', new \App\XmlHandler());
+$router->addRoute('/post-respond-track-user', new \App\PostRespondTrackUserHandler());
+$router->addRoute('/post-respond-rasp', new \App\PostRespondRaspHandler());
+
+while ($req = $httpWorker->waitRequest()) {
     try {
-        $request = $psr7->waitRequest();
-    } catch (\Throwable $e) {
-        $psr7->respond(new Response(400));
-        continue;
-    }
+        $path = parse_url($req->uri, PHP_URL_PATH);
 
-    try {
-        if ($request->getUri()->getPath() == "/error") {
-            throw new \Exception("Error page");
+        // Tracer integration tests use /error to assert the error-span path.
+        if ($path === '/error') {
+            throw new \Exception('Error page');
         }
 
-        $psr7->respond(new Response(200, [], 'Hello RoadRunner!'));
+        $handler = $router->getHandler($path);
+        if ($handler) {
+            /** @var \Nyholm\Psr7\Response $resp */
+            $psrReq = new \Adapters\Psr17RequestAdapter($req);
+            $resp = $handler->handle($psrReq);
+            $httpWorker->respond($resp->getStatusCode(), $resp->getBody()->getContents(), $resp->getHeaders());
+        } else {
+            // Fallback for tracer tests that hit arbitrary paths (/simple, /simple_view, ...).
+            $httpWorker->respond(200, 'Hello RoadRunner!', ['Content-type' => ['text/plain; charset=UTF-8']]);
+        }
     } catch (\Throwable $e) {
-        $psr7->respond(new Response(500, [], 'Something Went Wrong!'));
+        $httpWorker->respond(
+            500,
+            "handling threw: " .  $e->getMessage(),
+            ['Content-type' => ['text/plain; charset=UTF-8']]
+        );
+    }
+    // Post-respond hook: fires after request_shutdown has been sent inside respond().
+    if (isset($GLOBALS['_rr_post_respond'])) {
+        ($GLOBALS['_rr_post_respond'])();
+        unset($GLOBALS['_rr_post_respond']);
     }
 }