Release v1.17.0-alpha1 and fixes

.github/workflows/build.yml

@@ -326,7 +326,7 @@ jobs:
     if: startsWith(github.ref, 'refs/tags/')
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@v4
         with:
           path: artifacts
       - name: Display structure of downloaded files

CHANGELOG.md

@@ -1,4 +1,11 @@
 # libddwaf release
+### v1.17.0-alpha1 ([unstable](https://github.com/DataDog/libddwaf/blob/master/README.md#versioning-semantics))
+#### Fixes
+- Fix parsing of variadic arguments ([#267](https://github.com/DataDog/libddwaf/pull/267))
+
+#### Miscellaneous
+- Update node-16 actions to node-20 ones ([#266](https://github.com/DataDog/libddwaf/pull/266))
+
 ### v1.17.0-alpha0 ([unstable](https://github.com/DataDog/libddwaf/blob/master/README.md#versioning-semantics))
 #### Changes
 - Multivariate operator support ([#241](https://github.com/DataDog/libddwaf/pull/241))

src/condition/structured_condition.hpp

@@ -186,8 +186,8 @@ template <typename Self> class base_impl : public base_condition {
         return std::array<parameter_specification, sizeof...(Is)>{{
             {
                 param_names[Is],
-                argument_retriever<typename func_traits::template arg_type<Is>>::is_optional,
                 argument_retriever<typename func_traits::template arg_type<Is>>::is_variadic,
+                argument_retriever<typename func_traits::template arg_type<Is>>::is_optional,
             }...,
         }};
     }

validator/tests/rules/structured/001_lfi_basic_run_match.yaml

@@ -3,15 +3,15 @@
   runs: [
     {
       persistent-input: {
-        server.app.include_path: "documents/../../../../../../../../../etc/passwd",
+        server.io.fs.file: "documents/../../../../../../../../../etc/passwd",
         server.request.query: [ "../../../../../../../../../etc/passwd" ]
       },
       rules: [
         {
           "rsp-930-001": [
             {
               resource: {
-                address: "server.app.include_path",
+                address: "server.io.fs.file",
                 value: "documents/../../../../../../../../../etc/passwd"
               },
               params: {

validator/tests/rules/structured/ruleset.yaml

@@ -11,7 +11,12 @@ rules:
     conditions:
       - parameters:
           resource:
-            - address: server.app.include_path
+            - address: server.io.fs.file
           params:
             - address: server.request.query
+            - address: server.request.body
+            - address: server.request.path_params
+            - address: grpc.server.request.message
+            - address: graphql.server.all_resolvers
+            - address: graphql.server.resolver
         operator: lfi_detector

version

@@ -1 +1 @@
-1.17.0-alpha0
+1.17.0-alpha1