Support for per-input transformers

src/PWTransformer.cpp

@@ -1403,7 +1403,7 @@ PW_TRANSFORM_ID PWTransformer::getIDForString(std::string_view str)
     else if (str == "keys_only")
         return PWT_KEYS_ONLY;
     else if (str == "values_only")
-        return PWT_KEYS_ONLY;
+        return PWT_VALUES_ONLY;
     else if (str == "unicode_normalize")
         return PWT_UNICODE_NORMALIZE;
 

src/condition.cpp

@@ -12,17 +12,18 @@
 
 namespace ddwaf {
 
-std::optional<event::match> condition::match_object(
-    const ddwaf_object *object, const rule_processor::base::ptr &processor) const
+std::optional<event::match> condition::match_object(const ddwaf_object *object,
+    const rule_processor::base::ptr &processor,
+    const std::vector<PW_TRANSFORM_ID> &transformers) const
 {
-    const bool has_transform = !transformers_.empty();
+    const bool has_transform = !transformers.empty();
     bool transform_required = false;
 
     if (has_transform) {
         // This codepath is shared with the mutable path. The structure can't be const :/
         transform_required =
             // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
-            PWTransformer::doesNeedTransform(transformers_, const_cast<ddwaf_object *>(object));
+            PWTransformer::doesNeedTransform(transformers, const_cast<ddwaf_object *>(object));
     }
 
     const size_t length =
@@ -42,7 +43,7 @@ std::optional<event::match> condition::match_object(
 
     // Transform it and pick the pointer to process
     bool transformFailed = false;
-    for (const PW_TRANSFORM_ID &transform : transformers_) {
+    for (const PW_TRANSFORM_ID &transform : transformers) {
         transformFailed = !PWTransformer::transform(transform, &copy);
         if (transformFailed || (copy.type == DDWAF_OBJ_STRING && copy.nbEntries == 0)) {
             break;
@@ -57,8 +58,9 @@ std::optional<event::match> condition::match_object(
 }
 
 template <typename T>
-std::optional<event::match> condition::match_target(
-    T &it, const rule_processor::base::ptr &processor, ddwaf::timer &deadline) const
+std::optional<event::match> condition::match_target(T &it,
+    const rule_processor::base::ptr &processor, const std::vector<PW_TRANSFORM_ID> &transformers,
+    ddwaf::timer &deadline) const
 {
     for (; it; ++it) {
         if (deadline.expired()) {
@@ -69,7 +71,7 @@ std::optional<event::match> condition::match_target(
             continue;
         }
 
-        auto optional_match = match_object(*it, processor);
+        auto optional_match = match_object(*it, processor, transformers);
         if (!optional_match.has_value()) {
             continue;
         }
@@ -108,7 +110,7 @@ std::optional<event::match> condition::match(const object_store &store,
         return std::nullopt;
     }
 
-    for (const auto &[target, name, key_path] : targets_) {
+    for (const auto &[target, name, key_path, transformers, source] : targets_) {
         if (deadline.expired()) {
             throw ddwaf::timeout_exception();
         }
@@ -126,12 +128,12 @@ std::optional<event::match> condition::match(const object_store &store,
         }
 
         std::optional<event::match> optional_match;
-        if (source_ == data_source::keys) {
+        if (source == data_source::keys) {
             object::key_iterator it(object, key_path, objects_excluded, limits_);
-            optional_match = match_target(it, processor, deadline);
+            optional_match = match_target(it, processor, transformers, deadline);
         } else {
             object::value_iterator it(object, key_path, objects_excluded, limits_);
-            optional_match = match_target(it, processor, deadline);
+            optional_match = match_target(it, processor, transformers, deadline);
         }
 
         if (optional_match.has_value()) {

src/condition.hpp

@@ -27,21 +27,21 @@ namespace ddwaf {
 class condition {
 public:
     using ptr = std::shared_ptr<condition>;
+
+    enum class data_source : uint8_t { values, keys };
+
     struct target_type {
         manifest::target_type root;
         std::string name;
-        std::vector<std::string> key_path;
+        std::vector<std::string> key_path{};
+        std::vector<PW_TRANSFORM_ID> transformers{};
+        data_source source{data_source::values};
     };
 
-    enum class data_source : uint8_t { values, keys };
-
-    condition(std::vector<target_type> targets, std::vector<PW_TRANSFORM_ID> transformers,
-        std::shared_ptr<rule_processor::base> processor, std::string data_id = {},
-        ddwaf::object_limits limits = ddwaf::object_limits(),
-        data_source source = data_source::values)
-        : targets_(std::move(targets)), transformers_(std::move(transformers)),
-          processor_(std::move(processor)), data_id_(std::move(data_id)), limits_(limits),
-          source_(source)
+    condition(std::vector<target_type> targets, std::shared_ptr<rule_processor::base> processor,
+        std::string data_id = {}, ddwaf::object_limits limits = ddwaf::object_limits())
+        : targets_(std::move(targets)), processor_(std::move(processor)),
+          data_id_(std::move(data_id)), limits_(limits)
     {}
 
     ~condition() = default;
@@ -62,21 +62,20 @@ class condition {
     }
 
 protected:
-    std::optional<event::match> match_object(
-        const ddwaf_object *object, const rule_processor::base::ptr &processor) const;
+    std::optional<event::match> match_object(const ddwaf_object *object,
+        const rule_processor::base::ptr &processor,
+        const std::vector<PW_TRANSFORM_ID> &transformers) const;
 
     template <typename T>
-    std::optional<event::match> match_target(
-        T &it, const rule_processor::base::ptr &processor, ddwaf::timer &deadline) const;
+    std::optional<event::match> match_target(T &it, const rule_processor::base::ptr &processor,
+        const std::vector<PW_TRANSFORM_ID> &transformers, ddwaf::timer &deadline) const;
 
     [[nodiscard]] const rule_processor::base::ptr &get_processor(
         const std::unordered_map<std::string, rule_processor::base::ptr> &dynamic_processors) const;
     std::vector<condition::target_type> targets_;
-    std::vector<PW_TRANSFORM_ID> transformers_;
     std::shared_ptr<rule_processor::base> processor_;
     std::string data_id_;
     ddwaf::object_limits limits_;
-    data_source source_;
 };
 
 } // namespace ddwaf

src/parser/parser_v1.cpp

@@ -100,11 +100,12 @@ condition::ptr parseCondition(parameter::map &rule, manifest &target_manifest,
         if (!key_path.empty()) {
             target.key_path.emplace_back(key_path);
         }
+        target.transformers = transformers;
         targets.emplace_back(std::move(target));
     }
 
     return std::make_shared<condition>(
-        std::move(targets), std::move(transformers), std::move(processor), std::string{}, limits);
+        std::move(targets), std::move(processor), std::string{}, limits);
 }
 
 void parseRule(parameter::map &rule, base_section_info &info, manifest &target_manifest,

src/parser/parser_v2.cpp

@@ -100,9 +100,39 @@ std::pair<std::string, rule_processor::base::ptr> parse_processor(
     return {std::move(rule_data_id), std::move(processor)};
 }
 
+std::vector<PW_TRANSFORM_ID> parse_transformers(
+    const parameter::vector &root, condition::data_source &source)
+{
+    if (root.empty()) {
+        return {};
+    }
+
+    std::vector<PW_TRANSFORM_ID> transformers;
+    transformers.reserve(root.size());
+
+    for (const auto &transformer_param : root) {
+        auto transformer = static_cast<std::string_view>(transformer_param);
+        PW_TRANSFORM_ID transform_id = PWTransformer::getIDForString(transformer);
+        switch (transform_id) {
+        case PWT_KEYS_ONLY:
+            source = ddwaf::condition::data_source::keys;
+            break;
+        case PWT_VALUES_ONLY:
+            source = ddwaf::condition::data_source::values;
+            break;
+        case PWT_INVALID:
+            throw ddwaf::parsing_error("invalid transformer " + std::string(transformer));
+        default:
+            transformers.push_back(transform_id);
+            break;
+        }
+    }
+    return transformers;
+}
+
 condition::ptr parse_rule_condition(const parameter::map &root, manifest &target_manifest,
     std::unordered_map<std::string, std::string> &rule_data_ids, condition::data_source source,
-    std::vector<PW_TRANSFORM_ID> transformers, const object_limits &limits)
+    const std::vector<PW_TRANSFORM_ID> &transformers, const object_limits &limits)
 {
     auto operation = at<std::string_view>(root, "operator");
     auto params = at<parameter::map>(root, "parameters");
@@ -137,11 +167,20 @@ condition::ptr parse_rule_condition(const parameter::map &root, manifest &target
         target.name = address;
         target.key_path = std::move(kp);
 
+        auto it = input.find("transformers");
+        if (it == input.end()) {
+            target.source = source;
+            target.transformers = transformers;
+        } else {
+            auto input_transformers = static_cast<parameter::vector>(it->second);
+            target.source = condition::data_source::values;
+            target.transformers = parse_transformers(input_transformers, target.source);
+        }
         targets.emplace_back(target);
     }
 
-    return std::make_shared<condition>(std::move(targets), std::move(transformers),
-        std::move(processor), std::move(rule_data_id), limits, source);
+    return std::make_shared<condition>(
+        std::move(targets), std::move(processor), std::move(rule_data_id), limits);
 }
 
 rule_spec parse_rule(parameter::map &rule, manifest &target_manifest,
@@ -151,24 +190,7 @@ rule_spec parse_rule(parameter::map &rule, manifest &target_manifest,
     std::vector<PW_TRANSFORM_ID> rule_transformers;
     auto data_source = ddwaf::condition::data_source::values;
     auto transformers = at<parameter::vector>(rule, "transformers", {});
-    for (const auto &transformer_param : transformers) {
-        auto transformer = static_cast<std::string_view>(transformer_param);
-        PW_TRANSFORM_ID transform_id = PWTransformer::getIDForString(transformer);
-        if (transform_id == PWT_INVALID) {
-            throw ddwaf::parsing_error("invalid transformer " + std::string(transformer));
-        }
-
-        if (transform_id == PWT_KEYS_ONLY) {
-            if (!rule_transformers.empty()) {
-                DDWAF_WARN("keys_only transformer should be the first one "
-                           "in the list, all transformers will be applied to "
-                           "keys and not values");
-            }
-            data_source = ddwaf::condition::data_source::keys;
-        } else {
-            rule_transformers.push_back(transform_id);
-        }
-    }
+    rule_transformers = parse_transformers(transformers, data_source);
 
     std::vector<condition::ptr> conditions;
     auto conditions_array = at<parameter::vector>(rule, "conditions");
@@ -301,8 +323,8 @@ condition::ptr parse_filter_condition(
         targets.emplace_back(target);
     }
 
-    return std::make_shared<condition>(std::move(targets), std::vector<PW_TRANSFORM_ID>{},
-        std::move(processor), std::string{}, limits);
+    return std::make_shared<condition>(
+        std::move(targets), std::move(processor), std::string{}, limits);
 }
 
 input_filter_spec parse_input_filter(