Detection/blocking of SQL injections through libddwaf

[cataphract]

Description

Pass SQL queries to the libddwaf, allowing actions for SQL injections

APPSEC-51313

Reviewer checklist

• Test coverage seems ok.
• Appropriate labels assigned.

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 67.27273% with 18 lines in your changes missing coverage. Please review.

Project coverage is 75.83%. Comparing base (0c1d9c2) to head (ecdd79b).

Files with missing lines	Patch %	Lines
.../DDTrace/Integrations/Mysqli/MysqliIntegration.php	70.58%	10 Missing ⚠️
src/DDTrace/Integrations/PDO/PDOIntegration.php	61.90%	8 Missing ⚠️

Additional details and impacted files

@@                      Coverage Diff                      @@
##             glopes/appsec-flakiness    #3186      +/-   ##
=============================================================
- Coverage                      75.86%   75.83%   -0.04%     
- Complexity                      2910     2925      +15     
=============================================================
  Files                            141      141              
  Lines                          15953    16007      +54     
  Branches                        1107     1107              
=============================================================
+ Hits                           12103    12139      +36     
- Misses                          3275     3293      +18     
  Partials                         575      575              

Flag	Coverage Δ
appsec-extension	68.76% <ø> (ø)
tracer-php	78.54% <67.27%> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/DDTrace/Integrations/PDO/PDOIntegration.php	85.47% <61.90%> (-3.21%)	⬇️
.../DDTrace/Integrations/Mysqli/MysqliIntegration.php	86.37% <70.58%> (-2.02%)	⬇️

---

Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0c1d9c2...ecdd79b. Read the comment docs.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[pr-commenter]

Benchmarks [ tracer ]

Benchmark execution time: 2025-04-05 00:55:46

Comparing candidate commit ecdd79b in PR branch glopes/rasp-sqli with baseline commit 0c1d9c2 in branch glopes/appsec-flakiness.

Found 1 performance improvements and 0 performance regressions! Performance is the same for 177 metrics, 0 unstable metrics.

scenario:TraceFlushBench/benchFlushTrace

• 🟩 execution_time [-1000.000ns; -1000.000ns] or [-50.000%; -50.000%]

[pr-commenter]

Benchmarks [ appsec ]

Benchmark execution time: 2025-04-05 01:03:58

Comparing candidate commit ecdd79b in PR branch glopes/rasp-sqli with baseline commit 0c1d9c2 in branch glopes/appsec-flakiness.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 0 unstable metrics.