Use WASM module of zen-internals instead of FFI

.github/CONTRIBUTING.md

@@ -101,7 +101,7 @@ Enhancement suggestions are tracked as [GitHub issues](https://github.com/Aikido
 ### Your First Code Contribution
 
 - clone the repository to your local machine
-- run `$ make build` to build a `dist/` folder which includes binaries, agent.jar file and the agent_api.jar file
+- run `$ make build` to build a `dist/` folder which includes the agent.jar and agent_api.jar files
 - run `$ make mock_init` to build and start the mock aikido server (uses docker)
 - run `$ make test` to test the library with JUnit 5
 - run `$ make clean` to clean up the repository

.github/workflows/benchmarks.yml

@@ -23,7 +23,7 @@ jobs:
         working-directory: ./
         run: |
           chmod +x gradlew
-          make binaries
+          make wasm
           make build
 
       - name: Upload build artifacts

.github/workflows/end2end.yml

@@ -23,7 +23,7 @@ jobs:
         working-directory: ./
         run: |
           chmod +x gradlew
-          make binaries
+          make wasm
           make build
 
       - name: Upload build artifacts

.github/workflows/gradle-tests.yml

@@ -26,7 +26,7 @@ jobs:
         working-directory: ./
         run: |
           chmod +x gradlew
-          make binaries
+          make wasm
           make build
 
       - name: Upload build artifacts

.github/workflows/opentel.yml

@@ -23,7 +23,7 @@ jobs:
         working-directory: ./
         run: |
           chmod +x gradlew
-          make binaries
+          make wasm
           make build
 
       - name: Upload build artifacts

.github/workflows/qa-tests.yml

@@ -33,7 +33,7 @@ jobs:
               working-directory: ./firewall-java
               run: |
                   chmod +x gradlew
-                  make binaries
+                  make wasm
                   make build
 
                   # Move the build jars to demo app

.github/workflows/release.yml

@@ -31,8 +31,11 @@ jobs:
         with:
           java-version: '21'
           distribution: 'adopt'
-      - name: Download binaries & Build with Gradle
-        run: chmod +x gradlew && make binaries && make build
+      - name: Build with Gradle
+        run: |
+          chmod +x gradlew
+          make wasm
+          make build
       - name: Create zip and tar.gz files of the build
         run: |
           mv dist/ zen/

.github/workflows/smoke-tests.yml

@@ -28,13 +28,13 @@ jobs:
               working-directory: ./
               run: |
                   chmod +x gradlew
-                  make binaries
+                  make wasm
                   make build
 
-            - name: Run RustSQLInterfaceTest
+            - name: Run WasmSQLInterfaceTest
               working-directory: ./
               run: |
-                  ./gradlew test --tests "vulnerabilities.RustSQLInterfaceTest" --info
+                  ./gradlew test --tests "vulnerabilities.WasmSQLInterfaceTest" --info
 
     smoke-test-musl:
         name: Smoke Test (${{matrix.image}}, Java 21)
@@ -56,12 +56,12 @@ jobs:
               working-directory: ./
               run: |
                   chmod +x gradlew
-                  make binaries
+                  make wasm
                   make build
 
-            - name: Run RustSQLInterfaceTest on ${{matrix.image}}
+            - name: Run WasmSQLInterfaceTest on ${{matrix.image}}
               run: |
                   docker run --rm -v "$(pwd):/app" -w /app ${{matrix.image}} sh -c "
                     chmod +x gradlew && \
-                    AIKIDO_DEBUG=true ./gradlew test --tests 'vulnerabilities.RustSQLInterfaceTest' --info
+                    AIKIDO_DEBUG=true ./gradlew test --tests 'vulnerabilities.WasmSQLInterfaceTest' --info
                   "

.github/workflows/test-ddtrace.yml

@@ -23,7 +23,7 @@ jobs:
         working-directory: ./
         run: |
           chmod +x gradlew
-          make binaries
+          make wasm
           make build
       - name: Upload build artifacts
         uses: actions/upload-artifact@v4

Makefile

@@ -2,11 +2,34 @@ clean:
 	rm -rf dist/
 	./gradlew clean
 
-build: clean check_binaries
-	mkdir -p dist/
+ZEN_INTERNALS_VERSION = v0.1.60
+WASM_BASE_URL = https://github.com/AikidoSec/zen-internals/releases/download/$(ZEN_INTERNALS_VERSION)
+WASM_RESOURCE_DIR = agent_api/src/main/resources
+
+.PHONY: wasm download-wasm check-wasm
+wasm: download-wasm check-wasm
+
+download-wasm:
+	mkdir -p $(WASM_RESOURCE_DIR)
+	@set -e; \
+	tmp_dir=$$(mktemp -d); \
+	trap 'rm -rf "$$tmp_dir"' 0; \
+	curl -fL -o "$$tmp_dir/zen_internals.wasm" $(WASM_BASE_URL)/libzen_internals.wasm; \
+	curl -fL -o "$$tmp_dir/checksum" $(WASM_BASE_URL)/libzen_internals.wasm.sha256sum; \
+	sed 's/libzen_internals\.wasm/zen_internals.wasm/' "$$tmp_dir/checksum" > "$$tmp_dir/zen_internals.wasm.sha256sum"; \
+	mv "$$tmp_dir/zen_internals.wasm" $(WASM_RESOURCE_DIR)/zen_internals.wasm; \
+	mv "$$tmp_dir/zen_internals.wasm.sha256sum" $(WASM_RESOURCE_DIR)/zen_internals.wasm.sha256sum
+
+check-wasm:
+	@expected=$$(awk '{print $$1}' $(WASM_RESOURCE_DIR)/zen_internals.wasm.sha256sum); \
+	actual=$$(shasum -a 256 $(WASM_RESOURCE_DIR)/zen_internals.wasm | awk '{print $$1}'); \
+	if [ "$$expected" != "$$actual" ]; then \
+		echo "WASM checksum mismatch: expected $$expected, got $$actual"; \
+		exit 1; \
+	fi
 
-	@echo "Copying binaries from .cache folder"
-	cp -r .cache/binaries dist/binaries
+build: clean
+	mkdir -p dist/
 
 	./gradlew agent:shadowJar
 	cp agent/build/libs/agent*-all.jar dist/agent.jar
@@ -23,49 +46,13 @@ mock_restart:
 mock_stop:
 	docker kill mock_core && docker rm mock_core
 
-test: check_binaries
+test:
 	AIKIDO_LOG_LEVEL="error" AIKIDO_TOKEN="token" ./gradlew test
 
-cov: check_binaries
+cov:
 	AIKIDO_LOG_LEVEL="error" AIKIDO_TOKEN="token" ./gradlew test --rerun-tasks -PcoverageRun jacocoTestReport jacocoTestCoverageVerification
 
 
-# Binaries :
-
-BASE_URL = https://github.com/AikidoSec/zen-internals/releases/download/v0.1.60
-FILES = \
-    libzen_internals_aarch64-apple-darwin.dylib \
-    libzen_internals_aarch64-apple-darwin.dylib.sha256sum \
-    libzen_internals_aarch64-unknown-linux-gnu.so \
-    libzen_internals_aarch64-unknown-linux-gnu.so.sha256sum \
-    libzen_internals_aarch64-unknown-linux-musl.so \
-    libzen_internals_aarch64-unknown-linux-musl.so.sha256sum \
-    libzen_internals_x86_64-apple-darwin.dylib \
-    libzen_internals_x86_64-apple-darwin.dylib.sha256sum \
-    libzen_internals_x86_64-pc-windows-gnu.dll \
-    libzen_internals_x86_64-pc-windows-gnu.dll.sha256sum \
-    libzen_internals_x86_64-unknown-linux-gnu.so \
-    libzen_internals_x86_64-unknown-linux-gnu.so.sha256sum \
-    libzen_internals_x86_64-unknown-linux-musl.so \
-    libzen_internals_x86_64-unknown-linux-musl.so.sha256sum \
-
-binaries: binaries_make_dir $(addprefix .cache/binaries/, $(FILES))
-binaries_make_dir:
-	rm -rf .cache/binaries
-	mkdir -p .cache/binaries/
-.cache/binaries/%:
-	@echo "Downloading $*..."
-	curl -L -o $@ $(BASE_URL)/$*
-.PHONY: check_binaries
-check_binaries:
-	@if [ -d ".cache/binaries" ]; then \
-  		echo "Cache directory exists."; \
-	else \
-		echo "Cache directory is empty. Running 'make binaries'..."; \
-		$(MAKE) binaries; \
-	fi
-
-
 # Automatic versioning for releases :
 
 VERSION_FILES = ./build.gradle ./agent_api/src/main/java/dev/aikido/agent_api/Config.java
@@ -80,4 +67,3 @@ replace_version:
 		sed -i.bak "s/1.0-REPLACE-VERSION/$$version/g" $$file; \
 		rm $$file.bak; \
 	done;
-

README.md

@@ -73,26 +73,6 @@ To activate Zen you then just have to add the following `-javaagent` to your Jav
 ```
 java -javaagent:/opt/zen/agent.jar -jar build/myapp.jar
 ```
-Replace `/opt/zen` with your directory of choice. Keep `agent.jar` together with the `binaries` folder from the
-release - if you copy `agent.jar` into a different location or a different Docker build stage, copy the whole
-directory, not just the jar. Without `binaries`, SQL injection detection is disabled.
-
-<details>
-<summary>Seeing <code>System::load has been called ... in an unnamed module</code> on Java 22+?</summary>
-
-This warning is safe to ignore for now - SQL injection detection still works, since `--illegal-native-access`
-still defaults to `warn`, not `deny`, on Java 25.
-
-To get rid of it, add `--enable-native-access=ALL-UNNAMED` to your Java command, or set it through the
-`JDK_JAVA_OPTIONS` environment variable so you don't have to touch your existing startup command:
-```
-java --enable-native-access=ALL-UNNAMED -javaagent:/opt/zen/agent.jar -jar build/myapp.jar
-```
-```
-JDK_JAVA_OPTIONS=--enable-native-access=ALL-UNNAMED
-```
-</details>
-
 To use user-blocking and/or rate-limiting features, you will have to include the following Jarfile into your repository
 ### Gradle
 Add the following code to your `build.gradle` file.

agent/src/main/java/dev/aikido/agent/Agent.java

@@ -17,7 +17,7 @@
 import static dev.aikido.agent.ByteBuddyInitializer.createAgentBuilder;
 import static dev.aikido.agent.DaemonStarter.startDaemon;
 import static dev.aikido.agent.Wrappers.WRAPPERS;
-import static dev.aikido.agent_api.vulnerabilities.sql_injection.RustSQLInterface.loadLibrary;
+import static dev.aikido.agent_api.vulnerabilities.sql_injection.WasmSQLInterface.initialize;
 
 public class Agent {
     private static final Logger logger = LogManager.getLogger(Agent.class);
@@ -38,8 +38,8 @@ public static void premain(String agentArgs, Instrumentation inst) {
         logger.info("Zen by Aikido v%s starting.", Config.pkgVersion);
         setAikidoSysProperties();
 
-        // Test loading of zen binaries :
-        loadLibrary();
+        // Load the zen-internals WASM module.
+        initialize();
 
         ElementMatcher.Junction wrapperTypeDescriptors = ElementMatchers.none();
         for(Wrapper wrapper: WRAPPERS) {

agent_api/build.gradle

@@ -12,7 +12,8 @@ jacoco {
 dependencies {
     implementation 'com.github.seancfoley:ipaddress:5.5.1'
     implementation 'com.google.code.gson:gson:2.11.0'
-    implementation 'com.github.jnr:jnr-ffi:2.2.17'
+    implementation 'com.dylibso.chicory:runtime:1.7.5'
+    implementation 'com.dylibso.chicory:compiler:1.7.5'
     // Junixsocket imports :
     implementation 'com.kohlschutter.junixsocket:junixsocket-core:2.10.1'
     implementation 'com.kohlschutter.junixsocket:junixsocket-server:2.10.1'
@@ -48,7 +49,6 @@ test {
     jvmArgs '--add-opens', 'java.base/java.lang=ALL-UNNAMED'
     jvmArgs '-Dnet.bytebuddy.experimental=true' // Mockito support.
 
-    systemProperty 'AIK_agent_dir', "${project.rootDir}/dist"
     if (project.hasProperty('coverageRun')) {
         systemProperty 'AIK_INTERNAL_coverage_run', '1'
     }