Limit the number of transformers per rule or input

[Anilm3]

This PR introduces a limit to the number of transformers that can be used on a single input. This limit has been arbitrarily set to 10 transformers in order to account for future requirements and is currently not user configurable.

The limit applies to transformers in a rule:

  {
    "id": "rule-xxx-yyy",
    "name": "rule with transformers",
    "tags": { ... },
    "conditions": [ ... ],
    "transformers": [ ... ]
  }

As well as transformers applied to a single input:

  {
    "id": "rule-xxx-yyy",
    "name": "rule with transformers",
    "tags": { ... },
    "conditions": [
      {
        "operator": "match_regex",
        "parameters": {
          "inputs": [
            {
              "address": "arg2",
              "key_path": [
                "y"
              ],
              "transformers": [ ... ]
            }
          ],
          "regex": ".*"
        }
      }

    ]
  }

Related Jira: APPSEC-53552

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.61%. Comparing base (aaf4d2a) to head (bb6303a).

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #309      +/-   ##
==========================================
+ Coverage   83.59%   83.61%   +0.01%     
==========================================
  Files         137      137              
  Lines        6041     6047       +6     
  Branches     2848     2854       +6     
==========================================
+ Hits         5050     5056       +6     
  Misses        370      370              
  Partials      621      621              

Flag	Coverage Δ
waf_test	83.61% <100.00%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-06-24 15:18:44

Comparing candidate commit bb6303a in PR branch anilm3/transformer-limit with baseline commit aaf4d2a in branch master.

Found 9 performance improvements and 3 performance regressions! Performance is the same for 7 metrics, 0 unstable metrics.

scenario:bool_equals_matcher.random

• 🟩 execution_time [-40.668µs; -37.802µs] or [-3.339%; -3.104%]

scenario:float_equals_matcher.random

• 🟩 execution_time [-51.849µs; -50.582µs] or [-4.238%; -4.135%]

scenario:ip_match_matcher.random

• 🟩 execution_time [-77.806µs; -76.634µs] or [-4.553%; -4.485%]

scenario:is_xss_matcher.random

• 🟩 execution_time [-4.091ms; -4.072ms] or [-4.688%; -4.666%]

scenario:lowercase_transformer.random

• 🟩 execution_time [-240.143µs; -237.502µs] or [-12.104%; -11.971%]

scenario:regex_match_matcher.case_insensitive_flag.random

• 🟥 execution_time [+714.865µs; +717.336µs] or [+14.081%; +14.130%]

scenario:regex_match_matcher.case_insensitive_option.random

• 🟥 execution_time [+717.873µs; +720.504µs] or [+14.143%; +14.194%]

scenario:regex_match_matcher.lowercase_transformer.random

• 🟥 execution_time [+528.035µs; +531.163µs] or [+7.886%; +7.933%]

scenario:remove_nulls_transformer.random

• 🟩 execution_time [-2.117ms; -2.110ms] or [-14.703%; -14.657%]

scenario:signed_equals_matcher.random

• 🟩 execution_time [-47.406µs; -45.717µs] or [-3.883%; -3.745%]

scenario:string_equals_matcher.random

• 🟩 execution_time [-79.800µs; -78.656µs] or [-5.156%; -5.082%]

scenario:unsigned_equals_matcher.random

• 🟩 execution_time [-50.503µs; -47.511µs] or [-4.131%; -3.886%]