shadowbq-threatinator 0.5.0

data/spec/threatinator/feed_spec.rb

@@ -0,0 +1,169 @@
+require 'spec_helper'
+require 'threatinator/feed'
+
+describe Threatinator::Feed do
+  let (:provider) { 'FakeSecureCo' }
+  let (:name) { 'MaliciousDataFeed' }
+  let(:fetcher_io) { double("io") }
+  let(:parser_block) { lambda {}  }
+  let(:filter_builders) { [] }
+  let(:decoder_builders) { [] }
+  let(:fetcher_builder) { lambda { FeedSpec::Fetcher.new({}) }  }
+  let(:parser_builder) { lambda { FeedSpec::Parser.new({}) { } }  }
+
+  let(:feed_opts) { 
+    {
+      :provider => provider, 
+      :name => name,
+      :parser_block => parser_block,
+      :fetcher_builder => fetcher_builder,
+      :parser_builder => parser_builder,
+      :filter_builders => filter_builders,
+      :decoder_builders => filter_builders,
+    }
+  }
+
+  shared_examples_for "a field with an invalid value" do |value|
+    it "should raise InvalidAttributeError if it is a #{value.class}" do
+      expect { 
+        described_class.new(feed_opts.merge(field => value)) 
+      }.to raise_error(Threatinator::Exceptions::InvalidAttributeError)
+    end
+  end
+
+  shared_examples_for "a field with a valid value" do |value|
+    it "should not raise any errors when set to a #{value.class}" do
+      expect { 
+        described_class.new(feed_opts.merge(field => value)) 
+      }.not_to raise_error
+    end
+  end
+
+  shared_examples_for "a field that is required" do
+    it "is required" do
+      feed_opts.delete(field)
+      expect { described_class.new(feed_opts) }.to raise_error(Threatinator::Exceptions::InvalidAttributeError)
+    end
+  end
+
+  shared_examples_for "a field with a default" do |value|
+    it "should default to #{value.inspect}" do
+      feed_opts.delete(field)
+      feed = described_class.new(feed_opts)
+      expect(feed.send(field)).to eq(value)
+    end
+  end
+
+  shared_examples_for "a field that is immutable" do
+    it "should be immutable" do
+      feed = described_class.new(feed_opts) 
+      expect(feed.send(field)).not_to be(feed.send(field))
+    end
+  end
+
+  describe ":provider" do
+    let(:field) { :provider } 
+    include_examples "a field that is required"
+    include_examples "a field that is immutable"
+    include_examples "a field with a valid value", "asdf"
+    include_examples "a field with an invalid value", 1234
+    include_examples "a field with an invalid value", :asdf
+    include_examples "a field with an invalid value", []
+    include_examples "a field with an invalid value", {}
+  end
+
+  describe ":name" do
+    let(:field) { :name } 
+    include_examples "a field that is required", :name
+    include_examples "a field that is immutable"
+    include_examples "a field with a valid value", "asdf"
+    include_examples "a field with an invalid value", 1234
+    include_examples "a field with an invalid value", :asdf
+    include_examples "a field with an invalid value", []
+    include_examples "a field with an invalid value", {}
+  end
+
+  describe ":fetcher_builder" do
+    let(:field) { :fetcher_builder} 
+    include_examples "a field that is required", :fetcher_builder
+    include_examples "a field with a valid value", lambda { } 
+    include_examples "a field with an invalid value", Class.new
+    include_examples "a field with an invalid value", 1234
+    include_examples "a field with an invalid value", :asdf
+    include_examples "a field with an invalid value", []
+    include_examples "a field with an invalid value", {}
+  end
+
+  describe ":parser_builder" do
+    let(:field) { :parser_builder } 
+    include_examples "a field that is required", :parser_builder
+    include_examples "a field with a valid value", lambda { } 
+    include_examples "a field with an invalid value", Class.new
+    include_examples "a field with an invalid value", 1234
+    include_examples "a field with an invalid value", :asdf
+    include_examples "a field with an invalid value", []
+    include_examples "a field with an invalid value", {}
+  end
+
+  describe ":filter_builders" do
+    let(:field) { :filter_builders} 
+    include_examples "a field with a default", []
+    include_examples "a field with a valid value", []
+    include_examples "a field with a valid value", [ lambda { }  ]
+    include_examples "a field that is immutable"
+    include_examples "a field with an invalid value", Class.new
+    include_examples "a field with an invalid value", 1234
+    include_examples "a field with an invalid value", :asdf
+    include_examples "a field with an invalid value", [1,2,3]
+    include_examples "a field with an invalid value", {}
+  end
+
+  describe ":decoder_builders" do
+    let(:field) { :decoder_builders} 
+    include_examples "a field with a default", []
+    include_examples "a field with a valid value", []
+    include_examples "a field with a valid value", [ lambda { }  ]
+    include_examples "a field that is immutable"
+    include_examples "a field with an invalid value", Class.new
+    include_examples "a field with an invalid value", 1234
+    include_examples "a field with an invalid value", :asdf
+    include_examples "a field with an invalid value", [1,2,3]
+    include_examples "a field with an invalid value", {}
+  end
+
+  describe ":parser_block" do
+    let(:field) { :parser_block } 
+    include_examples "a field that is required", :parser_block
+    include_examples "a field with a valid value", lambda {}
+    include_examples "a field with an invalid value", 1234
+    include_examples "a field with an invalid value", :asdf
+    include_examples "a field with an invalid value", []
+  end
+
+  context "when initialized with required fields" do
+    let (:feed) do 
+      described_class.new(feed_opts) 
+    end
+
+    describe "#name" do
+      it "should return the name" do
+        expect(feed.name).to eq(name)
+      end
+    end
+
+    describe "#provider" do
+      it "should return the provider" do
+        expect(feed.provider).to eq(provider)
+      end
+    end
+
+    describe "#parser_block" do
+      it "should return the parser_block" do
+        expect(feed.parser_block).to eq(parser_block)
+      end
+    end
+
+  end
+end
+
+

data/spec/threatinator/fetcher_spec.rb

@@ -0,0 +1,12 @@
+require 'spec_helper'
+require 'threatinator/fetcher'
+
+describe Threatinator::Fetcher do
+  let(:fetcher) { Threatinator::Fetcher.new }
+  describe "#fetch" do
+    it "should raise NotImplementedError because it's not implemented" do
+      expect {fetcher.fetch}.to raise_error(NotImplementedError)
+    end
+  end
+end
+

data/spec/threatinator/fetchers/http_spec.rb

@@ -0,0 +1,32 @@
+require 'spec_helper'
+require 'threatinator/fetchers/http'
+
+describe Threatinator::Fetchers::Http do
+    let(:url) { "http://foobar.com/bla.json" }
+    let(:fetcher_builder) { lambda { described_class.new(url: url) } }
+    let(:fetcher_builder_different) { lambda { described_class.new(url: "http://foobar.com/sdf.json") } }
+    let(:fetcher) { fetcher_builder.call() }
+
+  it_should_behave_like "a fetcher" do
+    before :each do
+      stub_request(:get, url).to_return(:body => expected_data)
+    end
+  end
+
+  describe "#url" do
+    it "should return the value of the URL" do
+      expect(fetcher.url).to eq(url)
+    end
+  end
+
+  [404, 500].each do |status_code|
+    context "when an HTTP response has a status code of #{status_code}" do
+      it_should_behave_like "a #fetch call that failed" do
+        before :each do
+          stub_request(:get, url)
+            .to_return(:status => status_code)
+        end
+      end
+    end
+  end
+end

data/spec/threatinator/filter_spec.rb

@@ -0,0 +1,13 @@
+require 'spec_helper'
+require 'threatinator/filter'
+
+describe Threatinator::Filter do
+  let(:filter) { Threatinator::Filter.new }
+  describe "#filter?(record)" do
+    it "should raise NotImplementedError because it's not implemented" do
+      expect {filter.filter?(1234)}.to raise_error(NotImplementedError)
+    end
+  end
+end
+
+

data/spec/threatinator/filters/block_spec.rb

@@ -0,0 +1,16 @@
+require 'spec_helper'
+require 'threatinator/record'
+require 'threatinator/filters/block'
+
+describe Threatinator::Filters::Block do
+  it_should_behave_like "a filter" do
+    let(:filter_block) {
+      lambda do |record|
+        record.data =~ /^FILTERME$/
+      end
+    }
+    let(:filter) { described_class.new(filter_block) }
+    let(:should_filter) { Threatinator::Record.new("FILTERME") }
+    let(:shouldnt_filter) { Threatinator::Record.new("I'm OK!") }
+  end
+end

data/spec/threatinator/filters/comments_spec.rb

@@ -0,0 +1,13 @@
+require 'spec_helper'
+require 'threatinator/record'
+require 'threatinator/filters/comments'
+
+describe Threatinator::Filters::Comments do
+  it_should_behave_like "a filter" do
+    let(:filter) { described_class.new() }
+    let(:should_filter) { Threatinator::Record.new("# Here's my comment") }
+    let(:shouldnt_filter) { Threatinator::Record.new("I'm OK # wooo!") }
+  end
+end
+
+

data/spec/threatinator/filters/whitespace_spec.rb

@@ -0,0 +1,12 @@
+require 'spec_helper'
+require 'threatinator/record'
+require 'threatinator/filters/whitespace'
+
+describe Threatinator::Filters::Whitespace do
+  it_should_behave_like "a filter" do
+    let(:filter) { described_class.new() }
+    let(:should_filter) { Threatinator::Record.new("    ") }
+    let(:shouldnt_filter) { Threatinator::Record.new("    I'm OK!") }
+  end
+end
+

data/spec/threatinator/logger_spec.rb

@@ -0,0 +1,29 @@
+require 'spec_helper'
+require 'threatinator/logger'
+require 'threatinator/config/logger'
+
+describe Threatinator::Logger do
+  before :each do
+    @orig_level = Threatinator::Logger.level
+  end
+
+  after :each do
+    Threatinator::Logger.level = @orig_level
+  end
+
+  describe ".configure_logger(config)" do
+    let(:config) { Threatinator::Config::Logger.new }
+    it "sets the logging level to that specified by config.level" do
+      Threatinator::Logger.level = Threatinator::Logger::Levels::FATAL
+      config.level = "DEBUG"
+      Threatinator::Logger.configure_logger(config)
+      expect(Threatinator::Logger.level).to eq(Threatinator::Logger::Levels::DEBUG)
+    end
+
+    it "warns when an unknown logging level is provided" do
+      config.level = "FOO"
+      expect(Threatinator::Logger.default_logger).to receive(:warn).with(/Ignoring unknown logging level:/)
+      Threatinator::Logger.configure_logger(config)
+    end
+  end
+end

data/spec/threatinator/model/observables/fqdn_collection_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+require 'threatinator/model/observables/fqdn_collection'
+
+describe Threatinator::Model::Observables::FqdnCollection do
+  it_behaves_like "a model collection" do
+    def generate_ten_valid_members
+      ret = []
+      1.upto(10) do |i|
+        ret << "domain#{i}.com"
+      end
+      ret
+    end
+
+    def generate_invalid_members
+      [1234, :foobar]
+    end
+  end
+
+  let(:collection) { described_class.new }
+
+  describe "#valid_member?(v)" do
+    context "when provided a valid FQDN string" do
+      it "returns true" do
+        expect(collection.valid_member?("yahoo.com")).to eq(true)
+      end
+    end
+
+    context "when provided an invalid FQDN string" do
+      it "returns false" do
+        expect(collection.valid_member?("yahoo..com")).to eq(false)
+      end
+    end
+
+    context "when provided something other than a string" do
+      it "returns false" do
+        expect(collection.valid_member?(:asdf)).to eq(false)
+        expect(collection.valid_member?(1234)).to eq(false)
+      end
+    end
+  end
+end

data/spec/threatinator/model/observables/ipv4_collection_spec.rb

@@ -0,0 +1,36 @@
+require 'spec_helper'
+require 'threatinator/model/observables/ipv4_collection'
+require 'threatinator/model/observables/ipv4'
+
+describe Threatinator::Model::Observables::Ipv4Collection do
+  it_behaves_like "a model collection" do
+    def generate_ten_valid_members
+      ret = []
+      1.upto(10) do |i|
+        ret << build(:ipv4, ipv4: "1.2.3.#{i}")
+      end
+      ret
+    end
+
+    def generate_invalid_members
+      [1234, :foobar]
+    end
+  end
+
+  let(:collection) { described_class.new }
+
+  describe "#valid_member?(v)" do
+    context "when provided an Ipv4 observable" do
+      it "returns true" do
+        ipv4 = build(:ipv4, ipv4: "1.2.3.4")
+        expect(collection.valid_member?(ipv4)).to eq(true)
+      end
+    end
+
+    context "when provided something other than an Ipv4 observable" do
+      it "returns false" do
+        expect(collection.valid_member?("1.2.3.257")).to eq(false)
+      end
+    end
+  end
+end

data/spec/threatinator/model/observables/ipv4_spec.rb

@@ -0,0 +1,75 @@
+require 'spec_helper'
+require 'threatinator/model/observables/ipv4'
+
+describe Threatinator::Model::Observables::Ipv4 do
+  let(:ipv4_opts) { {} }
+
+  describe ":ipv4" do
+    it "is required" do
+      ipv4_opts.delete(:ipv4)
+      expect {
+        described_class.new(ipv4_opts)
+      }.to raise_error(Threatinator::Exceptions::InvalidAttributeError)
+    end
+
+    it "must be an IP::V4 object" do
+      opts1 = ipv4_opts.dup
+      opts1[:ipv4] = '1.2.3.4'
+      expect {
+        described_class.new(opts1)
+      }.to raise_error(Threatinator::Exceptions::InvalidAttributeError)
+
+      opts2 = ipv4_opts.dup
+      opts2[:ipv4] = IP::V4.parse('1.2.3.4')
+      expect {
+        described_class.new(opts2)
+      }.not_to raise_error
+    end
+
+    it "must have a 32 bit prefix" do
+      opts1 = ipv4_opts.dup
+      opts1[:ipv4] = IP::V4.parse('10.1.1.0/24')
+      expect {
+        described_class.new(opts1)
+      }.to raise_error(Threatinator::Exceptions::InvalidAttributeError)
+
+      opts2 = ipv4_opts.dup
+      opts2[:ipv4] = IP::V4.parse('10.1.1.0/32')
+      expect {
+        described_class.new(opts2)
+      }.not_to raise_error
+    end
+
+
+    it "sets the value of #ipv4" do
+      ipv4 = IP::V4.parse('1.2.3.4')
+      ipv4_opts[:ipv4] = ipv4
+      o = described_class.new(ipv4_opts)
+      expect(o.ipv4).to be(ipv4)
+    end
+  end
+
+  describe "#==(other)" do
+    it "returns true when compared to an identically configured event" do
+      opts1 = ipv4_opts.dup
+      opts1[:ipv4] = IP::V4.parse('1.2.3.4')
+      opts2 = ipv4_opts.dup
+      opts2[:ipv4] = IP::V4.parse('1.2.3.4')
+      o1 = described_class.new(opts1)
+      o2 = described_class.new(opts2)
+      expect(o1).to be == o2
+    end
+
+    it "returns false when compared to differently configured event" do
+      opts1 = ipv4_opts.dup
+      opts1[:ipv4] = IP::V4.parse('1.2.3.4')
+      opts2 = ipv4_opts.dup
+      opts2[:ipv4] = IP::V4.parse('8.8.8.8')
+      o1 = described_class.new(opts1)
+      o2 = described_class.new(opts2)
+      expect(o1).not_to be == o2
+    end
+  end
+
+end
+

data/spec/threatinator/model/observables/url_collection_spec.rb

@@ -0,0 +1,45 @@
+require 'spec_helper'
+require 'threatinator/model/observables/url_collection'
+require 'addressable/uri'
+
+describe Threatinator::Model::Observables::UrlCollection do
+  it_behaves_like "a model collection" do
+    def generate_ten_valid_members
+      ret = []
+      1.upto(10) do |i|
+        ret << ::Addressable::URI.parse("http://foobar#{i}.com")
+      end
+      ret
+    end
+
+    def generate_invalid_members
+      [
+        1234, 
+       :foobar,
+       'http://yahoo.com',
+       ::Addressable::URI.parse('/foo/bar')
+      ]
+    end
+  end
+
+  let(:collection) { described_class.new }
+
+  describe "#valid_member?(v)" do
+    it "returns true when an absolute Addressable::URI" do
+      url = Addressable::URI.parse('http://yahoo.com')
+      expect(collection.valid_member?(url)).to eq(true)
+    end
+
+    it "returns false when the Addressable::URI is relative"  do
+      url = Addressable::URI.parse('/foo/bar')
+      expect(collection.valid_member?(url)).to eq(false)
+    end
+
+    it "returns false when not an Addressable::URI" do
+      expect(collection.valid_member?('http://yahoo.com')).to eq(false)
+      expect(collection.valid_member?(:foobar)).to eq(false)
+      expect(collection.valid_member?(nil)).to eq(false)
+    end
+  end
+end
+

data/spec/threatinator/model/validations/type_spec.rb

@@ -0,0 +1,37 @@
+require 'spec_helper'
+require 'threatinator/model/validations/type'
+
+describe Threatinator::Model::Validations::TypeValidator do
+  before :each do
+    module Examples
+      class Person 
+        include ActiveModel::Validations
+        include Threatinator::Model::Validations
+        attr_accessor :name, :age
+      end
+    end
+  end
+
+  after :each do
+    Examples::Person.clear_validators!
+  end
+
+  it "validates that the value is an instance of the class specified by :type" do
+    Examples::Person.validates :name, type: String
+    person = Examples::Person.new
+    expect(person).not_to be_valid
+
+    person.name = :asdf
+    expect(person).not_to be_valid
+
+    person.name = "Mike"
+    expect(person).to be_valid
+
+    Examples::Person.validates :age, type: Integer
+    expect(person).not_to be_valid
+    person.age = :eight
+    expect(person).not_to be_valid
+    person.age = 8
+    expect(person).to be_valid
+  end
+end

data/spec/threatinator/parser_spec.rb

@@ -0,0 +1,13 @@
+require 'spec_helper'
+require 'threatinator/parser'
+
+describe Threatinator::Parser do
+  let(:parser) { Threatinator::Parser.new() }
+  describe "#run" do
+    it "should raise NotImplementedError because it's not implemented" do
+      expect { |b| parser.run(double("io"), &b) }.to raise_error(NotImplementedError)
+    end
+  end
+end
+
+