tcell_agent 0.2.18 → 0.2.19

data/spec/lib/tcell_agent/policies/appsensor/response_codes_sensor_spec.rb

@@ -40,6 +40,16 @@ module TCellAgent
             expect(sensor.series_500_enabled).to eq(true)
           end
         end
+
+        context "setting excluded_route_ids on sensor" do
+          it "should have excluded_route_ids" do
+            sensor = ResponseCodesSensor.new({"exclude_routes" => ["excluded_route_id"]})
+            expect(sensor.enabled).to eq(false)
+            expect(sensor.series_400_enabled).to eq(false)
+            expect(sensor.series_500_enabled).to eq(false)
+            expect(sensor.excluded_route_ids).to eq({"excluded_route_id" => true})
+          end
+        end
       end
 
       context "#check" do
@@ -62,19 +72,50 @@ module TCellAgent
 
         context "with enabled sensor" do
           context "with 200 response code" do
+            before(:each) do
+              @sensor = ResponseCodesSensor.new({"enabled" => true})
+
+              @meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
+              @meta.remote_address = "remote_address"
+              @meta.method = "get"
+              @meta.location = "location"
+              @meta.route_id = "route_id"
+              @meta.session_id = "session_id"
+              @meta.user_id = "user_id"
+              @meta.transaction_id = "transaction_id"
+            end
+
             it "should not send an event" do
-              sensor = ResponseCodesSensor.new({"enabled" => true})
-              meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-              meta.remote_address = "remote_address"
-              meta.method = "get"
-              meta.location = "location"
-              meta.route_id = "route_id"
-              meta.session_id = "session_id"
-              meta.user_id = "user_id"
-              meta.transaction_id = "transaction_id"
+              expect(@sensor).to_not receive(:send_event)
+              @sensor.check(@meta, 200)
+            end
 
-              expect(sensor).to_not receive(:send_event)
-              sensor.check(meta, 200)
+            context "no excluded routes" do
+              it "should not send an event" do
+                @sensor.excluded_route_ids = {}
+
+                expect(@sensor).to_not receive(:send_event)
+                @sensor.check(@meta, 200)
+              end
+            end
+
+            context "has excluded routes" do
+              context "route id matches" do
+                it "should not send an event" do
+                  @sensor.excluded_route_ids = {"route_id" => true}
+
+                  expect(@sensor).to_not receive(:send_event)
+                  @sensor.check(@meta, 200)
+                end
+              end
+              context "route id does not match" do
+                it "should not send an event" do
+                  @sensor.excluded_route_ids = {"unmatching_route_id" => true}
+
+                  expect(@sensor).to_not receive(:send_event)
+                  @sensor.check(@meta, 200)
+                end
+              end
             end
           end
 
@@ -119,24 +160,58 @@ module TCellAgent
 
           context "with enabled series_400_enabled" do
             context "with 400 response code" do
-              it "should send an event" do
-                sensor = ResponseCodesSensor.new({
+              before(:each) do
+                @sensor = ResponseCodesSensor.new({
                   "enabled" => true,
                   "series_400_enabled" => true
                 })
-                meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-                meta.remote_address = "remote_address"
-                meta.method = "get"
-                meta.location = "location"
-                meta.route_id = "route_id"
-                meta.session_id = "session_id"
-                meta.user_id = "user_id"
-                meta.transaction_id = "transaction_id"
+                @meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
+                @meta.remote_address = "remote_address"
+                @meta.method = "get"
+                @meta.location = "location"
+                @meta.route_id = "route_id"
+                @meta.session_id = "session_id"
+                @meta.user_id = "user_id"
+                @meta.transaction_id = "transaction_id"
+              end
 
-                expect(sensor).to receive(:send_event).with(
-                  meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], "400", nil
+              it "should send an event" do
+                expect(@sensor).to receive(:send_event).with(
+                  @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], "400", nil
                 )
-                sensor.check(meta, 400)
+                @sensor.check(@meta, 400)
+              end
+
+              context "no excluded routes" do
+                it "should send an event" do
+                  @sensor.excluded_route_ids = {}
+
+                  expect(@sensor).to receive(:send_event).with(
+                    @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], "400", nil
+                  )
+                  @sensor.check(@meta, 400)
+                end
+              end
+
+              context "has excluded routes" do
+                context "route id matches" do
+                  it "should not send an event" do
+                    @sensor.excluded_route_ids = {"route_id" => true}
+
+                    expect(@sensor).to_not receive(:send_event)
+                    @sensor.check(@meta, 400)
+                  end
+                end
+                context "route id does not match" do
+                  it "should send an event" do
+                    @sensor.excluded_route_ids = {"unmatching_route_id" => true}
+
+                    expect(@sensor).to receive(:send_event).with(
+                      @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], "400", nil
+                    )
+                    @sensor.check(@meta, 400)
+                  end
+                end
               end
             end
           end

data/spec/lib/tcell_agent/policies/appsensor/response_size_sensor_spec.rb

@@ -10,7 +10,7 @@ module TCellAgent
             sensor = ResponseSizeSensor.new
             expect(sensor.enabled).to eq(false)
             expect(sensor.limit).to eq(2097152)
-            expect(sensor.exclude_routes).to eq({})
+            expect(sensor.excluded_route_ids).to eq({})
             expect(sensor.dp_code).to eq(ResponseSizeSensor::DP_UNUSUAL_RESPONSE_SIZE)
           end
         end
@@ -20,7 +20,7 @@ module TCellAgent
             sensor = ResponseSizeSensor.new({"enabled" => true})
             expect(sensor.enabled).to eq(true)
             expect(sensor.limit).to eq(2097152)
-            expect(sensor.exclude_routes).to eq({})
+            expect(sensor.excluded_route_ids).to eq({})
             expect(sensor.dp_code).to eq(ResponseSizeSensor::DP_UNUSUAL_RESPONSE_SIZE)
           end
         end
@@ -30,7 +30,7 @@ module TCellAgent
             sensor = ResponseSizeSensor.new({"limit" => 1})
             expect(sensor.enabled).to eq(false)
             expect(sensor.limit).to eq(1)
-            expect(sensor.exclude_routes).to eq({})
+            expect(sensor.excluded_route_ids).to eq({})
             expect(sensor.dp_code).to eq(ResponseSizeSensor::DP_UNUSUAL_RESPONSE_SIZE)
           end
         end
@@ -40,7 +40,7 @@ module TCellAgent
             sensor = ResponseSizeSensor.new({"exclude_routes" => ["1", "10", "20"]})
             expect(sensor.enabled).to eq(false)
             expect(sensor.limit).to eq(2097152)
-            expect(sensor.exclude_routes).to eq({"1"=>true, "10"=>true, "20"=>true})
+            expect(sensor.excluded_route_ids).to eq({"1"=>true, "10"=>true, "20"=>true})
             expect(sensor.dp_code).to eq(ResponseSizeSensor::DP_UNUSUAL_RESPONSE_SIZE)
           end
         end

data/spec/lib/tcell_agent/policies/appsensor/user_agent_sensor_spec.rb

@@ -0,0 +1,156 @@
+require 'spec_helper'
+
+module TCellAgent
+  module Policies
+
+    describe UserAgentSensor do
+      context "#initialize" do
+        context "default sensor" do
+          it "should have properties set to defaults" do
+            sensor = UserAgentSensor.new
+            expect(sensor.enabled).to eq(false)
+            expect(sensor.empty_enabled).to eq(false)
+            expect(UserAgentSensor::DP_CODE).to eq("uaempty")
+          end
+        end
+
+        context "setting enabled on sensor" do
+          it "should have properties set to defaults" do
+            sensor = UserAgentSensor.new({"enabled" => true, "empty_enabled" => false})
+            expect(sensor.enabled).to eq(true)
+            expect(sensor.empty_enabled).to eq(false)
+          end
+        end
+
+        context "setting empty_enabled on sensor" do
+          it "should have properties set to defaults" do
+            sensor = UserAgentSensor.new({"enabled" => false, "empty_enabled" => true})
+            expect(sensor.enabled).to eq(false)
+            expect(sensor.empty_enabled).to eq(true)
+          end
+        end
+
+        context "setting exclude_routes on sensor" do
+          it "should exclude_routes set" do
+            sensor = UserAgentSensor.new({
+              "enabled" => false,
+              "empty_enabled" => true,
+              "exclude_routes" => ["route_id"]
+            })
+            expect(sensor.enabled).to eq(false)
+            expect(sensor.empty_enabled).to eq(true)
+            expect(sensor.excluded_route_ids).to eq({"route_id" => true})
+          end
+        end
+      end
+
+      context "#check" do
+        before(:each) do
+          @meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
+          @meta.remote_address = "remote_address"
+          @meta.method = "get"
+          @meta.location = "location"
+          @meta.route_id = "route_id"
+          @meta.session_id = "session_id"
+          @meta.user_id = "user_id"
+          @meta.transaction_id = "transaction_id"
+        end
+
+        context "with disabled sensor" do
+          context "with empty user agent" do
+            it "should not send event" do
+              sensor = UserAgentSensor.new({"enabled" => false, "empty_enabled" => false})
+              @meta.user_agent = nil
+
+              expect(sensor).to_not receive(:send_event)
+              sensor.check(@meta)
+            end
+          end
+
+          context "with user agent present" do
+            it "should not send event" do
+              sensor = UserAgentSensor.new({"enabled" => false, "empty_enabled" => false})
+              @meta.user_agent = "Mozilla"
+
+              expect(sensor).to_not receive(:send_event)
+              sensor.check(@meta)
+            end
+          end
+        end
+
+        context "with enabled sensor" do
+          before(:each) do
+            @sensor = UserAgentSensor.new({"enabled" => true, "empty_enabled" => true})
+          end
+
+          context "with empty user agent" do
+            it "should send event" do
+              @meta.user_agent = ""
+
+              expect(@sensor).to receive(:send_event).with(
+                @meta, UserAgentSensor::DP_CODE, nil, nil
+              )
+              @sensor.check(@meta)
+            end
+
+            context "no excluded routes" do
+              it "should send an event" do
+                @meta.user_agent = ""
+                @sensor.excluded_route_ids = {}
+
+                expect(@sensor).to receive(:send_event).with(
+                  @meta, UserAgentSensor::DP_CODE, nil, nil
+                )
+                @sensor.check(@meta)
+              end
+            end
+
+            context "has excluded routes" do
+              context "route id matches" do
+                it "should not send an event" do
+                  @meta.user_agent = ""
+                  @sensor.excluded_route_ids = {"route_id" => true}
+
+                  expect(@sensor).to_not receive(:send_event)
+                  @sensor.check(@meta)
+                end
+              end
+              context "route id does not match" do
+                it "should send an event" do
+                  @meta.user_agent = ""
+                  @sensor.excluded_route_ids = {"nonmatching" => true}
+
+                  expect(@sensor).to receive(:send_event).with(
+                    @meta, UserAgentSensor::DP_CODE, nil, nil
+                  )
+                  @sensor.check(@meta)
+                end
+              end
+            end
+          end
+
+          context "with blank space user agent" do
+            it "should not send event" do
+              @meta.user_agent = "\n  \t  \s"
+
+              expect(@sensor).to receive(:send_event).with(
+                @meta, UserAgentSensor::DP_CODE, nil, nil
+              )
+              @sensor.check(@meta)
+            end
+          end
+
+          context "with user agent present" do
+            it "should not send event" do
+              @meta.user_agent = "Mozilla"
+
+              expect(@sensor).to_not receive(:send_event)
+              @sensor.check(@meta)
+            end
+          end
+        end
+      end
+    end
+
+  end
+end

data/spec/lib/tcell_agent/policies/appsensor/xss_sensor_spec.rb

@@ -144,6 +144,21 @@ module TCellAgent
           end
         end
 
+        context "setting excluded_route_ids on sensor" do
+          it "should have excluded_route_ids" do
+            sensor = XssSensor.new({"exclude_routes" => ["excluded_route_id"]})
+            expect(sensor.enabled).to eq(false)
+            expect(sensor.libinjection).to eq(false)
+            expect(sensor.detection_point).to eq("xss")
+            expect(sensor.exclude_headers).to eq(false)
+            expect(sensor.exclude_forms).to eq(false)
+            expect(sensor.exclude_cookies).to eq(false)
+            expect(sensor.exclusions).to eq({})
+            expect(sensor.active_pattern_ids).to eq({})
+            expect(sensor.v1_compatability_enabled).to eq(false)
+            expect(sensor.excluded_route_ids).to eq({"excluded_route_id" => true})
+          end
+        end
       end
 
       describe "#find_vulnerability" do
@@ -211,6 +226,7 @@ module TCellAgent
           before(:each) do
             @sensor = XssSensor.new({"enabled" => true})
           end
+
           context "param has NO vulnerability" do
             it "should return false" do
               sensor = XssSensor.new({"enabled" => false})
@@ -218,6 +234,34 @@ module TCellAgent
 
               expect(result).to eq(false)
             end
+
+            context "no excluded routes" do
+              it "should return false" do
+                sensor = XssSensor.new({"enabled" => false, "exclude_routes" => []})
+                result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                expect(result).to eq(false)
+              end
+            end
+
+            context "has excluded routes" do
+              context "route id matches" do
+                it "should return false" do
+                  sensor = XssSensor.new({"enabled" => false, "exclude_routes" => ["route_id"]})
+                  result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                  expect(result).to eq(false)
+                end
+              end
+              context "route id does not match" do
+                it "should return false" do
+                  sensor = XssSensor.new({"enabled" => false, "exclude_routes" => ["unmatching_route_id"]})
+                  result = sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                  expect(result).to eq(false)
+                end
+              end
+            end
           end
 
           context "param has a vulnerability" do
@@ -235,6 +279,55 @@ module TCellAgent
 
                   expect(result).to eq(false)
                 end
+
+                context "no excluded routes" do
+                  it "should return false" do
+                    @sensor.exclude_forms = true
+                    @sensor.exclude_cookies = false
+                    @sensor.excluded_route_ids = {}
+
+                    expect(TCellAgent).to_not receive(:configuration)
+                    expect(@sensor).to_not receive(:find_vulnerability)
+                    expect(@sensor).to_not receive(:send_event)
+
+                    result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                    expect(result).to eq(false)
+                  end
+                end
+
+                context "has excluded routes" do
+                  context "route id matches" do
+                    it "should return false" do
+                      @sensor.exclude_forms = true
+                      @sensor.exclude_cookies = false
+                      @sensor.excluded_route_ids = {"route_id" => true}
+
+                      expect(TCellAgent).to_not receive(:configuration)
+                      expect(@sensor).to_not receive(:find_vulnerability)
+                      expect(@sensor).to_not receive(:send_event)
+
+                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                      expect(result).to eq(false)
+                    end
+                  end
+                  context "route id does not match" do
+                    it "should return false" do
+                      @sensor.exclude_forms = true
+                      @sensor.exclude_cookies = false
+                      @sensor.excluded_route_ids = {"unmatching_route_id" => true}
+
+                      expect(TCellAgent).to_not receive(:configuration)
+                      expect(@sensor).to_not receive(:find_vulnerability)
+                      expect(@sensor).to_not receive(:send_event)
+
+                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                      expect(result).to eq(false)
+                    end
+                  end
+                end
               end
 
               context "exclude cookies sensor" do
@@ -497,6 +590,88 @@ module TCellAgent
                      end
                    end
                 end
+
+                context "no excluded routes" do
+                  it "should return true" do
+                    @sensor.exclude_forms = false
+                    @sensor.exclude_cookies = true
+                    @sensor.excluded_route_ids = {}
+                    configuration = double(
+                      "configuration",
+                      allow_unencrypted_appfirewall_payloads_logging: false,
+                      allow_unencrypted_appfirewall_payloads: true,
+                      blacklisted_params: {},
+                      whitelist_present: false
+                    )
+
+                    expect(@sensor).to receive(:find_vulnerability).and_return(
+                      {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                    )
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                    expect(@sensor).to receive(:send_event).with(
+                      @meta,
+                      "xss",
+                      "vuln_param",
+                      {"t" => XssSensor::GET_PARAM}.to_json,
+                      "vuln_value",
+                      "1"
+                    )
+
+                    result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                    expect(result).to eq(true)
+                  end
+                end
+
+                context "has excluded routes" do
+                  context "route id matches" do
+                    it "should return false" do
+                      @sensor.exclude_forms = false
+                      @sensor.exclude_cookies = true
+                      @sensor.excluded_route_ids = {"route_id" => true}
+
+                      expect(TCellAgent).to_not receive(:configuration)
+                      expect(@sensor).to_not receive(:find_vulnerability)
+                      expect(@sensor).to_not receive(:send_event)
+
+                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                      expect(result).to eq(false)
+                    end
+                  end
+
+                  context "route id does not match" do
+                    it "should return true" do
+                      @sensor.exclude_forms = false
+                      @sensor.exclude_cookies = true
+                      @sensor.excluded_route_ids = {"unmatching_route_id" => true}
+                      configuration = double(
+                        "configuration",
+                        allow_unencrypted_appfirewall_payloads_logging: false,
+                        allow_unencrypted_appfirewall_payloads: true,
+                        blacklisted_params: {},
+                        whitelist_present: false
+                      )
+
+                      expect(@sensor).to receive(:find_vulnerability).and_return(
+                        {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                      )
+                      expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+                      expect(@sensor).to receive(:send_event).with(
+                        @meta,
+                        "xss",
+                        "vuln_param",
+                        {"t" => XssSensor::GET_PARAM}.to_json,
+                        "vuln_value",
+                        "1"
+                      )
+
+                      result = @sensor.check(XssSensor::GET_PARAM, @meta, "param_name", "param_value")
+
+                      expect(result).to eq(true)
+                    end
+                  end
+                end
               end
             end