tcell_agent 0.2.19 → 0.2.21

data/spec/lib/tcell_agent/policies/appsensor/misc_sensor_spec.rb

@@ -4,6 +4,12 @@ require 'spec_helper'
 module TCellAgent
   module Policies
 
+    class FakeInvalidAuthenticityToken < StandardError
+    end
+
+    class FakeStatementInvalid < StandardError
+    end
+
     describe MiscSensor do
       context "#initialize" do
         context "default sensor" do
@@ -58,6 +64,9 @@ module TCellAgent
       end
 
       describe "#csrf_rejected" do
+        before(:each) do
+          @exception_class = FakeInvalidAuthenticityToken
+        end
 
         context "with disabled sensor" do
           context "with disabled csrf_exception_enabled sensor" do
@@ -67,7 +76,7 @@ module TCellAgent
 
               expect(TCellAgent).to_not receive(:send_event)
 
-              sensor.csrf_rejected(tcell_data)
+              sensor.csrf_rejected(tcell_data, @exception_class)
             end
           end
 
@@ -78,7 +87,7 @@ module TCellAgent
 
               expect(TCellAgent).to_not receive(:send_event)
 
-              sensor.csrf_rejected(tcell_data)
+              sensor.csrf_rejected(tcell_data, @exception_class)
             end
 
             context "with nil tcell-data" do
@@ -88,7 +97,7 @@ module TCellAgent
 
                 expect(TCellAgent).to_not receive(:send_event)
 
-                sensor.csrf_rejected(tcell_data)
+                sensor.csrf_rejected(tcell_data, @exception_class)
               end
             end
           end
@@ -102,7 +111,7 @@ module TCellAgent
 
               expect(TCellAgent).to_not receive(:send_event)
 
-              sensor.csrf_rejected(tcell_data)
+              sensor.csrf_rejected(tcell_data, @exception_class)
             end
 
             context "no excluded routes" do
@@ -117,7 +126,7 @@ module TCellAgent
 
                 expect(TCellAgent).to_not receive(:send_event)
 
-                sensor.csrf_rejected(tcell_data)
+                sensor.csrf_rejected(tcell_data, @exception_class)
               end
             end
 
@@ -134,7 +143,7 @@ module TCellAgent
 
                   expect(TCellAgent).to_not receive(:send_event)
 
-                  sensor.csrf_rejected(tcell_data)
+                  sensor.csrf_rejected(tcell_data, @exception_class)
                 end
               end
 
@@ -150,7 +159,7 @@ module TCellAgent
 
                   expect(TCellAgent).to_not receive(:send_event)
 
-                  sensor.csrf_rejected(tcell_data)
+                  sensor.csrf_rejected(tcell_data, @exception_class)
                 end
               end
             end
@@ -164,12 +173,12 @@ module TCellAgent
               expect(TCellAgent).to receive(:send_event).with({
                 "event_type"=>"as",
                 "dp"=>"excsrf",
-                "param"=>nil,
+                "param"=>"TCellAgent::Policies::FakeInvalidAuthenticityToken",
                 "remote_addr"=>nil,
                 "m"=>nil
               })
 
-              sensor.csrf_rejected(tcell_data)
+              sensor.csrf_rejected(tcell_data, @exception_class)
             end
 
             context "no excluded routes" do
@@ -185,13 +194,13 @@ module TCellAgent
                 expect(TCellAgent).to receive(:send_event).with({
                   "event_type"=>"as",
                   "dp"=>"excsrf",
-                  "param"=>nil,
+                  "param"=>"TCellAgent::Policies::FakeInvalidAuthenticityToken",
                   "remote_addr"=>nil,
-                  "rou"=>"route_id",
+                  "rid"=>"route_id",
                   "m"=>nil
                 })
 
-                sensor.csrf_rejected(tcell_data)
+                sensor.csrf_rejected(tcell_data, @exception_class)
               end
             end
 
@@ -208,7 +217,7 @@ module TCellAgent
 
                   expect(TCellAgent).to_not receive(:send_event)
 
-                  sensor.csrf_rejected(tcell_data)
+                  sensor.csrf_rejected(tcell_data, @exception_class)
                 end
               end
 
@@ -225,13 +234,13 @@ module TCellAgent
                   expect(TCellAgent).to receive(:send_event).with({
                     "event_type"=>"as",
                     "dp"=>"excsrf",
-                    "param"=>nil,
+                    "param"=>"TCellAgent::Policies::FakeInvalidAuthenticityToken",
                     "remote_addr"=>nil,
-                    "rou"=>"route_id",
+                    "rid"=>"route_id",
                     "m"=>nil
                   })
 
-                  sensor.csrf_rejected(tcell_data)
+                  sensor.csrf_rejected(tcell_data, @exception_class)
                 end
               end
             end
@@ -242,7 +251,7 @@ module TCellAgent
 
       describe "#sql_exception_enabled" do
         before(:each) do
-          @exception = Exception.new
+          @exception = FakeStatementInvalid.new
         end
 
         context "with disabled sensor" do
@@ -350,7 +359,7 @@ module TCellAgent
               expect(TCellAgent).to receive(:send_event).with({
                 "event_type"=>"as",
                 "dp"=>"exsql",
-                "param"=>nil,
+                "param"=>"TCellAgent::Policies::FakeStatementInvalid",
                 "remote_addr"=>nil,
                 "m"=>nil
               })
@@ -371,9 +380,9 @@ module TCellAgent
                 expect(TCellAgent).to receive(:send_event).with({
                   "event_type"=>"as",
                   "dp"=>"exsql",
-                  "param"=>nil,
+                  "param"=>"TCellAgent::Policies::FakeStatementInvalid",
                   "remote_addr"=>nil,
-                  "rou"=>"route_id",
+                  "rid"=>"route_id",
                   "m"=>nil
                 })
 
@@ -411,9 +420,9 @@ module TCellAgent
                   expect(TCellAgent).to receive(:send_event).with({
                     "event_type"=>"as",
                     "dp"=>"exsql",
-                    "param"=>nil,
+                    "param"=>"TCellAgent::Policies::FakeStatementInvalid",
                     "remote_addr"=>nil,
-                    "rou"=>"route_id",
+                    "rid"=>"route_id",
                     "m"=>nil
                   })
 

data/spec/lib/tcell_agent/policies/appsensor/payloads_policy_apply_spec.rb

@@ -0,0 +1,466 @@
+require 'spec_helper'
+
+module TCellAgent
+  module Policies
+
+    describe AppSensorPolicy do
+
+      describe "#apply" do
+
+        context "with send_payloads disabled" do
+          it "should return nil payload" do
+            policy = PayloadsPolicy.from_json({
+              "payloads" => {
+                "send_payloads" => false
+              }
+            })
+
+            expect(TCellAgent).to_not receive(:configuration)
+            expect(policy).to receive(:log).with(
+              "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+            )
+
+            payload = policy.apply(
+              "xss",
+              nil,
+              TCellAgent::Utils::Params::GET_PARAM,
+              "password",
+              "alert()",
+              {"l" => "query"},
+              "pattern"
+            )
+
+            expect(payload).to eq(
+              nil
+            )
+          end
+        end
+
+        context "with send_payloads enabled" do
+          context "with allow_unencrypted_appfirewall_payloads disabled" do
+            it "should return nil payload" do
+              policy = PayloadsPolicy.from_json({
+                "payloads" => {
+                  "send_payloads" => true
+                }
+              })
+
+              configuration = double("configuration")
+
+              expect(TCellAgent).to receive(:configuration).and_return(configuration)
+              expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                false
+              )
+              expect(policy).to receive(:log).with(
+                "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+              )
+
+              payload = policy.apply(
+                "xss",
+                nil,
+                TCellAgent::Utils::Params::GET_PARAM,
+                "password",
+                "alert()",
+                {"l" => "query"},
+                "pattern"
+              )
+
+              expect(payload).to eq(
+                nil
+              )
+            end
+          end
+
+          context "with allow_unencrypted_appfirewall_payloads enabled" do
+            context "with no blacklist" do
+              context "with no whitelist" do
+                it "return the vulnerable value" do
+                  policy = PayloadsPolicy.from_json({
+                    "payloads" => {
+                      "send_payloads" => true
+                    }
+                  })
+                  configuration = double("configuration")
+
+                  expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                  expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                    true
+                  )
+                  expect(policy).to receive(:log).with(
+                    "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                  )
+
+                  payload = policy.apply(
+                    "xss",
+                    nil,
+                    TCellAgent::Utils::Params::GET_PARAM,
+                    "password",
+                    "alert()",
+                    {"l" => "query"},
+                    "pattern"
+                  )
+
+                  expect(payload).to eq(
+                    "alert()"
+                  )
+                end
+              end
+
+              context "with a whitelist" do
+                context "that does not specify locations for the param" do
+                  it "return return NOT_WHITELISTED" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "send_payloads" => true,
+                        "send_whitelist" => {
+                          "username" => ["*"]
+                        }
+                      }
+                    })
+                    configuration = double("configuration")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                      true
+                    )
+                    expect(policy).to receive(:log).with(
+                      "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                    )
+
+                    payload = policy.apply(
+                      "xss",
+                      nil,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+
+                    expect(payload).to eq(
+                      "NOT_WHITELISTED"
+                    )
+                  end
+                end
+
+                context "that specifies locations for the param" do
+                  context "param location does not match specified location do" do
+                    it "return should return NOT_WHITELISTED" do
+                      policy = PayloadsPolicy.from_json({
+                        "payloads" => {
+                          "send_payloads" => true,
+                          "send_whitelist" => {
+                            "username" => ["*"],
+                            "password" => ["cookie"]
+                          }
+                        }
+                      })
+                      configuration = double("configuration")
+
+                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                        true
+                      )
+                      expect(policy).to receive(:log).with(
+                        "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                      )
+
+                      payload = policy.apply(
+                        "xss",
+                        nil,
+                        TCellAgent::Utils::Params::GET_PARAM,
+                        "password",
+                        "alert()",
+                        {"l" => "query"},
+                        "pattern"
+                      )
+
+                      expect(payload).to eq(
+                        "NOT_WHITELISTED"
+                      )
+                    end
+                  end
+
+                  context "param location matches the specified location in the whitelist" do
+                    it "return the vulnerable value" do
+                      policy = PayloadsPolicy.from_json({
+                        "payloads" => {
+                          "send_payloads" => true,
+                          "send_whitelist" => {
+                            "username" => ["*"],
+                            "PASSWORD" => ["form"]
+                          }
+                        }
+                      })
+                      configuration = double("configuration")
+
+                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                        true
+                      )
+                      expect(policy).to receive(:log).with(
+                        "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                      )
+
+                      payload = policy.apply(
+                        "xss",
+                        nil,
+                        TCellAgent::Utils::Params::GET_PARAM,
+                        "password",
+                        "alert()",
+                        {"l" => "query"},
+                        "pattern"
+                      )
+
+                      expect(payload).to eq(
+                        "alert()"
+                      )
+                    end
+                  end
+                end
+              end
+            end
+
+            context "with a blacklist" do
+              context "that does not specify locations for the param" do
+                context "with no whitelist" do
+                  it "should return the vulnerable value" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "send_payloads" => true,
+                        "send_blacklist" => {
+                          "username" => ["*"]
+                        }
+                      }
+                    })
+                    configuration = double("configuration")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                      true
+                    )
+                    expect(policy).to receive(:log).with(
+                      "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                    )
+
+                    payload = policy.apply(
+                      "xss",
+                      nil,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+
+                    expect(payload).to eq(
+                      "alert()"
+                    )
+                  end
+                end
+
+                context "with a whitelist" do
+                  context "that does not specify locations for the param" do
+                    it "should return NOT_WHITELISTED" do
+                      policy = PayloadsPolicy.from_json({
+                        "payloads" => {
+                          "send_payloads" => true,
+                          "send_blacklist" => {
+                            "username" => ["*"]
+                          },
+                          "send_whitelist" => {
+                            "username" => ["*"]
+                          }
+                        }
+                      })
+                      configuration = double("configuration")
+
+                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                        true
+                      )
+                      expect(policy).to receive(:log).with(
+                        "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                      )
+
+                      payload = policy.apply(
+                        "xss",
+                        nil,
+                        TCellAgent::Utils::Params::GET_PARAM,
+                        "password",
+                        "alert()",
+                        {"l" => "query"},
+                        "pattern"
+                      )
+
+                      expect(payload).to eq(
+                        "NOT_WHITELISTED"
+                      )
+                    end
+                  end
+
+                  context "that specifies locations for the param" do
+                    context "param location does not match specified location" do
+                      it "should return NOT_WHITELISTED" do
+                        policy = PayloadsPolicy.from_json({
+                          "payloads" => {
+                            "send_payloads" => true,
+                            "send_blacklist" => {
+                              "username" => ["*"],
+                            },
+                            "send_whitelist" => {
+                              "password" => ["cookie"]
+                            }
+                          }
+                        })
+                        configuration = double("configuration")
+
+                        expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                        expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                          true
+                        )
+                        expect(policy).to receive(:log).with(
+                          "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                        )
+
+                        payload = policy.apply(
+                          "xss",
+                          nil,
+                          TCellAgent::Utils::Params::GET_PARAM,
+                          "password",
+                          "alert()",
+                          {"l" => "query"},
+                          "pattern"
+                        )
+
+                        expect(payload).to eq(
+                          "NOT_WHITELISTED"
+                        )
+                      end
+                    end
+
+                    context "param location matches the specified location" do
+                      it "should return the vulnerable value" do
+                        policy = PayloadsPolicy.from_json({
+                          "payloads" => {
+                            "send_payloads" => true,
+                            "send_blacklist" => {
+                              "username" => ["*"],
+                            },
+                            "send_whitelist" => {
+                              "PASSWORD" => ["form"]
+                            }
+                          }
+                        })
+                        configuration = double("configuration")
+
+                        expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                        expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                          true
+                        )
+                        expect(policy).to receive(:log).with(
+                          "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                        )
+
+                        payload = policy.apply(
+                          "xss",
+                          nil,
+                          TCellAgent::Utils::Params::GET_PARAM,
+                          "password",
+                          "alert()",
+                          {"l" => "query"},
+                          "pattern"
+                        )
+
+                        expect(payload).to eq(
+                          "alert()"
+                        )
+                      end
+                    end
+                  end
+                end
+              end
+
+              context "that specifies locations for the param" do
+                context "param location does not match specified location" do
+                  it "should return the vulnerable value" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "send_payloads" => true,
+                        "send_blacklist" => {
+                          "password" => ["cookie"],
+                        }
+                      }
+                    })
+                    configuration = double("configuration")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                      true
+                    )
+                    expect(policy).to receive(:log).with(
+                      "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                    )
+
+                    payload = policy.apply(
+                      "xss",
+                      nil,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+
+                    expect(payload).to eq(
+                      "alert()"
+                    )
+                  end
+                end
+
+                context "param location matches the specified location" do
+                  it "should return BLACKLISTED" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "send_payloads" => true,
+                        "send_blacklist" => {
+                          "password" => ["form"],
+                        }
+                      }
+                    })
+                    configuration = double("configuration")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
+                      true
+                    )
+                    expect(policy).to receive(:log).with(
+                      "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
+                    )
+
+                    payload = policy.apply(
+                      "xss",
+                      nil,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+
+                    expect(payload).to eq(
+                      "BLACKLISTED"
+                    )
+                  end
+                end
+              end
+            end
+          end
+        end
+
+      end
+
+    end
+
+  end
+end