tcell_agent 0.2.19 → 0.2.21

data/spec/lib/tcell_agent/policies/appsensor/payloads_policy_log_spec.rb

@@ -0,0 +1,484 @@
+require 'spec_helper'
+
+module TCellAgent
+  module Policies
+
+    describe AppSensorPolicy do
+
+      describe "#log" do
+        before(:each) do
+          @meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
+          @meta.remote_address = "remote_address"
+          @meta.method = "get"
+          @meta.location = "location"
+          @meta.route_id = "route_id"
+          @meta.session_id = "session_id"
+          @meta.user_id = "user_id"
+          @meta.transaction_id = "transaction_id"
+        end
+
+        context "with log_payloads disabled" do
+          it "should not log" do
+            policy = PayloadsPolicy.from_json({
+              "payloads" => {
+                "log_payloads" => false
+              }
+            })
+
+            expect(TCellAgent).to_not receive(:configuration)
+            expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+
+            policy.log(
+              "xss",
+              @meta,
+              TCellAgent::Utils::Params::GET_PARAM,
+              "password",
+              "alert()",
+              {"l" => "query"},
+              "pattern"
+            )
+          end
+        end
+
+        context "with log_payloads enabled" do
+          context "with allow_unencrypted_appfirewall_payloads_logging disabled" do
+            it "should not log" do
+              policy = PayloadsPolicy.from_json({
+                "payloads" => {
+                  "log_payloads" => true
+                }
+              })
+
+              configuration = double("configuration")
+
+              expect(TCellAgent).to receive(:configuration).and_return(configuration)
+              expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                false
+              )
+              expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+
+              policy.log(
+                "xss",
+                @meta,
+                TCellAgent::Utils::Params::GET_PARAM,
+                "password",
+                "alert()",
+                {"l" => "query"},
+                "pattern"
+              )
+            end
+          end
+
+          context "with allow_unencrypted_appfirewall_payloads_logging enabled" do
+            context "with no blacklist" do
+              context "with no whitelist" do
+                it "should log the value" do
+                  policy = PayloadsPolicy.from_json({
+                    "payloads" => {
+                      "log_payloads" => true
+                    }
+                  })
+                  configuration = double("configuration")
+                  appfirewall_payloads_logger = double("appfirewall_payloads_logger")
+
+                  expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                  expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                    true
+                  )
+                  expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
+                    appfirewall_payloads_logger
+                  )
+                  expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
+                    :post_process
+                  )
+                  expect(appfirewall_payloads_logger).to receive(:info).with({
+                    "event_type" => "as",
+                    "dp" => "xss",
+                    "param" => "password",
+                    "remote_addr" => "remote_address",
+                    "m" => "get",
+                    "pattern" => "pattern",
+                    "meta" => {"l" => "query"},
+                    "rid" => "route_id"
+                  }.to_json)
+
+                  policy.log(
+                    "xss",
+                    @meta,
+                    TCellAgent::Utils::Params::GET_PARAM,
+                    "password",
+                    "alert()",
+                    {"l" => "query"},
+                    "pattern"
+                  )
+                end
+              end
+
+              context "with a whitelist" do
+                context "that does not specify locations for the param" do
+                  it "should not log" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "log_payloads" => true,
+                        "log_whitelist" => {
+                          "username" => ["*"]
+                        }
+                      }
+                    })
+                    configuration = double("configuration")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                      true
+                    )
+                    expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+
+                    policy.log(
+                      "xss",
+                      @meta,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+                  end
+                end
+
+                context "that specifies locations for the param" do
+                  context "param location does not match specified location do" do
+                    it "should not log" do
+                      policy = PayloadsPolicy.from_json({
+                        "payloads" => {
+                          "log_payloads" => true,
+                          "log_whitelist" => {
+                            "username" => ["*"],
+                            "password" => ["cookie"]
+                          }
+                        }
+                      })
+                      configuration = double("configuration")
+
+                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                        true
+                      )
+                      expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+
+                      policy.log(
+                        "xss",
+                        @meta,
+                        TCellAgent::Utils::Params::GET_PARAM,
+                        "password",
+                        "alert()",
+                        {"l" => "query"},
+                        "pattern"
+                      )
+                    end
+                  end
+
+                  context "param location matches the specified location in the whitelist" do
+                    it "should log the value" do
+                      policy = PayloadsPolicy.from_json({
+                        "payloads" => {
+                          "log_payloads" => true,
+                          "log_whitelist" => {
+                            "username" => ["*"],
+                            "PASSWORD" => ["form"]
+                          }
+                        }
+                      })
+                      configuration = double("configuration")
+                      appfirewall_payloads_logger = double("appfirewall_payloads_logger")
+
+                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                        true
+                      )
+                      expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
+                        appfirewall_payloads_logger
+                      )
+                      expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
+                        :post_process
+                      )
+                      expect(appfirewall_payloads_logger).to receive(:info).with({
+                        "event_type" => "as",
+                        "dp" => "xss",
+                        "param" => "password",
+                        "remote_addr" => "remote_address",
+                        "m" => "get",
+                        "pattern" => "pattern",
+                        "meta" => {"l" => "query"},
+                        "rid" => "route_id",
+                      }.to_json)
+
+                      policy.log(
+                        "xss",
+                        @meta,
+                        TCellAgent::Utils::Params::GET_PARAM,
+                        "password",
+                        "alert()",
+                        {"l" => "query"},
+                        "pattern"
+                      )
+                    end
+                  end
+                end
+              end
+            end
+
+            context "with a blacklist" do
+              context "that does not specify locations for the param" do
+                context "with no whitelist" do
+                  it "should log the value" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "log_payloads" => true,
+                        "log_blacklist" => {
+                          "username" => ["*"]
+                        }
+                      }
+                    })
+                    configuration = double("configuration")
+                    appfirewall_payloads_logger = double("appfirewall_payloads_logger")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                      true
+                    )
+                    expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
+                      appfirewall_payloads_logger
+                    )
+                    expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
+                      :post_process
+                    )
+                    expect(appfirewall_payloads_logger).to receive(:info).with({
+                      "event_type" => "as",
+                      "dp" => "xss",
+                      "param" => "password",
+                      "remote_addr" => "remote_address",
+                      "m" => "get",
+                      "pattern" => "pattern",
+                      "meta" => {"l" => "query"},
+                      "rid" => "route_id"
+                    }.to_json)
+
+                    policy.log(
+                      "xss",
+                      @meta,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+                  end
+                end
+
+                context "with a whitelist" do
+                  context "that does not specify locations for the param" do
+                    it "should not log" do
+                      policy = PayloadsPolicy.from_json({
+                        "payloads" => {
+                          "log_payloads" => true,
+                          "log_blacklist" => {
+                            "username" => ["*"]
+                          },
+                          "log_whitelist" => {
+                            "username" => ["*"]
+                          }
+                        }
+                      })
+                      configuration = double("configuration")
+
+                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                        true
+                      )
+                      expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+
+                      policy.log(
+                        "xss",
+                        @meta,
+                        TCellAgent::Utils::Params::GET_PARAM,
+                        "password",
+                        "alert()",
+                        {"l" => "query"},
+                        "pattern"
+                      )
+                    end
+                  end
+
+                  context "that specifies locations for the param" do
+                    context "param location does not match specified location" do
+                      it "should not log" do
+                        policy = PayloadsPolicy.from_json({
+                          "payloads" => {
+                            "log_payloads" => true,
+                            "log_blacklist" => {
+                              "username" => ["*"],
+                            },
+                            "log_whitelist" => {
+                              "password" => ["cookie"]
+                            }
+                          }
+                        })
+                        configuration = double("configuration")
+
+                        expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                        expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                          true
+                        )
+                        expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+
+                        policy.log(
+                          "xss",
+                          @meta,
+                          TCellAgent::Utils::Params::GET_PARAM,
+                          "password",
+                          "alert()",
+                          {"l" => "query"},
+                          "pattern"
+                        )
+                      end
+                    end
+
+                    context "param location matches the specified location" do
+                      it "should log the value" do
+                        policy = PayloadsPolicy.from_json({
+                          "payloads" => {
+                            "log_payloads" => true,
+                            "log_blacklist" => {
+                              "username" => ["*"],
+                            },
+                            "log_whitelist" => {
+                              "PASSWORD" => ["form"]
+                            }
+                          }
+                        })
+                        configuration = double("configuration")
+                        appfirewall_payloads_logger = double("appfirewall_payloads_logger")
+
+                        expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                        expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                          true
+                        )
+                        expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
+                          appfirewall_payloads_logger
+                        )
+                        expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
+                          :post_process
+                        )
+                        expect(appfirewall_payloads_logger).to receive(:info).with({
+                          "event_type" => "as",
+                          "dp" => "xss",
+                          "param" => "password",
+                          "remote_addr" => "remote_address",
+                          "m" => "get",
+                          "pattern" => "pattern",
+                          "meta" => {"l" => "query"},
+                          "rid" => "route_id"
+                        }.to_json)
+
+                        policy.log(
+                          "xss",
+                          @meta,
+                          TCellAgent::Utils::Params::GET_PARAM,
+                          "password",
+                          "alert()",
+                          {"l" => "query"},
+                          "pattern"
+                        )
+                      end
+                    end
+                  end
+                end
+              end
+
+              context "that specifies locations for the param" do
+                context "param location does not match specified location" do
+                  it "should log the value" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "log_payloads" => true,
+                        "log_blacklist" => {
+                          "password" => ["cookie"],
+                        }
+                      }
+                    })
+                    configuration = double("configuration")
+                    appfirewall_payloads_logger = double("appfirewall_payloads_logger")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                      true
+                    )
+                    expect(TCellAgent).to receive(:appfirewall_payloads_logger).and_return(
+                      appfirewall_payloads_logger
+                    )
+                    expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
+                      :post_process
+                    )
+                    expect(appfirewall_payloads_logger).to receive(:info).with({
+                      "event_type" => "as",
+                      "dp" => "xss",
+                      "param" => "password",
+                      "remote_addr" => "remote_address",
+                      "m" => "get",
+                      "pattern" => "pattern",
+                      "meta" => {"l" => "query"},
+                      "rid" => "route_id"
+                    }.to_json)
+
+                    policy.log(
+                      "xss",
+                      @meta,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+                  end
+                end
+
+                context "param location matches the specified location" do
+                  it "should not log" do
+                    policy = PayloadsPolicy.from_json({
+                      "payloads" => {
+                        "log_payloads" => true,
+                        "log_blacklist" => {
+                          "password" => ["form"],
+                        }
+                      }
+                    })
+                    configuration = double("configuration")
+
+                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
+                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads_logging).and_return(
+                      true
+                    )
+                    expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
+
+                    policy.log(
+                      "xss",
+                      @meta,
+                      TCellAgent::Utils::Params::GET_PARAM,
+                      "password",
+                      "alert()",
+                      {"l" => "query"},
+                      "pattern"
+                    )
+                  end
+                end
+              end
+            end
+          end
+        end
+
+      end
+
+    end
+
+  end
+end

data/spec/lib/tcell_agent/policies/appsensor/request_size_sensor_spec.rb

@@ -145,10 +145,11 @@ module TCellAgent
                   {
                     "event_type" => "as",
                     "dp" => RequestSizeSensor::DP_UNUSUAL_REQUEST_SIZE,
-                    "param" => "2048",
+                    "param" => nil,
                     "remote_addr" => "remote_address",
-                    "rou" => "excluded_route_id",
-                    "m" => "get"
+                    "m" => "get",
+                    "meta" => {"sz" => 2048},
+                    "rid" => "excluded_route_id"
                   }
                 )
                 sensor.check(meta, 2048)

data/spec/lib/tcell_agent/policies/appsensor/response_codes_sensor_spec.rb

@@ -177,7 +177,7 @@ module TCellAgent
 
               it "should send an event" do
                 expect(@sensor).to receive(:send_event).with(
-                  @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], "400", nil
+                  @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], nil, {code: 400} , nil, nil
                 )
                 @sensor.check(@meta, 400)
               end
@@ -187,7 +187,7 @@ module TCellAgent
                   @sensor.excluded_route_ids = {}
 
                   expect(@sensor).to receive(:send_event).with(
-                    @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], "400", nil
+                    @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], nil, {code: 400} , nil, nil
                   )
                   @sensor.check(@meta, 400)
                 end
@@ -207,7 +207,7 @@ module TCellAgent
                     @sensor.excluded_route_ids = {"unmatching_route_id" => true}
 
                     expect(@sensor).to receive(:send_event).with(
-                      @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], "400", nil
+                      @meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[4], nil, {code: 400} , nil, nil
                     )
                     @sensor.check(@meta, 400)
                   end
@@ -255,7 +255,7 @@ module TCellAgent
                 meta.transaction_id = "transaction_id"
 
                 expect(sensor).to receive(:send_event).with(
-                  meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[500], "500", nil
+                  meta, ResponseCodesSensor::RESPONSE_CODE_DP_DICT[500], nil, {code: 500} , nil, nil
                 )
                 sensor.check(meta, 500)
               end

data/spec/lib/tcell_agent/policies/appsensor/response_size_sensor_spec.rb

@@ -142,7 +142,7 @@ module TCellAgent
                 meta.transaction_id = "transaction_id"
 
                 expect(sensor).to receive(:send_event).with(
-                  meta, ResponseSizeSensor::DP_UNUSUAL_RESPONSE_SIZE, "2048", nil
+                  meta, ResponseSizeSensor::DP_UNUSUAL_RESPONSE_SIZE, nil, {"sz" => 2048}, nil, nil
                 )
                 sensor.check(meta, 2048)
               end

data/spec/lib/tcell_agent/policies/appsensor/sqli_sensor_spec.rb

@@ -1,3 +1,5 @@
+# encoding: utf-8
+
 require 'spec_helper'
 
 module TCellAgent
@@ -145,6 +147,89 @@ module TCellAgent
         end
 
       end
+
+      describe "#find_vulnerability" do
+        before(:each) do
+          @sensor = SqliSensor.new({"enabled" => true})
+        end
+
+        context "with libinjection enabled" do
+          context "with param value that doesn't match any vulnerabilities" do
+            it "should return nil" do
+              @sensor.libinjection = true
+
+              ruleset = double("ruleset")
+              expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
+              expect(ruleset).to receive(:check_violation).with(
+                "param", "value", {}, false
+              ).and_return(nil)
+
+              expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
+            end
+
+            context "and it has utf-8 chars" do
+              it "should return nil but not fail miserably" do
+                @sensor.libinjection = true
+
+                ruleset = double("ruleset")
+                expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
+                expect(ruleset).to receive(:check_violation).with(
+                  "param", "Müller", {}, false
+                ).and_return(nil)
+
+                expect(@sensor.find_vulnerability("param", "Müller")).to eq(nil)
+              end
+            end
+          end
+
+          context "with param value that matches a vulnerability" do
+            it "should return the param and it's value" do
+              @sensor.libinjection = true
+
+              expect(@sensor).to_not receive(:get_ruleset)
+
+              expect(@sensor.find_vulnerability("param_name", "' OR 1=1")).to eq(
+                {"param"=>"param_name", "value"=>"' OR 1=1", "pattern"=>"li"}
+              )
+            end
+          end
+        end
+
+        context "with no ruleset" do
+          it "should return nil" do
+            expect(@sensor).to receive(:get_ruleset).and_return(nil)
+
+            expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
+          end
+        end
+
+        context "with ruletset" do
+          context "with param value that doesn't match any vulnerabilities" do
+            it "should return nil" do
+              ruleset = double("ruleset")
+              expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
+              expect(ruleset).to receive(:check_violation).with(
+                "param", "value", {}, false
+              ).and_return(nil)
+
+              expect(@sensor.find_vulnerability("param", "value")).to eq(nil)
+            end
+          end
+
+          context "with param value that matches a vulnerability" do
+            it "should return the param and it's value" do
+              ruleset = double("ruleset")
+              expect(@sensor).to receive(:get_ruleset).and_return(ruleset)
+              expect(ruleset).to receive(:check_violation).with(
+                "param", "value", {}, false
+              ).and_return(true)
+
+              expect(@sensor.find_vulnerability("param", "value")).to eq(true)
+            end
+          end
+        end
+      end
+
     end
 
   end