tcell_agent 0.2.2

data/spec/lib/tcell_agent/policies/content_security_policy_spec.rb

@@ -0,0 +1,71 @@
+require 'spec_helper'
+
+module TCellAgent
+    module Policies
+        describe ContentSecurityPolicy do
+            content_security_policy_json = {
+                "policy_id"=>"00a1",
+                "headers"=>[
+                    {"name"=>"csp", "value"=>"csp header value"}
+                ]
+            }
+            csp_from_json = ContentSecurityPolicy.fromJson(content_security_policy_json)
+            context "initialized with 3 items" do
+              it "returns true" do
+                expect(csp_from_json.policy_id).to eq("00a1")
+                expect(csp_from_json.headers[0].type).to eq("csp")
+                expect(csp_from_json.headers[0].value).to eq("csp header value")
+              end
+            end
+            context "headers match up appropriately" do
+              it "returns content-security-policy headers" do
+                expect(ContentSecurityPolicy.cspHeadersForType("csp")).to match_array(["Content-Security-Policy"])
+              end
+            end
+        end
+        describe ContentSecurityPolicy do
+            content_security_policy_json = {
+                "policy_id"=>"01a1",
+                "headers"=>[
+                    {"name"=>"csp-header-is-bad", "value"=>"csp header value"}
+                ]
+            }
+            csp_policy = ContentSecurityPolicy.fromJson(content_security_policy_json)
+            context "csp header example, invalid header" do
+                it "returns false" do
+                    expect(csp_policy.headers.length).to eq(0)
+                end
+            end
+        end
+        describe ContentSecurityPolicy do
+            content_security_policy_json = {
+                "policy_id"=>"01a1",
+                "headers"=>[
+                    {"name"=>"csp", "value"=>"value123\\nabc"}
+                ]
+            }
+            csp_policy = ContentSecurityPolicy.fromJson(content_security_policy_json)
+            context "secure header, value is bad" do
+                it "returns false" do
+                    expect(csp_policy.headers.length).to eq(0)
+                end
+            end
+        end
+        describe ContentSecurityPolicy do
+            content_security_policy_json = {
+                "policy_id"=>"01a1",
+                "headers"=>[
+                    {"name"=>"csp", "value"=>"value normal", "report-uri"=>"https://example.com/abcdde"}
+                ]
+            }
+            csp_policy = ContentSecurityPolicy.fromJson(content_security_policy_json)
+            context "secure header, report-uri seperate" do
+                it "returns false" do
+                    expect(csp_policy.headers.length).to eq(1)
+                    expect(csp_policy.headers[0].value).to eq("value normal; report-uri https://example.com/abcdde")
+                    expect(csp_policy.headers[0].value("1","2","3")).to eq("value normal; report-uri https://example.com/abcdde?tid=1&sid=2&uid=3")
+                end
+            end
+        end
+    end
+end

data/spec/lib/tcell_agent/policies/dataloss_policy_spec.rb

@@ -0,0 +1,88 @@
+require 'spec_helper'
+require 'set'
+
+module TCellAgent
+    module Policies
+        describe DataLossPolicy do
+            policy_json = {
+                "policy_id"=>"x1a1",
+                "data"=>{
+                    "protections"=>[
+                        {"table"=>"user",
+                         "field"=>"ssn",
+                         "actions"=>{
+                            "body"=>["event","redact"],
+                            "logs"=>["redact"]
+                         }
+                        }
+                    ]
+                }
+            }
+            policy = DataLossPolicy.fromJson(policy_json)
+            context "initialized with 3 items" do
+              it "returns true" do
+                expect(policy.get_actions_for("user","ssn")).to eq(["body_redact"].to_set)
+              end
+            end
+            policy_json_two = {
+                "policy_id"=>"x1a1",
+                "data"=>{
+                    "session_id_protection"=>{"body"=>["redact"], "log"=>["event"]}
+                }
+            }
+            policy_two = DataLossPolicy.fromJson(policy_json_two)
+            context "check session_id_protections" do
+              it "gives the right actions" do
+                expect(policy_two.get_actions_for_session_id.body_redact).to eq(true)
+                expect(policy_two.get_actions_for_session_id.log_redact).to eq(nil)
+                expect(policy_two.get_actions_for_session_id.log_event).to eq(true)
+              end
+            end
+            context "Request Options" do
+              it "Ignores non-global scoped policy" do
+                policy_json_requests = {
+                    "policy_id"=>"x1a1",
+                    "data"=>{
+                        "request_protections"=>[
+                            {
+                                "context"=>"form",
+                                "scope"=>"route",
+                                "variable"=>"test123",
+                                "options"=>{
+                                    "log"=>["redact"],
+                                    "body"=>["event"]
+                                }
+                            }
+                        ]
+                    }
+                }
+                policy_three = DataLossPolicy.fromJson(policy_json_requests)
+                expect(policy_three.get_actions_for_request("form").keys).to eq([])
+              end
+              it "Reads in the policy" do
+                policy_json_requests = {
+                    "policy_id"=>"x1a1",
+                    "data"=>{
+                        "request_protections"=>[
+                            {
+                                "context"=>"form",
+                                "variable"=>"test123",
+                                "options"=>{
+                                    "log"=>["redact"],
+                                    "body"=>["event"]
+                                }
+                            }
+                        ]
+                    }
+                }
+                policy_three = DataLossPolicy.fromJson(policy_json_requests)
+                puts policy_three.request_filter_actions
+                expect(policy_three.get_actions_for_request("form").keys).to eq(["test123"])
+                expect(policy_three.get_actions_for_request("form")["test123"].log_redact).to eq(true)
+                expect(policy_three.get_actions_for_request("form")["test123"].body_redact).to eq(nil)
+                expect(policy_three.get_actions_for_request("form")["test123"].body_event).to eq(true)
+              end
+            end
+        end
+    end
+end

data/spec/lib/tcell_agent/policies/honeytokens_policy_spec.rb

@@ -0,0 +1,22 @@
+require 'spec_helper'
+
+module TCellAgent
+    module Policies
+        describe HoneytokensPolicy do
+            policy_json = {
+                "policy_id"=>"x1a1",
+                "token_salt"=>"saltsaltsalt",
+                "tokens"=>[
+                    {"type"=>"cred", "token"=>"TOKEN", "id"=>"ID001"}
+                ]
+            }
+            policy = HoneytokensPolicy.fromJson(policy_json)
+            context "initialized with 3 items" do
+              it "returns true" do
+                expect(policy.policy_id).to eq("x1a1")
+                expect(policy.cred_tokens["TOKEN"]).to eq("ID001")
+              end
+            end
+        end
+    end
+end

data/spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb

@@ -0,0 +1,62 @@
+require 'spec_helper'
+
+module TCellAgent
+    module Policies
+        describe HttpRedirectPolicy do
+            http_redirect_plain = HttpRedirectPolicy.new
+            context "defaults" do
+              it "returns true" do
+                expect(http_redirect_plain.policy_id).to eq(nil)
+                expect(http_redirect_plain.enabled).to eq(false)
+              end
+            end
+            http_redirect_policy_json = {
+                "policy_id"=>"x1a1",
+                "data"=>{
+                    "enabled"=>true
+                }
+            }
+            http_redirect_from_json = HttpRedirectPolicy.fromJson(http_redirect_policy_json)
+            context "initialized with 3 items" do
+              it "returns true" do
+                expect(http_redirect_from_json.policy_id).to eq("x1a1")
+                expect(http_redirect_from_json.enabled).to eq(true)
+              end
+            end
+            context "check url" do
+                it "see's other domain" do
+                    result = http_redirect_from_json.check("test.google.com", "www.test.com")
+                    expect(result).to eq(true)
+                end
+            end
+            context "check url" do
+                it "wildcard domain false" do
+                    http_redirect_from_json.whitelist = ["*.google.com"]
+                    result = http_redirect_from_json.check("test.google.com", "www.test.com")
+                    expect(result).to eq(false)
+                end
+                it "wildcard domain true" do
+                    http_redirect_from_json.whitelist = ["*.google.com"]
+                    result = http_redirect_from_json.check("test.google.net", "www.test.com")
+                    expect(result).to eq(true)
+                end
+            end
+            context "enforce url" do
+                it "domain enforce enabled false, block true" do
+                    http_redirect_from_json.enabled = false
+                    http_redirect_from_json.block = true
+                    http_redirect_from_json.whitelist = ["*.google.com"]
+                    result = http_redirect_from_json.enforce("https://test.google.com", "www.test.com", "/path/a", "GET", "1.1.1.1", 400)
+                    expect(result).to eq(nil)
+                end
+                it "domain enforce enabled true, block true" do
+                    http_redirect_from_json.enabled = true
+                    http_redirect_from_json.block = true
+                    http_redirect_from_json.whitelist = ["good.com"]
+                    result = http_redirect_from_json.enforce("https://www.google.com/abc/def", "localhost", "/path/a", "GET", "1.1.1.1", 400)
+                    expect(result).to eq("/")
+                end
+            end
+        end
+    end
+end

data/spec/lib/tcell_agent/policies/http_tx_policy_spec.rb

@@ -0,0 +1,22 @@
+require 'spec_helper'
+
+module TCellAgent
+    module Policies
+        describe HttpTxPolicy do
+            http_tx_policy_json = {
+                "policy_id"=>"01a1",
+                "types"=>{
+                    "firehose"=>{"enabled"=>true}
+                }
+            }
+            http_tx_from_json = HttpTxPolicy.fromJson(http_tx_policy_json)
+            context "initialized with 3 items" do
+              it "returns true" do
+                expect(http_tx_from_json.policy_id).to eq("01a1")
+                expect(http_tx_from_json.firehose["enabled"]).to eq(true)
+                expect(http_tx_from_json.firehose["lite"]).to eq(false)
+              end
+            end
+        end
+    end
+end

data/spec/lib/tcell_agent/policies/login_policy_spec.rb

@@ -0,0 +1,42 @@
+require 'spec_helper'
+
+module TCellAgent
+    module Policies
+        describe LoginFraudPolicy do
+            policy_json_empty = {
+                "policy_id"=>"01a1",
+                "data"=>{
+                  "options"=>{}
+                }
+            }
+
+            policy_json_one = {
+                "policy_id"=>"01a1",
+                "data"=>{
+                  "options"=>{
+                      "login_failed_enabled"=>true,
+                      "login_success_enabled"=>true
+                  }
+                }
+            }
+
+            empty_policy = LoginFraudPolicy.fromJson(policy_json_empty)
+            context "test empty agent" do
+              it "enabled is false" do
+                expect(empty_policy.policy_id).to eq("01a1")
+                expect(empty_policy.login_failed_enabled).to eq(false)
+                expect(empty_policy.login_success_enabled).to eq(false)
+              end
+            end
+
+            policy_one = LoginFraudPolicy.fromJson(policy_json_one)
+            context "enabled agent" do
+              it "enabled is true" do
+                expect(empty_policy.policy_id).to eq("01a1")
+                expect(policy_one.login_failed_enabled).to eq(true)
+                expect(policy_one.login_success_enabled).to eq(true)
+              end
+            end
+        end
+    end
+end

data/spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb

@@ -0,0 +1,67 @@
+require 'spec_helper'
+
+module TCellAgent
+    module Policies
+        describe SecureHeadersPolicy do
+            secure_headers_policy_json = {
+                "policy_id"=>"01a1",
+                "headers"=>[
+                    {"name"=>"x-permitted-cross-domain-policies", "value"=>"value123"}
+                ]
+            }
+            secure_headers_policy = SecureHeadersPolicy.fromJson(secure_headers_policy_json)
+            context "secure header example" do
+                it "returns true" do
+                    expect(secure_headers_policy.headers[0].name).to eq("x-permitted-cross-domain-policies")
+                    expect(secure_headers_policy.headers[0].value).to eq("value123")
+                end
+            end
+        end
+        describe SecureHeadersPolicy do
+            secure_headers_policy_json = {
+                "policy_id"=>"01a1",
+                "headers"=>[
+                    {"name"=>"x-frame-options", "value"=>"DENY"},
+                    {"name"=>"x-xss-protection", "value"=>"1; mode=block"}
+                ]
+            }
+            secure_headers_policy = SecureHeadersPolicy.fromJson(secure_headers_policy_json)
+            context "secure headers (2) example" do
+                it "returns true" do
+                    expect(secure_headers_policy.headers[0].name).to eq("x-frame-options")
+                    expect(secure_headers_policy.headers[0].value).to eq("DENY")
+                    expect(secure_headers_policy.headers[1].name).to eq("x-xss-protection")
+                    expect(secure_headers_policy.headers[1].value).to eq("1; mode=block")
+                end
+            end
+        end
+        describe SecureHeadersPolicy do
+            secure_headers_policy_json = {
+                "policy_id"=>"01a1",
+                "headers"=>[
+                    {"name"=>"bad-header", "value"=>"value123"}
+                ]
+            }
+            secure_headers_policy = SecureHeadersPolicy.fromJson(secure_headers_policy_json)
+            context "secure header example, invalid header" do
+                it "returns false" do
+                    expect(secure_headers_policy.headers.length).to eq(0)
+                end
+            end
+        end
+        describe SecureHeadersPolicy do
+            secure_headers_policy_json = {
+                "policy_id"=>"01a1",
+                "headers"=>[
+                    {"name"=>"x-permitted-cross-domain-policies", "value"=>"value123\\nabc"}
+                ]
+            }
+            secure_headers_policy = SecureHeadersPolicy.fromJson(secure_headers_policy_json)
+            context "secure header, value is bad" do
+                it "returns false" do
+                    expect(secure_headers_policy.headers.length).to eq(0)
+                end
+            end
+        end
+    end
+end

data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb

@@ -0,0 +1,187 @@
+require 'spec_helper'
+require 'rack/test'
+require 'rack'
+
+module TCellAgent
+  module Instrumentation
+    module Rails
+      module Middleware
+
+        class MockRackApp
+
+          attr_reader :request_body
+
+          def initialize
+            @request_headers = {}
+          end
+
+          def call(env)
+            @env = env
+            @request_body = env['rack.input'].read
+            rack_request = Rack::Request.new(env)
+            response_headers = {'Content-Type' => 'text/html'}
+            if (rack_request.params['rv'])
+              response_headers["Location"] = rack_request.params['rv']
+            end
+            [200, response_headers, ['OK']]
+          end
+
+          def [](key)
+            @env[key]
+          end
+
+        end
+
+        describe HeadersMiddleware do
+
+          let(:app) { GlobalMiddleware.new(MockRackApp.new) }
+          subject { ContextMiddleware.new(described_class.new(app)) }
+
+          context "Redirect Middleware" do
+            let(:request) { Rack::MockRequest.new(subject) }
+            let(:agent) { ::TCellAgent::Agent.new(Process.pid) }
+            before(:each) do
+              TCellAgent.configuration = TCellAgent::Configuration.new
+              TCellAgent.configuration.read_config_from_file("spec/resources/normal_config.json")
+              agent.start
+              TCellAgent.thread_agent = agent
+            end
+
+            context "not enabled" do
+              it "passes through unchanged" do
+                agent.processPolicyJson({"http-redirect"=>{
+                  "policy_id"=>"153ed270-7481-11e5-9194-95dad9b9dec3",
+                  "data"=>{
+                    "enabled"=>false,
+                    "block"=>true,
+                    "whitelist"=>[]
+                  }
+                }}, cache=false) 
+                tid_len = "78e596b7-e772-4caf-92eb-645fdbdec473".length + 1
+                response = request.get("/some/path?rv=https://www.google.com", 'CONTENT_TYPE' => 'text/html')
+                expect(response['Location']).to eq("https://www.google.com")
+              end
+            end
+
+            context "doesn't block simple whitelist" do
+              it "passes through unchanged" do
+                agent.processPolicyJson({"http-redirect"=>{
+                  "policy_id"=>"153ed270-7481-11e5-9194-95dad9b9dec3",
+                  "data"=>{
+                    "enabled"=>true,
+                    "block"=>true,
+                    "whitelist"=>["www.google.com"]
+                  }
+                }}, cache=false) 
+                
+                tid_len = "78e596b7-e772-4caf-92eb-645fdbdec473".length + 1
+                response = request.get("/some/path?rv=https://www.google.com", 'CONTENT_TYPE' => 'text/html')
+                expect(response['Location']).to eq("https://www.google.com")
+              end
+            end
+
+            context "doesn't block wildcard whitelist" do
+              it "passes through unchanged" do
+                agent.processPolicyJson({"http-redirect"=>{
+                  "policy_id"=>"153ed270-7481-11e5-9194-95dad9b9dec3",
+                  "data"=>{
+                    "enabled"=>true,
+                    "block"=>true,
+                    "whitelist"=>["*.google.com"]
+                  }
+                }}, cache=false) 
+                
+                tid_len = "78e596b7-e772-4caf-92eb-645fdbdec473".length + 1
+                response = request.get("/some/path?rv=https://www.google.com", 'CONTENT_TYPE' => 'text/html')
+                expect(response['Location']).to eq("https://www.google.com")
+              end
+            end
+
+            context "DOES block wildcard whitelist" do
+              it "replaces the value with /" do
+                agent.processPolicyJson({"http-redirect"=>{
+                  "policy_id"=>"153ed270-7481-11e5-9194-95dad9b9dec3",
+                  "data"=>{
+                    "enabled"=>true,
+                    "block"=>true,
+                    "whitelist"=>["*.google-test.com"]
+                  }
+                }}, cache=false) 
+                
+                tid_len = "78e596b7-e772-4caf-92eb-645fdbdec473".length + 1
+                response = request.get("/some/path?rv=https://www.google.com", 'CONTENT_TYPE' => 'text/html')
+                expect(response['Location']).to eq("/")
+              end
+            end
+
+          end
+
+          context "CSP Middleware" do
+            let(:request) { Rack::MockRequest.new(subject) }
+            let(:agent) { ::TCellAgent::Agent.new(Process.pid) }
+
+            before(:each) do
+              TCellAgent.configuration = TCellAgent::Configuration.new
+              TCellAgent.configuration.read_config_from_file("spec/resources/normal_config.json")
+              agent.start
+              TCellAgent.thread_agent = agent
+            end
+
+            context "Standard CSP Header" do
+              it "CSP Header is Added" do
+                agent.processPolicyJson({"csp-headers"=>{
+                  "policy_id"=>"153ed270-7481-11e5-9194-95dad9b9dec3",
+                  "headers"=>[{
+                    "name"=>"Content-Security-Policy-Report-Only",
+                    "value"=>"script-src 'unsafe-inline'",
+                    "report-uri"=>"http://test.tcell.io/report"
+                  }]
+                }}, cache=false) 
+                tid_len = "78e596b7-e772-4caf-92eb-645fdbdec473".length + 1
+                response = request.get("/some/path", 'CONTENT_TYPE' => 'text/plain', 'action_dispatch.request_id'=>'35281717-247e-44e6-bd42-0fb1417e80d')
+                expect(response['Content-Security-Policy-Report-Only'][0..-tid_len]).to eq("script-src 'unsafe-inline'; report-uri http://test.tcell.io/report?tid=")
+              end
+            end
+
+          end
+
+          # context "when called with a POST request" do
+          #   context "with some particular data" do
+          #     let(:request) { Rack::MockRequest.new(app) }
+
+          #     it "passes the request through unchanged" do
+
+          #       TCellAgent.configuration = TCellAgent::Configuration.new
+          #       TCellAgent.configuration.read_config_from_file("spec/resources/normal_config.json")
+
+          #       agent = ::TCellAgent::Agent.new(Process.pid)
+          #       ::TCellAgent::AgentThread.setThread(agent)
+          #       agent.start
+          #       agent.processPolicyJson({"csp"=>{
+          #         "policy_id"=>"153ed270-7481-11e5-9194-95dad9b9dec3",
+          #         "headers"=>{
+          #           "name"=>"Content-Security-Policy-Report-Only",
+          #           "value"=>"script-src 'unsafe-inline'",
+          #           "report-uri"=>"http://test.tcell.io/report"
+          #         }
+          #       }}) 
+
+          #       #noop       = Proc.new {[200, {}, ["hello"]]}
+          #       #middleware = ActionDispatch::Static.new(noop, "/my_rails_app/public")  
+          #       #request = Rack::MockRequest.new(middleware)
+          #       #puts request.get("/path_i_want_to_hit")
+
+          #       puts request.get("/some/path", 'CONTENT_TYPE' => 'text/plain')
+
+          #      # expect(app['CONTENT_TYPE']).to eq('text/plain')
+          #      # expect(app.request_body).to eq(post_data)
+
+          #     end
+          #   end
+          # end
+        end
+
+      end
+    end
+  end
+end