tcell_agent 0.2.29 → 0.4.0

data/spec/lib/tcell_agent/patches/block_rule_spec.rb

@@ -71,14 +71,20 @@ module TCellAgent
 
           context "with an rid" do
             context "that matches the request" do
+              before(:each) do
+                @meta_data = TCellAgent::Patches::MetaData.new(
+                  "get",
+                  "1.1.1.1",
+                  "route_id",
+                  "session_id",
+                  "user_id",
+                  "transaction_id")
+              end
+
               context "with empty sensors" do
                 it "should return true" do
                   injections_matcher = double("injections_matcher")
 
-                  meta_data = TCellAgent::Patches::MetaData.new
-                  meta_data.remote_address = "1.1.1.1"
-                  meta_data.route_id = "route_id"
-
                   block_rule = BlockRule.new(
                     Set.new,
                     Set.new(["route_id"]),
@@ -90,7 +96,7 @@ module TCellAgent
 
                   expect(injections_matcher).to receive(:enabled).and_return(false)
 
-                  expect(block_rule.block?(meta_data)).to eq(true)
+                  expect(block_rule.block?(@meta_data)).to eq(true)
                 end
               end
 
@@ -99,10 +105,6 @@ module TCellAgent
                   it "should return false" do
                     injections_matcher = double("injections_matcher")
 
-                    meta_data = TCellAgent::Patches::MetaData.new
-                    meta_data.remote_address = "1.1.1.1"
-                    meta_data.route_id = "route_id"
-
                     block_rule = BlockRule.new(
                       Set.new,
                       Set.new(["route_id"]),
@@ -115,7 +117,7 @@ module TCellAgent
                     expect(injections_matcher).to receive(:enabled).and_return(true)
                     expect(injections_matcher).to receive(:each_injection)
 
-                    expect(block_rule.block?(meta_data)).to eq(false)
+                    expect(block_rule.block?(@meta_data)).to eq(false)
                   end
                 end
 
@@ -123,10 +125,6 @@ module TCellAgent
                   it "should return true" do
                     injections_matcher = double("injections_matcher")
 
-                    meta_data = TCellAgent::Patches::MetaData.new
-                    meta_data.remote_address = "1.1.1.1"
-                    meta_data.route_id = "route_id"
-
                     block_rule = BlockRule.new(
                       Set.new,
                       Set.new(["route_id"]),
@@ -141,21 +139,27 @@ module TCellAgent
                       block.call(double("injection_attempt"))
                     end
 
-                    expect(block_rule.block?(meta_data)).to eq(true)
+                    expect(block_rule.block?(@meta_data)).to eq(true)
                   end
                 end
               end
             end
 
             context "that does not match the request" do
+              before(:each) do
+                @meta_data = TCellAgent::Patches::MetaData.new(
+                  "get",
+                  "1.1.1.1",
+                  "non_matching_route_id",
+                  "session_id",
+                  "user_id",
+                  "transaction_id")
+              end
+
               context "with empty sensors" do
                 it "should return false" do
                   injections_matcher = double("injections_matcher")
 
-                  meta_data = TCellAgent::Patches::MetaData.new
-                  meta_data.remote_address = "1.1.1.1"
-                  meta_data.route_id = "non_matching_route_id"
-
                   block_rule = BlockRule.new(
                     Set.new,
                     Set.new(["route_id"]),
@@ -167,7 +171,7 @@ module TCellAgent
 
                   expect(injections_matcher).to_not receive(:enabled)
 
-                  expect(block_rule.block?(meta_data)).to eq(false)
+                  expect(block_rule.block?(@meta_data)).to eq(false)
                 end
               end
 
@@ -176,10 +180,6 @@ module TCellAgent
                   it "should return false" do
                     injections_matcher = double("injections_matcher")
 
-                    meta_data = TCellAgent::Patches::MetaData.new
-                    meta_data.remote_address = "1.1.1.1"
-                    meta_data.route_id = "non_matching_route_id"
-
                     block_rule = BlockRule.new(
                       Set.new,
                       Set.new(["route_id"]),
@@ -191,7 +191,7 @@ module TCellAgent
 
                     expect(injections_matcher).to_not receive(:enabled)
 
-                    expect(block_rule.block?(meta_data)).to eq(false)
+                    expect(block_rule.block?(@meta_data)).to eq(false)
                   end
                 end
 
@@ -199,10 +199,6 @@ module TCellAgent
                   it "should return false" do
                     injections_matcher = double("injections_matcher")
 
-                    meta_data = TCellAgent::Patches::MetaData.new
-                    meta_data.remote_address = "1.1.1.1"
-                    meta_data.route_id = "non_matching_route_id"
-
                     block_rule = BlockRule.new(
                       Set.new,
                       Set.new(["route_id"]),
@@ -214,7 +210,7 @@ module TCellAgent
 
                     expect(injections_matcher).to_not receive(:enabled)
 
-                    expect(block_rule.block?(meta_data)).to eq(false)
+                    expect(block_rule.block?(@meta_data)).to eq(false)
                   end
                 end
               end
@@ -223,14 +219,20 @@ module TCellAgent
         end
 
         context "with ips" do
+          before(:each) do
+            @meta_data = TCellAgent::Patches::MetaData.new(
+              "get",
+              "1.1.1.1",
+              "route_id",
+              "session_id",
+              "user_id",
+              "transaction_id")
+          end
+
           context "that does not match the request" do
             it "should return false" do
               injections_matcher = double("injections_matcher")
 
-              meta_data = TCellAgent::Patches::MetaData.new
-              meta_data.remote_address = "1.1.1.1"
-              meta_data.route_id = "route_id"
-
               block_rule = BlockRule.new(
                 Set.new(["2.2.2.2"]),
                 Set.new(["route_id"]),
@@ -242,7 +244,7 @@ module TCellAgent
 
               expect(injections_matcher).to_not receive(:enabled)
 
-              expect(block_rule.block?(meta_data)).to eq(false)
+              expect(block_rule.block?(@meta_data)).to eq(false)
             end
           end
 
@@ -253,10 +255,6 @@ module TCellAgent
                   it "should return true" do
                     injections_matcher = double("injections_matcher")
 
-                    meta_data = TCellAgent::Patches::MetaData.new
-                    meta_data.remote_address = "1.1.1.1"
-                    meta_data.route_id = "route_id"
-
                     block_rule = BlockRule.new(
                       Set.new(["1.1.1.1"]),
                       Set.new(["route_id"]),
@@ -268,7 +266,7 @@ module TCellAgent
 
                     expect(injections_matcher).to receive(:enabled).and_return(false)
 
-                    expect(block_rule.block?(meta_data)).to eq(true)
+                    expect(block_rule.block?(@meta_data)).to eq(true)
                   end
                 end
 
@@ -277,10 +275,6 @@ module TCellAgent
                     it "should return false" do
                       injections_matcher = double("injections_matcher")
 
-                      meta_data = TCellAgent::Patches::MetaData.new
-                      meta_data.remote_address = "1.1.1.1"
-                      meta_data.route_id = "route_id"
-
                       block_rule = BlockRule.new(
                         Set.new(["1.1.1.1"]),
                         Set.new(["route_id"]),
@@ -293,7 +287,7 @@ module TCellAgent
                       expect(injections_matcher).to receive(:enabled).and_return(true)
                       expect(injections_matcher).to receive(:each_injection)
 
-                      expect(block_rule.block?(meta_data)).to eq(false)
+                      expect(block_rule.block?(@meta_data)).to eq(false)
                     end
                   end
 
@@ -301,10 +295,6 @@ module TCellAgent
                     it "should return true" do
                       injections_matcher = double("injections_matcher")
 
-                      meta_data = TCellAgent::Patches::MetaData.new
-                      meta_data.remote_address = "1.1.1.1"
-                      meta_data.route_id = "route_id"
-
                       block_rule = BlockRule.new(
                         Set.new(["1.1.1.1"]),
                         Set.new(["route_id"]),
@@ -319,21 +309,20 @@ module TCellAgent
                         block.call(double("injection_attempt"))
                       end
 
-                      expect(block_rule.block?(meta_data)).to eq(true)
+                      expect(block_rule.block?(@meta_data)).to eq(true)
                     end
                   end
                 end
               end
 
               context "that does not match the request" do
+                before(:each) do
+                  @meta_data.route_id = "non_matching_route_id"
+                end
                 context "with empty sensors" do
                   it "should return false" do
                     injections_matcher = double("injections_matcher")
 
-                    meta_data = TCellAgent::Patches::MetaData.new
-                    meta_data.remote_address = "1.1.1.1"
-                    meta_data.route_id = "non_matching_route_id"
-
                     block_rule = BlockRule.new(
                       Set.new(["1.1.1.1"]),
                       Set.new(["route_id"]),
@@ -345,7 +334,7 @@ module TCellAgent
 
                     expect(injections_matcher).to_not receive(:enabled)
 
-                    expect(block_rule.block?(meta_data)).to eq(false)
+                    expect(block_rule.block?(@meta_data)).to eq(false)
                   end
                 end
 
@@ -354,10 +343,6 @@ module TCellAgent
                     it "should return false" do
                       injections_matcher = double("injections_matcher")
 
-                      meta_data = TCellAgent::Patches::MetaData.new
-                      meta_data.remote_address = "1.1.1.1"
-                      meta_data.route_id = "non_matching_route_id"
-
                       block_rule = BlockRule.new(
                         Set.new(["1.1.1.1"]),
                         Set.new(["route_id"]),
@@ -369,7 +354,7 @@ module TCellAgent
 
                       expect(injections_matcher).to_not receive(:enabled)
 
-                      expect(block_rule.block?(meta_data)).to eq(false)
+                      expect(block_rule.block?(@meta_data)).to eq(false)
                     end
                   end
 
@@ -377,10 +362,6 @@ module TCellAgent
                     it "should return false" do
                       injections_matcher = double("injections_matcher")
 
-                      meta_data = TCellAgent::Patches::MetaData.new
-                      meta_data.remote_address = "1.1.1.1"
-                      meta_data.route_id = "non_matching_route_id"
-
                       block_rule = BlockRule.new(
                         Set.new(["1.1.1.1"]),
                         Set.new(["route_id"]),
@@ -392,7 +373,7 @@ module TCellAgent
 
                       expect(injections_matcher).to_not receive(:enabled)
 
-                      expect(block_rule.block?(meta_data)).to eq(false)
+                      expect(block_rule.block?(@meta_data)).to eq(false)
                     end
                   end
                 end
@@ -402,15 +383,21 @@ module TCellAgent
         end
 
         context "with blocked paths" do
+          before(:each) do
+            @meta_data = TCellAgent::Patches::MetaData.new(
+              "get",
+              "1.1.1.1",
+              "route_id",
+              "session_id",
+              "user_id",
+              "transaction_id")
+          end
+
           context "without ips" do
             context "matching paths" do
               it "should block" do
                 injections_matcher = double("injections_matcher")
 
-                meta_data = TCellAgent::Patches::MetaData.new
-                meta_data.remote_address = "1.1.1.1"
-                meta_data.route_id = "route_id"
-
                 block_rule = BlockRule.new(
                   Set.new(["1.1.1.1"]),
                   Set.new(["route_id"]),
@@ -422,17 +409,17 @@ module TCellAgent
 
                 expect(injections_matcher).to_not receive(:enabled)
 
-                meta_data.path = "/index"
-                expect(block_rule.block?(meta_data)).to eq(true)
+                @meta_data.path = "/index"
+                expect(block_rule.block?(@meta_data)).to eq(true)
 
-                meta_data.path = "/index/"
-                expect(block_rule.block?(meta_data)).to eq(true)
+                @meta_data.path = "/index/"
+                expect(block_rule.block?(@meta_data)).to eq(true)
 
-                meta_data.path = "/admin"
-                expect(block_rule.block?(meta_data)).to eq(true)
+                @meta_data.path = "/admin"
+                expect(block_rule.block?(@meta_data)).to eq(true)
 
-                meta_data.path = "/admin/users"
-                expect(block_rule.block?(meta_data)).to eq(true)
+                @meta_data.path = "/admin/users"
+                expect(block_rule.block?(@meta_data)).to eq(true)
               end
             end
 
@@ -440,10 +427,6 @@ module TCellAgent
               it "should not block" do
                 injections_matcher = double("injections_matcher")
 
-                meta_data = TCellAgent::Patches::MetaData.new
-                meta_data.remote_address = "1.1.1.1"
-                meta_data.route_id = "route_id"
-
                 block_rule = BlockRule.new(
                   Set.new(["1.1.1.1"]),
                   Set.new(["route_id"]),
@@ -455,14 +438,14 @@ module TCellAgent
 
                 expect(injections_matcher).to_not receive(:enabled)
 
-                meta_data.path = "/index/subpath"
-                expect(block_rule.block?(meta_data)).to eq(false)
+                @meta_data.path = "/index/subpath"
+                expect(block_rule.block?(@meta_data)).to eq(false)
 
-                meta_data.path = "/welcome"
-                expect(block_rule.block?(meta_data)).to eq(false)
+                @meta_data.path = "/welcome"
+                expect(block_rule.block?(@meta_data)).to eq(false)
 
-                meta_data.path = "/welcome/"
-                expect(block_rule.block?(meta_data)).to eq(false)
+                @meta_data.path = "/welcome/"
+                expect(block_rule.block?(@meta_data)).to eq(false)
               end
             end
           end

data/spec/lib/tcell_agent/patches_spec.rb

@@ -8,7 +8,7 @@ module TCellAgent
       context "with an unexpected error" do
         it "should return nil" do
           request = double("request")
-          expect(TCellAgent).to receive(:policy).and_raise(Exception.new("UNEXPECTED"))
+          expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::Patches).and_raise(Exception.new("UNEXPECTED"))
           expect(TCellAgent::Patches::MetaData).to_not receive(:build)
 
           expect(Patches.block?(request)).to eq(nil)
@@ -92,8 +92,13 @@ module TCellAgent
         context "and that's complex" do
           it "should return a response" do
             request = double("request")
-            meta_data = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-            meta_data.remote_address = "2.3.4.5"
+            meta_data = TCellAgent::Patches::MetaData.new(
+              "get",
+              "2.3.4.5",
+              "route_id",
+              "session_id",
+              "user_id",
+              "transaction_id")
             meta_data.get_dict = {"paramater" => "<script>"}
             tcell_context = TCellAgent::Instrumentation::TCellData.new
             patches = TCellAgent::Policies::PatchesPolicy.from_json({
@@ -138,7 +143,7 @@ module TCellAgent
             })
             expect(patches.enabled).to eq(true)
 
-            expect(TCellAgent).to receive(:policy).and_return(patches)
+            expect(TCellAgent).to receive(:policy).with(TCellAgent::PolicyTypes::Patches).and_return(patches)
             expect(TCellAgent::Patches::MetaData).to receive(:build).and_return(
               meta_data
             )

data/spec/lib/tcell_agent/policies/appsensor/xss_sensor_spec.rb

@@ -247,14 +247,13 @@ module TCellAgent
 
       describe "#get_injection_attempt" do
         before(:each) do
-          @appsensor_meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-          @appsensor_meta.remote_address = "remote_address"
-          @appsensor_meta.method = "get"
-          @appsensor_meta.location = "location"
-          @appsensor_meta.route_id = "route_id"
-          @appsensor_meta.session_id = "session_id"
-          @appsensor_meta.user_id = "user_id"
-          @appsensor_meta.transaction_id = "transaction_id"
+          @appsensor_meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new(
+            "get",
+            "remote_address",
+            "route_id",
+            "session_id",
+            "user_id",
+            "transaction_id")
         end
 
         context "enabled sensor" do
@@ -318,7 +317,7 @@ module TCellAgent
           context "param has a vulnerability" do
             context "param is a URI param" do
               context "exclude forms sensor" do
-                it "should return false" do
+               it "should return false" do
                   sensor = XssSensor.new({"enabled" => true, "exclude_forms" => true})
 
                   expect(sensor).to_not receive(:find_vulnerability)
@@ -539,6 +538,32 @@ module TCellAgent
                   end
                 end
               end
+
+              context "exclude headers sensor" do
+                it "should return true" do
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_headers" => true,
+                  })
+
+                  expect(sensor).to receive(:find_vulnerability).and_return(
+                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                  )
+
+                  result = sensor.get_injection_attempt(
+                    XssSensor::GET_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value",
+                  )
+
+                  expect(result.type_of_param).to eq(XssSensor::GET_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
+                end
+              end
             end
 
             context "param is a POST param" do
@@ -587,6 +612,32 @@ module TCellAgent
                   expect(result.pattern).to eq("1")
                 end
               end
+
+              context "exclude headers sensor" do
+                it "should return true" do
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_headers" => true,
+                  })
+
+                  expect(sensor).to receive(:find_vulnerability).and_return(
+                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                  )
+
+                  result = sensor.get_injection_attempt(
+                    XssSensor::POST_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value",
+                  )
+
+                  expect(result.type_of_param).to eq(XssSensor::POST_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
+                end
+              end
             end
 
             context "param is a JSON param" do
@@ -635,6 +686,32 @@ module TCellAgent
                   expect(result.pattern).to eq("1")
                 end
               end
+
+              context "exclude headers sensor" do
+                it "should return true" do
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_headers" => true,
+                  })
+
+                  expect(sensor).to receive(:find_vulnerability).and_return(
+                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                  )
+
+                  result = sensor.get_injection_attempt(
+                    XssSensor::JSON_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value",
+                  )
+
+                  expect(result.type_of_param).to eq(XssSensor::JSON_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
+                end
+              end
             end
 
             context "param is a COOKIE param" do
@@ -683,6 +760,106 @@ module TCellAgent
                   expect(result).to eq(false)
                 end
               end
+
+              context "exclude headers sensor" do
+                it "should return true" do
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_headers" => true,
+                  })
+
+                  expect(sensor).to receive(:find_vulnerability).and_return(
+                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                  )
+
+                  result = sensor.get_injection_attempt(
+                    XssSensor::COOKIE_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value",
+                  )
+
+                  expect(result.type_of_param).to eq(XssSensor::COOKIE_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
+                end
+              end
+            end
+
+            context "param is a HEADER param" do
+              context "exclude forms sensor" do
+                it "should return true" do
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_forms" => true
+                  })
+
+                  expect(sensor).to receive(:find_vulnerability).and_return(
+                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                  )
+
+                  result = sensor.get_injection_attempt(
+                    XssSensor::HEADER_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value",
+                  )
+
+                  expect(result.type_of_param).to eq(XssSensor::HEADER_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
+                end
+              end
+
+              context "exclude cookies sensor" do
+                it "should return true" do
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_cookies" => true
+                  })
+
+                  expect(sensor).to receive(:find_vulnerability).and_return(
+                    {"param" => "vuln_param", "value" => "vuln_value", "pattern" => "1"}
+                  )
+
+                  result = sensor.get_injection_attempt(
+                    XssSensor::HEADER_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value",
+                  )
+
+                  expect(result.type_of_param).to eq(XssSensor::HEADER_PARAM)
+                  expect(result.detection_point).to eq(sensor.detection_point)
+                  expect(result.param_name).to eq("vuln_param")
+                  expect(result.param_value).to eq("vuln_value")
+                  expect(result.pattern).to eq("1")
+                end
+              end
+
+              context "exclude headers sensor" do
+                it "should return true" do
+                  sensor = XssSensor.new({
+                    "enabled" => true,
+                    "exclude_headers" => true,
+                  })
+
+                  expect(sensor).to_not receive(:find_vulnerability)
+
+                  result = sensor.get_injection_attempt(
+                    XssSensor::HEADER_PARAM,
+                    @appsensor_meta,
+                    "param_name",
+                    "param_value",
+                  )
+
+                  expect(result).to eq(false)
+                end
+              end
             end
           end
         end