RubyGems - tcell_agent - Versions diffs - 0.2.29 → 0.4.0 - Mend

tcell_agent 0.2.29 → 0.4.0

Files changed (100) hide show

checksums.yaml +4 -4
data/Readme.txt +7 -0
data/bin/tcell_agent +9 -0
data/lib/tcell_agent/agent/policy_manager.rb +3 -0
data/lib/tcell_agent/agent/policy_types.rb +4 -1
data/lib/tcell_agent/appsensor/injections_matcher.rb +20 -0
data/lib/tcell_agent/appsensor/injections_reporter.rb +15 -56
data/lib/tcell_agent/appsensor/meta_data.rb +56 -2
data/lib/tcell_agent/appsensor/rules/baserules.json +371 -138
data/lib/tcell_agent/cmdi.rb +113 -0
data/lib/tcell_agent/config/unknown_options.rb +2 -0
data/lib/tcell_agent/configuration.rb +30 -16
data/lib/tcell_agent/hooks/login_fraud.rb +79 -0
data/lib/tcell_agent/instrumentation.rb +6 -11
data/lib/tcell_agent/patches/meta_data.rb +14 -11
data/lib/tcell_agent/policies/appsensor/injection_sensor.rb +5 -9
data/lib/tcell_agent/policies/appsensor_policy.rb +22 -206
data/lib/tcell_agent/policies/clickjacking_policy.rb +4 -2
data/lib/tcell_agent/policies/command_injection_policy.rb +196 -0
data/lib/tcell_agent/policies/content_security_policy.rb +3 -2
data/lib/tcell_agent/policies/dataloss_policy.rb +3 -1
data/lib/tcell_agent/policies/honeytokens_policy.rb +3 -1
data/lib/tcell_agent/policies/http_redirect_policy.rb +51 -37
data/lib/tcell_agent/policies/http_tx_policy.rb +5 -1
data/lib/tcell_agent/policies/login_fraud_policy.rb +6 -1
data/lib/tcell_agent/policies/patches_policy.rb +3 -1
data/lib/tcell_agent/policies/policy.rb +10 -0
data/lib/tcell_agent/policies/secure_headers_policy.rb +5 -2
data/lib/tcell_agent/rails/auth/devise.rb +12 -23
data/lib/tcell_agent/rails/csrf_exception.rb +1 -1
data/lib/tcell_agent/rails/dlp.rb +50 -54
data/lib/tcell_agent/rails/middleware/body_filter_middleware.rb +0 -1
data/lib/tcell_agent/rails/middleware/context_middleware.rb +0 -1
data/lib/tcell_agent/rails/middleware/global_middleware.rb +0 -1
data/lib/tcell_agent/rails/middleware/headers_middleware.rb +7 -10
data/lib/tcell_agent/rails/on_start.rb +0 -1
data/lib/tcell_agent/rails/tcell_body_proxy.rb +4 -4
data/lib/tcell_agent/rails.rb +0 -2
data/lib/tcell_agent/rust/libtcellagent-0.6.1.dylib +0 -0
data/lib/tcell_agent/rust/libtcellagent-0.6.1.so +0 -0
data/lib/tcell_agent/rust/models.rb +61 -0
data/lib/tcell_agent/rust/tcellagent-0.6.1.dll +0 -0
data/lib/tcell_agent/rust/whisperer.rb +112 -0
data/lib/tcell_agent/sensor_events/appsensor_event.rb +25 -21
data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb +31 -24
data/lib/tcell_agent/sensor_events/command_injection.rb +58 -0
data/lib/tcell_agent/sensor_events/discovery.rb +1 -1
data/lib/tcell_agent/sensor_events/login_fraud.rb +3 -13
data/lib/tcell_agent/sensor_events/sensor.rb +81 -77
data/lib/tcell_agent/sensor_events/util/sanitizer_utilities.rb +8 -0
data/lib/tcell_agent/start_background_thread.rb +12 -3
data/lib/tcell_agent/utils/io.rb +4 -1
data/lib/tcell_agent/utils/params.rb +1 -0
data/lib/tcell_agent/version.rb +1 -1
data/lib/tcell_agent.rb +0 -1
data/spec/lib/tcell_agent/appsensor/injections_matcher_spec.rb +27 -9
data/spec/lib/tcell_agent/appsensor/injections_reporter_spec.rb +143 -193
data/spec/lib/tcell_agent/appsensor/meta_data_spec.rb +67 -0
data/spec/lib/tcell_agent/appsensor/rules/appsensor_rule_manager_spec.rb +0 -10
data/spec/lib/tcell_agent/cmdi_spec.rb +748 -0
data/spec/lib/tcell_agent/config/unknown_options_spec.rb +8 -0
data/spec/lib/tcell_agent/configuration_spec.rb +138 -6
data/spec/lib/tcell_agent/hooks/login_fraud_spec.rb +357 -0
data/spec/lib/tcell_agent/patches/block_rule_spec.rb +70 -87
data/spec/lib/tcell_agent/patches_spec.rb +9 -4
data/spec/lib/tcell_agent/policies/appsensor/xss_sensor_spec.rb +186 -9
data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb +309 -484
data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb +736 -0
data/spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb +222 -41
data/spec/lib/tcell_agent/policies/patches_policy_spec.rb +56 -32
data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb +161 -85
data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb +40 -72
data/spec/lib/tcell_agent/rust/whisperer_spec.rb +267 -0
data/spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb +20 -15
data/spec/spec_helper.rb +0 -9
data/tcell_agent.gemspec +8 -3
metadata +40 -39
data/lib/tcell_agent/appsensor/sensor.rb +0 -52
data/lib/tcell_agent/policies/appsensor/database_sensor.rb +0 -56
data/lib/tcell_agent/policies/appsensor/misc_sensor.rb +0 -59
data/lib/tcell_agent/policies/appsensor/payloads_policy.rb +0 -150
data/lib/tcell_agent/policies/appsensor/request_size_sensor.rb +0 -25
data/lib/tcell_agent/policies/appsensor/response_codes_sensor.rb +0 -73
data/lib/tcell_agent/policies/appsensor/response_size_sensor.rb +0 -25
data/lib/tcell_agent/policies/appsensor/size_sensor.rb +0 -71
data/lib/tcell_agent/policies/appsensor/user_agent_sensor.rb +0 -47
data/lib/tcell_agent/rails/auth/hooks.rb +0 -79
data/lib/tcell_agent/sensor_events/util/redirect_utils.rb +0 -22
data/spec/lib/tcell_agent/policies/appsensor/database_sensor_spec.rb +0 -165
data/spec/lib/tcell_agent/policies/appsensor/misc_sensor_spec.rb +0 -429
data/spec/lib/tcell_agent/policies/appsensor/payloads_policy_apply_spec.rb +0 -466
data/spec/lib/tcell_agent/policies/appsensor/payloads_policy_from_json_spec.rb +0 -890
data/spec/lib/tcell_agent/policies/appsensor/payloads_policy_log_spec.rb +0 -417
data/spec/lib/tcell_agent/policies/appsensor/request_size_sensor_spec.rb +0 -236
data/spec/lib/tcell_agent/policies/appsensor/response_codes_sensor_spec.rb +0 -297
data/spec/lib/tcell_agent/policies/appsensor/response_size_sensor_spec.rb +0 -241
data/spec/lib/tcell_agent/policies/appsensor/user_agent_sensor_spec.rb +0 -172
data/spec/lib/tcell_agent/rails/auth/hooks_spec.rb +0 -246
data/spec/lib/tcell_agent/sensor_events/util/redirect_utils_spec.rb +0 -25
data/spec/support/resources/baserules.json +0 -155

data/spec/lib/tcell_agent/policies/appsensor/payloads_policy_apply_spec.rb DELETED Viewed

@@ -1,466 +0,0 @@
-require 'spec_helper'
-module TCellAgent
-  module Policies
-    describe AppSensorPolicy do
-      describe "#apply" do
-        context "with send_payloads disabled" do
-          it "should return nil payload" do
-            policy = PayloadsPolicy.from_json({
-              "payloads" => {
-                "send_payloads" => false
-              }
-            })
-            expect(TCellAgent).to_not receive(:configuration)
-            expect(policy).to receive(:log).with(
-              "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-            )
-            payload = policy.apply(
-              "xss",
-              nil,
-              TCellAgent::Utils::Params::GET_PARAM,
-              "password",
-              "alert()",
-              {"l" => "query"},
-              "pattern"
-            )
-            expect(payload).to eq(
-              nil
-            )
-          end
-        end
-        context "with send_payloads enabled" do
-          context "with allow_unencrypted_appfirewall_payloads disabled" do
-            it "should return nil payload" do
-              policy = PayloadsPolicy.from_json({
-                "payloads" => {
-                  "send_payloads" => true
-                }
-              })
-              configuration = double("configuration")
-              expect(TCellAgent).to receive(:configuration).and_return(configuration)
-              expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                false
-              )
-              expect(policy).to receive(:log).with(
-                "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-              )
-              payload = policy.apply(
-                "xss",
-                nil,
-                TCellAgent::Utils::Params::GET_PARAM,
-                "password",
-                "alert()",
-                {"l" => "query"},
-                "pattern"
-              )
-              expect(payload).to eq(
-                nil
-              )
-            end
-          end
-          context "with allow_unencrypted_appfirewall_payloads enabled" do
-            context "with no blacklist" do
-              context "with no whitelist" do
-                it "return the vulnerable value" do
-                  policy = PayloadsPolicy.from_json({
-                    "payloads" => {
-                      "send_payloads" => true
-                    }
-                  })
-                  configuration = double("configuration")
-                  expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                  expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                    true
-                  )
-                  expect(policy).to receive(:log).with(
-                    "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                  )
-                  payload = policy.apply(
-                    "xss",
-                    nil,
-                    TCellAgent::Utils::Params::GET_PARAM,
-                    "password",
-                    "alert()",
-                    {"l" => "query"},
-                    "pattern"
-                  )
-                  expect(payload).to eq(
-                    "alert()"
-                  )
-                end
-              end
-              context "with a whitelist" do
-                context "that does not specify locations for the param" do
-                  it "return return NOT_WHITELISTED" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "send_payloads" => true,
-                        "send_whitelist" => {
-                          "username" => ["*"]
-                        }
-                      }
-                    })
-                    configuration = double("configuration")
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                      true
-                    )
-                    expect(policy).to receive(:log).with(
-                      "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                    )
-                    payload = policy.apply(
-                      "xss",
-                      nil,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                    expect(payload).to eq(
-                      "NOT_WHITELISTED"
-                    )
-                  end
-                end
-                context "that specifies locations for the param" do
-                  context "param location does not match specified location do" do
-                    it "return should return NOT_WHITELISTED" do
-                      policy = PayloadsPolicy.from_json({
-                        "payloads" => {
-                          "send_payloads" => true,
-                          "send_whitelist" => {
-                            "username" => ["*"],
-                            "password" => ["cookie"]
-                          }
-                        }
-                      })
-                      configuration = double("configuration")
-                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                        true
-                      )
-                      expect(policy).to receive(:log).with(
-                        "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                      )
-                      payload = policy.apply(
-                        "xss",
-                        nil,
-                        TCellAgent::Utils::Params::GET_PARAM,
-                        "password",
-                        "alert()",
-                        {"l" => "query"},
-                        "pattern"
-                      )
-                      expect(payload).to eq(
-                        "NOT_WHITELISTED"
-                      )
-                    end
-                  end
-                  context "param location matches the specified location in the whitelist" do
-                    it "return the vulnerable value" do
-                      policy = PayloadsPolicy.from_json({
-                        "payloads" => {
-                          "send_payloads" => true,
-                          "send_whitelist" => {
-                            "username" => ["*"],
-                            "PASSWORD" => ["form"]
-                          }
-                        }
-                      })
-                      configuration = double("configuration")
-                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                        true
-                      )
-                      expect(policy).to receive(:log).with(
-                        "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                      )
-                      payload = policy.apply(
-                        "xss",
-                        nil,
-                        TCellAgent::Utils::Params::GET_PARAM,
-                        "password",
-                        "alert()",
-                        {"l" => "query"},
-                        "pattern"
-                      )
-                      expect(payload).to eq(
-                        "alert()"
-                      )
-                    end
-                  end
-                end
-              end
-            end
-            context "with a blacklist" do
-              context "that does not specify locations for the param" do
-                context "with no whitelist" do
-                  it "should return the vulnerable value" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "send_payloads" => true,
-                        "send_blacklist" => {
-                          "username" => ["*"]
-                        }
-                      }
-                    })
-                    configuration = double("configuration")
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                      true
-                    )
-                    expect(policy).to receive(:log).with(
-                      "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                    )
-                    payload = policy.apply(
-                      "xss",
-                      nil,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                    expect(payload).to eq(
-                      "alert()"
-                    )
-                  end
-                end
-                context "with a whitelist" do
-                  context "that does not specify locations for the param" do
-                    it "should return NOT_WHITELISTED" do
-                      policy = PayloadsPolicy.from_json({
-                        "payloads" => {
-                          "send_payloads" => true,
-                          "send_blacklist" => {
-                            "username" => ["*"]
-                          },
-                          "send_whitelist" => {
-                            "username" => ["*"]
-                          }
-                        }
-                      })
-                      configuration = double("configuration")
-                      expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                      expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                        true
-                      )
-                      expect(policy).to receive(:log).with(
-                        "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                      )
-                      payload = policy.apply(
-                        "xss",
-                        nil,
-                        TCellAgent::Utils::Params::GET_PARAM,
-                        "password",
-                        "alert()",
-                        {"l" => "query"},
-                        "pattern"
-                      )
-                      expect(payload).to eq(
-                        "NOT_WHITELISTED"
-                      )
-                    end
-                  end
-                  context "that specifies locations for the param" do
-                    context "param location does not match specified location" do
-                      it "should return NOT_WHITELISTED" do
-                        policy = PayloadsPolicy.from_json({
-                          "payloads" => {
-                            "send_payloads" => true,
-                            "send_blacklist" => {
-                              "username" => ["*"],
-                            },
-                            "send_whitelist" => {
-                              "password" => ["cookie"]
-                            }
-                          }
-                        })
-                        configuration = double("configuration")
-                        expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                        expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                          true
-                        )
-                        expect(policy).to receive(:log).with(
-                          "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                        )
-                        payload = policy.apply(
-                          "xss",
-                          nil,
-                          TCellAgent::Utils::Params::GET_PARAM,
-                          "password",
-                          "alert()",
-                          {"l" => "query"},
-                          "pattern"
-                        )
-                        expect(payload).to eq(
-                          "NOT_WHITELISTED"
-                        )
-                      end
-                    end
-                    context "param location matches the specified location" do
-                      it "should return the vulnerable value" do
-                        policy = PayloadsPolicy.from_json({
-                          "payloads" => {
-                            "send_payloads" => true,
-                            "send_blacklist" => {
-                              "username" => ["*"],
-                            },
-                            "send_whitelist" => {
-                              "PASSWORD" => ["form"]
-                            }
-                          }
-                        })
-                        configuration = double("configuration")
-                        expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                        expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                          true
-                        )
-                        expect(policy).to receive(:log).with(
-                          "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                        )
-                        payload = policy.apply(
-                          "xss",
-                          nil,
-                          TCellAgent::Utils::Params::GET_PARAM,
-                          "password",
-                          "alert()",
-                          {"l" => "query"},
-                          "pattern"
-                        )
-                        expect(payload).to eq(
-                          "alert()"
-                        )
-                      end
-                    end
-                  end
-                end
-              end
-              context "that specifies locations for the param" do
-                context "param location does not match specified location" do
-                  it "should return the vulnerable value" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "send_payloads" => true,
-                        "send_blacklist" => {
-                          "password" => ["cookie"],
-                        }
-                      }
-                    })
-                    configuration = double("configuration")
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                      true
-                    )
-                    expect(policy).to receive(:log).with(
-                      "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                    )
-                    payload = policy.apply(
-                      "xss",
-                      nil,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                    expect(payload).to eq(
-                      "alert()"
-                    )
-                  end
-                end
-                context "param location matches the specified location" do
-                  it "should return BLACKLISTED" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "send_payloads" => true,
-                        "send_blacklist" => {
-                          "password" => ["form"],
-                        }
-                      }
-                    })
-                    configuration = double("configuration")
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration)
-                    expect(configuration).to receive(:allow_unencrypted_appfirewall_payloads).and_return(
-                      true
-                    )
-                    expect(policy).to receive(:log).with(
-                      "xss", nil, TCellAgent::Utils::Params::GET_PARAM, "password", "alert()", {"l" => "query"}, "pattern"
-                    )
-                    payload = policy.apply(
-                      "xss",
-                      nil,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                    expect(payload).to eq(
-                      "BLACKLISTED"
-                    )
-                  end
-                end
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end