tcell_agent 0.2.29 → 0.4.0

data/spec/lib/tcell_agent/policies/appsensor/payloads_policy_log_spec.rb

@@ -1,417 +0,0 @@
-require 'spec_helper'
-
-module TCellAgent
-  module Policies
-
-    describe AppSensorPolicy do
-
-      describe "#log" do
-        before(:each) do
-          @meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-          @meta.remote_address = "remote_address"
-          @meta.method = "get"
-          @meta.location = "location"
-          @meta.route_id = "route_id"
-          @meta.session_id = "session_id"
-          @meta.user_id = "user_id"
-          @meta.transaction_id = "transaction_id"
-        end
-
-        context "with log_payloads disabled" do
-          it "should not log" do
-            policy = PayloadsPolicy.from_json({
-              "payloads" => {
-                "log_payloads" => false
-              }
-            })
-
-            expect(TCellAgent).to_not receive(:configuration)
-            expect(TCellAgent).to_not receive(:appfirewall_payloads_logger)
-
-            policy.log(
-              "xss",
-              @meta,
-              TCellAgent::Utils::Params::GET_PARAM,
-              "password",
-              "alert()",
-              {"l" => "query"},
-              "pattern"
-            )
-          end
-        end
-
-        context "with log_payloads enabled" do
-          context "with no blacklist" do
-            context "with no whitelist" do
-              it "should log the value" do
-                policy = PayloadsPolicy.from_json({
-                  "payloads" => {
-                    "log_payloads" => true
-                  }
-                })
-                configuration = double("configuration", "enabled" => true)
-                appfirewall_payloads_logger = double("appfirewall_payloads_logger")
-
-                expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
-                expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
-                  appfirewall_payloads_logger
-                ).exactly(2).times
-                expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
-                  :post_process
-                )
-                expect(appfirewall_payloads_logger).to receive(:info).with({
-                  "event_type" => "as",
-                  "dp" => "xss",
-                  "param" => "password",
-                  "remote_addr" => "remote_address",
-                  "m" => "get",
-                  "pattern" => "pattern",
-                  "meta" => {"l" => "query"},
-                  "rid" => "route_id"
-                }.to_json)
-
-                policy.log(
-                  "xss",
-                  @meta,
-                  TCellAgent::Utils::Params::GET_PARAM,
-                  "password",
-                  "alert()",
-                  {"l" => "query"},
-                  "pattern"
-                )
-              end
-            end
-
-            context "with a whitelist" do
-              context "that does not specify locations for the param" do
-                it "should not log" do
-                  policy = PayloadsPolicy.from_json({
-                    "payloads" => {
-                      "log_payloads" => true,
-                      "log_whitelist" => {
-                        "username" => ["*"]
-                      }
-                    }
-                  })
-
-                  expect(TCellAgent).to_not receive(:configuration)
-
-                  policy.log(
-                    "xss",
-                    @meta,
-                    TCellAgent::Utils::Params::GET_PARAM,
-                    "password",
-                    "alert()",
-                    {"l" => "query"},
-                    "pattern"
-                  )
-                end
-              end
-
-              context "that specifies locations for the param" do
-                context "param location does not match specified location do" do
-                  it "should not log" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "log_payloads" => true,
-                        "log_whitelist" => {
-                          "username" => ["*"],
-                          "password" => ["cookie"]
-                        }
-                      }
-                    })
-
-                    expect(TCellAgent).to_not receive(:configuration)
-
-                    policy.log(
-                      "xss",
-                      @meta,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                  end
-                end
-
-                context "param location matches the specified location in the whitelist" do
-                  it "should log the value" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "log_payloads" => true,
-                        "log_whitelist" => {
-                          "username" => ["*"],
-                          "PASSWORD" => ["form"]
-                        }
-                      }
-                    })
-                    configuration = double("configuration", "enabled" => true)
-                    appfirewall_payloads_logger = double("appfirewall_payloads_logger")
-
-                    expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
-                    expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
-                      appfirewall_payloads_logger
-                    ).exactly(2).times
-                    expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
-                      :post_process
-                    )
-                    expect(appfirewall_payloads_logger).to receive(:info).with({
-                      "event_type" => "as",
-                      "dp" => "xss",
-                      "param" => "password",
-                      "remote_addr" => "remote_address",
-                      "m" => "get",
-                      "pattern" => "pattern",
-                      "meta" => {"l" => "query"},
-                      "rid" => "route_id",
-                    }.to_json)
-
-                    policy.log(
-                      "xss",
-                      @meta,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                  end
-                end
-              end
-            end
-          end
-
-          context "with a blacklist" do
-            context "that does not specify locations for the param" do
-              context "with no whitelist" do
-                it "should log the value" do
-                  policy = PayloadsPolicy.from_json({
-                    "payloads" => {
-                      "log_payloads" => true,
-                      "log_blacklist" => {
-                        "username" => ["*"]
-                      }
-                    }
-                  })
-                  configuration = double("configuration", "enabled" => true)
-                  appfirewall_payloads_logger = double("appfirewall_payloads_logger")
-
-                  expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
-                  expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
-                    appfirewall_payloads_logger
-                  ).exactly(2).times
-                  expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
-                    :post_process
-                  )
-                  expect(appfirewall_payloads_logger).to receive(:info).with({
-                    "event_type" => "as",
-                    "dp" => "xss",
-                    "param" => "password",
-                    "remote_addr" => "remote_address",
-                    "m" => "get",
-                    "pattern" => "pattern",
-                    "meta" => {"l" => "query"},
-                    "rid" => "route_id"
-                  }.to_json)
-
-                  policy.log(
-                    "xss",
-                    @meta,
-                    TCellAgent::Utils::Params::GET_PARAM,
-                    "password",
-                    "alert()",
-                    {"l" => "query"},
-                    "pattern"
-                  )
-                end
-              end
-
-              context "with a whitelist" do
-                context "that does not specify locations for the param" do
-                  it "should not log" do
-                    policy = PayloadsPolicy.from_json({
-                      "payloads" => {
-                        "log_payloads" => true,
-                        "log_blacklist" => {
-                          "username" => ["*"]
-                        },
-                        "log_whitelist" => {
-                          "username" => ["*"]
-                        }
-                      }
-                    })
-
-                    expect(TCellAgent).to_not receive(:configuration)
-
-                    policy.log(
-                      "xss",
-                      @meta,
-                      TCellAgent::Utils::Params::GET_PARAM,
-                      "password",
-                      "alert()",
-                      {"l" => "query"},
-                      "pattern"
-                    )
-                  end
-                end
-
-                context "that specifies locations for the param" do
-                  context "param location does not match specified location" do
-                    it "should not log" do
-                      policy = PayloadsPolicy.from_json({
-                        "payloads" => {
-                          "log_payloads" => true,
-                          "log_blacklist" => {
-                            "username" => ["*"],
-                          },
-                          "log_whitelist" => {
-                            "password" => ["cookie"]
-                          }
-                        }
-                      })
-
-                      expect(TCellAgent).to_not receive(:configuration)
-
-                      policy.log(
-                        "xss",
-                        @meta,
-                        TCellAgent::Utils::Params::GET_PARAM,
-                        "password",
-                        "alert()",
-                        {"l" => "query"},
-                        "pattern"
-                      )
-                    end
-                  end
-
-                  context "param location matches the specified location" do
-                    it "should log the value" do
-                      policy = PayloadsPolicy.from_json({
-                        "payloads" => {
-                          "log_payloads" => true,
-                          "log_blacklist" => {
-                            "username" => ["*"],
-                          },
-                          "log_whitelist" => {
-                            "PASSWORD" => ["form"]
-                          }
-                        },
-                        "uri_options" => {"collect_full_uri" => true}
-                      })
-                      configuration = double("configuration", "enabled" => true)
-                      appfirewall_payloads_logger = double("appfirewall_payloads_logger")
-
-                      expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
-                      expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
-                        appfirewall_payloads_logger
-                      ).exactly(2).times
-                      expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
-                        :post_process
-                      )
-                      expect(appfirewall_payloads_logger).to receive(:info).with({
-                        "event_type" => "as",
-                        "dp" => "xss",
-                        "param" => "password",
-                        "remote_addr" => "remote_address",
-                        "m" => "get",
-                        "pattern" => "pattern",
-                        "meta" => {"l" => "query"},
-                        "rid" => "route_id",
-                        "full_uri" => "location"
-                      }.to_json)
-
-                      policy.log(
-                        "xss",
-                        @meta,
-                        TCellAgent::Utils::Params::GET_PARAM,
-                        "password",
-                        "alert()",
-                        {"l" => "query"},
-                        "pattern"
-                      )
-                    end
-                  end
-                end
-              end
-            end
-
-            context "that specifies locations for the param" do
-              context "param location does not match specified location" do
-                it "should log the value" do
-                  policy = PayloadsPolicy.from_json({
-                    "payloads" => {
-                      "log_payloads" => true,
-                      "log_blacklist" => {
-                        "password" => ["cookie"],
-                      }
-                    },
-                    "uri_options" => {"collect_full_uri" => false}
-                  })
-                  configuration = double("configuration", "enabled" => true)
-                  appfirewall_payloads_logger = double("appfirewall_payloads_logger")
-
-                  expect(TCellAgent).to receive(:configuration).and_return(configuration).exactly(3).times
-                  expect(configuration).to receive(:appfirewall_payloads_logger).and_return(
-                    appfirewall_payloads_logger
-                  ).exactly(2).times
-                  expect_any_instance_of(TCellAgent::SensorEvents::TCellAppSensorEvent).to receive(
-                    :post_process
-                  )
-                  expect(appfirewall_payloads_logger).to receive(:info).with({
-                    "event_type" => "as",
-                    "dp" => "xss",
-                    "param" => "password",
-                    "remote_addr" => "remote_address",
-                    "m" => "get",
-                    "pattern" => "pattern",
-                    "meta" => {"l" => "query"},
-                    "rid" => "route_id"
-                  }.to_json)
-
-                  policy.log(
-                    "xss",
-                    @meta,
-                    TCellAgent::Utils::Params::GET_PARAM,
-                    "password",
-                    "alert()",
-                    {"l" => "query"},
-                    "pattern"
-                  )
-                end
-              end
-
-              context "param location matches the specified location" do
-                it "should not log" do
-                  policy = PayloadsPolicy.from_json({
-                    "payloads" => {
-                      "log_payloads" => true,
-                      "log_blacklist" => {
-                        "password" => ["form"],
-                      }
-                    }
-                  })
-
-                  expect(TCellAgent).to_not receive(:configuration)
-
-                  policy.log(
-                    "xss",
-                    @meta,
-                    TCellAgent::Utils::Params::GET_PARAM,
-                    "password",
-                    "alert()",
-                    {"l" => "query"},
-                    "pattern"
-                  )
-                end
-              end
-            end
-          end
-        end
-
-      end
-
-    end
-
-  end
-end

data/spec/lib/tcell_agent/policies/appsensor/request_size_sensor_spec.rb

@@ -1,236 +0,0 @@
-require 'spec_helper'
-
-module TCellAgent
-  module Policies
-
-    describe RequestSizeSensor do
-      context "#initialize" do
-        context "default sensor" do
-          it "should have properties set to defaults" do
-            sensor = RequestSizeSensor.new
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.limit).to eq(524288)
-            expect(sensor.excluded_route_ids).to eq({})
-            expect(sensor.dp_code).to eq(RequestSizeSensor::DP_UNUSUAL_REQUEST_SIZE)
-          end
-        end
-
-        context "setting enabled on sensor" do
-          it "should have properties set to defaults" do
-            sensor = RequestSizeSensor.new({"enabled" => true})
-            expect(sensor.enabled).to eq(true)
-            expect(sensor.limit).to eq(524288)
-            expect(sensor.excluded_route_ids).to eq({})
-            expect(sensor.dp_code).to eq(RequestSizeSensor::DP_UNUSUAL_REQUEST_SIZE)
-          end
-        end
-
-        context "setting limit on sensor" do
-          it "should have properties set to defaults" do
-            sensor = RequestSizeSensor.new({"limit" => 1})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.limit).to eq(1)
-            expect(sensor.excluded_route_ids).to eq({})
-            expect(sensor.dp_code).to eq(RequestSizeSensor::DP_UNUSUAL_REQUEST_SIZE)
-          end
-        end
-
-        context "setting excluded routes on sensor" do
-          it "should have properties set to defaults" do
-            sensor = RequestSizeSensor.new({"exclude_routes" => ["1", "10", "20"]})
-            expect(sensor.enabled).to eq(false)
-            expect(sensor.limit).to eq(524288)
-            expect(sensor.excluded_route_ids).to eq({"1"=>true, "10"=>true, "20"=>true})
-            expect(sensor.dp_code).to eq(RequestSizeSensor::DP_UNUSUAL_REQUEST_SIZE)
-          end
-        end
-      end
-
-      context "#check" do
-        context "with disabled sensor" do
-          it "should not send event" do
-            sensor = RequestSizeSensor.new({"enabled" => false})
-            meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-            meta.remote_address = "remote_address"
-            meta.method = "get"
-            meta.location = "location"
-            meta.route_id = "route_id"
-            meta.session_id = "session_id"
-            meta.user_id = "user_id"
-            meta.transaction_id = "transaction_id"
-            meta.request_content_bytes_len = 1024
-
-            expect(TCellAgent).to_not receive(:send_event)
-            sensor.check(meta)
-          end
-        end
-
-        context "with enabled sensor" do
-          context "size is zero" do
-            it "should not send event" do
-              sensor = RequestSizeSensor.new({
-                "enabled" => true,
-                "limit" => 1,
-                "exclude_routes" => []
-              })
-
-              meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-              meta.remote_address = "remote_address"
-              meta.method = "get"
-              meta.location = "location"
-              meta.route_id = "route_id"
-              meta.session_id = "session_id"
-              meta.user_id = "user_id"
-              meta.transaction_id = "transaction_id"
-              meta.request_content_bytes_len = 0
-
-              expect(TCellAgent).to_not receive(:send_event)
-              sensor.check(meta)
-            end
-          end
-
-          context "size is too small" do
-            context "by half a KiB" do
-              it "should not send event" do
-                sensor = RequestSizeSensor.new({
-                  "enabled" => true,
-                  "limit" => 1,
-                  "exclude_routes" => []
-                })
-
-                meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-                meta.remote_address = "remote_address"
-                meta.method = "get"
-                meta.location = "location"
-                meta.route_id = "route_id"
-                meta.session_id = "session_id"
-                meta.user_id = "user_id"
-                meta.transaction_id = "transaction_id"
-                meta.request_content_bytes_len = 512
-
-                expect(TCellAgent).to_not receive(:send_event)
-                sensor.check(meta)
-              end
-            end
-          end
-
-          context "size is ok" do
-            it "should not send event" do
-              sensor = RequestSizeSensor.new({
-                "enabled" => true,
-                "limit" => 1,
-                "exclude_routes" => []
-              })
-
-              meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-              meta.remote_address = "remote_address"
-              meta.method = "get"
-              meta.location = "location"
-              meta.route_id = "route_id"
-              meta.session_id = "session_id"
-              meta.user_id = "user_id"
-              meta.transaction_id = "transaction_id"
-                meta.request_content_bytes_len = 1024
-
-              expect(TCellAgent).to_not receive(:send_event)
-              sensor.check(meta)
-            end
-          end
-
-          context "size is too big" do
-            context "by half a KiB" do
-              it "should not send event" do
-                sensor = RequestSizeSensor.new({
-                  "enabled" => true,
-                  "limit" => 1,
-                  "exclude_routes" => ["excluded_route_id"]
-                })
-
-                meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-                meta.remote_address = "remote_address"
-                meta.method = "get"
-                meta.location = "location"
-                meta.route_id = "excluded_route_id"
-                meta.session_id = "session_id"
-                meta.user_id = "user_id"
-                meta.transaction_id = "transaction_id"
-                meta.request_content_bytes_len = 1024 + 512
-
-                expect(TCellAgent).to_not receive(:send_event)
-                sensor.check(meta)
-              end
-            end
-
-            context "route_id is excluded" do
-              it "should not send event" do
-                sensor = RequestSizeSensor.new({
-                  "enabled" => true,
-                  "limit" => 1,
-                  "exclude_routes" => ["excluded_route_id"]
-                })
-
-                meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-                meta.remote_address = "remote_address"
-                meta.method = "get"
-                meta.location = "location"
-                meta.route_id = "excluded_route_id"
-                meta.session_id = "session_id"
-                meta.user_id = "user_id"
-                meta.transaction_id = "transaction_id"
-                meta.request_content_bytes_len = 2048
-
-                expect(TCellAgent).to_not receive(:send_event)
-                sensor.check(meta)
-              end
-            end
-
-            context "route is not excluded" do
-              it "should send event" do
-                sensor = RequestSizeSensor.new({
-                  "enabled" => true,
-                  "limit" => 1,
-                  "exclude_routes" => []
-                })
-
-                meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-                meta.remote_address = "remote_address"
-                meta.method = "get"
-                meta.location = "location"
-                meta.route_id = "excluded_route_id"
-                meta.session_id = "session_id"
-                meta.user_id = "user_id"
-                meta.transaction_id = "transaction_id"
-                meta.request_content_bytes_len = 2048
-
-                expect(TCellAgent).to receive(:send_event).with(
-                  {
-                    "event_type" => "as",
-                    "dp" => RequestSizeSensor::DP_UNUSUAL_REQUEST_SIZE,
-                    "remote_addr" => "remote_address",
-                    "m" => "get",
-                    "meta" => {"sz" => 2048},
-                    "rid" => "excluded_route_id"
-                  }
-                )
-                sensor.check(meta)
-              end
-            end
-          end
-
-        end
-      end
-
-      context "#get_content_length" do
-        it "should return the request size" do
-          sensor = RequestSizeSensor.new({"enabled" => false})
-          meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new
-          meta.request_content_bytes_len = 1024
-          meta.response_content_bytes_len = 2048
-
-          expect(sensor.get_content_length(meta)).to eq(1024)
-        end
-      end
-    end
-
-  end
-end