tcell_agent 0.4.0 → 1.0.0

data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb

@@ -6,279 +6,262 @@ module TCellAgent
   module Instrumentation
     module Rails
       module Middleware
+        regex_policy = {
+          'data' => {
+            'patterns' => [
+              {
+                'id' => 'tc-xss-1',
+                'pattern' => '(?:<(script|iframe|embed|frame|frameset|' \
+                             'object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound))',
+                'sensor' => 'xss',
+                'title' => 'Basic Injection'
+              },
 
+              {
+                'id' => 'tc-sqli-1',
+                'pattern' => "(?:(?:\\d[\"'`\u00b4\u2019\u2018]\\s+" \
+                             "[\"'`\u00b4\u2019\u2018]\\s+\\d)|(?:^admin" \
+                             "\\s*?[\"'`\u00b4\u2019\u2018]|(/\\*)+[\"'`" \
+                             "\u00b4\u2019\u2018]+\\s?(?:--|#|/\\*|\\{)?)|" \
+                             "(?:[\"'`\u00b4\u2019\u2018]\\s*?\\b(x?or|div|" \
+                             'like|between|and)\\b\\s*?[+<>=(),-]\\s*?[\\d"' \
+                             "'`\u00b4\u2019\u2018])|(?:[\"'`\u00b4\u2019\u2018]" \
+                             "\\s*?[^\\w\\s]?=\\s*?[\"'`\u00b4\u2019\u2018])|(?:[\"'`" \
+                             "\u00b4\u2019\u2018]\\W*?[+=]+\\W*?[\"'`\u00b4\u2019\u2018])" \
+                             "|(?:[\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=+-]+.*?[\"'`" \
+                             "\u00b4\u2019\u2018(].*?$)|(?:[\"'`\u00b4\u2019\u2018]\\s*?[!=|]" \
+                             "[\\d\\s!=]+.*?\\d+$)|(?:[\"'`\u00b4\u2019\u2018]\\s*?" \
+                             "like\\W+[\\w\"'`\u00b4\u2019\u2018(])|(?:\\sis\\s*?0\\W)" \
+                             "|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:[\"'`\u00b4\u2019\u2018" \
+                             "][<>~]+[\"'`\u00b4\u2019\u2018]))",
+                'sensor' => 'sqli',
+                'title' => 'Basic Injection'
+              },
 
-        class MockAppsensorRackApp
+              {
+                'id' => 'tc-fpt-2',
+                'pattern' => '(?:%c0%ae/)|(?:(?:/|\\\\)(conf|usr|etc|proc|opt|s?bin' \
+                             '|local|dev|tmp|kern|[br]oot|sys|system|windows|winnt|program|' \
+                             '%[a-z_-]{3,}%)(?:/|\\\\))|(?:(?:/|\\\\)inetpub|localstart\\.asp|' \
+                             'boot\\.ini)',
+                'sensor' => 'fpt',
+                'title' => 'Common System Probing'
+              }
+            ],
+            'version' => 1_518_546_622_571
+          },
+          'policy_id' => 'f3a313b0-10eb-11e8-8080-808080808080',
+          'version' => 1
+        }
 
+        class MockAppsensorRackApp
           attr_reader :request_body
 
-          def initialize(route_id=nil)
+          def initialize(route_id = nil)
             @route_id = route_id
             @request_headers = {}
           end
 
           def call(env)
             @env = env
-            rack_request = Rack::Request.new(env)
-            response_headers = {'Content-Type' => 'text/html'}
-            env["tcell.request_data"].transaction_id = "a-b-c-d-e-f"
-            env["tcell.request_data"].route_id = @route_id
-            #env["tcell.request_data"].route_id = "x-b-c-d-e-f"
+            Rack::Request.new(env)
+            response_headers = { 'Content-Type' => 'text/html' }
+            env['tcell.request_data'].transaction_id = 'a-b-c-d-e-f'
+            env['tcell.request_data'].route_id = @route_id
             [200, response_headers, ['OK']]
           end
 
           def [](key)
             @env[key]
           end
-
         end
 
         describe HeadersMiddleware do
-
           let(:app) { MockAppsensorRackApp.new }
-          let(:app2) { MockAppsensorRackApp.new(route_id="myrouteid") }
+          let(:app2) { MockAppsensorRackApp.new('myrouteid') }
 
-          subject { withTCellMiddleware( app ) }
-
-          context "Appsensor Middleware" do
-            before(:all) do
-              # need to ensure default rules file is loaded
-              AppSensorRuleManager.instance.load_default_rules_file
-            end
+          subject { with_tcell_middleware(app) }
 
+          context 'Appsensor Middleware' do
             before(:each) do
               TCellAgent.configuration = TCellAgent::Configuration.new
-              TCellAgent.configuration.read_config_from_file(get_test_resource_path("normal_config.json"))
+              TCellAgent.configuration.read_config_from_file(get_test_resource_path('normal_config.json'))
             end
             let(:request) { Rack::MockRequest.new(subject) }
-            let(:request2) { Rack::MockRequest.new( withTCellMiddleware( app2 )) }
+            let(:request2) { Rack::MockRequest.new(with_tcell_middleware(app2)) }
             let(:agent) { ::TCellAgent::Agent.new }
-            context "XSS" do
-              context "with allow_payloads = false" do
+
+            context 'XSS' do
+              context 'with allow_payloads = false' do
                 before(:each) do
                   old_uap = TCellAgent.configuration.allow_payloads
-                  TCellAgent.configuration.allow_payloads = false
-                  TCellAgent.thread_agent.processPolicyJson({"appsensor"=>{
-                    "policy_id" => "153ed270",
-                    "version" => 2,
-                    "data" => {
-                      "options" => {
-                        "payloads" => {
-                          "send_payloads" => true,
-                          "log_payloads" => false
-                        }
-                      },
-                      "sensors" => {
-                        "xss" => {
-                          "patterns" => ["1", "2", "8"]
+                  TCellAgent.configuration.allow_payloads = true
+                  TCellAgent.thread_agent.processPolicyJson(
+                    {
+                      'regex' => regex_policy,
+                      'appsensor' => {
+                        'policy_id' => '153ed270',
+                        'version' => 2,
+                        'data' => {
+                          'options' => {
+                            'payloads' => {
+                              'send_payloads' => true,
+                              'log_payloads' => false
+                            }
+                          },
+                          'sensors' => {
+                            'xss' => {
+                              'dynamic_patterns' => ['tc-xss-1'],
+                              'patterns' => ['1']
+                            }
+                          }
                         }
                       }
-                    }
-                  }}, cache=false)
+                    },
+                    false
+                  )
+
                   TCellAgent.empty_event_queue
                   TCellAgent.configuration.allow_payloads = old_uap
                 end
-                it "alerts on get xss payload" do
-                  response = request.get("/foo?xyz=%3CSCRIPT%3Ealert(1)%3C%2Fscript%3E", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
-                  expected_as = {
-                    "event_type"=>"as",
-                    "dp"=>"xss",
-                    "param"=>"xyz",
-                    "remote_addr"=>"1.3.3.4",
-                    "m"=>"GET",
-                    "pattern"=>"1",
-                    "uri"=>"http://example.org/foo?xyz=",
-                    "meta"=>{"l" => "query"}}
-                  expect(TCellAgent.event_queue).to include(expected_as)
-                end
 
-                it "alerts on post xss payload" do
-                  response = request.post("/foo", :input => "x=<SCRIPT>alert(1)</SCRIPT>", 'REMOTE_ADDR' => '1.2.3.4,3.4.5.6')
+                it 'alerts on get xss payload' do
+                  request.get('/foo?xyz=%3CSCRIPT%3Ealert(1)%3C%2Fscript%3E', 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
                   expected_as = {
-                    "event_type"=>"as",
-                    "dp"=>"xss",
-                    "param"=>"x",
-                    "remote_addr"=>"1.2.3.4",
-                    "m"=>"POST",
-                    "pattern"=>"1",
-                    "uri"=>"http://example.org/foo",
-                    "meta"=>{"l" => "body"}}
+                    'event_type' => 'as',
+                    'dp' => 'xss',
+                    'param' => 'xyz',
+                    'remote_addr' => '1.3.3.4',
+                    'm' => 'GET',
+                    'pattern' => 'tc-xss-1',
+                    'uri' => 'http://example.org/foo?xyz=',
+                    'meta' => { 'l' => 'query' },
+                    'payload' => '<SCRIPT>alert(1)</script>'
+                  }
                   expect(TCellAgent.event_queue).to include(expected_as)
-                end #/it
+                end
 
-                it "alerts on get xss payload with route_id" do
-                  response = request2.get("/foo?xyz=%3Cscript%3Ealert(1)%3C%2Fscript%3E")
+                it 'alerts on post xss payload' do
+                  request.post('/foo', :input => 'x=<SCRIPT>alert(1)</SCRIPT>', 'REMOTE_ADDR' => '1.2.3.4,3.4.5.6')
                   expected_as = {
-                    "event_type"=>"as",
-                    "dp"=>"xss",
-                    "param"=>"xyz",
-                    "rid"=>"myrouteid",
-                    "m"=>"GET",
-                    "pattern"=>"1",
-                    "uri"=>"http://example.org/foo?xyz=",
-                    "meta"=>{"l" => "query"}}
+                    'event_type' => 'as',
+                    'dp' => 'xss',
+                    'param' => 'x',
+                    'remote_addr' => '1.2.3.4',
+                    'm' => 'POST',
+                    'pattern' => 'tc-xss-1',
+                    'uri' => 'http://example.org/foo',
+                    'meta' => { 'l' => 'body' },
+                    'payload' => '<SCRIPT>alert(1)</SCRIPT>'
+                  }
                   expect(TCellAgent.event_queue).to include(expected_as)
                 end
-              end
 
-              context "with allow_payloads = true" do
-                before(:each) do
-                  old_uap = TCellAgent.configuration.allow_payloads
-                  TCellAgent.configuration.allow_payloads = true
-                  TCellAgent.thread_agent.processPolicyJson({"appsensor"=>{
-                    "policy_id" => "153ed270",
-                    "version" => 2,
-                    "data" => {
-                      "options" => {
-                        "payloads" => {
-                          "send_payloads" => true,
-                          "log_payloads" => false
-                        }
-                      },
-                      "sensors" => {
-                        "xss" => {
-                          "patterns" => ["1", "2", "8"]
-                        }
-                      }
-                    }
-                  }}, cache=false)
-                  TCellAgent.empty_event_queue
-                  TCellAgent.configuration.allow_payloads = old_uap
-                end
-
-                it "checks that payload is sent in xss with route_id" do
-                  response = request2.get("/foo?xyz=%3Cscript%3Ealert(1)%3C%2Fscript%3E")
+                it 'alerts on get xss payload with route_id' do
+                  request2.get('/foo?xyz=%3Cscript%3Ealert(1)%3C%2Fscript%3E')
                   expected_as = {
-                    "event_type"=>"as",
-                    "dp"=>"xss",
-                    "param"=>"xyz",
-                    "rid"=>"myrouteid",
-                    "m"=>"GET",
-                    "pattern"=>"1",
-                    "uri"=>"http://example.org/foo?xyz=",
-                    "payload"=>"<script>alert(1)</script>",
-                    "meta"=>{"l" => "query"}}
-
+                    'event_type' => 'as',
+                    'dp' => 'xss',
+                    'param' => 'xyz',
+                    'rid' => 'myrouteid',
+                    'm' => 'GET',
+                    'pattern' => 'tc-xss-1',
+                    'uri' => 'http://example.org/foo?xyz=',
+                    'meta' => { 'l' => 'query' },
+                    'payload' => '<script>alert(1)</script>'
+                  }
                   expect(TCellAgent.event_queue).to include(expected_as)
                 end
               end
-
             end
 
-            context "SQL Injection" do
+            context 'SQL Injection' do
               before(:each) do
-                TCellAgent.thread_agent.processPolicyJson({"appsensor"=>{
-                  "policy_id"=>"153ed270",
-                  "version" => 2,
-                  "data"=>{
-                    "sensors" => {
-                      "xss" => {
-                        "patterns" => ["1"]
-                      },
-                      "sqli" => {
-                        "patterns" => ["1"]
-                      },
-                      "cmdi" => {
-                        "patterns" => ["1"]
+                TCellAgent.thread_agent.processPolicyJson(
+                  {
+                    'regex' => regex_policy,
+                    'appsensor' => {
+                      'policy_id' => '153ed270',
+                      'version' => 2,
+                      'data' => {
+                        'sensors' => {
+                          'sqli' => {
+                            'dynamic_patterns' => ['tc-sqli-1'],
+                            'patterns' => ['1']
+                          }
+                        }
                       }
                     }
-                  }
-                }}, cache=false) 
+                  },
+                  false
+                )
                 TCellAgent.empty_event_queue
               end
 
-              it "alerts on get sqli payload" do
+              it 'alerts on get sqli payload' do
                 old_uap = TCellAgent.configuration.allow_payloads
                 TCellAgent.configuration.allow_payloads = false
                 # ' OR '3'='3
-                response = request.get("/foo?xyz=abds&def=%27%20OR%20%273%27%3D%273", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
+                request.get('/foo?xyz=abds&def=%27%20OR%20%273%27%3D%273', 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
                 TCellAgent.configuration.allow_payloads = old_uap
                 expected_as = {
-                  "event_type"=>"as",
-                  "dp"=>"sqli",
-                  "param"=>"def",
-                  "remote_addr"=>"1.3.3.4",
-                  "m"=>"GET",
-                  "pattern"=>"1",
-                  "uri"=>"http://example.org/foo?xyz=&def=",
-                  "meta"=>{"l" => "query"}}
+                  'event_type' => 'as',
+                  'dp' => 'sqli',
+                  'param' => 'def',
+                  'remote_addr' => '1.3.3.4',
+                  'm' => 'GET',
+                  'pattern' => 'tc-sqli-1',
+                  'uri' => 'http://example.org/foo?xyz=&def=',
+                  'meta' => { 'l' => 'query' }
+                }
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
             end
 
-            context "File Path Traversal" do
-              it "alerts on most obvious payload" do
-                TCellAgent.thread_agent.processPolicyJson({"appsensor"=>{
-                  "policy_id"=>"153ed270",
-                  "version" => 2,
-                  "data"=>{
-                    "options" => {
-                      "payloads" => {
-                        "send_payloads" => false,
-                        "log_payloads" => false
-                      }
-                    },
-                    "sensors" => {
-                      "fpt" => {
-                        "patterns" => ["1", "2", "3"]
-                      }
-                    }
-                  }
-                }}, cache=false) 
-                TCellAgent.empty_event_queue
-
-                response = request.get("/foo?xyz=/ETC/PASSWD", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
-                expected_as = {
-                  "event_type"=>"as",
-                  "dp"=>"fpt",
-                  "param"=>"xyz",
-                  "remote_addr"=>"1.3.3.4",
-                  "m"=>"GET",
-                  "pattern"=>"2",
-                  "uri"=>"http://example.org/foo?xyz=",
-                  "meta"=>{"l" => "query"}}
-                expect(TCellAgent.event_queue).to include(expected_as)
-              end
-
-              it "checks that payload is sent" do
-                TCellAgent.thread_agent.processPolicyJson({"appsensor"=>{
-                  "policy_id"=>"153ed270",
-                  "version" => 2,
-                  "data"=>{
-                    "options" => {
-                      "payloads" => {
-                        "send_payloads" => true,
-                        "log_payloads" => false
-                      }
-                    },
-                    "sensors" => {
-                      "fpt" => {
-                        "patterns" => ["1", "2", "3"]
+            context 'File Path Traversal' do
+              it 'alerts on most obvious payload' do
+                TCellAgent.thread_agent.processPolicyJson(
+                  {
+                    'regex' => regex_policy,
+                    'appsensor' => {
+                      'policy_id' => '153ed270',
+                      'version' => 2,
+                      'data' => {
+                        'options' => {
+                          'payloads' => {
+                            'send_payloads' => false,
+                            'log_payloads' => false
+                          }
+                        },
+                        'sensors' => {
+                          'fpt' => {
+                            'dynamic_patterns' => ['tc-fpt-2'],
+                            'patterns' => ['2']
+                          }
+                        }
                       }
                     }
-                  }
-                }}, cache=false) 
+                  },
+                  false
+                )
                 TCellAgent.empty_event_queue
 
-                response = request.get("/foo?xyz=/etc/passwd", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
+                request.get('/foo?xyz=/ETC/PASSWD', 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
                 expected_as = {
-                  "event_type"=>"as",
-                  "dp"=>"fpt",
-                  "param"=>"xyz",
-                  "remote_addr"=>"1.3.3.4",
-                  "m"=>"GET",
-                  "pattern"=>"2",
-                  "uri"=>"http://example.org/foo?xyz=",
-                  "payload"=>"/etc/passwd",
-                  "meta"=>{"l" => "query"}}
+                  'event_type' => 'as',
+                  'dp' => 'fpt',
+                  'param' => 'xyz',
+                  'remote_addr' => '1.3.3.4',
+                  'm' => 'GET',
+                  'pattern' => 'tc-fpt-2',
+                  'uri' => 'http://example.org/foo?xyz=',
+                  'meta' => { 'l' => 'query' }
+                }
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
             end
           end
-
         end
-
-
       end
     end
   end