tcell_agent 0.4.0 → 1.0.0

data/spec/lib/tcell_agent/appsensor/injections_matcher_spec.rb

@@ -1,522 +0,0 @@
-require 'spec_helper'
-
-module TCellAgent
-  module AppSensor
-
-    describe "InjectionsMatcher" do
-
-      describe ".from_json" do
-        context "with nil json" do
-          it "should create a disabled injections matcher" do
-            injection_matcher = InjectionsMatcher.from_json(1, nil)
-
-            expect(injection_matcher.enabled).to eq(false)
-            expect(injection_matcher.sensors).to eq([])
-          end
-        end
-
-        context "with empty json" do
-          it "should create a disabled injections matcher" do
-            injection_matcher = InjectionsMatcher.from_json(1, {})
-
-            expect(injection_matcher.enabled).to eq(false)
-            expect(injection_matcher.sensors).to eq([])
-          end
-        end
-
-        context "with v1 sensors config" do
-          context "with nil options" do
-            it "should create a disabled injection matcher" do
-              injection_matcher = InjectionsMatcher.from_json(1, {"options" => nil})
-
-              expect(injection_matcher.enabled).to eq(false)
-              expect(injection_matcher.sensors).to eq([])
-            end
-          end
-
-          context "with empty options" do
-            it "should create a disabled injection matcher" do
-              injection_matcher = InjectionsMatcher.from_json(1, {"options" => []})
-
-              expect(injection_matcher.enabled).to eq(false)
-              expect(injection_matcher.sensors).to eq([])
-            end
-          end
-
-          context "with xss sensor disabled" do
-            it "should create no sensors" do
-              sensors_json = {
-                "options" => {
-                  "xss" => false
-                }
-              }
-
-              injection_matcher = InjectionsMatcher.from_json(1, sensors_json)
-
-              expect(injection_matcher.enabled).to eq(false)
-              expect(injection_matcher.sensors).to eq([])
-            end
-          end
-
-          context "with xss sensor enabled" do
-            it "should create an xss sensors" do
-              sensors_json = {
-                "options" => {
-                  "xss" => true
-                }
-              }
-
-              injection_matcher = InjectionsMatcher.from_json(1, sensors_json)
-
-              expect(injection_matcher.enabled).to eq(true)
-              expect(injection_matcher.sensors.size).to eq(1)
-              expect(injection_matcher.sensors[ 0 ].enabled).to eq(true)
-              expect(injection_matcher.sensors[ 0 ].libinjection).to eq(false)
-              expect(injection_matcher.sensors[ 0 ].detection_point).to eq("xss")
-              expect(injection_matcher.sensors[ 0 ].exclude_headers).to eq(false)
-              expect(injection_matcher.sensors[ 0 ].exclude_forms).to eq(false)
-              expect(injection_matcher.sensors[ 0 ].exclude_cookies).to eq(false)
-              expect(injection_matcher.sensors[ 0 ].exclusions).to eq({})
-              expect(injection_matcher.sensors[ 0 ].active_pattern_ids).to eq(Set.new)
-              expect(injection_matcher.sensors[ 0 ].v1_compatability_enabled).to eq(true)
-              expect(injection_matcher.sensors[ 0 ].excluded_route_ids).to eq(Set.new)
-            end
-          end
-
-          context "with two sensors" do
-            context "one is disabled and one is enabled" do
-              it "should create one sensor" do
-                sensors_json = {
-                  "options" => {
-                    "sqli" => false,
-                    "xss" => true
-                  }
-                }
-
-                injection_matcher = InjectionsMatcher.from_json(1, sensors_json)
-
-                expect(injection_matcher.enabled).to eq(true)
-                expect(injection_matcher.sensors.size).to eq(1)
-                expect(injection_matcher.sensors[ 0 ].enabled).to eq(true)
-                expect(injection_matcher.sensors[ 0 ].libinjection).to eq(false)
-                expect(injection_matcher.sensors[ 0 ].detection_point).to eq("xss")
-                expect(injection_matcher.sensors[ 0 ].exclude_headers).to eq(false)
-                expect(injection_matcher.sensors[ 0 ].exclude_forms).to eq(false)
-                expect(injection_matcher.sensors[ 0 ].exclude_cookies).to eq(false)
-                expect(injection_matcher.sensors[ 0 ].exclusions).to eq({})
-                expect(injection_matcher.sensors[ 0 ].active_pattern_ids).to eq(Set.new)
-                expect(injection_matcher.sensors[ 0 ].v1_compatability_enabled).to eq(true)
-                expect(injection_matcher.sensors[ 0 ].excluded_route_ids).to eq(Set.new)
-              end
-            end
-
-            context "both enabled" do
-              it "should create two sensors" do
-                sensors_json = {
-                  "options" => {
-                    "sqli" => true,
-                    "xss" => true
-                  }
-                }
-
-                injection_matcher = InjectionsMatcher.from_json(1, sensors_json)
-
-                sorted_sensors = injection_matcher.sensors.sort { |a,b| a.detection_point <=> b.detection_point }
-
-                expect(injection_matcher.enabled).to eq(true)
-                expect(injection_matcher.sensors.size).to eq(2)
-                expect(sorted_sensors[ 0 ].enabled).to eq(true)
-                expect(sorted_sensors[ 0 ].libinjection).to eq(false)
-                expect(sorted_sensors[ 0 ].detection_point).to eq("sqli")
-                expect(sorted_sensors[ 0 ].exclude_headers).to eq(false)
-                expect(sorted_sensors[ 0 ].exclude_forms).to eq(false)
-                expect(sorted_sensors[ 0 ].exclude_cookies).to eq(false)
-                expect(sorted_sensors[ 0 ].exclusions).to eq({})
-                expect(sorted_sensors[ 0 ].active_pattern_ids).to eq(Set.new)
-                expect(sorted_sensors[ 0 ].v1_compatability_enabled).to eq(true)
-                expect(sorted_sensors[ 0 ].excluded_route_ids).to eq(Set.new)
-                expect(sorted_sensors[ 1 ].enabled).to eq(true)
-                expect(sorted_sensors[ 1 ].libinjection).to eq(false)
-                expect(sorted_sensors[ 1 ].detection_point).to eq("xss")
-                expect(sorted_sensors[ 1 ].exclude_headers).to eq(false)
-                expect(sorted_sensors[ 1 ].exclude_forms).to eq(false)
-                expect(sorted_sensors[ 1 ].exclude_cookies).to eq(false)
-                expect(sorted_sensors[ 1 ].exclusions).to eq({})
-                expect(sorted_sensors[ 1 ].active_pattern_ids).to eq(Set.new)
-                expect(sorted_sensors[ 1 ].v1_compatability_enabled).to eq(true)
-                expect(sorted_sensors[ 1 ].excluded_route_ids).to eq(Set.new)
-              end
-            end
-
-            context "both disabled" do
-              it "should create no sensors and be disabled" do
-                sensors_json = {
-                  "options" => {
-                    "sqli" => false,
-                    "xss" => false
-                  }
-                }
-
-                injection_matcher = InjectionsMatcher.from_json(1, sensors_json)
-
-                expect(injection_matcher.enabled).to eq(false)
-                expect(injection_matcher.sensors.size).to eq(0)
-              end
-
-            end
-          end
-
-          context "with resp_codes sensor enabled" do
-            it "should create no sensors" do
-              sensors_json = {
-                "options" => {
-                  "resp_codes" => true
-                }
-              }
-
-              injection_matcher = InjectionsMatcher.from_json(1, sensors_json)
-
-              expect(injection_matcher.enabled).to eq(false)
-              expect(injection_matcher.sensors).to eq([])
-            end
-          end
-        end
-
-        context "with v2 sensors config" do
-          context "with a sensor config that's not an injection sensor" do
-            it "should ignore the sensor config" do
-              sensors_json = {
-                "req_size" => {
-                    "limit" => 1024,
-                    "exclude_routes" => ["2300"]
-                }
-              }
-
-              injection_matcher = InjectionsMatcher.from_json(2, sensors_json)
-
-              expect(injection_matcher.enabled).to eq(false)
-              expect(injection_matcher.sensors.size).to eq(0)
-            end
-          end
-
-          context "with a disabled sensor config" do
-            it "should create no sensors and be disabled" do
-              sensors_json = {
-                "xss" => {
-                  "enabled" => false,
-                  "libinjection" => true,
-                  "patterns" => ["1","2","8"],
-                  "exclusions" => {
-                      "bob" => ["*"]
-                  }
-                }
-              }
-
-              injection_matcher = InjectionsMatcher.from_json(2, sensors_json)
-
-              expect(injection_matcher.enabled).to eq(false)
-              expect(injection_matcher.sensors.size).to eq(0)
-            end
-          end
-
-          context "with one sensor config" do
-            it "should create one sensor" do
-              sensors_json = {
-                "xss" => {
-                  "libinjection" => true,
-                  "patterns" => ["1","2","8"],
-                  "exclusions" => {
-                      "bob" => ["*"]
-                  }
-                }
-              }
-
-              injection_matcher = InjectionsMatcher.from_json(2, sensors_json)
-
-              expect(injection_matcher.enabled).to eq(true)
-              expect(injection_matcher.sensors.size).to eq(1)
-              expect(injection_matcher.sensors[0].enabled).to eq(true)
-              expect(injection_matcher.sensors[0].detection_point).to eq("xss")
-              expect(injection_matcher.sensors[0].exclude_headers).to eq(false)
-              expect(injection_matcher.sensors[0].exclude_forms).to eq(false)
-              expect(injection_matcher.sensors[0].exclude_cookies).to eq(false)
-              expect(injection_matcher.sensors[0].exclusions).to eq({"bob" => Set.new(["*"])})
-              expect(injection_matcher.sensors[0].active_pattern_ids).to eq(Set.new(["1", "2", "8"]))
-              expect(injection_matcher.sensors[0].v1_compatability_enabled).to eq(false)
-              expect(injection_matcher.sensors[0].excluded_route_ids).to eq(Set.new)
-            end
-          end
-
-          context "with two sensor configs" do
-            context "one enabled and one disabled" do
-              it "should create one sensor" do
-                sensors_json = {
-                  "sqli" => {
-                    "enabled" => false,
-                    "libinjection" => true,
-                    "patterns" => ["1","2","8"],
-                    "exclusions" => {
-                        "bob" => ["*"]
-                    }
-                  },
-                  "xss" => {
-                    "libinjection" => true,
-                    "patterns" => ["1","2","8"],
-                    "exclusions" => {
-                        "bob" => ["*"]
-                    }
-                  }
-                }
-
-                injection_matcher = InjectionsMatcher.from_json(2, sensors_json)
-
-                expect(injection_matcher.enabled).to eq(true)
-                expect(injection_matcher.sensors.size).to eq(1)
-                expect(injection_matcher.sensors[0].enabled).to eq(true)
-                expect(injection_matcher.sensors[0].detection_point).to eq("xss")
-                expect(injection_matcher.sensors[0].exclude_headers).to eq(false)
-                expect(injection_matcher.sensors[0].exclude_forms).to eq(false)
-                expect(injection_matcher.sensors[0].exclude_cookies).to eq(false)
-                expect(injection_matcher.sensors[0].exclusions).to eq({"bob" => Set.new(["*"])})
-                expect(injection_matcher.sensors[0].active_pattern_ids).to eq(Set.new(["1", "2", "8"]))
-                expect(injection_matcher.sensors[0].v1_compatability_enabled).to eq(false)
-                expect(injection_matcher.sensors[0].excluded_route_ids).to eq(Set.new)
-              end
-            end
-
-            context "both disabled" do
-              it "should create no sensors and be disabled" do
-                sensors_json = {
-                  "sqli" => {
-                    "enabled" => false,
-                    "libinjection" => true,
-                    "patterns" => ["1","2","8"],
-                    "exclusions" => {
-                        "bob" => ["*"]
-                    }
-                  },
-                  "xss" => {
-                    "enabled" => false,
-                    "libinjection" => true,
-                    "patterns" => ["1","2","8"],
-                    "exclusions" => {
-                        "bob" => ["*"]
-                    }
-                  }
-                }
-
-                injection_matcher = InjectionsMatcher.from_json(2, sensors_json)
-
-                expect(injection_matcher.enabled).to eq(false)
-                expect(injection_matcher.sensors.size).to eq(0)
-              end
-            end
-
-            context "both enabled" do
-              it "should create two sensors" do
-                sensors_json = {
-                  "sqli" => {
-                    "libinjection" => true,
-                    "patterns" => ["1","2","8"],
-                    "exclusions" => {
-                        "bob" => ["*"]
-                    }
-                  },
-                  "xss" => {
-                    "libinjection" => true,
-                    "patterns" => ["3","4","5"],
-                    "exclusions" => {
-                        "bob" => ["*"]
-                    }
-                  }
-                }
-
-                injection_matcher = InjectionsMatcher.from_json(2, sensors_json)
-
-                sorted_sensors = injection_matcher.sensors.sort { |a,b| a.detection_point <=> b.detection_point }
-
-                expect(injection_matcher.enabled).to eq(true)
-                expect(injection_matcher.sensors.size).to eq(2)
-                expect(sorted_sensors[0].enabled).to eq(true)
-                expect(sorted_sensors[0].detection_point).to eq("sqli")
-                expect(sorted_sensors[0].exclude_headers).to eq(false)
-                expect(sorted_sensors[0].exclude_forms).to eq(false)
-                expect(sorted_sensors[0].exclude_cookies).to eq(false)
-                expect(sorted_sensors[0].exclusions).to eq({"bob" => Set.new(["*"])})
-                expect(sorted_sensors[0].active_pattern_ids).to eq(Set.new(["1", "2", "8"]))
-                expect(sorted_sensors[0].v1_compatability_enabled).to eq(false)
-                expect(sorted_sensors[0].excluded_route_ids).to eq(Set.new)
-                expect(sorted_sensors[1].enabled).to eq(true)
-                expect(sorted_sensors[1].detection_point).to eq("xss")
-                expect(sorted_sensors[1].exclude_headers).to eq(false)
-                expect(sorted_sensors[1].exclude_forms).to eq(false)
-                expect(sorted_sensors[1].exclude_cookies).to eq(false)
-                expect(sorted_sensors[1].exclusions).to eq({"bob" => Set.new(["*"])})
-                expect(sorted_sensors[1].active_pattern_ids).to eq(Set.new(["3", "4", "5"]))
-                expect(sorted_sensors[1].v1_compatability_enabled).to eq(false)
-                expect(sorted_sensors[1].excluded_route_ids).to eq(Set.new)
-              end
-            end
-          end
-
-        end
-      end
-
-      describe "#check_param_for_injections" do
-        before(:each) do
-          @meta_data = TCellAgent::AppSensor::MetaData.new(
-            "get",
-            "remote_address",
-            "route_id",
-            "session_id",
-            "user_id",
-            "transaction_id")
-        end
-
-        context "with no sensors" do
-          it "should not find any injections" do
-            injection_matcher = InjectionsMatcher.new([])
-
-            result = injection_matcher.check_param_for_injections(
-              InjectionsMatcher::URI_PARAM, @meta_data, "dirty", "<script></script>"
-            )
-
-            expect(result).to eq(nil)
-          end
-        end
-
-        context "with one sensors that finds an injection" do
-          it "should return the injection attempt" do
-            fake_sensor = double("fake_sensor")
-
-            injection_matcher = InjectionsMatcher.new([fake_sensor])
-
-            expect(fake_sensor).to receive(:applicable_for_param_type?).with(
-              InjectionsMatcher::URI_PARAM
-            ).and_return(true)
-            expect(fake_sensor).to receive(:get_injection_attempt).with(
-              InjectionsMatcher::URI_PARAM, @meta_data, "dirty", "<script></script>"
-            ).and_return({"injection" => true})
-
-            result = injection_matcher.check_param_for_injections(
-              InjectionsMatcher::URI_PARAM, @meta_data, "dirty", "<script></script>"
-            )
-
-            expect(result).to eq({"injection" => true})
-          end
-        end
-      end
-
-      describe "#each_injection" do
-        context "with appsensor meta data" do
-          context "with one param of each type" do
-            it "should call check_param_for_injections once for each param" do
-              meta_data = TCellAgent::SensorEvents::AppSensorMetaEvent.new(
-                "get",
-                "remote_address",
-                "route_id",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              meta_data.get_dict = {"get_param" => "get_value"}
-              # post dict for appsensor meta data gets flatten before being enqueued
-              meta_data.post_dict = TCellAgent::Utils::Params.flatten({"post_param" => "post_value"})
-              meta_data.body_dict = TCellAgent::Utils::Params.flatten({"body_param" => "body_value"})
-              meta_data.cookie_dict = {"cookie_param" => "cookie_value"}
-              meta_data.path_parameters = {"path_param" => "path_value"}
-
-              uri_injection = double("uri_injection")
-              get_injection = double("get_injection")
-              post_injection = double("post_injection")
-              json_injection = double("json_injection")
-              cookie_injection = double("cookie_injection")
-
-              injections_matcher = InjectionsMatcher.new([double("fake_sensor")])
-
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::URI_PARAM, meta_data, "path_param", "path_value"
-              ).and_return(uri_injection)
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::GET_PARAM, meta_data, "get_param", "get_value"
-              ).and_return(get_injection)
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::POST_PARAM, meta_data, "post_param", "post_value"
-              ).and_return(post_injection)
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::JSON_PARAM, meta_data, "body_param", "body_value"
-              ).and_return(json_injection)
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::COOKIE_PARAM, meta_data, "cookie_param", "cookie_value"
-              ).and_return(cookie_injection)
-
-              injection_attempts = []
-              injections_matcher.each_injection(meta_data) do |injection_attempt|
-                injection_attempts.push(injection_attempt)
-              end
-
-              expect(injection_attempts.size).to eq(5)
-              expect(injection_attempts).to eq(
-                [uri_injection, get_injection, post_injection, json_injection, cookie_injection]
-              )
-            end
-          end
-        end
-
-        context "with patches meta data" do
-          context "with one param of each type" do
-            it "should call check_param_for_injections once for each param" do
-              meta_data = TCellAgent::Patches::MetaData.new(
-                "get",
-                "remote_address",
-                "route_id",
-                "session_id",
-                "user_id",
-                "transaction_id")
-              meta_data.get_dict = {"get_param" => "get_value"}
-              meta_data.post_dict = {"post_param" => "post_value"}
-              meta_data.body_dict = TCellAgent::Utils::Params.flatten({"body_param" => "body_value"})
-              meta_data.cookie_dict = {"cookie_param" => "cookie_value"}
-              meta_data.path_parameters = {"path_param" => "path_value"}
-
-              uri_injection = double("uri_injection")
-              get_injection = double("get_injection")
-              post_injection = double("post_injection")
-              json_injection = double("json_injection")
-              cookie_injection = double("cookie_injection")
-
-              injections_matcher = InjectionsMatcher.new([double("fake_sensor")])
-
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::URI_PARAM, meta_data, "path_param", "path_value"
-              ).and_return(uri_injection)
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::GET_PARAM, meta_data, "get_param", "get_value"
-              ).and_return(get_injection)
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::POST_PARAM, meta_data, "post_param", "post_value"
-              ).and_return(post_injection)
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::JSON_PARAM, meta_data, "body_param", "body_value"
-              ).and_return(json_injection)
-              expect(injections_matcher).to receive(:check_param_for_injections).with(
-                InjectionsMatcher::COOKIE_PARAM, meta_data, "cookie_param", "cookie_value"
-              ).and_return(cookie_injection)
-
-              injection_attempts = []
-              injections_matcher.each_injection(meta_data) do |injection_attempt|
-                injection_attempts.push(injection_attempt)
-              end
-
-              expect(injection_attempts.size).to eq(5)
-              expect(injection_attempts).to eq(
-                [uri_injection, get_injection, post_injection, json_injection, cookie_injection]
-              )
-            end
-          end
-
-        end
-      end
-    end
-
-  end
-end

data/spec/lib/tcell_agent/appsensor/rules/appsensor_rule_manager_spec.rb

@@ -1,23 +0,0 @@
-require 'spec_helper'
-
-module TCellAgent
-
-  describe AppSensorRuleManager do
-    after(:each) do
-      # since rule manager is a singleton, load default rules so rest of the specs work properly
-      AppSensorRuleManager.instance.load_default_rules_file
-    end
-
-    describe "#load_rules_file" do
-      context "with nonexistent file" do
-        it "should do nothing" do
-          rule_manager = AppSensorRuleManager.instance
-          rule_manager.load_rules_file("non-existent-file.json")
-
-          expect(rule_manager.rule_info.empty?).to eq(true)
-        end
-      end
-    end
-  end
-
-end