tcell_agent 0.4.0 → 1.0.0

data/spec/lib/tcell_agent/appsensor/rules/appsensor_rule_set_spec.rb

@@ -1,159 +0,0 @@
-require 'spec_helper'
-
-module TCellAgent
-
-  describe AppSensorRuleSet do
-
-    describe "#add_pattern_from_dict" do
-      context "adding from nil dict" do
-        it "should do nothing" do
-          rule_set = AppSensorRuleSet.new
-          rule_set.add_pattern_from_dict(nil)
-          expect(rule_set.safe_pattern).to eq(nil)
-          expect(rule_set.patterns).to eq([])
-        end
-      end
-
-      context "adding from empty dict" do
-        it "should do nothing" do
-          rule_set = AppSensorRuleSet.new
-          rule_set.add_pattern_from_dict({})
-          expect(rule_set.safe_pattern).to eq(nil)
-          expect(rule_set.patterns).to eq([])
-        end
-      end
-
-      context "adding a ruby pattern" do
-        it "should add the pattern" do
-          rule_set = AppSensorRuleSet.new
-          rule_set.add_pattern_from_dict({
-            "id" => "1",
-            "common" => "<(iframe)",
-            "ruby" => "<(script)"
-          })
-
-          expect(rule_set.safe_pattern).to eq(nil)
-          expect(rule_set.patterns.size).to eq(1)
-
-          arp = rule_set.patterns[0]
-          expect(arp.enabled).to eq(true)
-          expect(arp.pattern_id).to eq("1")
-          expect(arp.pattern_regex).to_not eq(nil)
-          expect("<script".match(arp.pattern_regex).captures).to eq(["script"])
-        end
-      end
-
-      context "adding a common pattern" do
-        it "should add the pattern" do
-          rule_set = AppSensorRuleSet.new
-          rule_set.add_pattern_from_dict({
-            "id" => "1",
-            "common" => "<(script|iframe|embed|frame|frameset|object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound)"
-          })
-
-          expect(rule_set.safe_pattern).to eq(nil)
-          expect(rule_set.patterns.size).to eq(1)
-
-          arp = rule_set.patterns[0]
-          expect(arp.enabled).to eq(true)
-          expect(arp.pattern_id).to eq("1")
-          expect(arp.pattern_regex).to_not eq(nil)
-          expect("<script".match(arp.pattern_regex).captures).to eq(["script"])
-        end
-      end
-    end
-
-    describe "#set_safe_pattern_from_string" do
-      it "should set the safe pattern" do
-        rule_set = AppSensorRuleSet.new
-        rule_set.set_safe_pattern_from_string("^[a-zA-Z0-9_\s\r\n\t]*$")
-
-        expect(rule_set.safe_pattern).to eq(Regexp.new("^[a-zA-Z0-9_\s\r\n\t]*$"))
-        expect(rule_set.patterns.size).to eq(0)
-      end
-    end
-
-    describe "#check_violation" do
-      before(:each) do
-        @rule_set = AppSensorRuleSet.new
-        @rule_set.set_safe_pattern_from_string("super_safe")
-        @rule_set.add_pattern_from_dict({
-          "id" => "1",
-          "common" => "<(script)"
-        })
-        @rule_set.add_pattern_from_dict({
-          "id" => "2",
-          "common" => "<(iframe)"
-        })
-      end
-
-      context "param value is nil" do
-        it "should return nil" do
-          expect(@rule_set.check_violation(nil, nil, Set.new, true)).to eq(nil)
-        end
-      end
-
-      context "param value is empty" do
-        it "should return nil" do
-          expect(@rule_set.check_violation(nil, nil, Set.new, true)).to eq(nil)
-        end
-      end
-
-      context "param value is present" do
-        context "param value matches safe pattern" do
-          it "should return nil" do
-            expect(@rule_set.check_violation("param_name", "super_safe", Set.new, true)).to eq(nil)
-          end
-        end
-
-        context "param value does not match anything" do
-          it "should return nil" do
-            expect(@rule_set.check_violation("param_name", "weeee", Set.new, true)).to eq(nil)
-          end
-        end
-
-        context "param value matches a pattern" do
-          it "should return the match" do
-            match_data = @rule_set.check_violation("param_name", "evil <script>", Set.new, true)
-            expect(match_data).to eq({"param"=>"param_name", "value"=>"evil <script>", "pattern"=>"1"})
-          end
-
-          context "uppercasing param value still matches pattern" do
-            it "should return the match" do
-              match_data = @rule_set.check_violation("param_name", "evil <SCRIPT>", Set.new, true)
-              expect(match_data).to eq({"param"=>"param_name", "value"=>"evil <SCRIPT>", "pattern"=>"1"})
-            end
-          end
-        end
-
-        context "v1_compatability is off" do
-          context "all patterns are disabled" do
-            context "param value contains evil pattern" do
-              it "should return nil" do
-                match_data = @rule_set.check_violation("param_name", "evil <script>", Set.new, false)
-                expect(match_data).to eq(nil)
-              end
-            end
-          end
-
-          context "one pattern is disabled" do
-            context "evil param_value matches disabled pattern" do
-              it "should return nil" do
-                match_data = @rule_set.check_violation("param_name", "evil <script>", Set.new(["2"]), false)
-                expect(match_data).to eq(nil)
-              end
-            end
-
-            context "evil param_value matches enabled pattern" do
-              it "should return the match" do
-                match_data = @rule_set.check_violation("param_name", "evil <iframe>", Set.new(["2"]), false)
-                expect(match_data).to eq({"param"=>"param_name", "value"=>"evil <iframe>", "pattern"=>"2"})
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-
-end

data/spec/lib/tcell_agent/patches/block_rule_spec.rb

@@ -1,458 +0,0 @@
-require 'spec_helper'
-
-module TCellAgent
-  module Patches
-
-    describe "BlockRule" do
-
-      describe ".from_json" do
-        context "empty action provided" do
-          it "should return nil" do
-            logger = double("logger")
-            expect(TCellAgent).to receive(:logger).and_return(logger)
-            expect(logger).to receive(:error).with("Patches Policy action not supported: ")
-
-            expect(BlockRule.from_json({"action" => nil})).to eq(nil)
-          end
-        end
-
-        context "unknown action provided" do
-          it "should return nil" do
-            logger = double("logger")
-            expect(TCellAgent).to receive(:logger).and_return(logger)
-            expect(logger).to receive(:error).with("Patches Policy action not supported: bogus")
-
-            expect(BlockRule.from_json({"action" => "bogus"})).to eq(nil)
-          end
-        end
-
-        context "with no ips or rids provided" do
-          it "should return nil" do
-            logger = double("logger")
-            expect(TCellAgent).to receive(:logger).and_return(logger)
-            expect(logger).to receive(:error).with("Patches Policy block rule cannot be global. Specify either ips and/or route ids or blocked paths")
-
-            expect(BlockRule.from_json({"action" => "block_403s"})).to eq(nil)
-          end
-        end
-
-        context "with all the fields provided" do
-          it "should create a block rule properly" do
-            policy_json = {
-              "ips" => ["1.1.1.1", "1.3.3.3"],
-              "rids" => ["1396482959514716287","1396482959514716237"],
-              "paths" => [{"exact" => "/index/"}, {"starts_with" => "/admin"}],
-              "sensor_matches" => {
-                "xss" => {}
-              },
-              "action" => "block_403s"
-            }
-
-            block_rule = BlockRule.from_json(policy_json)
-
-            expect(block_rule.ips).to eq(Set.new(["1.1.1.1", "1.3.3.3"]))
-            expect(block_rule.rids).to eq(Set.new(["1396482959514716287", "1396482959514716237"]))
-            expect(block_rule.action).to eq("block_403s")
-            expect(block_rule.sensors_matcher.injections_matcher.enabled).to eq(true)
-            expect(block_rule.sensors_matcher.injections_matcher.sensors.size).to eq(1)
-            expect(block_rule.sensors_matcher.injections_matcher.sensors[0].active_pattern_ids).to eq(Set.new)
-            expect(block_rule.exact_blocked_paths).to eq(Set.new(["/index", "/index/"]))
-            expect(block_rule.starts_with_blocked_paths).to eq(["/admin"])
-          end
-        end
-      end
-
-      describe "#block?" do
-
-        context "with empty ips" do
-          context "with empty rids" do
-            # from_json prevents this case
-          end
-
-          context "with an rid" do
-            context "that matches the request" do
-              before(:each) do
-                @meta_data = TCellAgent::Patches::MetaData.new(
-                  "get",
-                  "1.1.1.1",
-                  "route_id",
-                  "session_id",
-                  "user_id",
-                  "transaction_id")
-              end
-
-              context "with empty sensors" do
-                it "should return true" do
-                  injections_matcher = double("injections_matcher")
-
-                  block_rule = BlockRule.new(
-                    Set.new,
-                    Set.new(["route_id"]),
-                    SensorsMatcher.new(injections_matcher),
-                    "block_403s",
-                    Set.new,
-                    []
-                  )
-
-                  expect(injections_matcher).to receive(:enabled).and_return(false)
-
-                  expect(block_rule.block?(@meta_data)).to eq(true)
-                end
-              end
-
-              context "with sensors" do
-                context "that don't have a match" do
-                  it "should return false" do
-                    injections_matcher = double("injections_matcher")
-
-                    block_rule = BlockRule.new(
-                      Set.new,
-                      Set.new(["route_id"]),
-                      SensorsMatcher.new(injections_matcher),
-                      "block_403s",
-                      Set.new,
-                      []
-                    )
-
-                    expect(injections_matcher).to receive(:enabled).and_return(true)
-                    expect(injections_matcher).to receive(:each_injection)
-
-                    expect(block_rule.block?(@meta_data)).to eq(false)
-                  end
-                end
-
-                context "that have a match" do
-                  it "should return true" do
-                    injections_matcher = double("injections_matcher")
-
-                    block_rule = BlockRule.new(
-                      Set.new,
-                      Set.new(["route_id"]),
-                      SensorsMatcher.new(injections_matcher),
-                      "block_403s",
-                      Set.new,
-                      []
-                    )
-
-                    expect(injections_matcher).to receive(:enabled).and_return(true)
-                    expect(injections_matcher).to receive(:each_injection) do |md, &block|
-                      block.call(double("injection_attempt"))
-                    end
-
-                    expect(block_rule.block?(@meta_data)).to eq(true)
-                  end
-                end
-              end
-            end
-
-            context "that does not match the request" do
-              before(:each) do
-                @meta_data = TCellAgent::Patches::MetaData.new(
-                  "get",
-                  "1.1.1.1",
-                  "non_matching_route_id",
-                  "session_id",
-                  "user_id",
-                  "transaction_id")
-              end
-
-              context "with empty sensors" do
-                it "should return false" do
-                  injections_matcher = double("injections_matcher")
-
-                  block_rule = BlockRule.new(
-                    Set.new,
-                    Set.new(["route_id"]),
-                    SensorsMatcher.new(injections_matcher),
-                    "block_403s",
-                    Set.new,
-                    []
-                  )
-
-                  expect(injections_matcher).to_not receive(:enabled)
-
-                  expect(block_rule.block?(@meta_data)).to eq(false)
-                end
-              end
-
-              context "with sensors" do
-                context "that don't have a match" do
-                  it "should return false" do
-                    injections_matcher = double("injections_matcher")
-
-                    block_rule = BlockRule.new(
-                      Set.new,
-                      Set.new(["route_id"]),
-                      SensorsMatcher.new(injections_matcher),
-                      "block_403s",
-                      Set.new,
-                      []
-                    )
-
-                    expect(injections_matcher).to_not receive(:enabled)
-
-                    expect(block_rule.block?(@meta_data)).to eq(false)
-                  end
-                end
-
-                context "that have a match" do
-                  it "should return false" do
-                    injections_matcher = double("injections_matcher")
-
-                    block_rule = BlockRule.new(
-                      Set.new,
-                      Set.new(["route_id"]),
-                      SensorsMatcher.new(injections_matcher),
-                      "block_403s",
-                      Set.new,
-                      []
-                    )
-
-                    expect(injections_matcher).to_not receive(:enabled)
-
-                    expect(block_rule.block?(@meta_data)).to eq(false)
-                  end
-                end
-              end
-            end
-          end
-        end
-
-        context "with ips" do
-          before(:each) do
-            @meta_data = TCellAgent::Patches::MetaData.new(
-              "get",
-              "1.1.1.1",
-              "route_id",
-              "session_id",
-              "user_id",
-              "transaction_id")
-          end
-
-          context "that does not match the request" do
-            it "should return false" do
-              injections_matcher = double("injections_matcher")
-
-              block_rule = BlockRule.new(
-                Set.new(["2.2.2.2"]),
-                Set.new(["route_id"]),
-                SensorsMatcher.new(injections_matcher),
-                "block_403s",
-                Set.new,
-                []
-              )
-
-              expect(injections_matcher).to_not receive(:enabled)
-
-              expect(block_rule.block?(@meta_data)).to eq(false)
-            end
-          end
-
-          context "that matches the request" do
-            context "with an rid" do
-              context "that matches the request" do
-                context "with empty sensors" do
-                  it "should return true" do
-                    injections_matcher = double("injections_matcher")
-
-                    block_rule = BlockRule.new(
-                      Set.new(["1.1.1.1"]),
-                      Set.new(["route_id"]),
-                      SensorsMatcher.new(injections_matcher),
-                      "block_403s",
-                      Set.new,
-                      []
-                    )
-
-                    expect(injections_matcher).to receive(:enabled).and_return(false)
-
-                    expect(block_rule.block?(@meta_data)).to eq(true)
-                  end
-                end
-
-                context "with sensors" do
-                  context "that don't have a match" do
-                    it "should return false" do
-                      injections_matcher = double("injections_matcher")
-
-                      block_rule = BlockRule.new(
-                        Set.new(["1.1.1.1"]),
-                        Set.new(["route_id"]),
-                        SensorsMatcher.new(injections_matcher),
-                        "block_403s",
-                        Set.new,
-                        []
-                      )
-
-                      expect(injections_matcher).to receive(:enabled).and_return(true)
-                      expect(injections_matcher).to receive(:each_injection)
-
-                      expect(block_rule.block?(@meta_data)).to eq(false)
-                    end
-                  end
-
-                  context "that have a match" do
-                    it "should return true" do
-                      injections_matcher = double("injections_matcher")
-
-                      block_rule = BlockRule.new(
-                        Set.new(["1.1.1.1"]),
-                        Set.new(["route_id"]),
-                        SensorsMatcher.new(injections_matcher),
-                        "block_403s",
-                        Set.new,
-                        []
-                      )
-
-                      expect(injections_matcher).to receive(:enabled).and_return(true)
-                      expect(injections_matcher).to receive(:each_injection) do |md, &block|
-                        block.call(double("injection_attempt"))
-                      end
-
-                      expect(block_rule.block?(@meta_data)).to eq(true)
-                    end
-                  end
-                end
-              end
-
-              context "that does not match the request" do
-                before(:each) do
-                  @meta_data.route_id = "non_matching_route_id"
-                end
-                context "with empty sensors" do
-                  it "should return false" do
-                    injections_matcher = double("injections_matcher")
-
-                    block_rule = BlockRule.new(
-                      Set.new(["1.1.1.1"]),
-                      Set.new(["route_id"]),
-                      SensorsMatcher.new(injections_matcher),
-                      "block_403s",
-                      Set.new,
-                      []
-                    )
-
-                    expect(injections_matcher).to_not receive(:enabled)
-
-                    expect(block_rule.block?(@meta_data)).to eq(false)
-                  end
-                end
-
-                context "with sensors" do
-                  context "that don't have a match" do
-                    it "should return false" do
-                      injections_matcher = double("injections_matcher")
-
-                      block_rule = BlockRule.new(
-                        Set.new(["1.1.1.1"]),
-                        Set.new(["route_id"]),
-                        SensorsMatcher.new(injections_matcher),
-                        "block_403s",
-                        Set.new,
-                        []
-                      )
-
-                      expect(injections_matcher).to_not receive(:enabled)
-
-                      expect(block_rule.block?(@meta_data)).to eq(false)
-                    end
-                  end
-
-                  context "that have a match" do
-                    it "should return false" do
-                      injections_matcher = double("injections_matcher")
-
-                      block_rule = BlockRule.new(
-                        Set.new(["1.1.1.1"]),
-                        Set.new(["route_id"]),
-                        SensorsMatcher.new(injections_matcher),
-                        "block_403s",
-                        Set.new,
-                        []
-                      )
-
-                      expect(injections_matcher).to_not receive(:enabled)
-
-                      expect(block_rule.block?(@meta_data)).to eq(false)
-                    end
-                  end
-                end
-              end
-            end
-          end
-        end
-
-        context "with blocked paths" do
-          before(:each) do
-            @meta_data = TCellAgent::Patches::MetaData.new(
-              "get",
-              "1.1.1.1",
-              "route_id",
-              "session_id",
-              "user_id",
-              "transaction_id")
-          end
-
-          context "without ips" do
-            context "matching paths" do
-              it "should block" do
-                injections_matcher = double("injections_matcher")
-
-                block_rule = BlockRule.new(
-                  Set.new(["1.1.1.1"]),
-                  Set.new(["route_id"]),
-                  SensorsMatcher.new(injections_matcher),
-                  "block_403s",
-                  Set.new(["/index", "/index/"]),
-                  ["/admin"]
-                )
-
-                expect(injections_matcher).to_not receive(:enabled)
-
-                @meta_data.path = "/index"
-                expect(block_rule.block?(@meta_data)).to eq(true)
-
-                @meta_data.path = "/index/"
-                expect(block_rule.block?(@meta_data)).to eq(true)
-
-                @meta_data.path = "/admin"
-                expect(block_rule.block?(@meta_data)).to eq(true)
-
-                @meta_data.path = "/admin/users"
-                expect(block_rule.block?(@meta_data)).to eq(true)
-              end
-            end
-
-            context "not matching blocking paths" do
-              it "should not block" do
-                injections_matcher = double("injections_matcher")
-
-                block_rule = BlockRule.new(
-                  Set.new(["1.1.1.1"]),
-                  Set.new(["route_id"]),
-                  SensorsMatcher.new(injections_matcher),
-                  "block_403s",
-                  Set.new(["/index", "/index/"]),
-                  ["/admin"]
-                )
-
-                expect(injections_matcher).to_not receive(:enabled)
-
-                @meta_data.path = "/index/subpath"
-                expect(block_rule.block?(@meta_data)).to eq(false)
-
-                @meta_data.path = "/welcome"
-                expect(block_rule.block?(@meta_data)).to eq(false)
-
-                @meta_data.path = "/welcome/"
-                expect(block_rule.block?(@meta_data)).to eq(false)
-              end
-            end
-          end
-        end
-      end
-
-    end
-
-  end
-end

data/spec/lib/tcell_agent/patches/sensors_matcher_spec.rb

@@ -1,35 +0,0 @@
-require 'spec_helper'
-
-module TCellAgent
-  module Patches
-
-    describe "SensorsMatcher" do
-      describe ".from_json" do
-        context "with all the fields provided" do
-          it "should create a sensor matcher properly" do
-            sensor_matcher_json = {
-              "xss" => {
-                "libinjection" => true,
-                "exclude_cookies" => false,
-                "exclude_forms" => false,
-                "exclusions" => {"generic" => ["form", "cookies"]},
-                "patterns" => ["1", "2"]
-              }
-            }
-
-            sensor_matcher = SensorsMatcher.from_json(sensor_matcher_json)
-
-            sorted_sensors = sensor_matcher.injections_matcher.sensors.sort
-
-            expect(sorted_sensors.size).to eq(1)
-            expect(sorted_sensors[0].libinjection).to eq(true)
-            expect(sorted_sensors[0].exclude_cookies).to eq(false)
-            expect(sorted_sensors[0].exclude_forms).to eq(false)
-            expect(sorted_sensors[0].exclusions).to eq({"generic" => Set.new(["form", "cookies"])})
-          end
-        end
-      end
-    end
-
-  end
-end