tcell_agent 1.1.12 → 2.0.0

data/lib/tcell_agent/utils/headers.rb

@@ -0,0 +1,14 @@
+
+module TCellAgent
+  module Utils
+    module Headers
+      def self.clean_keys(request_env_or_header_keys)
+        if request_env_or_header_keys.is_a?(Hash)
+          request_env_or_header_keys.select { |k, _v| k.start_with? 'HTTP_' }.collect { |k, _v| k.sub(/^HTTP_/, '') }
+        else
+          request_env_or_header_keys.map { |k| k.sub(/^HTTP_/, '') }
+        end
+      end
+    end
+  end
+end

data/lib/tcell_agent/version.rb

@@ -1,5 +1,5 @@
 # See the file "LICENSE" for the full license governing this code.
 
 module TCellAgent
-  VERSION = '1.1.12'.freeze
+  VERSION = '2.0.0'.freeze
 end

data/spec/lib/tcell_agent/cmdi_spec.rb

@@ -148,589 +148,4 @@ module TCellAgent
       end
     end
   end
-
-  describe IO do
-    describe '.popen' do
-      before(:each) do
-        configuration = double(
-          'configuration',
-          {
-            'app_id' => 'app_id',
-            'api_key' => 'api_key',
-            'allow_payloads' => true,
-            'js_agent_api_base_url' => 'http://api.tcell.com/',
-            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
-            'max_csp_header_bytes' => nil,
-            'event_time_limit_seconds' => 15,
-            'event_batch_size_limit' => 50,
-            'preload_policy_filename' => nil,
-            'cache_filename_with_app_id' => '/tcellagent_src/tcell/cache/tcell_agent.cache',
-            'agent_home_owner' => nil
-          }
-        )
-        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-        @rust_policies = TCellAgent::Policies::RustPolicies.new
-      end
-
-      context 'empty command' do
-        it 'should raise an error' do
-          expect do
-            IO.popen
-          end.to raise_error(ArgumentError)
-          expect do
-            IO.popen(nil)
-          end.to raise_error(TypeError)
-          expect do
-            IO.popen('')
-          end.to raise_error(Errno::ENOENT)
-        end
-      end
-
-      context 'non existent command' do
-        it 'should return nil' do
-          expect do
-            IO.popen('foobar')
-          end.to raise_error(Errno::ENOENT)
-        end
-      end
-
-      context 'with a valid command' do
-        it 'should execute command' do
-          expect(IO.popen('echo test').read.chomp).to eq('test')
-        end
-      end
-
-      context 'with a non blocked command present' do
-        context 'with no command injection' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(nil)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:cmdi_enabled)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:block_command?)
-
-            IO.popen('echo test')
-          end
-        end
-
-        context 'with command injection disabled' do
-          it 'should execute the command' do
-            expect(@rust_policies.cmdi_enabled).to eq(false)
-
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_call_original
-            expect(@rust_policies).to_not receive(:block_command?)
-
-            IO.popen('echo test')
-          end
-        end
-
-        context 'with command injection enabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
-
-            IO.popen('echo test')
-          end
-        end
-      end
-
-      context 'with a blocked command present' do
-        context 'with command injection enabled' do
-          it 'should raise a Errno::ENOENT' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
-
-            expect do
-              IO.popen('echo test')
-            end.to raise_error(Errno::ENOENT)
-          end
-        end
-      end
-
-      context 'with env' do
-        before(:each) do
-          @env = { 'TCELL_VAR' => 'enabled' }
-        end
-
-        context 'with string command' do
-          it 'should execute the command' do
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo')
-            IO.popen(@env, 'echo', 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo')
-            IO.popen(@env, 'echo', 'w+', :unsetenv_others => true)
-          end
-        end
-
-        context 'with string command and arguments' do
-          it 'should parse the command' do
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, 'echo test')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, 'echo test', 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, 'echo test', :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, 'echo test', 'w+', :unsetenv_others => true)
-          end
-        end
-
-        context 'with array command' do
-          it 'should parse the command properly' do
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo')
-            IO.popen(@env, [%w[echo argv0]], 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo')
-            IO.popen(@env, [%w[echo argv0]], :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo')
-            IO.popen(@env, [%w[echo argv0]], 'w+', :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo')
-            IO.popen(@env, ['echo'], 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo')
-            IO.popen(@env, ['echo'], :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo')
-            IO.popen(@env, ['echo'], 'w+', :unsetenv_others => true)
-          end
-        end
-
-        context 'with array command and arguments' do
-          it 'should parse the command properly' do
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, [%w[echo argv0], 'test'])
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, [%w[echo argv0], 'test'], 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, [%w[echo argv0], 'test'], :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, [%w[echo argv0], 'test'], 'w+', :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, %w[echo test])
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, %w[echo test], 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, %w[echo test], :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, %w[echo test], 'w+', :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen([@env, 'echo', 'test', :unsetenv_others => true], 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(@env, [@env, 'echo', 'test', :unsetenv_others => true], 'w+', :err => %i[child out])
-          end
-        end
-      end
-
-      context 'without env' do
-        context 'with array command and arguments' do
-          it 'should parse the command properly' do
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen([%w[echo argv0], 'test'])
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen([%w[echo argv0], 'test'], 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen([%w[echo argv0], 'test'], :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen([%w[echo argv0], 'test'], 'w+', :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(%w[echo test])
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(%w[echo test], 'w+')
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(%w[echo test], :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with('echo test')
-            IO.popen(%w[echo test], 'w+', :unsetenv_others => true)
-
-            expect(TCellAgent::Cmdi).to receive(:block_command?).with(
-              "echo -size 320x85 canvas:none -font Bookman-DemiItalic -draw \"text 25,60 'Magick'\""
-            )
-            IO.popen(
-              [%w[echo argv0],
-               '-size',
-               '320x85',
-               'canvas:none',
-               '-font',
-               'Bookman-DemiItalic',
-               '-draw',
-               "\"text 25,60 \'Magick\'\""],
-              :unsetenv_others => true
-            )
-          end
-        end
-      end
-    end
-  end
-
-  describe Kernel do
-    before(:each) do
-      configuration = double(
-        'configuration',
-        {
-          'app_id' => 'app_id',
-          'api_key' => 'api_key',
-          'allow_payloads' => true,
-          'js_agent_api_base_url' => 'http://api.tcell.com/',
-          'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
-          'max_csp_header_bytes' => nil,
-          'event_time_limit_seconds' => 15,
-          'event_batch_size_limit' => 50,
-          'preload_policy_filename' => nil,
-          'cache_filename_with_app_id' => '/tcellagent_src/tcell/cache/tcell_agent.cache',
-          'agent_home_owner' => nil
-        }
-      )
-      expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
-      @rust_policies = TCellAgent::Policies::RustPolicies.new
-    end
-
-    describe '.backtick' do
-      context 'empty command' do
-        it 'should raise Errno::ENOENT' do
-          expect do
-            ``
-          end.to raise_error(Errno::ENOENT)
-        end
-      end
-
-      context 'with a non blocked command present' do
-        context 'with no command injection' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(nil)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:cmdi_enabled)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:block_command?)
-
-            `echo test`
-          end
-        end
-
-        context 'with command injection disabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(false)
-            expect(@rust_policies).to_not receive(:block_command?)
-
-            `echo test`
-          end
-        end
-
-        context 'with command injection enabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
-
-            `echo test`
-          end
-        end
-      end
-
-      context 'with a blocked command present' do
-        context 'with command injection enabled' do
-          it 'should raise a Errno::ENOENT' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
-
-            expect do
-              `echo test`
-            end.to raise_error(Errno::ENOENT)
-          end
-        end
-      end
-    end
-
-    describe '%x methods' do
-      context 'empty command' do
-        it 'should raise Errno::ENOENT' do
-          expect do
-            ``
-          end.to raise_error(Errno::ENOENT)
-        end
-      end
-
-      context 'with a non blocked command present' do
-        context 'with no command injection' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(nil)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:cmdi_enabled)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:block_command?)
-
-            `echo test`
-          end
-        end
-
-        context 'with command injection disabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(false)
-            expect(@rust_policies).to_not receive(:block_command?)
-
-            `echo test`
-          end
-        end
-
-        context 'with command injection enabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
-
-            `echo test`
-          end
-        end
-      end
-
-      context 'with a blocked command present' do
-        context 'with command injection enabled' do
-          it 'should raise a Errno::ENOENT' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
-
-            expect do
-              `echo test`
-            end.to raise_error(Errno::ENOENT)
-          end
-        end
-      end
-    end
-
-    describe '.system' do
-      context 'empty command' do
-        it 'should raise an error' do
-          expect do
-            system
-          end.to raise_error(ArgumentError)
-          expect do
-            system(nil)
-          end.to raise_error(TypeError)
-
-          expect(system('')).to be_nil
-        end
-      end
-
-      context 'non existent command' do
-        it 'should return nil' do
-          expect(system('foobar')).to be_nil
-        end
-      end
-
-      context 'with a valid command' do
-        it 'should execute command' do
-          pid = system('echo test > /dev/null 2>&1')
-          expect(pid).to eq(true)
-
-          pid = system(RbConfig.ruby, "-e'Hello World!'", '>', '/dev/null', '2>&1')
-          expect(pid).to eq(true)
-        end
-      end
-
-      context 'with a non blocked command present' do
-        context 'with no command injection' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(nil)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:cmdi_enabled)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:block_command?)
-
-            system('echo test > /dev/null 2>&1')
-          end
-        end
-
-        context 'with command injection disabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(false)
-            expect(@rust_policies).to_not receive(:block_command?)
-
-            system('echo test > /dev/null 2>&1')
-          end
-        end
-
-        context 'with command injection enabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test > /dev/null 2>&1', nil).and_return(false)
-
-            system('echo test > /dev/null 2>&1')
-          end
-        end
-      end
-
-      context 'with a blocked command present' do
-        context 'with command injection enabled' do
-          it 'should raise a Errno::ENOENT' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
-
-            expect do
-              system('echo test')
-            end.to raise_error(Errno::ENOENT)
-          end
-        end
-      end
-    end
-
-    describe '.spawn' do
-      context 'empty command' do
-        it 'should raise an error' do
-          expect do
-            spawn
-          end.to raise_error(ArgumentError)
-          expect do
-            spawn(nil)
-          end.to raise_error(TypeError)
-          expect do
-            spawn('')
-          end.to raise_error(Errno::ENOENT)
-        end
-      end
-
-      context 'non existent command' do
-        it 'should raise error' do
-          expect do
-            spawn('foobar')
-          end.to raise_error(Errno::ENOENT)
-        end
-      end
-
-      context 'with a valid command' do
-        it 'should execute command' do
-          pid = spawn('echo test > /dev/null 2>&1')
-          expect(pid).to_not be_nil
-
-          pid = spawn(RbConfig.ruby, "-e'Hello World!'", '>', '/dev/null', '2>&1')
-          expect(pid).to_not be_nil
-        end
-      end
-
-      context 'with a non blocked command present' do
-        context 'with no command injection' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(nil)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:cmdi_enabled)
-            expect_any_instance_of(TCellAgent::Policies::RustPolicies).to_not receive(:block_command?)
-
-            spawn('echo test > /dev/null 2>&1')
-          end
-        end
-
-        context 'with command injection disabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(false)
-            expect(@rust_policies).to_not receive(:block_command?)
-
-            spawn('echo test > /dev/null 2>&1')
-          end
-        end
-
-        context 'with command injection enabled' do
-          it 'should execute the command' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test > /dev/null 2>&1', nil).and_return(false)
-
-            spawn('echo test > /dev/null 2>&1')
-          end
-        end
-      end
-
-      context 'with a blocked command present' do
-        context 'with command injection enabled' do
-          it 'should raise a Errno::ENOENT' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
-
-            expect do
-              spawn('echo test')
-            end.to raise_error(Errno::ENOENT)
-          end
-        end
-      end
-    end
-
-    describe '.exec' do
-      # can only test this case since exec replaces current process with new process
-      context 'with a blocked command present' do
-        context 'with command injection enabled' do
-          it 'should raise a Errno::ENOENT' do
-            expect(TCellAgent).to receive(:policy).with(
-              TCellAgent::PolicyTypes::RUST
-            ).and_return(@rust_policies)
-            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
-
-            expect do
-              exec('echo test')
-            end.to raise_error(Errno::ENOENT)
-          end
-        end
-      end
-    end
-  end
 end