tcell_agent 1.1.3 → 1.1.4

data/lib/tcell_agent/sensor_events/app_config.rb

@@ -4,20 +4,20 @@ module TCellAgent
   module SensorEvents
     class AppConfigSettingEvent < TCellSensorEvent
       def initialize(package, section, prefix, name, value)
-        super("app_config_setting")
-        self["package"] = package
-        self["section"] = section
+        super('app_config_setting')
+        self['package'] = package
+        self['section'] = section
 
-        self["name"] = name
-        self["value"] = value.to_s
+        self['name'] = name
+        self['value'] = value.to_s
 
-        self["prefix"] = prefix if prefix
+        self['prefix'] = prefix if prefix
       end
     end
 
     class TCellAgentSettingEvent < AppConfigSettingEvent
       def initialize(name, value)
-        super("tcell", "config", nil, name, value)
+        super('tcell', 'config', nil, name, value)
       end
     end
   end

data/lib/tcell_agent/sensor_events/appsensor_event.rb

@@ -1,6 +1,5 @@
 require 'tcell_agent/sensor_events/sensor'
 
-
 module TCellAgent
   module SensorEvents
     class TCellAppSensorEvent < TCellSensorEvent
@@ -16,36 +15,36 @@ module TCellAgent
                      payload,
                      pattern,
                      full_uri)
-        super("as")
-        self["dp"] = detection_point
+        super('as')
+        self['dp'] = detection_point
 
-        self["param"] = param.to_s if param
-        self["m"] = method.to_s if method
-        self["pattern"] = pattern if pattern
-        self["meta"] = meta if meta
-        self["rid"] = route_id.to_s if route_id
-        self["full_uri"] = full_uri if full_uri
-        self["uri"] = location if location
-        self["uid"] = user_id.to_s if user_id
-        self["sid"] = hmac_session_id if hmac_session_id
-        self["remote_addr"] = remote_address.to_s if remote_address
-        self["payload"] = payload if payload
+        self['param'] = param.to_s if param
+        self['m'] = method.to_s if method
+        self['pattern'] = pattern if pattern
+        self['meta'] = meta if meta
+        self['rid'] = route_id.to_s if route_id
+        self['full_uri'] = full_uri if full_uri
+        self['uri'] = location if location
+        self['uid'] = user_id.to_s if user_id
+        self['sid'] = hmac_session_id if hmac_session_id
+        self['remote_addr'] = remote_address.to_s if remote_address
+        self['payload'] = payload if payload
       end
 
       def self.build_from_native_lib_event(event)
-        return TCellAppSensorEvent.new(
-          event["uri"],
-          event["detection_point"],
-          event["method"],
-          event["remote_address"],
-          event["parameter"],
-          event["route_id"],
-          event["meta"],
-          event["session_id"],
-          event["user_id"],
-          event["payload"],
-          event["pattern"],
-          event["full_uri"]
+        TCellAppSensorEvent.new(
+          event['uri'],
+          event['detection_point'],
+          event['method'],
+          event['remote_address'],
+          event['parameter'],
+          event['route_id'],
+          event['meta'],
+          event['session_id'],
+          event['user_id'],
+          event['payload'],
+          event['pattern'],
+          event['full_uri']
         )
       end
     end

data/lib/tcell_agent/sensor_events/appsensor_meta_event.rb

@@ -1,113 +1,45 @@
-# encoding: utf-8
-# See the file "LICENSE" for the full license governing this code.
-
-require 'tcell_agent/sensor_events/sensor'
-
 require 'tcell_agent/agent'
 require 'tcell_agent/agent/policy_types'
-require 'tcell_agent/appsensor/meta_data'
-require 'tcell_agent/utils/params'
-
-
-# Some Rules Originate from ModSecurity
-#   ModSecurity for Apache 2.x, http://www.modsecurity.org/
-#   Copyright (c) 2004-2013 Trustwave Holdings, Inc. (http://www.trustwave.com/)
+require 'tcell_agent/tcell_context'
+require 'tcell_agent/sensor_events/sensor'
 
 module TCellAgent
   module SensorEvents
-
-    class AppSensorMetaEvent < TCellAgent::AppSensor::MetaData
-
+    class AppSensorMetaEvent < TCellAgent::SensorEvents::TCellSensorEvent
       class << self
         def build(request, response_content_length, response_code, response_headers)
-          tcell_context = request.env[TCellAgent::Instrumentation::TCELL_ID]
-          meta_event = AppSensorMetaEvent.new(
-            tcell_context.request_method,
-            tcell_context.ip_address,
-            tcell_context.route_id,
-            tcell_context.hmac_session_id,
-            tcell_context.user_id,
-            tcell_context.transaction_id,
-            tcell_context.uri
-          )
-
-          meta_event.csrf_exception_name = tcell_context.csrf_exception_name
-          meta_event.user_agent = tcell_context.user_agent
-          meta_event.request_content_bytes_len = (request.content_length || 0).to_i
-          meta_event.response_content_bytes_len = response_content_length
-
-          # use uri stored in tcell_context because
-          # rails modifies original request.url
-          # to always return /404 (or whatever error code
-          # it encountered)
-          meta_event.location = tcell_context.uri
-          meta_event.path = tcell_context.path
+          meta_data = TCellAgent::MetaData.from_request(request)
 
-          meta_event.get_dict = request.GET
-          meta_event.cookie_dict = request.cookies
-          meta_event.set_headers_dict(request.env)
-
-          # don't enqueue parameter values of unknown type to avoid any serialization issues
-          meta_event.post_dict = TCellAgent::Utils::Params.flatten(request.POST)
-
-          meta_event.path_parameters = tcell_context.path_parameters
-          meta_event.response_code = response_code
-          meta_event.response_headers = response_headers
-
-          meta_event.sql_exceptions = tcell_context.sql_exceptions
-          meta_event.database_result_sizes = tcell_context.database_result_sizes
-
-          # Positions strio to the beginning of input, resetting lineno to zero.
-          # rails 4.1 seems to read the stringIO directly and so body.gets is empty
-          # this is called
-          request.body.rewind
+          tcell_context = request.env[TCellAgent::Instrumentation::TCELL_ID]
+          meta_data.csrf_exception_name = tcell_context.csrf_exception_name
+          meta_data.user_agent = tcell_context.user_agent
+          meta_data.path_parameters = tcell_context.path_parameters
+          meta_data.sql_exceptions = tcell_context.sql_exceptions
+          meta_data.database_result_sizes = tcell_context.database_result_sizes
 
-          meta_event.set_body_dict(
-            meta_event.request_content_bytes_len,
-            request.content_type,
-            request.body.gets
-          )
+          meta_data.response_content_bytes_len = response_content_length
 
-          meta_event
-        end
+          meta_data.response_code = response_code
+          meta_data.response_headers = response_headers
 
-        def build_basic(appsensor_meta)
-          AppSensorMetaEvent.new(
-            appsensor_meta.method,
-            appsensor_meta.remote_address,
-            appsensor_meta.route_id,
-            appsensor_meta.session_id,
-            appsensor_meta.user_id,
-            appsensor_meta.transaction_id,
-            appsensor_meta.location
-          )
+          AppSensorMetaEvent.new(meta_data)
         end
       end
 
+      attr_accessor :meta_data
 
-      attr_accessor :request_content_bytes_len, :response_content_bytes_len,
-        :response_code, :user_agent, :response_headers, :csrf_exception_name, :path,
-        :sql_exceptions, :database_result_sizes
-
-      def initialize(method, remote_address, route_id, session_id, user_id, transaction_id, location)
-        super(method, remote_address, route_id, session_id, user_id, transaction_id, location)
+      def initialize(meta_data)
+        @send = false
 
-        @request_content_bytes_len = 0
-        @response_content_bytes_len = 0
-        @user_agent = nil
+        @meta_data = meta_data
       end
 
       def post_process
-        rust_policies = TCellAgent.policy(TCellAgent::PolicyTypes::Rust)
+        rust_policies = TCellAgent.policy(TCellAgent::PolicyTypes::RUST)
         return unless rust_policies
 
-        rust_policies.check_appfirewall_injections(self)
-      end
-
-      def flattened_post_dict
-        @post_dict
+        rust_policies.check_appfirewall_injections(@meta_data)
       end
     end
-
   end
 end

data/lib/tcell_agent/sensor_events/command_injection.rb

@@ -2,102 +2,74 @@ require 'tcell_agent/sensor_events/sensor'
 
 module TCellAgent
   module SensorEvents
-
     class CommandInjectionMatchEvent < Hash
       def initialize(rule_id, command)
-        self["rule_id"] = rule_id
-        if command
-          self["command"] = command
-        end
+        self['rule_id'] = rule_id
+        self['command'] = command if command
       end
     end
 
     class CommandInjectionEvent < TCellSensorEvent
-
       def self.build_from_native_lib_response_and_tcell_context(apply_response,
                                                                 tcell_context)
-        matches = apply_response.fetch("matches", [])
-
-        if matches && matches.size > 0
-          method, remote_address, route_id, session_id, user_id, uri = nil
-          if tcell_context
-            method = tcell_context.request_method
-            remote_address = tcell_context.ip_address
-            route_id = tcell_context.route_id
-            session_id = tcell_context.hmac_session_id
-            user_id = tcell_context.user_id
-            uri = tcell_context.uri
-          end
-
-          matches_without_emtpy_values = matches.map do |match|
-            CommandInjectionMatchEvent.new(
-              match["rule_id"], match["command"]
-            )
-          end
-
-          CommandInjectionEvent.new(
-            apply_response["commands"],
-            blocked=apply_response.fetch("blocked", false),
-            matches=matches_without_emtpy_values,
-            method=method,
-            remote_address=remote_address,
-            route_id=route_id,
-            session_id=session_id,
-            user_id=user_id,
-            uri=uri,
-            full_commandline=apply_response["full_commandline"])
+        matches = apply_response.fetch('matches', [])
+
+        return nil if !matches || matches.empty?
+
+        method, remote_address, route_id, session_id, user_id, uri = nil
+        if tcell_context
+          method = tcell_context.request_method
+          remote_address = tcell_context.ip_address
+          route_id = tcell_context.route_id
+          session_id = tcell_context.hmac_session_id
+          user_id = tcell_context.user_id
+          uri = tcell_context.uri
+        end
 
-        else
-          nil
+        matches_without_emtpy_values = matches.map do |match|
+          CommandInjectionMatchEvent.new(
+            match['rule_id'], match['command']
+          )
         end
-      end
 
+        CommandInjectionEvent.new(
+          apply_response['commands'],
+          apply_response.fetch('blocked', false),
+          matches_without_emtpy_values,
+          method,
+          remote_address,
+          route_id,
+          session_id,
+          user_id,
+          uri,
+          apply_response['full_commandline']
+        )
+      end
 
       def initialize(commands,
                      blocked,
                      matches,
-                     method=nil,
-                     remote_address=nil,
-                     route_id=nil,
-                     session_id=nil,
-                     user_id=nil,
-                     uri=nil,
-                     full_commandline=nil)
-        super("cmdi")
-
-        self["commands"] = commands
-        self["blocked"] = blocked
-        self["matches"] = matches
-
-        if method
-          self["m"] = method
-        end
-
-        if remote_address
-          self["remote_addr"] = remote_address
-        end
-
-        if route_id
-          self["rid"] = route_id
-        end
-
-        if session_id
-          self["sid"] = session_id
-        end
-
-        if user_id
-          self["uid"] = user_id
-        end
-
-        if full_commandline
-          self["full_commandline"] = full_commandline
-        end
-
-        if uri
-          self["uri"] = TCellAgent::SensorEvents::Util.strip_uri_values(uri)
-        end
+                     method = nil,
+                     remote_address = nil,
+                     route_id = nil,
+                     session_id = nil,
+                     user_id = nil,
+                     uri = nil,
+                     full_commandline = nil)
+        super('cmdi')
+
+        self['commands'] = commands
+        self['blocked'] = blocked
+        self['matches'] = matches
+        self['m'] = method if method
+
+        self['remote_addr'] = remote_address if remote_address
+        self['rid'] = route_id if route_id
+        self['sid'] = session_id if session_id
+        self['uid'] = user_id if user_id
+        self['full_commandline'] = full_commandline if full_commandline
+        self['uri'] = TCellAgent::SensorEvents::Util.strip_uri_values(uri) if uri
       end
     end
-
   end
 end

data/lib/tcell_agent/sensor_events/discovery.rb

@@ -1,30 +1,30 @@
 require 'tcell_agent/sensor_events/sensor'
 
 module TCellAgent
-    module SensorEvents
-        class DiscoveryEvent < TCellSensorEvent
-            DATABASE_TYPE = "db"
-            def initialize(route_id=nil)
-                super("discovery")
-                if route_id
-                    self["rid"] = route_id
-                end
-            end
-            def for_database(database, schema, table, field)
-                self["type"] = "db"
-                self["db"] = database
-                self["schema"] = schema
-                self["table"] = table
-                self["field"] = field
-            end
-            def for_database_fields(database, schema, table, fields)
-                self["type"] = "db"
-                self["db"] = database
-                self["schema"] = schema
-                self["table"] = table
-                self["fields"] = fields
-                return self
-            end
-        end #/DiscoveryEvent
-    end #/SensorEvents
-end #/TCellAgent
+  module SensorEvents
+    class DiscoveryEvent < TCellSensorEvent
+      DATABASE_TYPE = 'db'.freeze
+      def initialize(route_id = nil)
+        super('discovery')
+        self['rid'] = route_id if route_id
+      end
+
+      def for_database(database, schema, table, field)
+        self['type'] = 'db'
+        self['db'] = database
+        self['schema'] = schema
+        self['table'] = table
+        self['field'] = field
+      end
+
+      def for_database_fields(database, schema, table, fields)
+        self['type'] = 'db'
+        self['db'] = database
+        self['schema'] = schema
+        self['table'] = table
+        self['fields'] = fields
+        self
+      end
+    end
+  end
+end

data/lib/tcell_agent/sensor_events/dlp.rb

@@ -4,60 +4,54 @@ require 'tcell_agent/sensor_events/util/sanitizer_utilities'
 require 'tcell_agent/sensor_events/sensor'
 require 'tcell_agent/sensor_events/util/sanitizer_utilities'
 module TCellAgent
-    module SensorEvents
-        class DlpEvent < TCellSensorEvent
-            FOUND_IN_BODY = "body"
-            FOUND_IN_LOG = "log"
-            FOUND_IN_CONSOLE = "console"
-
-            FRAMEWORK_VARIABLE_SESSION_ID="session_id"
-
-            REQUEST_CONTEXT_FORM = "form"
-            REQUEST_CONTEXT_COOKIE = "cookie"
-            REQUEST_CONTEXT_HEADER = "header"
-
-            def initialize(route_id, raw_uri, found_in, id=nil, hmac_session_id=nil, user_id=nil)
-                super("dlp")
-                if route_id
-                    self["rid"] = route_id
-                end
-                self["found_in"] = found_in
-                @raw_uri = raw_uri
-                if hmac_session_id
-                    self["sid"] = hmac_session_id
-                end
-                if user_id
-                    self["uid"] = user_id
-                end
-                if id
-                    self["rule"] = id
-                end
-            end
-            def for_database(database, schema, table, field)
-                self["type"] = "db"
-                self["db"] = database
-                self["schema"] = schema
-                self["table"] = table
-                self["field"] = field
-                return self
-            end
-            def for_framework(variable)
-                self["type"] = "fw"
-                self["context"] = "framework"
-                self["variable"] = variable
-                return self
-            end
-            def for_request(variable_context, variable)
-                self["type"] = "req"
-                self["context"] = variable_context
-                self["variable"] = variable
-                return self
-            end
-            def post_process
-                if @raw_uri
-                    self["uri"] = Util.strip_uri_values(@raw_uri)
-                end
-            end
-        end
+  module SensorEvents
+    class DlpEvent < TCellSensorEvent
+      FOUND_IN_BODY = 'body'.freeze
+      FOUND_IN_LOG = 'log'.freeze
+      FOUND_IN_CONSOLE = 'console'.freeze
+
+      FRAMEWORK_VARIABLE_SESSION_ID = 'session_id'.freeze
+
+      REQUEST_CONTEXT_FORM = 'form'.freeze
+      REQUEST_CONTEXT_COOKIE = 'cookie'.freeze
+      REQUEST_CONTEXT_HEADER = 'header'.freeze
+
+      def initialize(route_id, raw_uri, found_in, id = nil, hmac_session_id = nil, user_id = nil)
+        super('dlp')
+        self['rid'] = route_id if route_id
+        self['found_in'] = found_in
+        @raw_uri = raw_uri
+        self['sid'] = hmac_session_id if hmac_session_id
+        self['uid'] = user_id if user_id
+        self['rule'] = id if id
+      end
+
+      def for_database(database, schema, table, field)
+        self['type'] = 'db'
+        self['db'] = database
+        self['schema'] = schema
+        self['table'] = table
+        self['field'] = field
+        self
+      end
+
+      def for_framework(variable)
+        self['type'] = 'fw'
+        self['context'] = 'framework'
+        self['variable'] = variable
+        self
+      end
+
+      def for_request(variable_context, variable)
+        self['type'] = 'req'
+        self['context'] = variable_context
+        self['variable'] = variable
+        self
+      end
+
+      def post_process
+        self['uri'] = Util.strip_uri_values(@raw_uri) if @raw_uri
+      end
     end
-end
+  end
+end