tcell_agent 2.0.0 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0b98e0366f6de14a287a83e13f08a0b5fdc9f13d12d8c6d1f0a2fa7f1caad9c
-  data.tar.gz: 88cfc253d06f635d54ab72d83e4d3a28829526c3df47e2e1e7cad19fd47c9293
+  metadata.gz: 9d37df3ff2819b9794d9bde01418437c3efed75358fa58f4f65d80ea4f63e7b8
+  data.tar.gz: 97efa888f4adf090f13fa5bc0597a91ea981ad299062d3dbd267ed4216b18ba8
 SHA512:
-  metadata.gz: 04c30f374634daf21590a07f94e3ea27cf09cd6931570b43a215f8d424983a86519c393faad76f7c809580dc9a02a905de00e6e28c4017d789b7baa6b86c5a3f
-  data.tar.gz: 39119777a798add18175e51c5935fb08d8ea85f2cde16d237e87f9175f477d9d3333cf91e4cecf089b39b355db31052a5047a444a420ea778e505631952be623
+  metadata.gz: 0f77740a99dd8678ca62a5ccf7e0e69304e680a8fa65258105c101ec360413920afcfea4d6e03237e1c6893198fa6232133ab05111bb2b0341586635db43a9bd
+  data.tar.gz: c980a3e122b6453e3660358a2ba6a2bbe86179a9f54ca09e34135c8e9f86eb6498ebd8346dbf28b117f2f0b160bc23338b80502dc6c07c28d0b3b03472756a39

data/lib/tcell_agent/instrumentation/cmdi.rb

@@ -50,7 +50,7 @@ module TCellAgent
           args_copy = Array.new(args)
           first_arg = args_copy.shift
 
-          cmd = first_arg[1..-1] if first_arg && first_arg[0] == '|'
+          cmd = first_arg[1..-1] if first_arg && (first_arg.is_a? String) && first_arg[0] == '|'
         end
       end
 

data/lib/tcell_agent/instrumentation/lfi.rb

@@ -32,12 +32,12 @@ module TCellAgent
           args_copy = Array.new(args)
           path = args_copy.shift
           mode = args_copy.shift || 'r'
-        end
 
-        if path && path.to_s[0] != '|'
-          [File.expand_path(path).to_s, convert_mode(mode)]
-        else
-          ['', '']
+          if path && path.to_s[0] != '|'
+            [File.expand_path(path).to_s, convert_mode(mode)]
+          else
+            ['', '']
+          end
         end
       end
 
@@ -52,10 +52,10 @@ module TCellAgent
           else
             path = ARGF.filename
           end
-        end
 
-        path = File.expand_path(path) unless path.nil?
-        [path.to_s, mode]
+          path = File.expand_path(path) unless path.nil?
+          [path.to_s, mode]
+        end
       end
 
       def self.convert_mode(mode)

data/lib/tcell_agent/instrumentation/monkey_patches/io.rb

@@ -4,12 +4,15 @@ class IO
     def binread(*args, &block)
       path, mode = TCellAgent::Instrumentation::Lfi.extract_path_mode(*args)
 
-      if path && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
+      if !path.strip.empty? && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
         raise IOError, "tCell.io Agent: Attempted access to file #{path} with mode #{mode} denied"
       end
-      cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
-      if cmd && TCellAgent::Cmdi.block_command?(cmd)
-        raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+
+      if path.empty?
+        cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
+        if cmd && TCellAgent::Cmdi.block_command?(cmd)
+          raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+        end
       end
 
       tcell_original_binread(*args, &block)
@@ -69,14 +72,17 @@ class IO
       path, _mode = TCellAgent::Instrumentation::Lfi.extract_path_mode(*args)
       mode = 'Read'
 
-      if path && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
+      if !path.strip.empty? && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
         raise IOError, "tCell.io Agent: Attempted access to file #{path} with mode #{mode} denied"
       end
 
-      cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
-      if cmd && TCellAgent::Cmdi.block_command?(cmd)
-        raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+      if path.empty?
+        cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
+        if cmd && TCellAgent::Cmdi.block_command?(cmd)
+          raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+        end
       end
+
       tcell_original_read(*args, &block)
     end
 
@@ -85,13 +91,15 @@ class IO
       path, _mode = TCellAgent::Instrumentation::Lfi.extract_path_mode(*args)
       mode = 'Read'
 
-      if path && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
+      if !path.strip.empty? && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
         raise IOError, "tCell.io Agent: Attempted access to file #{path} with mode #{mode} denied"
       end
 
-      cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
-      if cmd && TCellAgent::Cmdi.block_command?(cmd)
-        raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+      if path.empty?
+        cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
+        if cmd && TCellAgent::Cmdi.block_command?(cmd)
+          raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+        end
       end
 
       tcell_original_readlines(*args, &block)

data/lib/tcell_agent/instrumentation/monkey_patches/kernel.rb

@@ -4,13 +4,15 @@ module Kernel
     def open(*args, &block)
       path, mode = TCellAgent::Instrumentation::Lfi.extract_path_mode(*args)
 
-      if path && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
+      if !path.strip.empty? && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
         raise IOError, "tCell.io Agent: Attempted access to file #{path} with mode #{mode} denied"
       end
 
-      cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
-      if cmd && TCellAgent::Cmdi.block_command?(cmd)
-        raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+      if path.empty?
+        cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
+        if cmd && TCellAgent::Cmdi.block_command?(cmd)
+          raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+        end
       end
 
       tcell_original_1_open(*args, &block)
@@ -72,13 +74,15 @@ module Kernel
   def open(*args, &block)
     path, mode = TCellAgent::Instrumentation::Lfi.extract_path_mode(*args)
 
-    if path && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
+    if !path.strip.empty? && TCellAgent::Instrumentation::Lfi.block_file_access?(path, mode)
       raise IOError, "tCell.io Agent: Attempted access to file #{path} with mode #{mode} denied"
     end
 
-    cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
-    if cmd && TCellAgent::Cmdi.block_command?(cmd)
-      raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+    if path.empty?
+      cmd = TCellAgent::Cmdi.parse_command_from_open(*args)
+      if cmd && TCellAgent::Cmdi.block_command?(cmd)
+        raise "tCell.io Agent: Command not allowed by policy: #{cmd}"
+      end
     end
 
     tcell_original_2_open(*args, &block)

data/lib/tcell_agent/policies/command_injection_policy.rb

@@ -15,7 +15,7 @@ module TCellAgent
       end
 
       def block_command?(command, tcell_context)
-        return false unless @enabled
+        return false unless @enabled && tcell_context
 
         response = @native_agent.apply_cmdi(
           command, tcell_context

data/lib/tcell_agent/rails/dlp.rb

@@ -228,9 +228,15 @@ module TCellAgent
                 )
                 tcell_data = request_env[TCellAgent::Instrumentation::TCELL_ID]
                 if tcell_data && result.is_a?(ActiveRecord::StatementInvalid)
-                  tcell_data.sql_exceptions.push(
-                    { 'exception_name' => result.class.name, 'exception_payload' => message }
-                  )
+                  if message.is_a? Hash
+                    tcell_data.sql_exceptions.push(
+                      { 'exception_name' => result.class.name, 'exception_payload' => message[:message] }
+                    )
+                  else
+                    tcell_data.sql_exceptions.push(
+                      { 'exception_name' => result.class.name, 'exception_payload' => message }
+                    )
+                  end
                 end
               end
             end
@@ -253,7 +259,7 @@ module TCellAgent
         end
 
         ActiveRecord::Querying.module_eval do
-          if ::Rails::VERSION::MAJOR == 5
+          if ::Rails::VERSION::MAJOR >= 5
             alias_method :tcell_find_by_sql, :find_by_sql
             def find_by_sql(*args)
               results = tcell_find_by_sql(*args)

data/lib/tcell_agent/rails/routes.rb

@@ -77,7 +77,7 @@ module TCellAgent
       end
 
       def self.create_tcell_route(route)
-        return TCellRoute5.new(route) if route && ::Rails::VERSION::MAJOR == 5
+        return TCellRoute5.new(route) if route && ::Rails::VERSION::MAJOR >= 5
         return TCellRoute4.new(route) if route && ::Rails::VERSION::MAJOR < 5
 
         TCellRoute.new
@@ -173,7 +173,7 @@ module TCellAgent
         end
       end
 
-      if ::Rails::VERSION::MAJOR == 5
+      if ::Rails::VERSION::MAJOR >= 5
         ActionDispatch::Journey::Routes.class_eval do
           alias_method :tcell_add_route, :add_route
           def add_route(name, mapping)
@@ -188,7 +188,7 @@ module TCellAgent
         end
       end
 
-      if ::Rails::VERSION::MAJOR == 5 || (::Rails::VERSION::MAJOR == 4 && ::Rails::VERSION::MINOR >= 2)
+      if ::Rails::VERSION::MAJOR >= 5 || (::Rails::VERSION::MAJOR == 4 && ::Rails::VERSION::MINOR >= 2)
         ActionDispatch::Journey::Router.class_eval do
           alias_method :tcell_serve, :serve
           def serve(req)

data/lib/tcell_agent/rust/native_library.rb

@@ -6,7 +6,7 @@ module TCellAgent
       require 'ffi'
       extend FFI::Library
 
-      VERSION = '4.14.0'.freeze
+      VERSION = '4.17.1'.freeze
       prefix = 'lib'
       extension = '.so'
       variant = ''

data/lib/tcell_agent/version.rb

@@ -1,5 +1,5 @@
 # See the file "LICENSE" for the full license governing this code.
 
 module TCellAgent
-  VERSION = '2.0.0'.freeze
+  VERSION = '2.1.0'.freeze
 end

data/spec/lib/tcell_agent/{cmdi_spec.rb → instrumentation/cmdi_spec.rb}

@@ -147,5 +147,13 @@ module TCellAgent
         end
       end
     end
+    describe '.parse_command_from_open' do
+      context 'with string command' do
+        it 'should parse the command properly' do
+          cmd = TCellAgent::Cmdi.parse_command_from_open('|echo')
+          expect(cmd).to eq('echo')
+        end
+      end
+    end
   end
 end

data/spec/lib/tcell_agent/instrumentation/lfi/io_lfi_spec.rb

@@ -42,6 +42,7 @@ describe 'IO' do
             TCellAgent::PolicyTypes::LFI
           ).and_return(@local_files_policy)
           expect(@local_files_policy).to receive(:block_file_access?).and_return(false)
+          expect(TCellAgent::Cmdi).not_to receive(:parse_command_from_open)
         end
       end
 
@@ -75,6 +76,7 @@ describe 'IO' do
             TCellAgent::PolicyTypes::LFI
           ).and_return(@local_files_policy)
           expect(@local_files_policy).to receive(:block_file_access?).and_return(true)
+          expect(TCellAgent::Cmdi).not_to receive(:parse_command_from_open)
         end
       end
 
@@ -254,6 +256,7 @@ describe 'IO' do
           ).and_return(@local_files_policy)
 
           expect(@local_files_policy).to receive(:block_file_access?).and_return(false)
+          expect(TCellAgent::Cmdi).not_to receive(:parse_command_from_open)
         end
       end
 
@@ -288,6 +291,7 @@ describe 'IO' do
           ).and_return(@local_files_policy)
 
           expect(@local_files_policy).to receive(:block_file_access?).and_return(true)
+          expect(TCellAgent::Cmdi).not_to receive(:parse_command_from_open)
         end
       end
 
@@ -338,6 +342,7 @@ describe 'IO' do
           ).and_return(@local_files_policy)
 
           expect(@local_files_policy).to receive(:block_file_access?).and_return(false)
+          expect(TCellAgent::Cmdi).not_to receive(:parse_command_from_open)
         end
       end
 
@@ -366,6 +371,7 @@ describe 'IO' do
           ).and_return(@local_files_policy)
 
           expect(@local_files_policy).to receive(:block_file_access?).and_return(true)
+          expect(TCellAgent::Cmdi).not_to receive(:parse_command_from_open)
         end
       end
 

data/spec/lib/tcell_agent/instrumentation/lfi/kernel_lfi_spec.rb

@@ -2,6 +2,7 @@
 # rubocop:disable Lint/UselessAssignment
 require 'spec_helper'
 require 'securerandom'
+require 'pathname'
 
 describe 'Kernel' do
   before do
@@ -15,6 +16,7 @@ describe 'Kernel' do
 
   before(:all) do
     @new_file_name = '/tmp/' + SecureRandom.uuid
+    @new_pathname = Pathname.new(@new_file_name)
   end
   describe '#open and ::open' do
     context 'empty path' do
@@ -39,13 +41,14 @@ describe 'Kernel' do
         end.to raise_error(Errno::ENOENT)
       end
     end
-    context 'with a filename not blocked for read/write' do
+    context 'with a non-existent file, with filename not blocked for read/write' do
       before do |test|
         unless test.metadata[:skip_before]
           expect(TCellAgent).to receive(:policy).with(
             TCellAgent::PolicyTypes::LFI
           ).and_return(@local_files_policy, @local_files_policy)
           expect(@local_files_policy).to receive(:block_file_access?).and_return(false, false)
+          expect(TCellAgent::Cmdi).not_to receive(:parse_command_from_open)
         end
       end
 
@@ -56,7 +59,18 @@ describe 'Kernel' do
         result = open('|echo test').read
         expect(result).to eq "test\n"
       end
-      context 'with a nonexistent filename with mode w' do
+      context 'with a pathname filename with mode w' do
+        it 'should create the file' do
+          Kernel.open(@new_pathname, 'w')
+          expect(File.exist?(@new_pathname)).to be_truthy
+          File.delete(@new_pathname)
+
+          open(@new_pathname, 'w')
+          expect(File.exist?(@new_pathname)).to be_truthy
+          File.delete(@new_pathname)
+        end
+      end
+      context 'with a filename with mode w' do
         it 'should create the file' do
           Kernel.open(@new_file_name, 'w')
           expect(File.exist?(@new_file_name)).to be_truthy
@@ -90,13 +104,14 @@ describe 'Kernel' do
         end
       end
     end
-    context 'with a filename blocked for read/write' do
+    context 'with a non-existent file, with filename blocked for read/write' do
       before do |test|
         unless test.metadata[:skip_before]
           expect(TCellAgent).to receive(:policy).with(
             TCellAgent::PolicyTypes::LFI
           ).and_return(@local_files_policy, @local_files_policy)
           expect(@local_files_policy).to receive(:block_file_access?).and_return(true, true)
+          expect(TCellAgent::Cmdi).not_to receive(:parse_command_from_open)
         end
       end
 
@@ -107,7 +122,7 @@ describe 'Kernel' do
         result = open('|echo test').read
         expect(result).to eq "test\n"
       end
-      context 'with a nonexistent filename with mode w' do
+      context 'with a filename with mode w' do
         it 'should raise an error' do
           expect do
             Kernel.open(@new_file_name, 'w')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tcell_agent
 version: !ruby/object:Gem::Version
-  version: 2.0.0
+  version: 2.1.0
 platform: ruby
 authors:
 - Rafael
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-02-04 00:00:00.000000000 Z
+date: 2020-04-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: ffi
@@ -162,14 +162,14 @@ files:
 - lib/tcell_agent/rails/tcell_body_proxy.rb
 - lib/tcell_agent/routes/table.rb
 - lib/tcell_agent/rust/agent_config.rb
-- lib/tcell_agent/rust/libtcellagent-4.14.0.dylib
-- lib/tcell_agent/rust/libtcellagent-4.14.0.so
-- lib/tcell_agent/rust/libtcellagent-alpine-4.14.0.so
+- lib/tcell_agent/rust/libtcellagent-4.17.1.dylib
+- lib/tcell_agent/rust/libtcellagent-4.17.1.so
+- lib/tcell_agent/rust/libtcellagent-alpine-4.17.1.so
 - lib/tcell_agent/rust/models.rb
 - lib/tcell_agent/rust/native_agent.rb
 - lib/tcell_agent/rust/native_agent_response.rb
 - lib/tcell_agent/rust/native_library.rb
-- lib/tcell_agent/rust/tcellagent-4.14.0.dll
+- lib/tcell_agent/rust/tcellagent-4.17.1.dll
 - lib/tcell_agent/sensor_events/agent_setting_event.rb
 - lib/tcell_agent/sensor_events/app_config_setting_event.rb
 - lib/tcell_agent/sensor_events/discovery.rb
@@ -192,12 +192,12 @@ files:
 - lib/tcell_agent/utils/params.rb
 - lib/tcell_agent/utils/strings.rb
 - lib/tcell_agent/version.rb
-- spec/lib/tcell_agent/cmdi_spec.rb
 - spec/lib/tcell_agent/config/unknown_options_spec.rb
 - spec/lib/tcell_agent/configuration_spec.rb
 - spec/lib/tcell_agent/hooks/login_fraud_spec.rb
 - spec/lib/tcell_agent/instrumentation/cmdi/io_cmdi_spec.rb
 - spec/lib/tcell_agent/instrumentation/cmdi/kernel_cmdi_spec.rb
+- spec/lib/tcell_agent/instrumentation/cmdi_spec.rb
 - spec/lib/tcell_agent/instrumentation/lfi/file_lfi_spec.rb
 - spec/lib/tcell_agent/instrumentation/lfi/io_lfi_spec.rb
 - spec/lib/tcell_agent/instrumentation/lfi/kernel_lfi_spec.rb
@@ -266,12 +266,12 @@ signing_key:
 specification_version: 4
 summary: tCell.io Agent for Rails
 test_files:
-- spec/lib/tcell_agent/cmdi_spec.rb
 - spec/lib/tcell_agent/config/unknown_options_spec.rb
 - spec/lib/tcell_agent/configuration_spec.rb
 - spec/lib/tcell_agent/hooks/login_fraud_spec.rb
 - spec/lib/tcell_agent/instrumentation/cmdi/io_cmdi_spec.rb
 - spec/lib/tcell_agent/instrumentation/cmdi/kernel_cmdi_spec.rb
+- spec/lib/tcell_agent/instrumentation/cmdi_spec.rb
 - spec/lib/tcell_agent/instrumentation/lfi/file_lfi_spec.rb
 - spec/lib/tcell_agent/instrumentation/lfi/io_lfi_spec.rb
 - spec/lib/tcell_agent/instrumentation/lfi/kernel_lfi_spec.rb