RubyGems - tcell_agent - Versions diffs - 0.2.16 → 0.2.17 - Mend

tcell_agent 0.2.16 → 0.2.17

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (19) hide show

checksums.yaml CHANGED Viewed

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f85f2f3d36743fb454fedfe89d0405f25ba46fa4
-  data.tar.gz: 328a8ab46597707c4305b40b707d48a004f84ac5
+  metadata.gz: b107a46d2c8ac57564b91097fe2c81e412469e7a
+  data.tar.gz: 60487a47c5ad5c02db8188748f9711a6d8a07476
 SHA512:
-  metadata.gz: 0a7f284d81621c91f7f142ea8c1bbc3941b64de7d9c203d5d2b07def0b351c766b8fbf750e763e9d9013c02ec2a0ac9e47c722bdc19db584aa2fa0920b69a5dc
-  data.tar.gz: 7637ca1c15dbeadc23ef5d72922d2f0e675653d0349c5ccc31dd3d2a394ec93298568047ca7a75eaeda61aca05dae252187be33e29a783e28b0b05b425ae305a
+  metadata.gz: 52f240c551aa5f4013301031d21570c66ec595eb6e1ac9d454b5b5ede7d649e8924a26acf8fa302c029fd81316472f5771477c2a58afa690cc23617890a39652
+  data.tar.gz: 34e537a766d75d51de5182a2230f66bfbbfbbd67ed34e72cd0ddb652a3bc5a60a8f7f9c86654bf02557450e202819897c66fa4f8874ec46c01dce8fb0a231700

data/lib/tcell_agent/agent/policy_manager.rb CHANGED Viewed

@@ -16,6 +16,7 @@ require "tcell_agent/policies/http_redirect_policy"
 require "tcell_agent/policies/secure_headers_policy"
 require "tcell_agent/policies/honeytokens_policy"
 require "tcell_agent/policies/appsensor_policy"
+require "tcell_agent/policies/patches_policy"
 require "tcell_agent/sensor_events/server_agent"

data/lib/tcell_agent/agent/policy_types.rb CHANGED Viewed

@@ -12,6 +12,7 @@ require "tcell_agent/policies/honeytokens_policy"
 require "tcell_agent/policies/appsensor_policy"
 require "tcell_agent/policies/login_fraud_policy"
 require "tcell_agent/policies/dataloss_policy"
+require "tcell_agent/policies/patches_policy"
 module TCellAgent
   class PolicyTypes
@@ -24,6 +25,7 @@ module TCellAgent
     HoneyTokens = "exp-honeytokens"
     LoginFraud = "login"
     DataLoss = "dlp"
+    Patches = "patches"
     ClassMap = {
       CSP=>TCellAgent::Policies::ContentSecurityPolicy,
@@ -34,8 +36,9 @@ module TCellAgent
       AppSensor=>TCellAgent::Policies::AppSensorPolicy,
       HoneyTokens=>TCellAgent::Policies::HoneytokensPolicy,
       LoginFraud=>TCellAgent::Policies::LoginFraudPolicy,
-      DataLoss=>TCellAgent::Policies::DataLossPolicy
+      DataLoss=>TCellAgent::Policies::DataLossPolicy,
+      Patches=>TCellAgent::Policies::PatchesPolicy
     }
   end
-end
+end

data/lib/tcell_agent/appsensor/rules/appsensor_rule_manager.rb CHANGED Viewed

@@ -21,7 +21,7 @@ module TCellAgent
       @rule_info = {}
       if File.file?(filename)
-        rules_from_file = YAML.load(File.open(filename).read)
+        rules_from_file = JSON.parse(File.open(filename).read)
         rule_types = rules_from_file.fetch("sensors", {})
         rule_types.each do |sensor_name, sensor_config|

data/lib/tcell_agent/appsensor/rules/appsensor_rule_set.rb CHANGED Viewed

@@ -50,7 +50,7 @@ module TCellAgent
       return if pattern_id == nil or pattern == nil
-      pattern_regex = Regexp.new(pattern)
+      pattern_regex = Regexp.new(pattern, Regexp::MULTILINE | Regexp::IGNORECASE)
       enabled = rule_dict.fetch("enabled", true)
       rule_pattern = AppSensorRulePattern.new(pattern_id, pattern_regex, enabled)

data/lib/tcell_agent/appsensor/rules/baserules.json CHANGED Viewed

@@ -1,5 +1,5 @@
 {
-  "version":"20160322",
+  "version":"20160516",
   "sensors":{
     "xss":{
       "patterns":[
@@ -7,43 +7,73 @@
           "title":"Basic Injection",
           "sophistication":1,
           "common": "(?:<(script|iframe|embed|frame|frameset|object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound))",
+          "tests": {
+            "shouldFind":["\n\n<scRipT>document.write(1)</script>","<body onload=\"abc\">","<script>alert(123)</script>","<script>alert(\"hellox world\");</script>","9<script/src=http/attacker.com>"],
+            "shouldIgnore":["<h1>hi</h1>","Bob","Script"]
+          },
           "id": "1"
         },
         {
           "title":"Alert or Event XSS",
           "sophistication":2,
           "common": "(?:(alert|on\\w+|function\\s+\\w+)\\s*\\(\\s*(['+\\d\\w](,?\\s*['+\\d\\w]*)*)*\\s*\\))",
+          "tests":{
+            "shouldFind":["<input onmouseover='alert(1)'>","<input/onmouseover='alert(1)'>"],
+            "shouldIgnore":["<h1>hi</h1>","Bob","Sammy"]
+          },
           "id": "2"
         },
-        {
-          "title":"Tag Breaks",
-          "sophistication":2,
-          "common": "(?:\\\"[^\\\"]*[^-]?>)|(?:[^\\w\\s]\\s*\\/>)|(?:>\\\")",
-          "id": "3"
-        },
         {
           "title":"Attribute Breaks",
           "sophistication":3,
-         "common": "(?:\\\"+.*[<=]\\s*\\\"[^\\\"]+\\\")|(?:\\\"\\s*\\w+\\s*=)|(?:>\\w=\\/)|(?:#.+\\)[\\\"\\s]*>)|(?:\\\"\\s*(?:src|style|on\\w+)\\s*=\\s*\\\")|(?:[^\\\"]?\\\"[,;\\s]+\\w*[\\[\\(])(?:^>[\\w\\s]*<\\/?\\w{2,}>)",
-          "id": "4"
+          "common": "(?:\\\"+.*[<=]\\s*\\\"[^\\\"]+\\\")|(?:\\\"\\s*\\w+\\s*=)|(?:>\\w=\\/)|(?:#.+\\)[\\\"\\s]*>)|(?:\\\"\\s*(?:src|style|on\\w+)\\s*=\\s*\\\")|(?:[^\\\"]?\\\"[,;\\s]+\\w*[\\[\\(])(?:^>[\\w\\s]*<\\/?\\w{2,}>)",
+            "tests":{
+              "shouldFind":["<input src=\"b\" onmouseover=\"alert(1)\" test=\"abc\">"],
+              "shouldIgnore":["<h1>hi</h1>","<i class=\"test\">test</i>","Bob","Sammy","<i>","onmouseover","\"alert(1)\""]
+            },
+            "id": "4"
         },
         {
           "title":"Basic Obfuscation",
           "sophistication":3,
           "common": "(?:[\\\".]script\\s*\\()|(?:\\$\\$?\\s*\\(\\s*[\\w\\\"])|(?:\\/[\\w\\s]+\\/\\.)|(?:=\\s*\\/\\w+\\/\\s*\\.)|(?:(?:this|window|top|parent|frames|self|content)\\[\\s*[(,\\\"]*\\s*[\\w\\$])|(?:,\\s*new\\s+\\w+\\s*[,;)])",
-          "id": "5"
+            "tests": {
+              "shouldFind":[",YAHOO.util.Get.script(\"http://ha.ckers.org/xss.js\")"],
+              "shouldIgnore":["<h1>hi</h1>","<i class=\"test\">test</i>","Bob","Sammy","<i>","onmouseover","\"alert(1)\""]
+            },
+            "id": "5"
         },
         {
           "title":"Common Concatenation",
           "sophistication":3,
           "common": "(?:=\\s*\\w+\\s*\\+\\s*\\\")|(?:\\+=\\s*\\(\\s\\\")|(?:!+\\s*[\\d.,]+\\w?\\d*\\s*\\?)|(?:=\\s*\\[s*\\])|(?:\\\"\\s*\\+\\s*\\\")|(?:[^\\s]\\[\\s*\\d+\\s*\\]\\s*[;+])|(?:\\\"\\s*[&|]+\\s*\\\")|(?:\\/\\s*\\?\\s*\\\")|(?:\\/\\s*\\)\\s*\\[)|(?:\\d\\?.+:\\d)|(?:\\]\\s*\\[\\W*\\w)|(?:[^\\s]\\s*=\\s*\\/)",
-          "id": "6"
+            "tests": {
+              "shouldFind":["= werewr + \""],
+              "shouldIgnore":["<h1>hi</h1>","<i class=\"test\">test</i>","Bob","Sammy","<i>","onmouseover","\"alert(1)\""]
+            },
+            "id": "6"
         },
         {
           "title":"IFrame Tag Injection",
           "sophistication":1,
           "common": "<iframe.*",
+          "tests": {
+            "shouldFind":["Sam\n<h3><iframe/src=\\\\malware.xcc/>"],
+            "shouldIgnore":["<h1>hi</h1>","Bob","Script"]
+          },
           "id": "7"
+        },
+        {
+          "title":"JavaScript URL",
+          "sophistication":1,
+          "common": "\\b(src|href|lowsrc|url|content)\\b\\W*?\\bjavascript:",
+          "tests": {
+            "shouldFind":["\" href=\"javascript:alert(1)\"","' url='javascript:alert(1)'","<input type=image src=javascript:","<meta http-equiv=\"refresh\" content=\"javascript:..."],
+            "shouldIgnore":["<h1>hi</h1>","Bob","Script"]
+          },
+          "id": "8"
         }
       ]
     },
@@ -55,13 +85,20 @@
           "sophistication":2,
           "id":"1",
           "common":"(?:[\\;\\|\\`]\\W*?\\bcc|\\b(wget|curl))\\b|\\/cc(?:[\\'\\\"\\|\\;\\`\\-\\s]|$)",
-          "ruby":"(?i:(?:[\\;\\|\\`]\\W*?\\bcc|\\b(wget|curl))\\b|\\/cc(?:[\\'\\\"\\|\\;\\`\\-\\s]|$))"
+          "tests": {
+            "shouldFind":["|wget https://malware.com"],
+            "shouldIgnore":["aB--D_C=","union soldier", "a", "select", "James O'Connor", "Like this or that", "divide and conquer"]
+          }
         },
         {
           "title":"Common Command Attempts",
           "sophistication":1,
           "id":"2",
-          "common":"(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:\\.exe|32)\\b|\\b\\W*?\\\\\\/c)|d(?:\\b\\W*?[\\\\\\/]|\\W*?\\.\\.)|hmod.{0,40}?\\+.{0,3}x))|[\\;\\|\\`]\\W*?\\b(?:(?:c(?:h(?:grp|mod|own|sh)|md|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)\\b|g(?:\\+\\+|cc\\b)))"
+          "common":"(?:\\b(?:(?:n(?:et(?:\\b\\W+?\\blocalgroup|\\.exe)|(?:map|c)\\.exe)|t(?:racer(?:oute|t)|elnet\\.exe|clsh8?|ftp)|(?:w(?:guest|sh)|rcmd|ftp)\\.exe|echo\\b\\W*?\\by+)\\b|c(?:md(?:(?:\\.exe|32)\\b|\\b\\W*?\\/c)|d(?:\\b\\W*?[\\\\/]|\\W*?\\.\\.)|hmod.{0,40}?\\+.{0,3}x))|[\\;\\|\\`]\\W*?\\b(?:(?:c(?:h(?:grp|mod|own|sh)|md|pp)|p(?:asswd|ython|erl|ing|s)|n(?:asm|map|c)|f(?:inger|tp)|(?:kil|mai)l|(?:xte)?rm|ls(?:of)?|telnet|uname|echo|id)\\b|g(?:\\+\\+|cc\b)))",
+          "tests": {
+            "shouldFind":["test|echo hi","abc;nc","`ls /etc/passwd`"],
+            "shouldIgnore":["aB--D_C=","union soldier", "a", "select", "James O'Connor", "Like this or that", "divide and conquer","david;bob"]
+          }
         }
       ]
     },
@@ -71,7 +108,12 @@
         {
           "title":"Common Encoding Obfuscations",
           "sophistication":3,
-          "common": "(?:(?:\\d[\\\"'`\u00b4\u2019\u2018]\\s+[\\\"'`\u00b4\u2019\u2018]\\s+\\d)|(?:^admin\\s*?[\\\"'`\u00b4\u2019\u2018]|(\\/\\*)+[\\\"'`\u00b4\u2019\u2018]+\\s?(?:--|#|\\/\\*|{)?)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?\\b(x?or|div|like|between|and)\\b\\s*?[+<>=(),-]\\s*?[\\d\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[^\\w\\s]?=\\s*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\W*?[+=]+\\W*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=+-]+.*?[\\\"'`\u00b4\u2019\u2018(].*?$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=]+.*?\\d+$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?like\\W+[\\w\\\"'`\u00b4\u2019\u2018(])|(?:\\sis\\s*?0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:[\\\"'`\u00b4\u2019\u2018][<>~]+[\\\"'`\u00b4\u2019\u2018]))",
+          "common": "(?:(?:\\d[\\\"'`\u00b4\u2019\u2018]\\s+[\\\"'`\u00b4\u2019\u2018]\\s+\\d)|(?:^admin\\s*?[\\\"'`\u00b4\u2019\u2018]|(\\/\\*)+[\\\"'`\u00b4\u2019\u2018]+\\s?(?:--|#|\\/\\*|{)?)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?\\b(x?or|div|like|between|and)\\b\\s*?[+<>=(),-]\\s*?[\\d\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[^\\w\\s]?=\\s*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\W*?[+=]+\\W*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=+-]+.*?[\\\"'`\u00b4\u2019\u2018(].*?$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=]+.*?\\d+$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?like\\W+[\\w\\\"'`\u00b4\u2019\u2018(])|(?:\\sis\\s*?0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:[\\\"'`\u00b4\u2019\u2018][<>~]+[\\\"'`\u00b4\u2019\u2018]))","common": "(?:(?:\\d[\\\"'`\u00b4\u2019\u2018]\\s+[\\\"'`\u00b4\u2019\u2018]\\s+\\d)|(?:^admin\\s*?[\\\"'`\u00b4\u2019\u2018]|(\\/\\*)+[\\\"'`\u00b4\u2019\u2018]+\\s?(?:--|#|\\/\\*|{)?)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?\\b(x?or|div|like|between|and)\\b\\s*?[+<>=(),-]\\s*?[\\d\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[^\\w\\s]?=\\s*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\W*?[+=]+\\W*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=+-]+.*?[\\\"'`\u00b4\u2019\u2018(].*?$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=]+.*?\\d+$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?like\\W+[\\w\\\"'`\u00b4\u2019\u2018(])|(?:\\sis\\s*?0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:[\\\"'`\u00b4\u2019\u2018][<>~]+[\\\"'`\u00b4\u2019\u2018]))",
+          "java": "(?:(?:\\d[\\\"'`\u00b4\u2019\u2018]\\s+[\\\"'`\u00b4\u2019\u2018]\\s+\\d)|(?:^admin\\s*?[\\\"'`\u00b4\u2019\u2018]|(\\/\\*)+[\\\"'`\u00b4\u2019\u2018]+\\s?(?:--|#|\\/\\*|\\{)?)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?\\b(x?or|div|like|between|and)\\b\\s*?[+<>=(),-]\\s*?[\\d\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[^\\w\\s]?=\\s*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\W*?[+=]+\\W*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=+-]+.*?[\\\"'`\u00b4\u2019\u2018(].*?$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=]+.*?\\d+$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?like\\W+[\\w\\\"'`\u00b4\u2019\u2018(])|(?:\\sis\\s*?0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:[\\\"'`\u00b4\u2019\u2018][<>~]+[\\\"'`\u00b4\u2019\u2018]))","common": "(?:(?:\\d[\\\"'`\u00b4\u2019\u2018]\\s+[\\\"'`\u00b4\u2019\u2018]\\s+\\d)|(?:^admin\\s*?[\\\"'`\u00b4\u2019\u2018]|(\\/\\*)+[\\\"'`\u00b4\u2019\u2018]+\\s?(?:--|#|\\/\\*|\\{)?)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?\\b(x?or|div|like|between|and)\\b\\s*?[+<>=(),-]\\s*?[\\d\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[^\\w\\s]?=\\s*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\W*?[+=]+\\W*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=+-]+.*?[\\\"'`\u00b4\u2019\u2018(].*?$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=]+.*?\\d+$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?like\\W+[\\w\\\"'`\u00b4\u2019\u2018(])|(?:\\sis\\s*?0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:[\\\"'`\u00b4\u2019\u2018][<>~]+[\\\"'`\u00b4\u2019\u2018]))",
+          "tests": {
+            "shouldFind":["') or ('1'='1--","') or ('1'='1--","1 OR '1'!=0","aa' LIKE md5(1) or '1"],
+            "shouldIgnore":["aB--D_C=","union soldier", "select", "James O'Connor", "Like this or that", "divide and conquer"]
+          },
           "id": "1"
         },
         {
@@ -81,50 +123,80 @@
           "id": "2"
         },
         {
-          "title":"Comment Injection",
+          "title":"Conditional Attempts",
+          "sophistication":3,
+          "common": "(?:[\\s()]case\\s*\\()|(?:\\)\\s*like\\s*\\()|(?:having\\s*[^\\s]+\\s*[^\\w\\s])|(?:if\\s?\\([\\d\\w]\\s*[=<>~])",
+          "tests": {
+            "shouldFind":["' or id= 1 having 1 #1 !"],
+            "shouldIgnore":["aB--D_C=","union soldier", "select", "James O'Connor", "Like this or that", "divide and conquer"]
+          },
+          "id": "7"
+        },
+        {
+          "title":"Union Attempts",
+          "sophistication":3,
+          "java": "(?:union\\s*(?:all|distinct|[(!@]*)\\s*[(\\[]*\\s*select)|(?:\\w+\\s+like\\s+\\\")|(?:like\\s*\"\\%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:\"\\s*[^?\\w\\s=.,;)(]+\\s*[(@\"]*\\s*\\w+\\W+\\w)|(?:select\\s*[\\[\\]()\\s\\w\\.,\"-]+from)|(?:find_in_set\\s*\\()",
+          "ruby": "(?:union\\s*(?:all|distinct|[(!@]*)\\s*[(\\[]*\\s*select)|(?:\\w+\\s+like\\s+\\\")|(?:like\\s*\"\\%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:\"\\s*[^?\\w\\s=.,;)(]+\\s*[(@\"]*\\s*\\w+\\W+\\w)|(?:select\\s*[\\[\\]()\\s\\w\\.,\"-]+from)|(?:find_in_set\\s*\\()",
+          "common": "(?:union\\s*(?:all|distinct|[(!@]*)\\s*[([]*\\s*select)|(?:\\w+\\s+like\\s+\\\")|(?:like\\s*\"\\%)|(?:\"\\s*like\\W*[\"\\d])|(?:\"\\s*(?:n?and|x?or|not |\\|\\||\\&\\&)\\s+[\\s\\w]+=\\s*\\w+\\s*having)|(?:\"\\s*\\*\\s*\\w+\\W+\")|(?:\"\\s*[^?\\w\\s=.,;)(]+\\s*[(@\"]*\\s*\\w+\\W+\\w)|(?:select\\s*[\\[\\]()\\s\\w\\.,\"-]+from)|(?:find_in_set\\s*\\()",
+          "tests": {
+            "shouldFind":["‘union select all 1,2,x,x,x,x —-", "‘union select 1,2,3,x,x,x,x,@@version,x–-","‘union select UTL_INADDR.get_host_address,null,null,null,null from dual–-"],
+            "shouldIgnore":["aB--D_C=","union soldier", "select", "James O'Connor", "Like this or that", "divide and conquer"]
+          },
+          "id": "8"
+        },
+        {
+          "title":"SQL Comment Sequence",
           "sophistication":1,
           "common": "([';]--|--[\\s\\r\\n\\v\\f]|(?:--[^-]*?-)|([^\\-&])#.*?[\\s\\r\\n\\v\\f]|;?\\\\x00)",
+          "tests": {
+            "shouldFind":["'--","1=1;\\x00"],
+            "shouldIgnore":["aB--D_C=","union soldier", "select", "James O'Connor", "Like this or that", "divide and conquer"]
+          },
           "id": "3"
         },
         {
-          "title":"Extraction Attempts 1",
+          "title":"Extraction Attempts",
           "sophistication":1,
           "common": "(?:(?:@.+=\\s*?\\(\\s*?select)|(?:\\d+\\s*?(x?or|div|like|between|and)\\s*?\\d+\\s*?[\\-+])|(?:\\/\\w+;?\\s+(?:having|and|x?or|div|like|between|and|select)\\W)|(?:\\d\\s+group\\s+by.+\\()|(?:(?:;|#|--)\\s*?(?:drop|alter))|(?:(?:;|#|--)\\s*?(?:update|insert)\\s*?\\w{2,})|(?:[^\\w]SET\\s*?@\\w+)|(?:(?:n?and|x?x?or|div|like|between|and|not |\\|\\||\\&\\&)[\\s(]+\\w+[\\s)]*?[!=+]+[\\s\\d]*?[\\\"'`\u00b4\u2019\u2018=()]))",
+          "tests": {
+            "shouldFind":["';Drop table users"],
+            "shouldIgnore":["aB--D_C=","union soldier", "select", "James O'Connor", "Like this or that", "divide and conquer", "Sam; James"]
+          },
           "id": "4"
-        },
-        {
-          "title":"Extraction Attempts 2",
-          "sophistication":2,
-          "pattern": "(?:(?:in\\s*?\\(+\\s*?select)|(?:(?:n?and|x?x?or|div|like|between|and|not |\\|\\||\\&\\&)\\s+[\\s\\w+]+(?:regexp\\s*?\\(|sounds\\s+like\\s*?[\\\"'`\u00b4\u2019\u2018]|[=\\d]+x))|([\\\"'`\u00b4\u2019\u2018]\\s*?\\d\\s*?(?:--|#))|(?:[\\\"'`\u00b4\u2019\u2018][\\%&<>^=]+\\d\\s*?(=|x?or|div|like|between|and))|(?:[\\\"'`\u00b4\u2019\u2018]\\W+[\\w+-]+\\s*?=\\s*?\\d\\W+[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?is\\s*?\\d.+[\\\"'`\u00b4\u2019\u2018]?\\w)|(?:[\\\"'`\u00b4\u2019\u2018]\\|?[\\w-]{3,}[^\\w\\s.,]+[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?is\\s*?[\\d.]+\\s*?\\W.*?[\\\"'`\u00b4\u2019\u2018]))",
-          "id": "5"
-        },
-        {
-          "title":"Extraction Attempts 3",
-          "sophistication":3,
-          "pattern": "(?:(?:\\d[\\\"'`\u00b4\u2019\u2018]\\s+[\\\"'`\u00b4\u2019\u2018]\\s+\\d)|(?:^admin\\s*?[\\\"'`\u00b4\u2019\u2018]|(\\/\\*)+[\\\"'`\u00b4\u2019\u2018]+\\s?(?:--|#|\\/\\*|{)?)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?\\b(x?or|div|like|between|and)\\b\\s*?[+<>=(),-]\\s*?[\\d\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[^\\w\\s]?=\\s*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\W*?[+=]+\\W*?[\\\"'`\u00b4\u2019\u2018])|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=+-]+.*?[\\\"'`\u00b4\u2019\u2018(].*?$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?[!=|][\\d\\s!=]+.*?\\d+$)|(?:[\\\"'`\u00b4\u2019\u2018]\\s*?like\\W+[\\w\\\"'`\u00b4\u2019\u2018(])|(?:\\sis\\s*?0\\W)|(?:where\\s[\\s\\w\\.,-]+\\s=)|(?:[\\\"'`\u00b4\u2019\u2018][<>~]+[\\\"'`\u00b4\u2019\u2018]))",
-          "id": "6"
         }
       ]
     },
     "fpt":{
       "patterns":[
         {
-          "title":"Windows Probing",
-          "sophistication":1,
+          "title":"General Traversal",
+          "sophistication":2,
           "common": "(?:(?:\\/|\\\\)?\\.+(\\/|\\\\)(?:\\.+)?)|(?:\\w+\\.exe\\??\\s)|(?:;\\s*\\w+\\s*\\/[\\w*-]+\\/)|(?:\\d\\.\\dx\\|)|(?:%(?:c0\\.|af\\.|5c\\.))|(?:\\/(?:%2e){2})",
           "ruby": "(?:(?:\\/|\\\\)?\\.+(\\/|\\\\)(?:\\.*))|(?:\\w+\\.exe\\??\\s)|(?:;\\s*\\w+\\s*\\/[\\w*-]+\\/)|(?:\\d\\.\\dx\\|)|(?:%(?:c0\\.|af\\.|5c\\.))|(?:\\/(?:%2e){2})",
+          "tests":{
+            "shouldFind":["/.../.../.../.../.../","\\0../../../../../../etc/passwd","../../../../../../etc/shadow"],
+            "shouldIgnore":["Julie","The quick'o brown... fox.. was. /there"]
+          },
           "id": "1"
         },
         {
-          "title":"Unix Probing",
-          "sophistication":1,
+          "title":"Common System Probing",
+          "sophistication":4,
           "common": "(?:%c0%ae\\/)|(?:(?:\\/|\\\\)(home|conf|usr|etc|proc|opt|s?bin|local|dev|tmp|kern|[br]oot|sys|system|windows|winnt|program|%[a-z_-]{3,}%)(?:\\/|\\\\))|(?:(?:\\/|\\\\)inetpub|localstart\\.asp|boot\\.ini)",
+          "tests":{
+            "shouldFind":["/./././././././././././boot.ini","/home/apache/conf/httpd.conf"],
+            "shouldIgnore":["Julie","The quick'o brown... fox.. was. /there"]
+          },
           "id": "2"
         },
         {
-          "title":"Attempt for /etc/passwd",
+          "title":"Attempt for /etc/passwd, shadow",
           "sophistication":1,
-          "common": "(?:etc\\/\\W*passwd)",
+          "common": "(?:etc\\/\\W*passwd)|(?:etc\\/\\W*shadow)",
+          "tests":{
+            "shouldFind":["/etc/passwd"],
+            "shouldIgnore":["Julie","The quick'o brown... fox.. was. /there"]
+          },
           "id": "3"
         }
       ]
@@ -135,7 +207,12 @@
           "title":"Any Null Byte",
           "sophistication":1,
           "id":"1",
-          "common":"\\0"
+          "common":"\\0",
+          "java":"\u0000",
+          "tests":{
+            "shouldFind":["Duh\u0000","\u0000","\n\rOh\u0000No"],
+            "shouldIgnore":["Julie","The quick'o brown... fox.. was. /there"]
+          }
         }
       ]
     },
@@ -145,7 +222,11 @@
           "title":"Any Line-Break Character",
           "sophistication":1,
           "id":"1",
-          "common":"(\\n|\\r)"
+          "common":"(\\n|\\r)",
+          "tests":{
+            "shouldFind":["Duh\r","\r\n","\n\rOh\\0No"],
+            "shouldIgnore":["Julie","The quick'o brown... fox.. was. /there"]
+          }
         }
       ]
     }

data/lib/tcell_agent/configuration.rb CHANGED Viewed

@@ -108,6 +108,10 @@ module TCellAgent
       read_config_using_env
       read_config_from_file(@config_filename)
+      if ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS"]
+        puts "tCell.io Agent: [DEPRECATED] TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS is deprecated, please switch to TCELL_AGENT_ALLOW_UNENCRYPTED_APPFIREWALL_PAYLOADS."
+      end
       # Because ENV can override this one
       env_unencrypted_firewall =
       if (ENV["TCELL_AGENT_ALLOW_UNENCRYPTED_APPSENSOR_PAYLOADS"] != nil)

data/lib/tcell_agent/policies/appsensor/injection_sensor.rb CHANGED Viewed

@@ -114,7 +114,6 @@ module TCellAgent
             vuln_param,
             appsensor_meta.route_id,
             {"t" => type_of_param}.to_json,
-            appsensor_meta.transaction_id,
             appsensor_meta.session_id,
             appsensor_meta.user_id,
             vuln_value

data/lib/tcell_agent/policies/appsensor/sensor.rb CHANGED Viewed

@@ -13,7 +13,6 @@ module TCellAgent
           parameter,
           appsensor_meta.route_id,
           data,
-          appsensor_meta.transaction_id,
           appsensor_meta.session_id,
           appsensor_meta.user_id,
           payload,

data/lib/tcell_agent/policies/appsensor_policy.rb CHANGED Viewed

@@ -39,17 +39,20 @@ module TCellAgent
           "retr" => RetrSensor,
           "login" => LoginSensor}
-      attr_accessor :policy_id, :options
+      attr_accessor :policy_id, :options, :enabled
       def initialize
         @policy_id = nil
         @options = Hash.new
+        @enabled = false
       end
       def process_meta_event(appsensor_meta)
+        return unless @enabled
         check_request_size(appsensor_meta)
         check_response_size(appsensor_meta)
-        check_response_size(appsensor_meta)
+        check_response_code(appsensor_meta)
         check_params_for_injections(appsensor_meta)
       end
@@ -138,8 +141,13 @@ module TCellAgent
           if policy_json["version"] && policy_json["version"] == 2
             if data_json
-              sensors_json = data_json["sensors"]
-              if sensors_json
+              sensors_json = data_json.fetch("sensors", {})
+              if sensors_json.empty?
+                sensor_policy.enabled = false
+              else
+                sensor_policy.enabled = true
                 DETECTION_POINTS_V2.each do |sensor_name, sensor_class|
                   settings = sensors_json.fetch(sensor_name, {})
                   settings["enabled"] = sensors_json.has_key?(sensor_name)
@@ -151,9 +159,13 @@ module TCellAgent
           else
             if data_json
-              options_json = data_json["options"]
-              if options_json
+              options_json = data_json.fetch("options", {})
+              if options_json.empty?
+                sensor_policy.enabled = false
+              else
+                sensor_policy.enabled = true
                 DETECTION_POINTS_V1.each do |sensor_name|
                   if "req_res_size" == sensor_name
                     enabled = options_json.fetch(sensor_name, false)
@@ -193,7 +205,6 @@ module TCellAgent
                     )
                   end
                 end
               end
             end
           end

data/lib/tcell_agent/policies/patches_policy.rb ADDED Viewed

@@ -0,0 +1,52 @@
+module TCellAgent
+  module Policies
+    class PatchesPolicy
+      attr_accessor :policy_id, :version, :ip_blocking_enabled, :blocked_ips
+      def initialize
+        @policy_id = nil
+        @version = nil
+        @ip_blocking_enabled = false
+        @blocked_ips = {}
+      end
+      def block_ip?(request)
+        @ip_blocking_enabled && @blocked_ips[request.ip]
+      end
+      def self.from_json(policy_json)
+        return nil unless policy_json
+        policy_id = policy_json["policy_id"]
+        raise "Policy ID missing" unless policy_id
+        patches_policy = PatchesPolicy.new
+        patches_policy.policy_id = policy_id
+        patches_policy.version = policy_json["version"]
+        if 1 != patches_policy.version
+          TCellAgent.logger.warn("Patches Policy not supported: #{patches_policy.version}")
+          return patches_policy
+        end
+        data = policy_json["data"]
+        if data
+          blocked_ips = data["blocked_ips"]
+          if blocked_ips
+            blocked_ips.each do |ip_info|
+              if ip_info["ip"]
+                patches_policy.ip_blocking_enabled = true
+                patches_policy.blocked_ips[ip_info["ip"]] = true
+              end
+            end
+          end
+        end
+        patches_policy
+      end
+    end
+  end
+end

data/lib/tcell_agent/rails/middleware/headers_middleware.rb CHANGED Viewed

@@ -29,6 +29,17 @@ module TCellAgent
           def call(env)
             request = Rack::Request.new(env)
+            if TCellAgent.configuration.should_intercept_requests?
+              TCellAgent::Instrumentation.safe_block("Checking for blocked ips") do
+                patches_policy = TCellAgent.policy(TCellAgent::PolicyTypes::Patches)
+                if patches_policy
+                  if patches_policy.block_ip?(request)
+                    return [403, {"Content-Type" => "text/plain"}, ["Forbidden based on referer"]]
+                  end
+                end
+              end
+            end
             response = @app.call(env)
             if TCellAgent.configuration.should_intercept_requests?

data/lib/tcell_agent/sensor_events/appsensor_event.rb CHANGED Viewed

@@ -13,7 +13,6 @@ module TCellAgent
                      param,
                      route_id,
                      data=nil,
-                     transaction_id=nil,
                      session_id=nil,
                      user_id=nil,
                      payload=nil,
@@ -28,7 +27,6 @@ module TCellAgent
         self["m"] = method
         @raw_location = location
         @user_id = user_id
-        @transaction_id = transaction_id
         @raw_session_id = session_id
         @payload = payload
         if pattern
@@ -41,9 +39,6 @@ module TCellAgent
         if @user_id
           self["uid"] = @user_id.to_s
         end
-        if @transaction_id
-          self["tid"] = @transaction_id
-        end
         if @raw_session_id
           hmac_key = Util.getHmacKey()
           self["sid"] = Util.hmac(@raw_session_id, hmac_key)

data/lib/tcell_agent/version.rb CHANGED Viewed

@@ -1,5 +1,5 @@
 # See the file "LICENSE" for the full license governing this code.
 module TCellAgent
-  VERSION = "0.2.16"
+  VERSION = "0.2.17"
 end

data/spec/lib/tcell_agent/appsensor/rules/appsensor_rule_set_spec.rb CHANGED Viewed

@@ -117,6 +117,13 @@ module TCellAgent
             match_data = @rule_set.check_violation("param_name", "evil <script>", {}, true)
             expect(match_data).to eq({"param"=>"param_name", "value"=>"evil <script>", "pattern"=>1})
           end
+          context "uppercasing param value still matches pattern" do
+            it "should return the match" do
+              match_data = @rule_set.check_violation("param_name", "evil <SCRIPT>", {}, true)
+              expect(match_data).to eq({"param"=>"param_name", "value"=>"evil <SCRIPT>", "pattern"=>1})
+            end
+          end
         end
         context "v1_compatability is off" do

data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb CHANGED Viewed

@@ -18,7 +18,7 @@ module TCellAgent
             end
           end
-          context "that is empty" do
+          context "that has empty options" do
             it "should have all sensors disabled" do
               expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
@@ -32,34 +32,44 @@ module TCellAgent
               empty_policy = AppSensorPolicy.from_json(policy_json_empty)
               expect(empty_policy.policy_id).to eq("01a1")
-              expect(empty_policy.options["req_size"]).to_not be_nil
-              expect(empty_policy.options["resp_size"]).to_not be_nil
-              expect(empty_policy.options["resp_codes"]).to_not be_nil
-              expect(empty_policy.options["xss"]).to_not be_nil
-              expect(empty_policy.options["sqli"]).to_not be_nil
-              expect(empty_policy.options["cmdi"]).to_not be_nil
-              expect(empty_policy.options["fpt"]).to_not be_nil
-              expect(empty_policy.options["nullbyte"]).to_not be_nil
-              expect(empty_policy.options["retr"]).to_not be_nil
-              expect(empty_policy.options["login"]).to_not be_nil
+              expect(empty_policy.enabled).to eq(false)
+              expect(empty_policy.options["req_size"]).to be_nil
+              expect(empty_policy.options["resp_size"]).to be_nil
+              expect(empty_policy.options["resp_codes"]).to be_nil
+              expect(empty_policy.options["xss"]).to be_nil
+              expect(empty_policy.options["sqli"]).to be_nil
+              expect(empty_policy.options["cmdi"]).to be_nil
+              expect(empty_policy.options["fpt"]).to be_nil
+              expect(empty_policy.options["nullbyte"]).to be_nil
+              expect(empty_policy.options["retr"]).to be_nil
+              expect(empty_policy.options["login"]).to be_nil
+            end
+          end
-              expect(empty_policy.options["req_size"].enabled).to eq(false)
-              expect(empty_policy.options["resp_size"].enabled).to eq(false)
-              expect(empty_policy.options["resp_codes"].enabled).to eq(false)
-              expect(empty_policy.options["xss"].enabled).to eq(false)
-              expect(empty_policy.options["sqli"].enabled).to eq(false)
-              expect(empty_policy.options["cmdi"].enabled).to eq(false)
-              expect(empty_policy.options["fpt"].enabled).to eq(false)
-              expect(empty_policy.options["nullbyte"].enabled).to eq(false)
-              expect(empty_policy.options["retr"].enabled).to eq(false)
-              expect(empty_policy.options["login"].enabled).to eq(false)
+          context "that has no options" do
+            it "should have all sensors disabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
-              expect(empty_policy.options["xss"].v1_compatability_enabled).to eq(true)
-              expect(empty_policy.options["sqli"].v1_compatability_enabled).to eq(true)
-              expect(empty_policy.options["cmdi"].v1_compatability_enabled).to eq(true)
-              expect(empty_policy.options["fpt"].v1_compatability_enabled).to eq(true)
-              expect(empty_policy.options["nullbyte"].v1_compatability_enabled).to eq(true)
-              expect(empty_policy.options["retr"].v1_compatability_enabled).to eq(true)
+              policy_json_empty = {
+                "policy_id" => "01a1",
+                "data" => {
+                }
+              }
+              empty_policy = AppSensorPolicy.from_json(policy_json_empty)
+              expect(empty_policy.policy_id).to eq("01a1")
+              expect(empty_policy.enabled).to eq(false)
+              expect(empty_policy.options["req_size"]).to be_nil
+              expect(empty_policy.options["resp_size"]).to be_nil
+              expect(empty_policy.options["resp_codes"]).to be_nil
+              expect(empty_policy.options["xss"]).to be_nil
+              expect(empty_policy.options["sqli"]).to be_nil
+              expect(empty_policy.options["cmdi"]).to be_nil
+              expect(empty_policy.options["fpt"]).to be_nil
+              expect(empty_policy.options["nullbyte"]).to be_nil
+              expect(empty_policy.options["retr"]).to be_nil
+              expect(empty_policy.options["login"]).to be_nil
             end
           end
@@ -221,7 +231,7 @@ module TCellAgent
             end
           end
-          context "that is empty" do
+          context "that has no sensors" do
             it "should have all sensors disabled" do
               expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
@@ -229,41 +239,52 @@ module TCellAgent
                 "policy_id" => "01a1",
                 "version" => 2,
                 "data" => {
-                  "sensors" => {}
                 }
               }
               empty_policy = AppSensorPolicy.from_json(policy_json_empty)
               expect(empty_policy.policy_id).to eq("01a1")
-              expect(empty_policy.options["req_size"]).to_not be_nil
-              expect(empty_policy.options["resp_size"]).to_not be_nil
-              expect(empty_policy.options["resp_codes"]).to_not be_nil
-              expect(empty_policy.options["xss"]).to_not be_nil
-              expect(empty_policy.options["sqli"]).to_not be_nil
-              expect(empty_policy.options["cmdi"]).to_not be_nil
-              expect(empty_policy.options["fpt"]).to_not be_nil
-              expect(empty_policy.options["nullbyte"]).to_not be_nil
-              expect(empty_policy.options["retr"]).to_not be_nil
-              expect(empty_policy.options["login"]).to_not be_nil
+              expect(empty_policy.enabled).to eq(false)
+              expect(empty_policy.options["req_size"]).to be_nil
+              expect(empty_policy.options["resp_size"]).to be_nil
+              expect(empty_policy.options["resp_codes"]).to be_nil
+              expect(empty_policy.options["xss"]).to be_nil
+              expect(empty_policy.options["sqli"]).to be_nil
+              expect(empty_policy.options["cmdi"]).to be_nil
+              expect(empty_policy.options["fpt"]).to be_nil
+              expect(empty_policy.options["nullbyte"]).to be_nil
+              expect(empty_policy.options["retr"]).to be_nil
+              expect(empty_policy.options["login"]).to be_nil
+            end
+          end
-              expect(empty_policy.options["req_size"].enabled).to eq(false)
-              expect(empty_policy.options["resp_size"].enabled).to eq(false)
-              expect(empty_policy.options["resp_codes"].enabled).to eq(false)
-              expect(empty_policy.options["xss"].enabled).to eq(false)
-              expect(empty_policy.options["sqli"].enabled).to eq(false)
-              expect(empty_policy.options["cmdi"].enabled).to eq(false)
-              expect(empty_policy.options["fpt"].enabled).to eq(false)
-              expect(empty_policy.options["nullbyte"].enabled).to eq(false)
-              expect(empty_policy.options["retr"].enabled).to eq(false)
-              expect(empty_policy.options["login"].enabled).to eq(false)
+          context "that has empty sensors" do
+            it "should have all sensors disabled" do
+              expect_any_instance_of(AppSensorRuleManager).to receive(:load_default_rules_file)
+              policy_json_empty = {
+                "policy_id" => "01a1",
+                "version" => 2,
+                "data" => {
+                  "sensors" => {}
+                }
+              }
+              empty_policy = AppSensorPolicy.from_json(policy_json_empty)
-              expect(empty_policy.options["xss"].v1_compatability_enabled).to eq(false)
-              expect(empty_policy.options["sqli"].v1_compatability_enabled).to eq(false)
-              expect(empty_policy.options["cmdi"].v1_compatability_enabled).to eq(false)
-              expect(empty_policy.options["fpt"].v1_compatability_enabled).to eq(false)
-              expect(empty_policy.options["nullbyte"].v1_compatability_enabled).to eq(false)
-              expect(empty_policy.options["retr"].v1_compatability_enabled).to eq(false)
+              expect(empty_policy.policy_id).to eq("01a1")
+              expect(empty_policy.enabled).to eq(false)
+              expect(empty_policy.options["req_size"]).to be_nil
+              expect(empty_policy.options["resp_size"]).to be_nil
+              expect(empty_policy.options["resp_codes"]).to be_nil
+              expect(empty_policy.options["xss"]).to be_nil
+              expect(empty_policy.options["sqli"]).to be_nil
+              expect(empty_policy.options["cmdi"]).to be_nil
+              expect(empty_policy.options["fpt"]).to be_nil
+              expect(empty_policy.options["nullbyte"]).to be_nil
+              expect(empty_policy.options["retr"]).to be_nil
+              expect(empty_policy.options["login"]).to be_nil
             end
           end

data/spec/lib/tcell_agent/policies/patches_policy_spec.rb ADDED Viewed

@@ -0,0 +1,143 @@
+require 'spec_helper'
+module TCellAgent
+  module Policies
+    describe PatchesPolicy do
+      describe "#from_json" do
+        context "with a nil policy" do
+          it "should return nil" do
+            expect(PatchesPolicy.from_json(nil)).to be_nil
+          end
+        end
+        context "with an empty policy" do
+          it "should raise a policy missing error" do
+            expect {
+              PatchesPolicy.from_json({})
+            }.to raise_error(RuntimeError)
+          end
+        end
+        context "with an empty version" do
+          it "should have empty version" do
+            patches = PatchesPolicy.from_json({ "policy_id" => "policy_id" })
+            expect(patches.policy_id).to eq("policy_id")
+            expect(patches.version).to be_nil
+            expect(patches.ip_blocking_enabled).to eq(false)
+            expect(patches.blocked_ips).to eq({})
+          end
+        end
+        context "with an empty data" do
+          it "should have disabled ip blocking" do
+            patches = PatchesPolicy.from_json({
+              "policy_id" => "policy_id",
+              "version" => 1
+            })
+            expect(patches.policy_id).to eq("policy_id")
+            expect(patches.version).to eq(1)
+            expect(patches.ip_blocking_enabled).to eq(false)
+            expect(patches.blocked_ips).to eq({})
+          end
+        end
+        context "with an empty blocked_ips" do
+          it "should have disabled ip blocking" do
+            patches = PatchesPolicy.from_json({
+              "policy_id" => "policy_id",
+              "version" => 1,
+              "data" => {}
+            })
+            expect(patches.policy_id).to eq("policy_id")
+            expect(patches.version).to eq(1)
+            expect(patches.ip_blocking_enabled).to eq(false)
+            expect(patches.blocked_ips).to eq({})
+          end
+        end
+        context "with blocked_ips" do
+          context "as an empty list" do
+            it "should have ip blocking disabled" do
+              patches = PatchesPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "blocked_ips" => []
+                }
+              })
+              expect(patches.policy_id).to eq("policy_id")
+              expect(patches.version).to eq(1)
+              expect(patches.ip_blocking_enabled).to eq(false)
+              expect(patches.blocked_ips).to eq({})
+            end
+          end
+          context "a non empty list" do
+            it "should have ip blocking enabled" do
+              patches = PatchesPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "blocked_ips" => [
+                    {"ip" => "0.0.0.0"},
+                    {"ip" => "1.1.1.1"}
+                  ]
+                }
+              })
+              expect(patches.policy_id).to eq("policy_id")
+              expect(patches.version).to eq(1)
+              expect(patches.ip_blocking_enabled).to eq(true)
+              expect(patches.blocked_ips).to eq({"0.0.0.0"=>true, "1.1.1.1"=>true})
+            end
+            context "with incorrect key names" do
+              it "should skip bad keys" do
+                patches = PatchesPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "blocked_ips" => [
+                      {"ip_wrong" => "0.0.0.0"},
+                      {"ip" => "1.1.1.1"}
+                    ]
+                  }
+                })
+                expect(patches.policy_id).to eq("policy_id")
+                expect(patches.version).to eq(1)
+                expect(patches.ip_blocking_enabled).to eq(true)
+                expect(patches.blocked_ips).to eq({"1.1.1.1"=>true})
+              end
+            end
+            context "with a wrong version number" do
+              it "should have ip blocking disabled" do
+                logger = double("logger")
+                expect(TCellAgent).to receive(:logger).and_return(logger)
+                expect(logger).to receive(:warn).with("Patches Policy not supported: 2")
+                patches = PatchesPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 2,
+                  "data" => {
+                    "blocked_ips" => [
+                      {"ip" => "0.0.0.0"},
+                      {"ip" => "1.1.1.1"}
+                    ]
+                  }
+                })
+                expect(patches.policy_id).to eq("policy_id")
+                expect(patches.version).to eq(2)
+                expect(patches.ip_blocking_enabled).to eq(false)
+                expect(patches.blocked_ips).to eq({})
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb CHANGED Viewed

@@ -63,7 +63,7 @@ module TCellAgent
                 TCellAgent.empty_event_queue
               end
               it "alerts on get xss payload" do
-                response = request.get("/foo?xyz=%3Cscript%3Ealert(1)%3C%2Fscript%3E", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
+                response = request.get("/foo?xyz=%3CSCRIPT%3Ealert(1)%3C%2Fscript%3E", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
                 expected_as = {
                   "event_type"=>"as",
                   "dp"=>"xss",
@@ -71,12 +71,11 @@ module TCellAgent
                   "remote_addr"=>"1.3.3.4",
                   "m"=>"GET",
                   "pattern"=>"1",
-                  "loc"=>"http://example.org/foo?xyz=",
-                  "tid"=>"a-b-c-d-e-f"}
+                  "loc"=>"http://example.org/foo?xyz="}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
               it "alerts on post xss payload" do
-                response = request.post("/foo", :input => "x=<script>alert(1)</script>", 'REMOTE_ADDR' => '1.2.3.4,3.4.5.6')
+                response = request.post("/foo", :input => "x=<SCRIPT>alert(1)</SCRIPT>", 'REMOTE_ADDR' => '1.2.3.4,3.4.5.6')
                 expected_as = {
                   "event_type"=>"as",
                   "dp"=>"xss",
@@ -84,8 +83,7 @@ module TCellAgent
                   "remote_addr"=>"1.2.3.4",
                   "m"=>"POST",
                   "pattern"=>"1",
-                  "loc"=>"http://example.org/foo",
-                  "tid"=>"a-b-c-d-e-f"}
+                  "loc"=>"http://example.org/foo"}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end #/it
               it "alerts on get xss payload with route_id" do
@@ -98,8 +96,7 @@ module TCellAgent
                   "rou"=>"myrouteid",
                   "m"=>"GET",
                   "pattern"=>"1",
-                  "loc"=>"http://example.org/foo?xyz=",
-                  "tid"=>"a-b-c-d-e-f"}
+                  "loc"=>"http://example.org/foo?xyz="}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
               it "checks that payload is sent in xss with route_id" do
@@ -115,7 +112,6 @@ module TCellAgent
                   "m"=>"GET",
                   "pattern"=>"1",
                   "loc"=>"http://example.org/foo?xyz=",
-                  "tid"=>"a-b-c-d-e-f",
                   "payload"=>"<script>alert(1)</script>"}
                 TCellAgent.configuration.allow_unencrypted_appfirewall_payloads= old_uap
                 expect(TCellAgent.event_queue).to include(expected_as)
@@ -146,8 +142,7 @@ module TCellAgent
                   "remote_addr"=>"1.3.3.4",
                   "m"=>"GET",
                   "pattern"=>"1",
-                  "loc"=>"http://example.org/foo?xyz=&def=",
-                  "tid"=>"a-b-c-d-e-f"}
+                  "loc"=>"http://example.org/foo?xyz=&def="}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
             end #/conext
@@ -166,7 +161,7 @@ module TCellAgent
                 TCellAgent.empty_event_queue
               end
               it "alerts on most obvious payload" do
-                response = request.get("/foo?xyz=/etc/passwd", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
+                response = request.get("/foo?xyz=/ETC/PASSWD", 'REMOTE_ADDR' => '1.3.3.4,3.4.5.6')
                 expected_as = {
                   "event_type"=>"as",
                   "dp"=>"fpt",
@@ -174,8 +169,7 @@ module TCellAgent
                   "remote_addr"=>"1.3.3.4",
                   "m"=>"GET",
                   "pattern"=>"2",
-                  "loc"=>"http://example.org/foo?xyz=",
-                  "tid"=>"a-b-c-d-e-f"}
+                  "loc"=>"http://example.org/foo?xyz="}
                 expect(TCellAgent.event_queue).to include(expected_as)
               end
               it "checks that payload is sent" do
@@ -190,7 +184,6 @@ module TCellAgent
                   "m"=>"GET",
                   "pattern"=>"2",
                   "loc"=>"http://example.org/foo?xyz=",
-                  "tid"=>"a-b-c-d-e-f",
                   "payload"=>"/etc/passwd"}
                 TCellAgent.configuration.allow_unencrypted_appfirewall_payloads = old_uap
                 expect(TCellAgent.event_queue).to include(expected_as)

metadata CHANGED Viewed

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: tcell_agent
 version: !ruby/object:Gem::Version
-  version: 0.2.16
+  version: 0.2.17
 platform: ruby
 authors:
 - Garrett
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2016-05-20 00:00:00.000000000 Z
+date: 2016-06-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rest-client
@@ -155,6 +155,7 @@ files:
 - lib/tcell_agent/policies/http_redirect_policy.rb
 - lib/tcell_agent/policies/http_tx_policy.rb
 - lib/tcell_agent/policies/login_fraud_policy.rb
+- lib/tcell_agent/policies/patches_policy.rb
 - lib/tcell_agent/policies/secure_headers_policy.rb
 - lib/tcell_agent/rails/auth/authlogic.rb
 - lib/tcell_agent/rails/auth/devise.rb
@@ -267,6 +268,7 @@ files:
 - spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb
 - spec/lib/tcell_agent/policies/http_tx_policy_spec.rb
 - spec/lib/tcell_agent/policies/login_policy_spec.rb
+- spec/lib/tcell_agent/policies/patches_policy_spec.rb
 - spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb
 - spec/lib/tcell_agent/rails/logger_spec.rb
 - spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb
@@ -390,6 +392,7 @@ test_files:
 - spec/lib/tcell_agent/policies/http_redirect_policy_spec.rb
 - spec/lib/tcell_agent/policies/http_tx_policy_spec.rb
 - spec/lib/tcell_agent/policies/login_policy_spec.rb
+- spec/lib/tcell_agent/policies/patches_policy_spec.rb
 - spec/lib/tcell_agent/policies/secure_headers_policy_spec.rb
 - spec/lib/tcell_agent/rails/logger_spec.rb
 - spec/lib/tcell_agent/rails/middleware/appsensor_middleware_spec.rb