@oneuptime/common 12.0.24 → 12.0.26

package/Tests/Utils/SecurityEvent/ThreatIntel/StixPatternParser.test.ts

@@ -0,0 +1,281 @@
+import StixPatternParser, {
+  ParsedIndicatorValue,
+} from "../../../../Utils/SecurityEvent/ThreatIntel/StixPatternParser";
+import { ThreatIntelIndicatorType } from "../../../../Types/SecurityEvent/ThreatIntelConstants";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * The STIX pattern subset contract: plain IOC equality parses into
+ * normalized (lowercased, deduped) values; everything else returns null,
+ * all-or-nothing — a half-translated AND pattern would match MORE than
+ * its author intended, which for a detection feed is the dangerous
+ * direction. These tests pin both sides of that line, because the parser
+ * is what stands between a third-party feed's arbitrary text and this
+ * platform's match semantics.
+ */
+
+function parse(pattern: string): Array<ParsedIndicatorValue> | null {
+  return StixPatternParser.parse(pattern);
+}
+
+describe("StixPatternParser — supported patterns", () => {
+  test("parses a single ipv4 comparison", () => {
+    expect(parse("[ipv4-addr:value = '198.51.100.7']")).toEqual([
+      {
+        type: ThreatIntelIndicatorType.Ipv4Address,
+        value: "198.51.100.7",
+      },
+    ]);
+  });
+
+  test("parses every supported value path onto its indicator type", () => {
+    const cases: Array<[string, ThreatIntelIndicatorType, string]> = [
+      [
+        "[ipv6-addr:value = '2001:db8::1']",
+        ThreatIntelIndicatorType.Ipv6Address,
+        "2001:db8::1",
+      ],
+      [
+        "[domain-name:value = 'evil.example']",
+        ThreatIntelIndicatorType.DomainName,
+        "evil.example",
+      ],
+      [
+        "[url:value = 'http://evil.example/path']",
+        ThreatIntelIndicatorType.Url,
+        "http://evil.example/path",
+      ],
+      [
+        "[email-addr:value = 'attacker@evil.example']",
+        ThreatIntelIndicatorType.EmailAddress,
+        "attacker@evil.example",
+      ],
+    ];
+
+    for (const [pattern, type, value] of cases) {
+      expect(parse(pattern)).toEqual([{ type, value }]);
+    }
+  });
+
+  test("parses file hash paths in single-quoted, double-quoted and bare spellings", () => {
+    const sha256: string = "a".repeat(64);
+
+    expect(parse(`[file:hashes.'SHA-256' = '${sha256}']`)).toEqual([
+      {
+        type: ThreatIntelIndicatorType.FileHashSha256,
+        value: sha256,
+      },
+    ]);
+
+    expect(parse(`[file:hashes."SHA-1" = 'ABCDEF01']`)).toEqual([
+      {
+        type: ThreatIntelIndicatorType.FileHashSha1,
+        value: "abcdef01",
+      },
+    ]);
+
+    expect(
+      parse("[file:hashes.MD5 = 'D41D8CD98F00B204E9800998ECF8427E']"),
+    ).toEqual([
+      {
+        type: ThreatIntelIndicatorType.FileHashMd5,
+        value: "d41d8cd98f00b204e9800998ecf8427e",
+      },
+    ]);
+  });
+
+  test("lowercases and trims values — indicators store the canonical form once", () => {
+    expect(parse("[domain-name:value = '  EVIL.Example  ']")).toEqual([
+      {
+        type: ThreatIntelIndicatorType.DomainName,
+        value: "evil.example",
+      },
+    ]);
+  });
+
+  test("parses OR-combined comparisons inside one observation expression", () => {
+    expect(
+      parse(
+        "[domain-name:value = 'evil.example' OR domain-name:value = 'evil2.example']",
+      ),
+    ).toEqual([
+      {
+        type: ThreatIntelIndicatorType.DomainName,
+        value: "evil.example",
+      },
+      {
+        type: ThreatIntelIndicatorType.DomainName,
+        value: "evil2.example",
+      },
+    ]);
+  });
+
+  test("parses OR across observation expressions and mixed types", () => {
+    expect(
+      parse(
+        "[ipv4-addr:value = '198.51.100.7'] OR [url:value = 'http://evil.example/x']",
+      ),
+    ).toEqual([
+      {
+        type: ThreatIntelIndicatorType.Ipv4Address,
+        value: "198.51.100.7",
+      },
+      {
+        type: ThreatIntelIndicatorType.Url,
+        value: "http://evil.example/x",
+      },
+    ]);
+  });
+
+  test("dedupes repeated values case-insensitively across expressions", () => {
+    expect(
+      parse(
+        "[domain-name:value = 'evil.example' OR domain-name:value = 'EVIL.EXAMPLE'] OR [domain-name:value = 'evil.example']",
+      ),
+    ).toEqual([
+      {
+        type: ThreatIntelIndicatorType.DomainName,
+        value: "evil.example",
+      },
+    ]);
+  });
+
+  test("handles escaped quotes and backslashes inside values", () => {
+    expect(parse("[url:value = 'http://evil.example/a\\'b']")).toEqual([
+      {
+        type: ThreatIntelIndicatorType.Url,
+        value: "http://evil.example/a'b",
+      },
+    ]);
+
+    expect(parse("[url:value = 'c:\\\\temp']")).toEqual([
+      {
+        type: ThreatIntelIndicatorType.Url,
+        value: "c:\\temp",
+      },
+    ]);
+  });
+
+  test("a value containing the word OR inside quotes does not split the comparison", () => {
+    expect(parse("[url:value = 'http://evil.example/a OR b']")).toEqual([
+      {
+        type: ThreatIntelIndicatorType.Url,
+        value: "http://evil.example/a or b",
+      },
+    ]);
+  });
+
+  test("tolerates whitespace, newlines, and redundant parentheses around comparisons", () => {
+    expect(
+      parse(
+        "[ (ipv4-addr:value = '198.51.100.7') OR\n  (ipv4-addr:value = '198.51.100.8') ]",
+      ),
+    ).toEqual([
+      {
+        type: ThreatIntelIndicatorType.Ipv4Address,
+        value: "198.51.100.7",
+      },
+      {
+        type: ThreatIntelIndicatorType.Ipv4Address,
+        value: "198.51.100.8",
+      },
+    ]);
+  });
+
+  test("case-insensitive OR keyword and uppercase object types", () => {
+    expect(
+      parse(
+        "[IPV4-ADDR:value = '198.51.100.7' or ipv4-addr:value = '198.51.100.8']",
+      ),
+    ).toEqual([
+      {
+        type: ThreatIntelIndicatorType.Ipv4Address,
+        value: "198.51.100.7",
+      },
+      {
+        type: ThreatIntelIndicatorType.Ipv4Address,
+        value: "198.51.100.8",
+      },
+    ]);
+  });
+});
+
+describe("StixPatternParser — unsupported patterns return null, whole", () => {
+  test("empty and garbage input", () => {
+    expect(parse("")).toBeNull();
+    expect(parse("   ")).toBeNull();
+    expect(parse("not a pattern at all")).toBeNull();
+    expect(parse("[]")).toBeNull();
+  });
+
+  test("AND between comparisons", () => {
+    expect(
+      parse(
+        "[ipv4-addr:value = '198.51.100.7' AND domain-name:value = 'evil.example']",
+      ),
+    ).toBeNull();
+  });
+
+  test("AND / FOLLOWEDBY between observation expressions", () => {
+    expect(
+      parse(
+        "[ipv4-addr:value = '198.51.100.7'] AND [domain-name:value = 'evil.example']",
+      ),
+    ).toBeNull();
+    expect(
+      parse(
+        "[ipv4-addr:value = '198.51.100.7'] FOLLOWEDBY [domain-name:value = 'evil.example']",
+      ),
+    ).toBeNull();
+  });
+
+  test("temporal qualifiers", () => {
+    expect(
+      parse("[ipv4-addr:value = '198.51.100.7'] REPEATS 5 TIMES"),
+    ).toBeNull();
+    expect(
+      parse("[ipv4-addr:value = '198.51.100.7'] WITHIN 120 SECONDS"),
+    ).toBeNull();
+  });
+
+  test("negation and non-equality operators", () => {
+    expect(parse("[ipv4-addr:value != '198.51.100.7']")).toBeNull();
+    expect(parse("[NOT ipv4-addr:value = '198.51.100.7']")).toBeNull();
+    expect(parse("[url:value LIKE 'http://evil%']")).toBeNull();
+    expect(parse("[url:value MATCHES '^http']")).toBeNull();
+    expect(parse("[ipv4-addr:value ISSUBSET '198.51.100.0/24']")).toBeNull();
+  });
+
+  test("unsupported object paths", () => {
+    expect(parse("[process:name = 'evil.exe']")).toBeNull();
+    expect(parse("[windows-registry-key:key = 'HKLM\\\\x']")).toBeNull();
+    expect(parse("[file:name = 'evil.exe']")).toBeNull();
+    expect(parse("[file:hashes.SSDEEP = 'x']")).toBeNull();
+    expect(parse("[ipv4-addr:x_custom = '198.51.100.7']")).toBeNull();
+  });
+
+  test("one unsupported comparison poisons the whole pattern — no partial extraction", () => {
+    expect(
+      parse("[ipv4-addr:value = '198.51.100.7' OR process:name = 'evil.exe']"),
+    ).toBeNull();
+  });
+
+  test("unterminated string literals and unbalanced brackets", () => {
+    expect(parse("[ipv4-addr:value = '198.51.100.7]")).toBeNull();
+    expect(parse("[ipv4-addr:value = '198.51.100.7'")).toBeNull();
+    expect(parse("ipv4-addr:value = '198.51.100.7']")).toBeNull();
+  });
+
+  test("empty values are not indicators", () => {
+    expect(parse("[domain-name:value = '']")).toBeNull();
+    expect(parse("[domain-name:value = '   ']")).toBeNull();
+  });
+
+  test("stray text between observation expressions", () => {
+    expect(
+      parse(
+        "[ipv4-addr:value = '198.51.100.7'] garbage [domain-name:value = 'evil.example']",
+      ),
+    ).toBeNull();
+  });
+});

package/Tests/Utils/Telemetry/CrossSignalScope.test.ts

@@ -9,6 +9,12 @@ import MetricExplorerUrl, {
   SerializedMetricQuery,
 } from "../../../Utils/Metrics/MetricExplorerUrl";
 import TimeRange from "../../../Types/Time/TimeRange";
+import {
+  SearchToken,
+  SearchTokenType,
+  SearchValueOperator,
+  parseSearchQuery,
+} from "../../../Types/Telemetry/TelemetrySearchQuery";
 import { describe, expect, test } from "@jest/globals";
 
 /*
@@ -43,11 +49,11 @@ function fullScope(): TelemetryCrossSignalScope {
 }
 
 /*
- * Minimal replica of the traces explorer's search parsing — the tokenizer
- * regex, quote merging, `@attr:value` / `field:value` branches and the `~`
- * contains marker are copied from TracesViewer.tsx parseSearch (~L515-624)
- * so a grammar drift over there fails these fixtures instead of silently
- * breaking deep links.
+ * The traces explorer parses its search bar with the SHARED grammar
+ * (Common/Types/Telemetry/TelemetrySearchQuery), so these fixtures read the
+ * emitted search string back through that same parser rather than through a
+ * copy of a tokenizer that can drift. Only the trace-side vocabulary is local:
+ * which bare names are columns (TracesViewer's TRACE_FIELD_ALIAS_MAP).
  */
 interface ParsedTraceSearch {
   fieldFilters: Record<string, Array<string>>;
@@ -56,13 +62,17 @@ interface ParsedTraceSearch {
   freeText: Array<string>;
 }
 
-const TRACE_KNOWN_FIELD_KEYS: Record<string, string> = {
+const TRACE_FIELD_ALIASES: Record<string, string> = {
   service: "primaryEntityId",
   trace: "traceId",
   span: "spanId",
 };
 
-function parseTraceSearchReplica(raw: string): ParsedTraceSearch {
+const TRACE_KNOWN_FIELD_KEYS: Set<string> = new Set(
+  Object.keys(TRACE_FIELD_ALIASES),
+);
+
+function parseTraceSearch(raw: string): ParsedTraceSearch {
   const result: ParsedTraceSearch = {
     fieldFilters: {},
     attributes: {},
@@ -70,50 +80,37 @@ function parseTraceSearchReplica(raw: string): ParsedTraceSearch {
     freeText: [],
   };
 
-  const rawTokens: Array<string> =
-    raw.match(/@?\S+:~?"[^"]*"|@\S+:[^\s]+|\S+/g) || [];
+  const tokens: Array<SearchToken> = parseSearchQuery(raw, {
+    knownFieldKeys: TRACE_KNOWN_FIELD_KEYS,
+    fieldAliases: TRACE_FIELD_ALIASES,
+  });
 
-  const stripQuotes: (s: string) => string = (s: string): string => {
-    if (s.length >= 2 && s.startsWith('"') && s.endsWith('"')) {
-      return s.slice(1, -1);
+  for (const token of tokens) {
+    if (token.type === SearchTokenType.FreeText) {
+      result.freeText.push(token.predicate.value);
+      continue;
     }
-    return s;
-  };
-
-  for (const token of rawTokens) {
-    const attrMatch: RegExpMatchArray | null = token.match(/^@([^:]+):(.*)$/);
 
-    if (attrMatch) {
-      const attrValue: string = stripQuotes(attrMatch[2]!);
+    /*
+     * A serialized scope only ever emits exact values, so anything else means
+     * the escaping let an operator through — bucketed separately so a fixture
+     * that asserts an exact match cannot pass on a contains.
+     */
+    if (token.predicate.operator !== SearchValueOperator.Equals) {
+      result.attributeSearches[token.key] = token.predicate.value;
+      continue;
+    }
 
-      if (attrValue.startsWith("~")) {
-        result.attributeSearches[attrMatch[1]!] = stripQuotes(
-          attrValue.substring(1),
-        );
-      } else if (attrValue.length > 0) {
-        result.attributes[attrMatch[1]!] = attrValue;
-      }
+    if (token.type === SearchTokenType.Attribute) {
+      result.attributes[token.key] = token.predicate.value;
       continue;
     }
 
-    const fieldMatch: RegExpMatchArray | null = token.match(/^([^:]+):(.*)$/);
-
-    if (fieldMatch) {
-      const fieldName: string = fieldMatch[1]!.toLowerCase();
-      const fieldValue: string = stripQuotes(fieldMatch[2]!);
-      const backendField: string | undefined =
-        TRACE_KNOWN_FIELD_KEYS[fieldName];
-
-      if (backendField && fieldValue.length > 0) {
-        if (!result.fieldFilters[backendField]) {
-          result.fieldFilters[backendField] = [];
-        }
-        result.fieldFilters[backendField]!.push(fieldValue);
-        continue;
-      }
+    if (!result.fieldFilters[token.key]) {
+      result.fieldFilters[token.key] = [];
     }
 
-    result.freeText.push(token);
+    result.fieldFilters[token.key]!.push(token.predicate.value);
   }
 
   return result;
@@ -347,7 +344,7 @@ describe("toTracesExplorerQueryParams", () => {
       const result: CrossSignalQueryParams =
         toTracesExplorerQueryParams(fullScope());
 
-      const parsed: ParsedTraceSearch = parseTraceSearchReplica(
+      const parsed: ParsedTraceSearch = parseTraceSearch(
         result.params["search"] as string,
       );
 
@@ -397,7 +394,7 @@ describe("toTracesExplorerQueryParams", () => {
 
       expect(result.params["search"]).toBe('@db.statement:"SELECT wp_options"');
 
-      const parsed: ParsedTraceSearch = parseTraceSearchReplica(
+      const parsed: ParsedTraceSearch = parseTraceSearch(
         result.params["search"] as string,
       );
 
@@ -415,7 +412,7 @@ describe("toTracesExplorerQueryParams", () => {
         "@url.full:https://oneuptime.com:443/status",
       );
 
-      const parsed: ParsedTraceSearch = parseTraceSearchReplica(
+      const parsed: ParsedTraceSearch = parseTraceSearch(
         result.params["search"] as string,
       );
 
@@ -431,7 +428,7 @@ describe("toTracesExplorerQueryParams", () => {
 
       expect(result.params["search"]).toBe("@user.email:ünïcødé@example.com");
 
-      const parsed: ParsedTraceSearch = parseTraceSearchReplica(
+      const parsed: ParsedTraceSearch = parseTraceSearch(
         result.params["search"] as string,
       );
 
@@ -440,33 +437,59 @@ describe("toTracesExplorerQueryParams", () => {
       });
     });
 
-    test("values containing a double quote fall back to a filters chip (the DSL has no escape)", () => {
+    test("values containing a double quote ride an escaped token", () => {
       const result: CrossSignalQueryParams = toTracesExplorerQueryParams({
         attributes: { "db.statement": 'SELECT "id" FROM users' },
       });
 
-      expect(result.params["search"]).toBeUndefined();
-      expect(JSON.parse(result.params["filters"] as string)).toEqual([
-        ["attributes.db.statement", 'SELECT "id" FROM users'],
-      ]);
-      // A fallback is a carried filter, not a dropped one.
+      expect(result.params["search"]).toBe(
+        '@db.statement:"SELECT \\"id\\" FROM users"',
+      );
+      expect(result.params["filters"]).toBeUndefined();
       expect(result.dropped).toEqual([]);
+
+      const parsed: ParsedTraceSearch = parseTraceSearch(
+        result.params["search"] as string,
+      );
+
+      expect(parsed.attributes).toEqual({
+        "db.statement": 'SELECT "id" FROM users',
+      });
     });
 
-    test("values starting with ~ fall back to a chip (quoting cannot protect the contains marker)", () => {
+    test("a leading ~ is escaped rather than flipping the operator", () => {
       /*
-       * parseSearch strips quotes BEFORE the startsWith("~") check
-       * (TracesViewer.tsx), so `@home:"~/dir"` would flip the exact match
-       * into a contains match on "/dir".
+       * The grammar reads a bare leading `~` as "contains", and quoting does
+       * NOT protect it — quotes are stripped before the operator is read. The
+       * escape is what keeps `~/logs/app.log` an exact match.
        */
       const result: CrossSignalQueryParams = toTracesExplorerQueryParams({
         attributes: { "file.path": "~/logs/app.log" },
       });
 
-      expect(result.params["search"]).toBeUndefined();
-      expect(JSON.parse(result.params["filters"] as string)).toEqual([
-        ["attributes.file.path", "~/logs/app.log"],
-      ]);
+      expect(result.params["search"]).toBe("@file.path:\\~/logs/app.log");
+      expect(result.params["filters"]).toBeUndefined();
+
+      const parsed: ParsedTraceSearch = parseTraceSearch(
+        result.params["search"] as string,
+      );
+
+      expect(parsed.attributes).toEqual({ "file.path": "~/logs/app.log" });
+      expect(parsed.attributeSearches).toEqual({});
+    });
+
+    test("a wildcard in the value is escaped so the scope does not widen", () => {
+      const result: CrossSignalQueryParams = toTracesExplorerQueryParams({
+        attributes: { "http.route": "/api/*" },
+      });
+
+      expect(result.params["search"]).toBe("@http.route:/api/\\*");
+
+      const parsed: ParsedTraceSearch = parseTraceSearch(
+        result.params["search"] as string,
+      );
+
+      expect(parsed.attributes).toEqual({ "http.route": "/api/*" });
     });
 
     test("values containing % fall back to a chip (the viewer double-decodes search)", () => {
@@ -501,22 +524,19 @@ describe("toTracesExplorerQueryParams", () => {
       ]);
     });
 
-    test("trace ids with spaces are quoted; ids with quotes fall back to chips", () => {
+    test("trace ids with spaces or quotes both ride escaped tokens", () => {
       const result: CrossSignalQueryParams = toTracesExplorerQueryParams({
         traceIds: ["spaced trace", 'quoted"trace'],
         spanIds: ["span-ok"],
       });
 
-      expect(result.params["search"]).toBe('trace:"spaced trace" span:span-ok');
-      expect(JSON.parse(result.params["filters"] as string)).toEqual([
-        ["traceId", 'quoted"trace'],
-      ]);
+      expect(result.params["filters"]).toBeUndefined();
 
-      const parsed: ParsedTraceSearch = parseTraceSearchReplica(
+      const parsed: ParsedTraceSearch = parseTraceSearch(
         result.params["search"] as string,
       );
       expect(parsed.fieldFilters).toEqual({
-        traceId: ["spaced trace"],
+        traceId: ["spaced trace", 'quoted"trace'],
         spanId: ["span-ok"],
       });
     });