Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

internal/appsec: update the security rules to v1.2.6 #1191

Merged
merged 7 commits into from Mar 7, 2022
Merged

internal/appsec: update the security rules to v1.2.6 #1191

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
7f165e6
internal/appsec: update the security rules to v1.2.6
Julio-Guerra Mar 1, 2022
e8c8b53
internal/appsec: update the security rules to v1.2.6
Julio-Guerra Mar 1, 2022
6ee6e9d
internal/appsec/_tools/libddwaf-updater: add an optional library vers…
Julio-Guerra Mar 1, 2022
91bb07d
internal/appsec: update the security rules to v1.2.6internal/appsec: …
Julio-Guerra Mar 2, 2022
652fb61
internal/appsec/_tools/rules-updater: fix rules source path
Julio-Guerra Mar 3, 2022
6e874ba
Merge remote-tracking branch 'origin/v1' into julio.guerra/appsec-rul…
Julio-Guerra Mar 3, 2022
142f45a
Merge branch 'v1' into julio.guerra/appsec-rules-1.2.6
Julio-Guerra Mar 7, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions contrib/gin-gonic/gin/gintrace_test.go
View file
Open in desktop
Expand Up @@ -561,7 +561,7 @@ func TestAppSec(t *testing.T) {
t.Run("request-uri", func(t *testing.T) {
mt := mocktracer.Start()
defer mt.Stop()
// Send an LFI attack (according to appsec rule id crs-930-100)
// Send an LFI attack (according to appsec rule id crs-930-110)
req, err := http.NewRequest("POST", srv.URL+"/lfi/../../../secret.txt", nil)
if err != nil {
panic(err)
Expand All @@ -581,7 +581,7 @@ func TestAppSec(t *testing.T) {
event := finished[0].Tag("_dd.appsec.json").(string)
require.NotNil(t, event)
require.True(t, strings.Contains(event, "server.request.uri.raw"))
require.True(t, strings.Contains(event, "crs-930-100"))
require.True(t, strings.Contains(event, "crs-930-110"))
})

// Test a security scanner attack via path parameters
Expand Down
4 changes: 2 additions & 2 deletions contrib/go-chi/chi.v4/chi_test.go
View file
Open in desktop
Expand Up @@ -331,7 +331,7 @@ func TestAppSec(t *testing.T) {
t.Run("request-uri", func(t *testing.T) {
mt := mocktracer.Start()
defer mt.Stop()
// Send an LFI attack (according to appsec rule id crs-930-100)
// Send an LFI attack (according to appsec rule id crs-930-110)
req, err := http.NewRequest("POST", srv.URL+"/../../../secret.txt", nil)
if err != nil {
panic(err)
Expand All @@ -351,7 +351,7 @@ func TestAppSec(t *testing.T) {
event := finished[0].Tag("_dd.appsec.json").(string)
require.NotNil(t, event)
require.True(t, strings.Contains(event, "server.request.uri.raw"))
require.True(t, strings.Contains(event, "crs-930-100"))
require.True(t, strings.Contains(event, "crs-930-110"))
})

// Test a security scanner attack via path parameters
Expand Down
4 changes: 2 additions & 2 deletions contrib/go-chi/chi.v5/chi_test.go
View file
Open in desktop
Expand Up @@ -331,7 +331,7 @@ func TestAppSec(t *testing.T) {
t.Run("request-uri", func(t *testing.T) {
mt := mocktracer.Start()
defer mt.Stop()
// Send an LFI attack (according to appsec rule id crs-930-100)
// Send an LFI attack (according to appsec rule id crs-930-110)
req, err := http.NewRequest("POST", srv.URL+"/../../../secret.txt", nil)
if err != nil {
panic(err)
Expand All @@ -351,7 +351,7 @@ func TestAppSec(t *testing.T) {
event := finished[0].Tag("_dd.appsec.json").(string)
require.NotNil(t, event)
require.True(t, strings.Contains(event, "server.request.uri.raw"))
require.True(t, strings.Contains(event, "crs-930-100"))
require.True(t, strings.Contains(event, "crs-930-110"))
})

// Test a security scanner attack via path parameters
Expand Down
4 changes: 2 additions & 2 deletions contrib/go-chi/chi/chi_test.go
View file
Open in desktop
Expand Up @@ -331,7 +331,7 @@ func TestAppSec(t *testing.T) {
t.Run("request-uri", func(t *testing.T) {
mt := mocktracer.Start()
defer mt.Stop()
// Send an LFI attack (according to appsec rule id crs-930-100)
// Send an LFI attack (according to appsec rule id crs-930-110)
req, err := http.NewRequest("POST", srv.URL+"/../../../secret.txt", nil)
if err != nil {
panic(err)
Expand All @@ -351,7 +351,7 @@ func TestAppSec(t *testing.T) {
event := finished[0].Tag("_dd.appsec.json").(string)
require.NotNil(t, event)
require.True(t, strings.Contains(event, "server.request.uri.raw"))
require.True(t, strings.Contains(event, "crs-930-100"))
require.True(t, strings.Contains(event, "crs-930-110"))
})

// Test a security scanner attack via path parameters
Expand Down
6 changes: 3 additions & 3 deletions contrib/gorilla/mux/mux_test.go
View file
Open in desktop
Expand Up @@ -334,7 +334,7 @@ func TestAppSec(t *testing.T) {
t.Run("request-uri", func(t *testing.T) {
mt := mocktracer.Start()
defer mt.Stop()
// Send an LFI attack (according to appsec rule id crs-930-100)
// Send an LFI attack (according to appsec rule id crs-930-110)
req, err := http.NewRequest("POST", srv.URL+"/../../../secret.txt", nil)
if err != nil {
panic(err)
Expand All @@ -351,12 +351,12 @@ func TestAppSec(t *testing.T) {
event := finished[0].Tag("_dd.appsec.json").(string)
require.NotNil(t, event)
require.True(t, strings.Contains(event, "server.request.uri.raw"))
require.True(t, strings.Contains(event, "crs-930-100"))
require.True(t, strings.Contains(event, "crs-930-110"))
// The second request should contain the event via the referrer header
event = finished[1].Tag("_dd.appsec.json").(string)
require.NotNil(t, event)
require.True(t, strings.Contains(event, "server.request.headers.no_cookies"))
require.True(t, strings.Contains(event, "crs-930-100"))
require.True(t, strings.Contains(event, "crs-930-110"))
})

// Test a security scanner attack via path parameters
Expand Down
4 changes: 2 additions & 2 deletions contrib/labstack/echo.v4/echotrace_test.go
View file
Open in desktop
Expand Up @@ -297,7 +297,7 @@ func TestAppSec(t *testing.T) {
t.Run("request-uri", func(t *testing.T) {
mt := mocktracer.Start()
defer mt.Stop()
// Send an LFI attack (according to appsec rule id crs-930-100)
// Send an LFI attack (according to appsec rule id crs-930-110)
req, err := http.NewRequest("POST", srv.URL+"/../../../secret.txt", nil)
if err != nil {
panic(err)
Expand All @@ -311,7 +311,7 @@ func TestAppSec(t *testing.T) {
require.Len(t, finished, 1)
event := finished[0].Tag("_dd.appsec.json").(string)
require.NotNil(t, event)
require.True(t, strings.Contains(event, "crs-930-100"))
require.True(t, strings.Contains(event, "crs-930-110"))
require.True(t, strings.Contains(event, "server.request.uri.raw"))
})

Expand Down
14 changes: 9 additions & 5 deletions internal/appsec/_tools/libddwaf-updater/update.sh
View file
Open in desktop
Expand Up @@ -15,14 +15,18 @@ set -ex

bindings_dir=$(readlink -f "$(dirname $0)/../../waf")

echo Looking up for the latest GitHub release

latest_release=$(curl -s https://api.github.com/repos/DataDog/libddwaf/releases/latest)
version=$(jq -r '.tag_name') << EOF
version=""
if [ $# -eq 1 ]; then
version=$1
else
echo Looking up for the latest GitHub release
latest_release=$(curl -s https://api.github.com/repos/DataDog/libddwaf/releases/latest)
version=$(jq -r '.tag_name') << EOF
$latest_release
EOF
fi

echo Found libddwaf v$version
echo Updating to libddwaf v$version

tmpdir=$(mktemp -d /tmp/libddwaf-XXXXXXXX)
echo Using $tmpdir
Expand Down
2 changes: 1 addition & 1 deletion internal/appsec/_tools/rules-updater/Dockerfile
View file
Open in desktop
@@ -1,6 +1,6 @@
FROM tdewolff/minify as minify
ARG version
ADD https://raw.githubusercontent.com/DataDog/appsec-event-rules/$version/v2/build/recommended.json /home
ADD https://raw.githubusercontent.com/DataDog/appsec-event-rules/$version/build/recommended.json /home
RUN minify --type=json -o /home/out.json /home/recommended.json

FROM golang as go-format
Expand Down
6 changes: 3 additions & 3 deletions internal/appsec/rule.go
View file
Open in desktop

Large diffs are not rendered by default.

7 changes: 3 additions & 4 deletions internal/appsec/waf_test.go
View file
Open in desktop
Expand Up @@ -12,7 +12,6 @@ import (
"io/ioutil"
"net/http"
"net/http/httptest"
"strings"
"testing"

httptrace "gopkg.in/DataDog/dd-trace-go.v1/contrib/net/http"
Expand Down Expand Up @@ -61,12 +60,12 @@ func TestWAF(t *testing.T) {
require.Len(t, finished, 2)

// Two requests were performed by the client request (due to the 301 redirection) and the two should have the LFI
// attack attempt event (appsec rule id crs-930-100).
// attack attempt event (appsec rule id crs-930-110).
event := finished[0].Tag("_dd.appsec.json")
require.NotNil(t, event)
require.True(t, strings.Contains(event.(string), "crs-930-100"))
require.Contains(t, event.(string), "crs-930-110")

event = finished[1].Tag("_dd.appsec.json")
require.NotNil(t, event)
require.True(t, strings.Contains(event.(string), "crs-930-100"))
require.Contains(t, event.(string), "crs-930-110")
}