Skip to content

Commit

Permalink
test(integration): add integration test for fingerprints
Browse files Browse the repository at this point in the history 
Signed-off-by: Alexandre Rulleau <[email protected]>
  • Loading branch information
@Leiyks
Leiyks committed Nov 18, 2024
1 parent 218d34b commit 5e0cb00
Show file tree
Hide file tree
Showing 2 changed files with 226 additions and 50 deletions.
5 changes: 5 additions & 0 deletions ...c/tests/integration/src/test/groovy/com/datadog/appsec/php/integration/CommonTests.groovy
View file
Original file line number Diff line number Diff line change
Expand Up @@ -222,6 +222,7 @@ trait CommonTests {
assert span.metrics."_dd.appsec.enabled" == 1.0d
assert span.metrics."_dd.appsec.waf.duration" > 0.0d
assert span.meta."_dd.appsec.event_rules.version" != ''
assert span.meta."_dd.appsec.fp.http.endpoint" != ''
}

@Test
Expand All @@ -236,6 +237,7 @@ trait CommonTests {
assert span.metrics."_dd.appsec.enabled" == 1.0d
assert span.metrics."_dd.appsec.waf.duration" > 0.0d
assert span.meta."_dd.appsec.event_rules.version" != ''
assert span.meta."_dd.appsec.fp.http.endpoint" != ''
}

@Test
Expand All @@ -249,6 +251,7 @@ trait CommonTests {
assert span.metrics."_dd.appsec.enabled" == 1.0d
assert span.metrics."_dd.appsec.waf.duration" > 0.0d
assert span.meta."_dd.appsec.event_rules.version" != ''
assert span.meta."_dd.appsec.fp.http.endpoint" != ''
}

@Test
Expand All @@ -262,6 +265,7 @@ trait CommonTests {
assert span.metrics."_dd.appsec.enabled" == 1.0d
assert span.metrics."_dd.appsec.waf.duration" > 0.0d
assert span.meta."_dd.appsec.event_rules.version" != ''
assert span.meta."_dd.appsec.fp.http.endpoint" != ''
}

@Test
Expand All @@ -278,6 +282,7 @@ trait CommonTests {
assert span.metrics."_dd.appsec.waf.duration" > 0.0d
assert span.meta."_dd.appsec.event_rules.version" != ''
assert span.meta."appsec.blocked" == "true"
assert span.meta."_dd.appsec.fp.http.endpoint" != ''
}

@Test
Expand Down
271 changes: 221 additions & 50 deletions appsec/tests/integration/src/test/waf/recommended.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6754,15 +6754,15 @@
"parameters": {
"inputs": [
{
"address": "server.request.body",
"key_path": [
"message"
]
"address": "server.request.body",
"key_path": [
"message"
]
},
{
"address": "server.response.body",
"key_path": [
"message"
"message"
]
}
],
Expand All @@ -6777,60 +6777,60 @@
"id": "poison-in-json-block",
"name": "poison-in-json-block",
"tags": {
"type": "security_scanner",
"category": "attack_attempt"
"type": "security_scanner",
"category": "attack_attempt"
},
"conditions": [
{
"parameters": {
"inputs": [
{
"address": "server.response.body",
"key_path": [
"message"
]
}
],
"regex": "(?i)block_this"
},
"operator": "match_regex"
}
{
"parameters": {
"inputs": [
{
"address": "server.response.body",
"key_path": [
"message"
]
}
],
"regex": "(?i)block_this"
},
"operator": "match_regex"
}
],
"transformers": [],
"on_match": [
"block"
]
},
{
"id": "poison-in-xml",
"name": "poison-in-xml",
"tags": {
"type": "security_scanner",
"category": "attack_attempt"
},
"conditions": [
{
"parameters": {
"inputs": [
{
"address": "server.request.body",
"key_path": [
"note"
]
},
{
"address": "server.response.body",
"key_path": [
"note"
]
}
],
"regex": "(?i).*poison.*"
},
"operator": "match_regex"
}
],
"transformers": []
"id": "poison-in-xml",
"name": "poison-in-xml",
"tags": {
"type": "security_scanner",
"category": "attack_attempt"
},
"conditions": [
{
"parameters": {
"inputs": [
{
"address": "server.request.body",
"key_path": [
"note"
]
},
{
"address": "server.response.body",
"key_path": [
"note"
]
}
],
"regex": "(?i).*poison.*"
},
"operator": "match_regex"
}
],
"transformers": []
}
],
"rules_data": [
Expand Down Expand Up @@ -6884,5 +6884,176 @@
"location": "https://datadoghq.com"
}
}
],
"processors": [
{
"id": "http-endpoint-fingerprint",
"generator": "http_endpoint_fingerprint",
"conditions": [
{
"operator": "exists",
"parameters": {
"inputs": [
{
"address": "waf.context.event"
},
{
"address": "server.business_logic.users.login.failure"
},
{
"address": "server.business_logic.users.login.success"
}
]
}
}
],
"parameters": {
"mappings": [
{
"method": [
{
"address": "server.request.method"
}
],
"uri_raw": [
{
"address": "server.request.uri.raw"
}
],
"body": [
{
"address": "server.request.body"
}
],
"query": [
{
"address": "server.request.query"
}
],
"output": "_dd.appsec.fp.http.endpoint"
}
]
},
"evaluate": false,
"output": true
},
{
"id": "http-header-fingerprint",
"generator": "http_header_fingerprint",
"conditions": [
{
"operator": "exists",
"parameters": {
"inputs": [
{
"address": "waf.context.event"
},
{
"address": "server.business_logic.users.login.failure"
},
{
"address": "server.business_logic.users.login.success"
}
]
}
}
],
"parameters": {
"mappings": [
{
"headers": [
{
"address": "server.request.headers.no_cookies"
}
],
"output": "_dd.appsec.fp.http.header"
}
]
},
"evaluate": false,
"output": true
},
{
"id": "http-network-fingerprint",
"generator": "http_network_fingerprint",
"conditions": [
{
"operator": "exists",
"parameters": {
"inputs": [
{
"address": "waf.context.event"
},
{
"address": "server.business_logic.users.login.failure"
},
{
"address": "server.business_logic.users.login.success"
}
]
}
}
],
"parameters": {
"mappings": [
{
"headers": [
{
"address": "server.request.headers.no_cookies"
}
],
"output": "_dd.appsec.fp.http.network"
}
]
},
"evaluate": false,
"output": true
},
{
"id": "session-fingerprint",
"generator": "session_fingerprint",
"conditions": [
{
"operator": "exists",
"parameters": {
"inputs": [
{
"address": "waf.context.event"
},
{
"address": "server.business_logic.users.login.failure"
},
{
"address": "server.business_logic.users.login.success"
}
]
}
}
],
"parameters": {
"mappings": [
{
"cookies": [
{
"address": "server.request.cookies"
}
],
"session_id": [
{
"address": "usr.session_id"
}
],
"user_id": [
{
"address": "usr.id"
}
],
"output": "_dd.appsec.fp.session"
}
]
},
"evaluate": false,
"output": true
}
]
}

0 comments on commit 5e0cb00

Please sign in to comment.