-
Notifications
You must be signed in to change notification settings - Fork 306
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Use static vulnerability hash source when the cookie name is too long (…
- Loading branch information
Showing
11 changed files
with
193 additions
and
8 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
110 changes: 110 additions & 0 deletions
110
packages/dd-trace/test/appsec/iast/analyzers/cookie-analyzer.spec.js
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,110 @@ | ||
| 'use strict' | ||
|
|
||
| const { assert } = require('chai') | ||
| const CookieAnalyzer = require('../../../../src/appsec/iast/analyzers/cookie-analyzer') | ||
| const Analyzer = require('../../../../src/appsec/iast/analyzers/vulnerability-analyzer') | ||
| const Config = require('../../../../src/config') | ||
|
|
||
| describe('CookieAnalyzer', () => { | ||
| const VULNERABILITY_TYPE = 'VULN_TYPE' | ||
|
|
||
| it('should extends Analyzer', () => { | ||
| assert.isTrue(Analyzer.isPrototypeOf(CookieAnalyzer)) | ||
| }) | ||
|
|
||
| describe('_createHashSource', () => { | ||
| let cookieAnalyzer | ||
|
|
||
| beforeEach(() => { | ||
| cookieAnalyzer = new CookieAnalyzer(VULNERABILITY_TYPE, 'prop') | ||
| }) | ||
|
|
||
| describe('default config', () => { | ||
| beforeEach(() => { | ||
| cookieAnalyzer.onConfigure(new Config({ iast: true })) | ||
| }) | ||
|
|
||
| it('should create hash from vulnerability type and not long enough evidence value', () => { | ||
| const evidence = { | ||
| value: '0'.repeat(31) | ||
| } | ||
|
|
||
| const vulnerability = cookieAnalyzer._createVulnerability(VULNERABILITY_TYPE, evidence, null, {}) | ||
|
|
||
| assert.equal(vulnerability.hash, cookieAnalyzer._createHash(`${VULNERABILITY_TYPE}:${evidence.value}`)) | ||
| }) | ||
|
|
||
| it('should create different hash from vulnerability type and long evidence value', () => { | ||
| const evidence = { | ||
| value: '0'.repeat(32) | ||
| } | ||
|
|
||
| const vulnerability = cookieAnalyzer._createVulnerability(VULNERABILITY_TYPE, evidence, null, {}) | ||
|
|
||
| assert.equal(vulnerability.hash, cookieAnalyzer._createHash(`FILTERED_${VULNERABILITY_TYPE}`)) | ||
| }) | ||
| }) | ||
|
|
||
| describe('custom cookieFilterPattern', () => { | ||
| beforeEach(() => { | ||
| cookieAnalyzer.onConfigure(new Config({ | ||
| iast: { | ||
| enabled: true, | ||
| cookieFilterPattern: '^filtered$' | ||
| } | ||
| })) | ||
| }) | ||
|
|
||
| it('should create hash from vulnerability with the default pattern', () => { | ||
| const evidence = { | ||
| value: 'notfiltered' | ||
| } | ||
|
|
||
| const vulnerability = cookieAnalyzer._createVulnerability(VULNERABILITY_TYPE, evidence, null, {}) | ||
|
|
||
| assert.equal(vulnerability.hash, cookieAnalyzer._createHash(`${VULNERABILITY_TYPE}:${evidence.value}`)) | ||
| }) | ||
|
|
||
| it('should create different hash from vulnerability type and long evidence value', () => { | ||
| const evidence = { | ||
| value: 'filtered' | ||
| } | ||
|
|
||
| const vulnerability = cookieAnalyzer._createVulnerability(VULNERABILITY_TYPE, evidence, null, {}) | ||
|
|
||
| assert.equal(vulnerability.hash, cookieAnalyzer._createHash(`FILTERED_${VULNERABILITY_TYPE}`)) | ||
| }) | ||
| }) | ||
|
|
||
| describe('invalid cookieFilterPattern maintains default behaviour', () => { | ||
| beforeEach(() => { | ||
| cookieAnalyzer.onConfigure(new Config({ | ||
| iast: { | ||
| enabled: true, | ||
| cookieFilterPattern: '(' | ||
| } | ||
| })) | ||
| }) | ||
|
|
||
| it('should create hash from vulnerability type and not long enough evidence value', () => { | ||
| const evidence = { | ||
| value: '0'.repeat(31) | ||
| } | ||
|
|
||
| const vulnerability = cookieAnalyzer._createVulnerability(VULNERABILITY_TYPE, evidence, null, {}) | ||
|
|
||
| assert.equal(vulnerability.hash, cookieAnalyzer._createHash(`${VULNERABILITY_TYPE}:${evidence.value}`)) | ||
| }) | ||
|
|
||
| it('should create different hash from vulnerability type and long evidence value', () => { | ||
| const evidence = { | ||
| value: '0'.repeat(32) | ||
| } | ||
|
|
||
| const vulnerability = cookieAnalyzer._createVulnerability(VULNERABILITY_TYPE, evidence, null, {}) | ||
|
|
||
| assert.equal(vulnerability.hash, cookieAnalyzer._createHash(`FILTERED_${VULNERABILITY_TYPE}`)) | ||
| }) | ||
| }) | ||
| }) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.