web_exploit_detector.js

'use strict';

Object.defineProperty(exports, "__esModule", {
  value: true
});
exports.rules = undefined;
exports.loadExceptions = loadExceptions;
exports.executeTests = executeTests;
exports.getFileList = getFileList;
exports.processRulesOnFile = processRulesOnFile;
exports.formatResult = formatResult;
exports.getFileHash = getFileHash;
exports.getTreeSnapshot = getTreeSnapshot;

var _os = require('os');

var _os2 = _interopRequireDefault(_os);

var _path = require('path');

var _path2 = _interopRequireDefault(_path);

var _bluebird = require('bluebird');

var _bluebird2 = _interopRequireDefault(_bluebird);

function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }

var fs = _bluebird2.default.promisifyAll(require('graceful-fs'));

var crypto = null;
try {
  crypto = require('crypto');
} catch (err) {
  crypto = null;
}

var rules = exports.rules = require('../rules');

function loadExceptions(logger) {
  var ex_file = _path2.default.join(_os2.default.homedir(), 'wed-exceptions.json');
  return fs.accessAsync(ex_file, fs.R_OK).then(function (res) {
    if (res) return [];
    return fs.readFileAsync(ex_file).then(function (res) {
      return JSON.parse(res.toString());
    }).catch(function (err) {
      logger(1, 'ERROR: unable to load exceptions: ' + err.toString());
      return [];
    });
  }).catch(function () {
    return [];
  });
}

function executeTests(settings) {
  var exceptions = [];

  if (!settings.logger) settings.logger = function (level, msg) {
    return msg;
  };

  return loadExceptions(settings.logger).then(function (res) {
    exceptions = res;
  }).then(function () {
    settings.logger(3, 'Getting file list...');
    return getFileList(settings.webroot, settings.logger);
  }).then(function (files) {

    // Complete processing of all rules
    //  - Parallel mode: return the result of Promise.all()
    //  - Serial mode: use mapSeries() to call each function in the array in
    //    turn in order to process the rule
    var _processPromises = function _processPromises(promises) {
      return settings.parallel ? _bluebird2.default.all(promises) : _bluebird2.default.mapSeries(promises, function (func) {
        return func();
      });
    };

    var activeRules = rules

    // Remove debug rules if not in debug mode
    .filter(function (rule) {
      return settings.debug ? true : rule.tags.filter(function (tag) {
        return tag === 'debug';
      }).length === 0;
    })

    // Remove deprecated rules unless "include_deprecated" is set
    .filter(function (rule) {
      return settings.include_deprecated ? true : !rule.deprecated;
    })

    // Remove all rules not in "tags" (if set)
    .filter(function (rule) {
      if (!settings.tags) return true;
      var tags_arr = settings.tags.split(',').map(function (x) {
        return x.trim().toLowerCase();
      });
      return rule.tags.filter(function (tag) {
        return tags_arr.filter(function (x) {
          return x === tag;
        }).length > 0;
      }).length > 0;
    })

    // Remove all rules with tags included in "exclude_tags" (if set)
    .filter(function (rule) {
      if (!settings.exclude_tags) return true;
      var tags_arr = settings.exclude_tags.split(',').map(function (x) {
        return x.trim().toLowerCase();
      });
      return rule.tags.filter(function (tag) {
        return tags_arr.filter(function (x) {
          return x === tag;
        }).length > 0;
      }).length === 0;
    });

    settings.logger(3, 'Processing ' + activeRules.length + ' rules ' + (settings.parallel ? 'in parallel ' : '') + 'on ' + files.length + ' files...');

    // Process depending on current settings.mode
    //  - Parallel mode: map each rule to the result of processing the rule
    //    (a Promise) directly
    //  - Serial mode: map each rule to a function that can be called to
    //    start rule processing
    return _processPromises(files.length === 0 ? [] : settings.parallel ? files.map(function (file) {
      return processRulesOnFile(file, activeRules, exceptions[file], settings.logger);
    }) : files.map(function (file) {
      return function () {
        return processRulesOnFile(file, activeRules, exceptions[file], settings.logger);
      };
    }))
    // Re-group "file => matched rules" to "rule => matched files" and
    // remove rules with no matches
    .then(function (res) {
      var ruleMatches = res.reduce(function (acc, filerec) {
        if (filerec.matches.length === 0) return acc;
        filerec.matches.forEach(function (ruleMatch) {
          if (acc[ruleMatch.id]) acc[ruleMatch.id].matches.push(filerec.file);else acc[ruleMatch.id] = { rule: ruleMatch, matches: [filerec.file] };
        });
        return acc;
      }, {});
      return Object.keys(ruleMatches).map(function (ruleID) {
        return ruleMatches[ruleID];
      });
    });
  });
}

function getFileList(path) {
  var logger = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : null;

  return readDirRecursive(path, logger).catch(function (err) {
    if (logger) logger(2, 'WARN: Error reading webroot directory: ' + err.toString());
    return [];
  });
}

function readDirRecursive(basePath) {
  var logger = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : null;

  var list = [];
  return fs.readdirAsync(basePath).then(function (res) {
    return _bluebird2.default.all(res.map(function (x) {
      var filePath = _path2.default.join(basePath, x);
      return fs.statAsync(filePath).then(function (stat) {
        return { file: filePath, stat: stat };
      });
    }));
  }).then(function (res) {
    res.filter(function (x) {
      return !x.stat.isDirectory();
    }).forEach(function (x) {
      return list.push(x.file);
    });
    return _bluebird2.default.all(res.filter(function (x) {
      return x.stat.isDirectory();
    }).map(function (x) {
      return readDirRecursive(x.file, logger);
    })).then(function (lists) {
      return lists.forEach(function (x) {
        return x.forEach(function (y) {
          return list.push(y);
        });
      });
    });
  }).then(function () {
    return list;
  }).catch(function (err) {
    if (logger) logger(1, 'ERROR: unable to process ' + basePath + ': ' + err.toString());
    return list;
  });
}

function processSingleRule_path(file, rule) {
  if (!rule.tests || !rule.tests.path) return _bluebird2.default.resolve(false);

  if (typeof rule.tests.path === 'function') {
    var testResult = rule.tests.path(file.toString());
    if (testResult.then) return testResult;else return _bluebird2.default.resolve(testResult);
  }

  return _bluebird2.default.resolve(!!file.toString().match(rule.tests.path));
}

function processSingleRule_content(file, rule, contents) {
  if (!rule.tests || !rule.tests.content) return _bluebird2.default.resolve(false);

  if (typeof rule.tests.content === 'function') {
    var testResult = rule.tests.content(contents, file);
    if (testResult.then) return testResult;else return _bluebird2.default.resolve(testResult);
  }

  return _bluebird2.default.resolve(!!contents.match(rule.tests.content));
}

function processRulesOnFile(file, rules, exceptions) {
  var logger = arguments.length > 3 && arguments[3] !== undefined ? arguments[3] : null;

  var filteredRules = rules;

  // Remove rules that list this file as excluded if possible
  if (exceptions && exceptions.length > 0) filteredRules = rules.filter(function (r) {
    return exceptions.filter(function (ex) {
      return ex === r.id;
    }).length === 0;
  });

  // Process all path tests first
  return _bluebird2.default.all(filteredRules.map(function (r) {
    return processSingleRule_path(file, r).then(function (res) {
      return { rule: r, matched: res };
    });
  }))

  // Check to see if any of the files have path checks that matched for rules
  // that have a content check. For those that do, read the contents and
  // process all of the rule content checks too.
  .then(function (res) {
    var contentChecks = res.filter(function (x) {
      return x.matched;
    }).filter(function (x) {
      return x.rule.tests && x.rule.tests.content !== null;
    }).map(function (x) {
      return x.rule;
    });
    if (contentChecks.length > 0) {
      return fs.readFileAsync(file).then(function (content) {
        var content_str = content.toString();
        return _bluebird2.default.all(res.map(function (pathResult) {
          return pathResult.matched && pathResult.rule.tests.content !== null ? processSingleRule_content(file, pathResult.rule, content_str).then(function (contentRes) {
            return { rule: pathResult.rule, matched: contentRes };
          }) : pathResult;
        }));
      }).catch(function (err) {
        if (logger) logger(2, 'WARN: unable to read file: ' + err.toString());
        return res.map(function (pathResult) {
          return {
            rule: pathResult.rule,
            matched: pathResult.rule.tests.content !== null ? false : pathResult.matched
          };
        });
      });
    } else return res;
  }).then(function (res) {
    return {
      file: file,
      matches: res.filter(function (x) {
        return x.matched;
      }).map(function (x) {
        return x.rule;
      })
    };
  });
}

function formatResult(res) {
  return res.matches.length > 0 ? (res.rule.deprecated ? 'DEPRECATED RULE:' : 'Rule:') + ' ' + res.rule.name + ' (' + res.matches.length + ' matches)\n' + (res.rule.urls && res.rule.urls.length > 0 ? 'References: ' + res.rule.urls.join(', ') + '\n' : '') + res.matches.map(function (m) {
    return ' - ' + m;
  }).join('\n') + '\n' : null;
}

function getFileHash(file) {
  var hashName = 'sha256';
  var hash = null;

  if (!crypto) return _bluebird2.default.reject(new Error('Crypto support not available in this version of Node.js'));

  try {
    hash = crypto.createHash(hashName);
  } catch (err) {
    return _bluebird2.default.reject(new Error(hashName + ' hash is unavailable in this version of Node.js'));
  }

  return fs.readFileAsync(file).then(function (res) {
    return hash.update(res).digest('hex');
  });
}

function getTreeSnapshot(settings) {
  if (!settings.logger) settings.logger = function (level, msg) {
    return msg;
  };

  if (!settings.webroot) return _bluebird2.default.resolve([]);

  return getFileList(settings.webroot, settings.logger).then(function (fileList) {
    settings.logger(4, 'Processing ' + fileList.length + ' files...');
    return _bluebird2.default.all(fileList.map(function (f) {
      return getFileHash(f).then(function (hash) {
        return {
          file: settings.relative ? f.replace(_path2.default.join(settings.webroot, ' ').trim(), '') : f,
          hash: hash
        };
      });
    }));
  });
}