Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[7.17][Security Solution][Endpoint] Fix artifact path file name checking utility #131085

Merged
merged 4 commits into from
Apr 27, 2022
Merged

[7.17][Security Solution][Endpoint] Fix artifact path file name checking utility #131085

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
215faf1
Replace implementation of `hasSimpleExecutableName`
paul-tavares Apr 27, 2022
a6a9fc6
add additional tests for `hasSimpleExecutableName()`
paul-tavares Apr 27, 2022
21a9070
change test to use a long path
paul-tavares Apr 27, 2022
0dc084b
use code from `main` in checking for wildcard char.
paul-tavares Apr 27, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions x-pack/plugins/security_solution/common/endpoint/service/trusted_apps/validations.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -558,4 +558,26 @@ describe('Executable filenames with wildcard PATHS', () => {
})
).toEqual(false);
});

it('should return FALSE when WINDOWS wildcards paths do not have a file name', () => {
expect(
hasSimpleExecutableName({
os: OperatingSystem.WINDOWS,
type: 'wildcard',
value: 'c:\\folder\\',
})
).toEqual(false);
});

it('should TRUE when WINDOWS wildcards paths `type` is not `wildcard`', () => {
expect(
hasSimpleExecutableName({
os: OperatingSystem.WINDOWS,
type: 'match',
// Long path below is on purpose due to an issue found in the field
value:
'C:\\ProgramData\\Package Cache\\sdjfhwojvmlowhnknblkm\\658945C6D1 992AD 576CCC0F43728A9 E60A8908A2\\658945C6D1992AD576CCC0F43728A9E60A8908A2\\Installers\\WimMountAdkSetupAmd64.exe',
})
).toEqual(true);
});
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we add a test case with a very large path?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, I forgot about that. I'll add one next.

});
33 changes: 17 additions & 16 deletions x-pack/plugins/security_solution/common/endpoint/service/trusted_apps/validations.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,20 +34,13 @@ export const getDuplicateFields = (entries: ConditionEntry[]) => {
.map((entry) => entry[0]);
};

/*
* regex to match executable names
* starts matching from the eol of the path
* file names with a single or multiple spaces (for spaced names)
* and hyphens and combinations of these that produce complex names
* such as:
* c:\home\lib\dmp.dmp
* c:\home\lib\my-binary-app-+/ some/ x/ dmp.dmp
* /home/lib/dmp.dmp
* /home/lib/my-binary-app+-\ some\ x\ dmp.dmp
/**
* checks if the filename of a given path (if any) is a simple executable (does NOT have the
* wildcards supported by endpoing (`*` and `?`))
* @param os
* @param type
* @param value
*/
const WIN_EXEC_PATH = /\\(\w+|\w*[\w+|-]+\/ +)+\w+[\w+|-]+\.*\w+$/i;
const UNIX_EXEC_PATH = /(\/|\w*[\w+|-]+\\ +)+\w+[\w+|-]+\.*\w*$/i;

export const hasSimpleExecutableName = ({
os,
type,
Expand All @@ -57,10 +50,18 @@ export const hasSimpleExecutableName = ({
type: TrustedAppEntryTypes;
value: string;
}): boolean => {
if (type === 'wildcard') {
return os === OperatingSystem.WINDOWS ? WIN_EXEC_PATH.test(value) : UNIX_EXEC_PATH.test(value);
if (type !== 'wildcard') {
return true;
}
return true;

const separator = os === OperatingSystem.WINDOWS ? '\\' : '/';
const lastString = value.split(separator).pop();

if (!lastString) {
return false;
}

return (lastString.split('*').length || lastString.split('?').length) === 1;
};

export const isPathValid = ({
Expand Down