Skip to content

Commit 9607dcd

Browse files
CarlesDDCarlesDD
authored
Add ASM_EXCLUSION_DATA capability + RC management + test and refactor (#6101)
1 parent e2dbaa8 commit 9607dcd

File tree

3 files changed

+53
-190
lines changed

3 files changed

+53
-190
lines changed

‎packages/dd-trace/src/remote_config/capabilities.js

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ module.exports = {
1616
APM_TRACING_LOGS_INJECTION: 1n << 13n,
1717
APM_TRACING_HTTP_HEADER_TAGS: 1n << 14n,
1818
APM_TRACING_CUSTOM_TAGS: 1n << 15n,
19+
ASM_EXCLUSION_DATA: 1n << 18n,
1920
APM_TRACING_ENABLED: 1n << 19n,
2021
ASM_RASP_SQLI: 1n << 21n,
2122
ASM_RASP_LFI: 1n << 22n,

‎packages/dd-trace/src/remote_config/index.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ function enableWafUpdate (appsecConfig) {
8989
rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_RULES, true)
9090
rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, true)
9191
rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRUSTED_IPS, true)
92+
rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXCLUSION_DATA, true)
9293
rc.updateCapabilities(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, true)
9394
rc.updateCapabilities(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, true)
9495
rc.updateCapabilities(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, true)
@@ -125,6 +126,7 @@ function disableWafUpdate () {
125126
rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_RULES, false)
126127
rc.updateCapabilities(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, false)
127128
rc.updateCapabilities(RemoteConfigCapabilities.ASM_TRUSTED_IPS, false)
129+
rc.updateCapabilities(RemoteConfigCapabilities.ASM_EXCLUSION_DATA, false)
128130
rc.updateCapabilities(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, false)
129131
rc.updateCapabilities(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, false)
130132
rc.updateCapabilities(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, false)

‎packages/dd-trace/test/remote_config/index.spec.js

Lines changed: 50 additions & 190 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,48 @@ describe('Remote Config index', () => {
189189
})
190190

191191
describe('enableWafUpdate', () => {
192+
const expectCapabilitiesCalledWith = (capabilityList, expectedValue) => {
193+
capabilityList.forEach(capability => {
194+
expect(rc.updateCapabilities)
195+
.to.have.been.calledWithExactly(capability, expectedValue)
196+
})
197+
}
198+
199+
const expectCapabilitiesNotCalled = (capabilityList) => {
200+
capabilityList.forEach(capability => {
201+
expect(rc.updateCapabilities)
202+
.to.not.have.been.calledWith(capability)
203+
})
204+
}
205+
206+
const CORE_ASM_CAPABILITIES = [
207+
RemoteConfigCapabilities.ASM_IP_BLOCKING,
208+
RemoteConfigCapabilities.ASM_USER_BLOCKING,
209+
RemoteConfigCapabilities.ASM_DD_RULES,
210+
RemoteConfigCapabilities.ASM_EXCLUSIONS,
211+
RemoteConfigCapabilities.ASM_REQUEST_BLOCKING,
212+
RemoteConfigCapabilities.ASM_RESPONSE_BLOCKING,
213+
RemoteConfigCapabilities.ASM_CUSTOM_RULES,
214+
RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE,
215+
RemoteConfigCapabilities.ASM_TRUSTED_IPS,
216+
RemoteConfigCapabilities.ASM_EXCLUSION_DATA,
217+
RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT,
218+
RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT,
219+
RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT,
220+
RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT,
221+
RemoteConfigCapabilities.ASM_DD_MULTICONFIG
222+
]
223+
224+
const RASP_CAPABILITIES = [
225+
RemoteConfigCapabilities.ASM_RASP_SSRF,
226+
RemoteConfigCapabilities.ASM_RASP_SQLI,
227+
RemoteConfigCapabilities.ASM_RASP_LFI,
228+
RemoteConfigCapabilities.ASM_RASP_SHI,
229+
RemoteConfigCapabilities.ASM_RASP_CMDI
230+
]
231+
232+
const ALL_ASM_CAPABILITIES = [...CORE_ASM_CAPABILITIES, ...RASP_CAPABILITIES]
233+
192234
describe('enable', () => {
193235
it('should not fail if remote config is not enabled before', () => {
194236
config.appsec = {}
@@ -212,44 +254,7 @@ describe('Remote Config index', () => {
212254
remoteConfig.enable(config)
213255
remoteConfig.enableWafUpdate(config.appsec)
214256

215-
expect(rc.updateCapabilities)
216-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_IP_BLOCKING, true)
217-
expect(rc.updateCapabilities)
218-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_USER_BLOCKING, true)
219-
expect(rc.updateCapabilities)
220-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_RULES, true)
221-
expect(rc.updateCapabilities)
222-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_EXCLUSIONS, true)
223-
expect(rc.updateCapabilities)
224-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_REQUEST_BLOCKING, true)
225-
expect(rc.updateCapabilities)
226-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RESPONSE_BLOCKING, true)
227-
expect(rc.updateCapabilities)
228-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_RULES, true)
229-
expect(rc.updateCapabilities)
230-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, true)
231-
expect(rc.updateCapabilities)
232-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_TRUSTED_IPS, true)
233-
expect(rc.updateCapabilities)
234-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, true)
235-
expect(rc.updateCapabilities)
236-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, true)
237-
expect(rc.updateCapabilities)
238-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, true)
239-
expect(rc.updateCapabilities)
240-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, true)
241-
expect(rc.updateCapabilities)
242-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SSRF, true)
243-
expect(rc.updateCapabilities)
244-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SQLI, true)
245-
expect(rc.updateCapabilities)
246-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_LFI, true)
247-
expect(rc.updateCapabilities)
248-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SHI, true)
249-
expect(rc.updateCapabilities)
250-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_CMDI, true)
251-
expect(rc.updateCapabilities)
252-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_MULTICONFIG, true)
257+
expectCapabilitiesCalledWith(ALL_ASM_CAPABILITIES, true)
253258

254259
expect(rc.setProductHandler).to.have.been.calledWith('ASM_DATA')
255260
expect(rc.setProductHandler).to.have.been.calledWith('ASM_DD')
@@ -262,44 +267,7 @@ describe('Remote Config index', () => {
262267
remoteConfig.enable(config)
263268
remoteConfig.enableWafUpdate(config.appsec)
264269

265-
expect(rc.updateCapabilities)
266-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_IP_BLOCKING, true)
267-
expect(rc.updateCapabilities)
268-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_USER_BLOCKING, true)
269-
expect(rc.updateCapabilities)
270-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_RULES, true)
271-
expect(rc.updateCapabilities)
272-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_EXCLUSIONS, true)
273-
expect(rc.updateCapabilities)
274-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_REQUEST_BLOCKING, true)
275-
expect(rc.updateCapabilities)
276-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RESPONSE_BLOCKING, true)
277-
expect(rc.updateCapabilities)
278-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_RULES, true)
279-
expect(rc.updateCapabilities)
280-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, true)
281-
expect(rc.updateCapabilities)
282-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_TRUSTED_IPS, true)
283-
expect(rc.updateCapabilities)
284-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, true)
285-
expect(rc.updateCapabilities)
286-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, true)
287-
expect(rc.updateCapabilities)
288-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, true)
289-
expect(rc.updateCapabilities)
290-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, true)
291-
expect(rc.updateCapabilities)
292-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SSRF, true)
293-
expect(rc.updateCapabilities)
294-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SQLI, true)
295-
expect(rc.updateCapabilities)
296-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_LFI, true)
297-
expect(rc.updateCapabilities)
298-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SHI, true)
299-
expect(rc.updateCapabilities)
300-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_CMDI, true)
301-
expect(rc.updateCapabilities)
302-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_MULTICONFIG, true)
270+
expectCapabilitiesCalledWith(ALL_ASM_CAPABILITIES, true)
303271

304272
expect(rc.setProductHandler).to.have.been.calledWith('ASM_DATA')
305273
expect(rc.setProductHandler).to.have.been.calledWith('ASM_DD')
@@ -314,44 +282,8 @@ describe('Remote Config index', () => {
314282

315283
expect(rc.updateCapabilities)
316284
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_ACTIVATION, true)
317-
expect(rc.updateCapabilities)
318-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_IP_BLOCKING, true)
319-
expect(rc.updateCapabilities)
320-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_USER_BLOCKING, true)
321-
expect(rc.updateCapabilities)
322-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_RULES, true)
323-
expect(rc.updateCapabilities)
324-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_EXCLUSIONS, true)
325-
expect(rc.updateCapabilities)
326-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_REQUEST_BLOCKING, true)
327-
expect(rc.updateCapabilities)
328-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RESPONSE_BLOCKING, true)
329-
expect(rc.updateCapabilities)
330-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_RULES, true)
331-
expect(rc.updateCapabilities)
332-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, true)
333-
expect(rc.updateCapabilities)
334-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_TRUSTED_IPS, true)
335-
expect(rc.updateCapabilities)
336-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, true)
337-
expect(rc.updateCapabilities)
338-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, true)
339-
expect(rc.updateCapabilities)
340-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, true)
341-
expect(rc.updateCapabilities)
342-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, true)
343-
expect(rc.updateCapabilities)
344-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SSRF, true)
345-
expect(rc.updateCapabilities)
346-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SQLI, true)
347-
expect(rc.updateCapabilities)
348-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_LFI, true)
349-
expect(rc.updateCapabilities)
350-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SHI, true)
351-
expect(rc.updateCapabilities)
352-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_CMDI, true)
353-
expect(rc.updateCapabilities)
354-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_MULTICONFIG, true)
285+
286+
expectCapabilitiesCalledWith(ALL_ASM_CAPABILITIES, true)
355287
})
356288

357289
it('should not activate rasp capabilities if rasp is disabled', () => {
@@ -361,44 +293,9 @@ describe('Remote Config index', () => {
361293

362294
expect(rc.updateCapabilities)
363295
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_ACTIVATION, true)
364-
expect(rc.updateCapabilities)
365-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_IP_BLOCKING, true)
366-
expect(rc.updateCapabilities)
367-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_USER_BLOCKING, true)
368-
expect(rc.updateCapabilities)
369-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_RULES, true)
370-
expect(rc.updateCapabilities)
371-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_EXCLUSIONS, true)
372-
expect(rc.updateCapabilities)
373-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_REQUEST_BLOCKING, true)
374-
expect(rc.updateCapabilities)
375-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RESPONSE_BLOCKING, true)
376-
expect(rc.updateCapabilities)
377-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_RULES, true)
378-
expect(rc.updateCapabilities)
379-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, true)
380-
expect(rc.updateCapabilities)
381-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_TRUSTED_IPS, true)
382-
expect(rc.updateCapabilities)
383-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, true)
384-
expect(rc.updateCapabilities)
385-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, true)
386-
expect(rc.updateCapabilities)
387-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, true)
388-
expect(rc.updateCapabilities)
389-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, true)
390-
expect(rc.updateCapabilities)
391-
.to.not.have.been.calledWith(RemoteConfigCapabilities.ASM_RASP_SSRF)
392-
expect(rc.updateCapabilities)
393-
.to.not.have.been.calledWith(RemoteConfigCapabilities.ASM_RASP_SQLI)
394-
expect(rc.updateCapabilities)
395-
.to.not.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_LFI)
396-
expect(rc.updateCapabilities)
397-
.to.not.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SHI)
398-
expect(rc.updateCapabilities)
399-
.to.not.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_CMDI)
400-
expect(rc.updateCapabilities)
401-
.to.not.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_MULTICONFIG)
296+
297+
expectCapabilitiesCalledWith(CORE_ASM_CAPABILITIES, true)
298+
expectCapabilitiesNotCalled(RASP_CAPABILITIES)
402299
})
403300
})
404301

@@ -408,44 +305,7 @@ describe('Remote Config index', () => {
408305
rc.updateCapabilities.resetHistory()
409306
remoteConfig.disableWafUpdate()
410307

411-
expect(rc.updateCapabilities)
412-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_IP_BLOCKING, false)
413-
expect(rc.updateCapabilities)
414-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_USER_BLOCKING, false)
415-
expect(rc.updateCapabilities)
416-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_RULES, false)
417-
expect(rc.updateCapabilities)
418-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_EXCLUSIONS, false)
419-
expect(rc.updateCapabilities)
420-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_REQUEST_BLOCKING, false)
421-
expect(rc.updateCapabilities)
422-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RESPONSE_BLOCKING, false)
423-
expect(rc.updateCapabilities)
424-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_RULES, false)
425-
expect(rc.updateCapabilities)
426-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_CUSTOM_BLOCKING_RESPONSE, false)
427-
expect(rc.updateCapabilities)
428-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_TRUSTED_IPS, false)
429-
expect(rc.updateCapabilities)
430-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_ENDPOINT_FINGERPRINT, false)
431-
expect(rc.updateCapabilities)
432-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_SESSION_FINGERPRINT, false)
433-
expect(rc.updateCapabilities)
434-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_NETWORK_FINGERPRINT, false)
435-
expect(rc.updateCapabilities)
436-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_HEADER_FINGERPRINT, false)
437-
expect(rc.updateCapabilities)
438-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SSRF, false)
439-
expect(rc.updateCapabilities)
440-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SQLI, false)
441-
expect(rc.updateCapabilities)
442-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_LFI, false)
443-
expect(rc.updateCapabilities)
444-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_SHI, false)
445-
expect(rc.updateCapabilities)
446-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_RASP_CMDI, false)
447-
expect(rc.updateCapabilities)
448-
.to.have.been.calledWithExactly(RemoteConfigCapabilities.ASM_DD_MULTICONFIG, false)
308+
expectCapabilitiesCalledWith(ALL_ASM_CAPABILITIES, false)
449309

450310
expect(rc.removeProductHandler).to.have.been.calledWith('ASM_DATA')
451311
expect(rc.removeProductHandler).to.have.been.calledWith('ASM_DD')

0 commit comments

Comments
 (0)