Skip to content

Commit d4b0f93

Browse files
e-n-0e-n-0
committed
Add WebApi path param and body blocking tests
1 parent ebc42dd commit d4b0f93

10 files changed

Lines changed: 2153 additions & 0 deletions

‎tracer/test/Datadog.Trace.Security.IntegrationTests/AspNetWebApi.cs‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -106,6 +106,22 @@ public async Task TestBlockedRequest(string test)
106106
await TestAppSecRequestWithVerifyAsync(_iisFixture.Agent, url, null, 5, 1, settings, userAgent: "Hello/V");
107107
}
108108

109+
[Trait("Category", "EndToEnd")]
110+
[Trait("RunOnWindows", "True")]
111+
[Trait("LoadFromGAC", "True")]
112+
[SkippableTheory]
113+
[InlineData(AddressesConstants.RequestPathParams, "/api/route/2?arg=[blocking_test]")]
114+
[InlineData(AddressesConstants.RequestBody, "/api/Home/Upload", "{\"Property1\": \"[blocking_test]\"}")]
115+
public async Task TestBlockedRequests(string test, string url, string body = null)
116+
{
117+
var sanitisedUrl = VerifyHelper.SanitisePathsForVerify(url);
118+
var settings = VerifyHelper.GetSpanVerifierSettings(test, sanitisedUrl, body);
119+
120+
var expectedSpans = test == AddressesConstants.RequestPathParams ? 1 : 2;
121+
122+
await TestAppSecRequestWithVerifyAsync(_iisFixture.Agent, url, body, 5, expectedSpans, settings, "application/json");
123+
}
124+
109125
[SkippableFact]
110126
public async Task TestNullAction()
111127
{

‎tracer/test/Datadog.Trace.Security.IntegrationTests/ruleset.3.0.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5946,6 +5946,42 @@
59465946
"on_match": [
59475947
"block"
59485948
]
5949+
},
5950+
{
5951+
"id": "block-on-path-params",
5952+
"name": "Block on path params",
5953+
"tags": {
5954+
"type": "nosql_injection",
5955+
"crs_id": "000009",
5956+
"category": "attack_attempt"
5957+
},
5958+
"conditions": [
5959+
{
5960+
"parameters": {
5961+
"inputs": [
5962+
{
5963+
"address": "server.request.query"
5964+
},
5965+
{
5966+
"address": "server.request.body"
5967+
},
5968+
{
5969+
"address": "server.request.path_params"
5970+
}
5971+
],
5972+
"regex": "(?i:(?:\\[blocking_test\\]))",
5973+
"options": {
5974+
"case_sensitive": true,
5975+
"min_length": 5
5976+
}
5977+
},
5978+
"operator": "match_regex"
5979+
}
5980+
],
5981+
"transformers": [],
5982+
"on_match": [
5983+
"block"
5984+
]
59495985
}
59505986
]
59515987
}

‎tracer/test/snapshots/Security.AspNetWebApi.Classic.enableSecurity=False.__test=server.request.body_url=_api_Home_Upload_body={-Property1-- -[blocking_test]-}.verified.txt‎

Lines changed: 237 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,237 @@
1+
[
2+
{
3+
TraceId: Id_1,
4+
SpanId: Id_2,
5+
Name: aspnet-webapi.request,
6+
Resource: POST /api/home/{id},
7+
Service: sample,
8+
Type: web,
9+
ParentId: Id_3,
10+
Tags: {
11+
aspnet.controller: home,
12+
aspnet.route: api/{controller}/{id},
13+
env: integration_tests,
14+
http.method: POST,
15+
http.request.headers.host: localhost:00000,
16+
http.status_code: 204,
17+
http.url: http://localhost:00000/api/Home/Upload,
18+
http.useragent: Mistake Not...,
19+
language: dotnet,
20+
span.kind: server
21+
}
22+
},
23+
{
24+
TraceId: Id_1,
25+
SpanId: Id_3,
26+
Name: aspnet.request,
27+
Resource: POST /api/home/{id},
28+
Service: sample,
29+
Type: web,
30+
Tags: {
31+
env: integration_tests,
32+
http.method: POST,
33+
http.request.headers.host: localhost:00000,
34+
http.route: api/{controller}/{id},
35+
http.status_code: 204,
36+
http.url: http://localhost:00000/api/Home/Upload,
37+
http.useragent: Mistake Not...,
38+
language: dotnet,
39+
runtime-id: Guid_1,
40+
span.kind: server
41+
},
42+
Metrics: {
43+
process_id: 0,
44+
_dd.top_level: 1.0,
45+
_dd.tracer_kr: 1.0,
46+
_sampling_priority_v1: 1.0
47+
}
48+
},
49+
{
50+
TraceId: Id_4,
51+
SpanId: Id_5,
52+
Name: aspnet-webapi.request,
53+
Resource: POST /api/home/{id},
54+
Service: sample,
55+
Type: web,
56+
ParentId: Id_6,
57+
Tags: {
58+
aspnet.controller: home,
59+
aspnet.route: api/{controller}/{id},
60+
env: integration_tests,
61+
http.method: POST,
62+
http.request.headers.host: localhost:00000,
63+
http.status_code: 204,
64+
http.url: http://localhost:00000/api/Home/Upload,
65+
http.useragent: Mistake Not...,
66+
language: dotnet,
67+
span.kind: server
68+
}
69+
},
70+
{
71+
TraceId: Id_4,
72+
SpanId: Id_6,
73+
Name: aspnet.request,
74+
Resource: POST /api/home/{id},
75+
Service: sample,
76+
Type: web,
77+
Tags: {
78+
env: integration_tests,
79+
http.method: POST,
80+
http.request.headers.host: localhost:00000,
81+
http.route: api/{controller}/{id},
82+
http.status_code: 204,
83+
http.url: http://localhost:00000/api/Home/Upload,
84+
http.useragent: Mistake Not...,
85+
language: dotnet,
86+
runtime-id: Guid_1,
87+
span.kind: server
88+
},
89+
Metrics: {
90+
process_id: 0,
91+
_dd.top_level: 1.0,
92+
_dd.tracer_kr: 1.0,
93+
_sampling_priority_v1: 1.0
94+
}
95+
},
96+
{
97+
TraceId: Id_7,
98+
SpanId: Id_8,
99+
Name: aspnet-webapi.request,
100+
Resource: POST /api/home/{id},
101+
Service: sample,
102+
Type: web,
103+
ParentId: Id_9,
104+
Tags: {
105+
aspnet.controller: home,
106+
aspnet.route: api/{controller}/{id},
107+
env: integration_tests,
108+
http.method: POST,
109+
http.request.headers.host: localhost:00000,
110+
http.status_code: 204,
111+
http.url: http://localhost:00000/api/Home/Upload,
112+
http.useragent: Mistake Not...,
113+
language: dotnet,
114+
span.kind: server
115+
}
116+
},
117+
{
118+
TraceId: Id_7,
119+
SpanId: Id_9,
120+
Name: aspnet.request,
121+
Resource: POST /api/home/{id},
122+
Service: sample,
123+
Type: web,
124+
Tags: {
125+
env: integration_tests,
126+
http.method: POST,
127+
http.request.headers.host: localhost:00000,
128+
http.route: api/{controller}/{id},
129+
http.status_code: 204,
130+
http.url: http://localhost:00000/api/Home/Upload,
131+
http.useragent: Mistake Not...,
132+
language: dotnet,
133+
runtime-id: Guid_1,
134+
span.kind: server
135+
},
136+
Metrics: {
137+
process_id: 0,
138+
_dd.top_level: 1.0,
139+
_dd.tracer_kr: 1.0,
140+
_sampling_priority_v1: 1.0
141+
}
142+
},
143+
{
144+
TraceId: Id_10,
145+
SpanId: Id_11,
146+
Name: aspnet-webapi.request,
147+
Resource: POST /api/home/{id},
148+
Service: sample,
149+
Type: web,
150+
ParentId: Id_12,
151+
Tags: {
152+
aspnet.controller: home,
153+
aspnet.route: api/{controller}/{id},
154+
env: integration_tests,
155+
http.method: POST,
156+
http.request.headers.host: localhost:00000,
157+
http.status_code: 204,
158+
http.url: http://localhost:00000/api/Home/Upload,
159+
http.useragent: Mistake Not...,
160+
language: dotnet,
161+
span.kind: server
162+
}
163+
},
164+
{
165+
TraceId: Id_10,
166+
SpanId: Id_12,
167+
Name: aspnet.request,
168+
Resource: POST /api/home/{id},
169+
Service: sample,
170+
Type: web,
171+
Tags: {
172+
env: integration_tests,
173+
http.method: POST,
174+
http.request.headers.host: localhost:00000,
175+
http.route: api/{controller}/{id},
176+
http.status_code: 204,
177+
http.url: http://localhost:00000/api/Home/Upload,
178+
http.useragent: Mistake Not...,
179+
language: dotnet,
180+
runtime-id: Guid_1,
181+
span.kind: server
182+
},
183+
Metrics: {
184+
process_id: 0,
185+
_dd.top_level: 1.0,
186+
_dd.tracer_kr: 1.0,
187+
_sampling_priority_v1: 1.0
188+
}
189+
},
190+
{
191+
TraceId: Id_13,
192+
SpanId: Id_14,
193+
Name: aspnet-webapi.request,
194+
Resource: POST /api/home/{id},
195+
Service: sample,
196+
Type: web,
197+
ParentId: Id_15,
198+
Tags: {
199+
aspnet.controller: home,
200+
aspnet.route: api/{controller}/{id},
201+
env: integration_tests,
202+
http.method: POST,
203+
http.request.headers.host: localhost:00000,
204+
http.status_code: 204,
205+
http.url: http://localhost:00000/api/Home/Upload,
206+
http.useragent: Mistake Not...,
207+
language: dotnet,
208+
span.kind: server
209+
}
210+
},
211+
{
212+
TraceId: Id_13,
213+
SpanId: Id_15,
214+
Name: aspnet.request,
215+
Resource: POST /api/home/{id},
216+
Service: sample,
217+
Type: web,
218+
Tags: {
219+
env: integration_tests,
220+
http.method: POST,
221+
http.request.headers.host: localhost:00000,
222+
http.route: api/{controller}/{id},
223+
http.status_code: 204,
224+
http.url: http://localhost:00000/api/Home/Upload,
225+
http.useragent: Mistake Not...,
226+
language: dotnet,
227+
runtime-id: Guid_1,
228+
span.kind: server
229+
},
230+
Metrics: {
231+
process_id: 0,
232+
_dd.top_level: 1.0,
233+
_dd.tracer_kr: 1.0,
234+
_sampling_priority_v1: 1.0
235+
}
236+
}
237+
]

0 commit comments

Comments
 (0)