Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[APPSEC-8112] Appsec allow to set user id denylist #2612

Merged
merged 5 commits into from
Feb 13, 2023
Merged

[APPSEC-8112] Appsec allow to set user id denylist #2612

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
a7f13b4
add new user_id_denylist configuration to appsec
GustavoCaso Feb 9, 2023
65eabdb
load static rules data from configuration when initializing Datadog::…
GustavoCaso Feb 9, 2023
ecf17ad
set default value for denylist configurations at the the time os sett…
GustavoCaso Feb 13, 2023
36aaf27
Change the method signature for loading rule data.
GustavoCaso Feb 13, 2023
296b62b
make sure the default value for client_ip_denylist and user_id_denyli…
GustavoCaso Feb 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
add new user_id_denylist configuration to appsec
  • Loading branch information
@GustavoCaso
GustavoCaso committed Feb 9, 2023
commit a7f13b41eeb04a905e4caaabd31e0b582b192534
4 changes: 4 additions & 0 deletions lib/datadog/appsec/configuration.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,10 @@ def ip_denylist=(value)
options[:ip_denylist] = value
GustavoCaso marked this conversation as resolved.
Show resolved Hide resolved
end

def user_id_denylist=(value)
options[:user_id_denylist] = value
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wondering if we should rather resolve to a default here:

Suggested change
options[:user_id_denylist] = value
options[:user_id_denylist] = value || []

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I like that. That way the setting of sane defaults happen at the right layer 😄

Copy link
Member Author

@GustavoCaso GustavoCaso Feb 13, 2023 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lloeki I actually change the location in which we return the default empty array. Rather than on the setter I returned an empty array at the time of reading the value of client_ip_denylist or user_id_denylist if nothing has been configured.

Check 296b62b

end

# in microseconds
def waf_timeout=(value)
options[:waf_timeout] = value
Expand Down
7 changes: 7 additions & 0 deletions lib/datadog/appsec/configuration/settings.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,13 @@ def ip_denylist
_ = @options[:ip_denylist]
end

# EXPERIMENTAL: This configurable is not meant to be publicly used, but
# is very useful for testing. It may change at any point in time.
def user_id_denylist
# Cast for Steep
_ = @options[:user_id_denylist]
end

def waf_timeout
# Cast for Steep
_ = @options[:waf_timeout]
Expand Down
10 changes: 10 additions & 0 deletions lib/datadog/appsec/extensions.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,12 @@ def ip_denylist=(arg)
@settings.merge(dsl)
end

def user_id_denylist=(arg)
dsl = AppSec::Configuration::DSL.new
dsl.user_id_denylist = arg
@settings.merge(dsl)
end
GustavoCaso marked this conversation as resolved.
Show resolved Hide resolved

def waf_timeout=(arg)
dsl = AppSec::Configuration::DSL.new
dsl.waf_timeout = arg
Expand Down Expand Up @@ -102,6 +108,10 @@ def ip_denylist
@settings.ip_denylist
end

def user_id_denylist
@settings.user_id_denylist
end

def waf_timeout
@settings.waf_timeout
end
Expand Down
1 change: 1 addition & 0 deletions sig/datadog/appsec/configuration.rbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ module Datadog
def enabled=: (bool) -> void
def ruleset=: (::Symbol | ::String | ::Hash[::String, untyped] | ::File | ::StringIO) -> void
def ip_denylist=: (::Array[::String]) -> void
def user_id_denylist=: (::Array[::String]) -> void
def waf_timeout=: (::Integer) -> void
def waf_debug=: (bool) -> void
def trace_rate_limit=: (::Integer) -> void
Expand Down
1 change: 1 addition & 0 deletions sig/datadog/appsec/configuration/settings.rbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,7 @@ module Datadog
def enabled: () -> bool
def ruleset: () -> (::Symbol | ::String | ::Hash[::String, untyped] | ::File | ::StringIO)
def ip_denylist: () -> ::Array[::String]
def user_id_denylist: () -> ::Array[::String]
def waf_timeout: () -> ::Integer
def waf_debug: () -> bool
def trace_rate_limit: () -> ::Integer
Expand Down
2 changes: 2 additions & 0 deletions sig/datadog/appsec/extensions.rbs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ module Datadog
def enabled=: (bool arg) -> untyped
def ruleset=: ((::Symbol | ::String | ::Hash[::String, untyped] | ::File | ::StringIO) arg) -> untyped
def ip_denylist=: (::Array[::String] arg) -> untyped
def user_id_denylist=: (::Array[::String] arg) -> untyped
def waf_timeout=: (::Integer arg) -> untyped
def waf_debug=: (bool arg) -> untyped
def trace_rate_limit=: (::Integer arg) -> untyped
Expand All @@ -30,6 +31,7 @@ module Datadog
def enabled: () -> bool
def ruleset: () -> (::Symbol | ::String | ::Hash[::String, untyped] | ::File | ::StringIO)
def ip_denylist: () -> ::Array[::String]
def user_id_denylist: () -> ::Array[::String]
def waf_timeout: () -> ::Integer
def waf_debug: () -> bool
def trace_rate_limit: () -> ::Integer
Expand Down
20 changes: 20 additions & 0 deletions spec/datadog/appsec/configuration/settings_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,26 @@
it { expect { trace_rate_limit_ }.to change { settings.trace_rate_limit }.from(100).to(2) }
end

describe '#ip_denylist' do
subject(:ip_denylist) { settings.ip_denylist }
it { is_expected.to eq(nil) }
end

describe '#ip_denylist=' do
subject(:ip_denylist_) { settings.merge(dsl.tap { |c| c.ip_denylist = ['192.192.1.1'] }) }
it { expect { ip_denylist_ }.to change { settings.ip_denylist }.from(nil).to(['192.192.1.1']) }
end

describe '#user_id_denylist' do
subject(:user_id_denylist) { settings.user_id_denylist }
it { is_expected.to eq(nil) }
end

describe '#user_id_denylist=' do
subject(:user_id_denylist_) { settings.merge(dsl.tap { |c| c.user_id_denylist = ['8764937902709'] }) }
it { expect { user_id_denylist_ }.to change { settings.user_id_denylist }.from(nil).to(['8764937902709']) }
end

describe '#obfuscator_key_regex' do
subject(:obfuscator_key_regex) { settings.obfuscator_key_regex }
it { is_expected.to include('token') }
Expand Down
20 changes: 20 additions & 0 deletions spec/datadog/appsec/extensions_spec.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,26 @@
it { expect { trace_rate_limit_ }.to change { settings.trace_rate_limit }.from(100).to(2) }
end

describe '#ip_denylist' do
subject(:ip_denylist) { settings.ip_denylist }
it { is_expected.to eq(nil) }
end

describe '#ip_denylist=' do
subject(:ip_denylist_) { settings.ip_denylist = ['192.192.1.1'] }
it { expect { ip_denylist_ }.to change { settings.ip_denylist }.from(nil).to(['192.192.1.1']) }
end

describe '#user_id_denylist' do
subject(:user_id_denylist) { settings.user_id_denylist }
it { is_expected.to eq(nil) }
end

describe '#user_id_denylist=' do
subject(:user_id_denylist_) { settings.user_id_denylist = ['24528736564812'] }
it { expect { user_id_denylist_ }.to change { settings.user_id_denylist }.from(nil).to(['24528736564812']) }
end

describe '#[]' do
describe 'when the integration exists' do
subject(:get) { settings[integration_name] }
Expand Down