1
|
1 |
|
from time import strftime, localtime |
|
|
|
|
2
|
|
|
|
3
|
1 |
|
try: |
4
|
1 |
|
from urlparse import urlparse |
5
|
|
|
except ImportError: # python3 |
6
|
|
|
from urllib.parse import urlparse |
7
|
|
|
|
8
|
1 |
|
from spike import create_app |
9
|
1 |
|
from spike.model import db |
10
|
1 |
|
from spike.model.naxsi_rules import NaxsiRules |
11
|
1 |
|
import unittest |
12
|
|
|
|
13
|
|
|
|
14
|
1 |
|
class FlaskrTestCase(unittest.TestCase): |
|
|
|
|
15
|
1 |
|
def setUp(self): |
16
|
1 |
|
app = create_app() |
17
|
1 |
|
db.init_app(app) |
18
|
1 |
|
app.config['TESTING'] = True |
19
|
1 |
|
self.app = app.test_client() |
20
|
|
|
|
21
|
1 |
|
def tearDown(self): |
22
|
1 |
|
pass |
23
|
|
|
|
24
|
1 |
|
def __create_rule(self): |
25
|
|
|
""" |
26
|
|
|
|
27
|
|
|
:return int: The id of the new rule |
28
|
|
|
""" |
29
|
1 |
|
current_sid = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first() |
30
|
1 |
|
current_sid = 1337 if current_sid is None else current_sid.sid + 1 |
31
|
|
|
|
32
|
1 |
|
db.session.add(NaxsiRules(u'POUET', 'str:test', u'BODY', u'$SQL:8', current_sid, u'web_server.rules', |
|
|
|
|
33
|
|
|
u'f hqewifueiwf hueiwhf uiewh fiewh fhw', '1', True, 1457101045)) |
|
|
|
|
34
|
1 |
|
self.sid_to_delete = current_sid |
|
|
|
|
35
|
1 |
|
return current_sid |
36
|
|
|
|
37
|
1 |
|
def __delete_rule(self, sid=None): |
|
|
|
|
38
|
1 |
|
sid = self.sid_to_delete if sid is None else sid |
39
|
1 |
|
db.session.delete(NaxsiRules.query.filter(sid == NaxsiRules.sid).first()) |
40
|
|
|
|
41
|
1 |
|
def test_robotstxt(self): |
|
|
|
|
42
|
1 |
|
assert self.app.get('/robots.txt').data == 'User-agent: *\n Disallow: /' |
43
|
|
|
|
44
|
1 |
|
def test_redirect_root(self): |
|
|
|
|
45
|
1 |
|
rv = self.app.get('/', follow_redirects=False) |
|
|
|
|
46
|
1 |
|
self.assertEqual(rv.status_code, 302) |
47
|
1 |
|
self.assertEqual(urlparse(rv.location).path, '/rules') |
48
|
|
|
|
49
|
1 |
|
def test_add_rule(self): |
|
|
|
|
50
|
1 |
|
data = { |
51
|
|
|
'msg': 'this is a test message', |
52
|
|
|
'detection': 'DETECTION', |
53
|
|
|
'mz': 'BODY', |
54
|
|
|
'custom_mz_val': '', |
55
|
|
|
'negative': 'checked', |
56
|
|
|
'score_$SQL': 8, |
57
|
|
|
'score': '$SQL', |
58
|
|
|
'rmks': 'this is a test remark', |
59
|
|
|
'ruleset': 'scanner.rules' |
60
|
|
|
} |
61
|
1 |
|
rv = self.app.post('/rules/new', data=data, follow_redirects=True) |
|
|
|
|
62
|
1 |
|
_rule = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first() |
63
|
|
|
|
64
|
1 |
|
self.assertIn(('<li> - OK: created %d : %s</li>' % (_rule.sid, _rule.msg)), rv.data) |
|
|
|
|
65
|
1 |
|
self.assertEqual(_rule.msg, data['msg']) |
66
|
1 |
|
self.assertEqual(_rule.detection, 'str:' + data['detection']) |
67
|
1 |
|
self.assertEqual(_rule.mz, data['mz']) |
68
|
1 |
|
self.assertEqual(_rule.score, data['score'] + ':' + str(data['score_$SQL'])) |
69
|
1 |
|
self.assertEqual(_rule.rmks, data['rmks']) |
70
|
1 |
|
self.assertEqual(_rule.ruleset, data['ruleset']) |
71
|
|
|
|
72
|
1 |
|
self.__delete_rule(_rule.sid) |
73
|
|
|
|
74
|
1 |
|
def test_del_rule(self): |
|
|
|
|
75
|
1 |
|
old_sid = self.__create_rule() |
76
|
|
|
|
77
|
1 |
|
db.session.add(NaxsiRules(u'POUET', 'str:test', u'BODY', u'$SQL:8', old_sid + 1, u'web_server.rules', |
|
|
|
|
78
|
|
|
u'f hqewifueiwf hueiwhf uiewh fiewh fhw', '1', True, 1457101045)) |
|
|
|
|
79
|
1 |
|
rv = self.app.get('/rules/del/%d' % (old_sid + 1)) |
|
|
|
|
80
|
1 |
|
self.assertEqual(rv.status_code, 302) |
81
|
|
|
|
82
|
1 |
|
_rule = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first() |
83
|
1 |
|
self.assertEqual(_rule.sid, old_sid) |
84
|
|
|
|
85
|
1 |
|
self.__delete_rule() |
86
|
|
|
|
87
|
1 |
|
def test_plain_rule(self): |
|
|
|
|
88
|
1 |
|
self.__create_rule() |
89
|
1 |
|
_rule = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first() |
90
|
1 |
|
rv = self.app.get('/rules/plain/%d' % _rule.sid) |
|
|
|
|
91
|
1 |
|
self.assertEqual(rv.status_code, 200) |
92
|
1 |
|
rdate = strftime("%F - %H:%M", localtime(float(str(_rule.timestamp)))) |
93
|
1 |
|
rmks = "# ".join(_rule.rmks.strip().split("\n")) |
94
|
1 |
|
detect = _rule.detection.lower() if _rule.detection.startswith("str:") else _rule.detection |
|
|
|
|
95
|
1 |
|
negate = 'negative' if _rule.negative == 1 else '' |
96
|
1 |
|
expected = """ |
97
|
|
|
# |
98
|
|
|
# sid: %s | date: %s |
99
|
|
|
# |
100
|
|
|
# %s |
101
|
|
|
# |
102
|
|
|
MainRule %s "%s" "msg:%s" "mz:%s" "s:%s" id:%s ; |
103
|
|
|
|
104
|
|
|
""" % (_rule.sid, rdate, rmks, negate, detect, _rule.msg, _rule.mz, _rule.score, _rule.sid) |
|
|
|
|
105
|
1 |
|
self.assertEqual(expected, rv.data) |
106
|
1 |
|
self.__delete_rule() |
107
|
|
|
|
108
|
|
|
|
109
|
1 |
|
if __name__ == '__main__': |
110
|
|
|
unittest.main() |
111
|
|
|
|
The coding style of this project requires that you add a docstring to this code element. Below, you find an example for methods:
If you would like to know more about docstrings, we recommend to read PEP-257: Docstring Conventions.