1
|
|
|
from time import strftime, localtime |
|
|
|
|
2
|
|
|
|
3
|
|
|
try: |
4
|
|
|
from urlparse import urlparse |
5
|
|
|
except ImportError: # python3 |
6
|
|
|
from urllib.parse import urlparse |
7
|
|
|
|
8
|
|
|
import re |
|
|
|
|
9
|
|
|
|
10
|
|
|
from spike import create_app |
11
|
|
|
from spike.model import db |
|
|
|
|
12
|
|
|
from spike.model.naxsi_rules import ValueTemplates, NaxsiRules, NaxsiRuleSets |
|
|
|
|
13
|
|
|
import unittest |
14
|
|
|
|
15
|
|
|
|
16
|
|
|
class FlaskrTestCase(unittest.TestCase): |
|
|
|
|
17
|
|
|
|
18
|
|
|
def setUp(self): |
19
|
|
|
app = create_app() |
20
|
|
|
app.config['TESTING'] = True |
21
|
|
|
self.app = app.test_client() |
22
|
|
|
|
23
|
|
|
def tearDown(self): |
24
|
|
|
pass |
25
|
|
|
|
26
|
|
|
def test_robotstxt(self): |
|
|
|
|
27
|
|
|
assert self.app.get('/robots.txt').data == 'User-agent: *\n Disallow: /' |
28
|
|
|
|
29
|
|
|
def test_redirect_root(self): |
|
|
|
|
30
|
|
|
rv = self.app.get('/', follow_redirects=False) |
|
|
|
|
31
|
|
|
assert rv.status_code == 302 |
32
|
|
|
assert urlparse(rv.location).path == '/rules' |
33
|
|
|
|
34
|
|
|
def test_add_rule(self): |
|
|
|
|
35
|
|
|
data = { |
36
|
|
|
'msg': 'this is a test message', |
37
|
|
|
'detection': 'DETECTION', |
38
|
|
|
'mz': 'BODY', |
39
|
|
|
'custom_mz_val': '', |
40
|
|
|
'negative': 'checked', |
41
|
|
|
'score_$SQL': 8, |
42
|
|
|
'score': '$SQL', |
43
|
|
|
'rmks': 'this is a test remark', |
44
|
|
|
'ruleset': 'scanner.rules' |
45
|
|
|
} |
46
|
|
|
rv = self.app.post('/rules/new', data=data, follow_redirects=True) |
|
|
|
|
47
|
|
|
rule = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first() |
|
|
|
|
48
|
|
|
assert ('<li> - OK: created %d : %s</li>' % (rule.sid, rule.msg)) in rv.data |
|
|
|
|
49
|
|
|
assert rule.msg == data['msg'] |
50
|
|
|
assert rule.detection == 'str:' + data['detection'] |
51
|
|
|
assert rule.mz == data['mz'] |
52
|
|
|
assert rule.score == data['score'] + ':' + str(data['score_$SQL']) |
53
|
|
|
assert rule.rmks == data['rmks'] |
54
|
|
|
assert rule.ruleset == data['ruleset'] |
55
|
|
|
|
56
|
|
|
def test_del_rule(self): |
|
|
|
|
57
|
|
|
current_sid = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first().sid |
|
|
|
|
58
|
|
|
self.test_add_rule() |
59
|
|
|
|
60
|
|
|
sid = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first().sid |
|
|
|
|
61
|
|
|
rv = self.app.get('/rules/del/%d' % sid) |
|
|
|
|
62
|
|
|
assert rv.status_code == 302 |
63
|
|
|
|
64
|
|
|
rule = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first() |
|
|
|
|
65
|
|
|
assert rule.sid == current_sid |
66
|
|
|
|
67
|
|
|
def test_plain_rule(self): |
|
|
|
|
68
|
|
|
self.test_add_rule() |
69
|
|
|
|
70
|
|
|
_rule = NaxsiRules.query.order_by(NaxsiRules.sid.desc()).first() |
|
|
|
|
71
|
|
|
rv = self.app.get('/rules/plain/%d' % _rule.sid) |
|
|
|
|
72
|
|
|
assert rv.status_code == 200 |
73
|
|
|
rdate = strftime("%F - %H:%M", localtime(float(str(_rule.timestamp)))) |
74
|
|
|
rmks = "# ".join(_rule.rmks.strip().split("\n")) |
75
|
|
|
detect = _rule.detection.lower() if _rule.detection.startswith("str:") else _rule.detection |
|
|
|
|
76
|
|
|
negate = 'negative' if _rule.negative == 1 else '' |
77
|
|
|
expected = """ |
78
|
|
|
# |
79
|
|
|
# sid: %s | date: %s |
80
|
|
|
# |
81
|
|
|
# %s |
82
|
|
|
# |
83
|
|
|
MainRule %s "%s" "msg:%s" "mz:%s" "s:%s" id:%s ; |
84
|
|
|
|
85
|
|
|
""" % (_rule.sid, rdate, rmks, negate, detect, _rule.msg, _rule.mz, _rule.score, _rule.sid) |
|
|
|
|
86
|
|
|
assert expected == rv.data |
87
|
|
|
|
88
|
|
|
|
89
|
|
|
if __name__ == '__main__': |
90
|
|
|
unittest.main() |
|
|
|
|
The coding style of this project requires that you add a docstring to this code element. Below, you find an example for methods:
If you would like to know more about docstrings, we recommend to read PEP-257: Docstring Conventions.