Skip to content

Commit ca47a8e

Browse files
akozlovets098akozlovets098
committed
EXCEPTION_PATTERN for target_user
1 parent 3c0205f commit ca47a8e

File tree

2 files changed

+96
-19
lines changed

2 files changed

+96
-19
lines changed

‎rules/gsuite_reports_rules/gsuite_drive_external_share.py

+46-15
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,8 @@
55
COMPANY_DOMAIN = "your-company-name.com"
66
EXCEPTION_PATTERNS = {
77
# The glob pattern for the document title (lowercased)
8-
"document title p*": {
9-
# All actors allowed to receive the file share
10-
"allowed_for": {
8+
"1 document title p*": { # allow any title "all"
9+
"allowed_to_send": {
1110
"[email protected]",
1211
"[email protected]",
1312
"[email protected]",
@@ -17,6 +16,26 @@
1716
# Allow any user in a specific domain
1817
# "*@acme.com"
1918
},
19+
"allowed_to_receive": {
20+
"[email protected]",
21+
"[email protected]",
22+
"[email protected]",
23+
"[email protected]",
24+
# Allow any user
25+
# "all"
26+
# Allow any user in a specific domain
27+
# "*@acme.com"
28+
},
29+
# The time limit for how long the file share stays valid
30+
"allowed_until": datetime.datetime(year=2030, month=6, day=2),
31+
},
32+
"2 document title p*": {
33+
"allowed_to_send": {
34+
"[email protected]",
35+
},
36+
"allowed_to_receive": {
37+
"*@acme.com",
38+
},
2039
# The time limit for how long the file share stays valid
2140
"allowed_until": datetime.datetime(year=2030, month=6, day=2),
2241
},
@@ -32,7 +51,7 @@ def _check_acl_change_event(actor_email, acl_change_event):
3251
doc_title = parameters.get("doc_title", "TITLE_UNKNOWN")
3352
old_visibility = parameters.get("old_visibility", "OLD_VISIBILITY_UNKNOWN")
3453
new_visibility = parameters.get("visibility", "NEW_VISIBILITY_UNKNOWN")
35-
target_user = parameters.get("target_user", "USER_UNKNOWN")
54+
target_user = parameters.get("target_user") or parameters.get("target_domain") or "USER_UNKNOWN"
3655
current_time = datetime.datetime.now()
3756

3857
if (
@@ -41,24 +60,36 @@ def _check_acl_change_event(actor_email, acl_change_event):
4160
and not target_user.endswith(f"@{COMPANY_DOMAIN}")
4261
):
4362
# This is a dangerous share, check exceptions:
63+
4464
for pattern, details in EXCEPTION_PATTERNS.items():
4565
doc_title_match = pattern_match(doc_title.lower(), pattern)
46-
allowed_for_match = pattern_match_list(actor_email, details.get("allowed_for"))
47-
allowed_for_all_match = details.get("allowed_for") == {"all"}
66+
all_titles_allowed = pattern == "all"
67+
proper_title = doc_title_match or all_titles_allowed
68+
69+
allowed_to_send_match = pattern_match_list(actor_email, details.get("allowed_to_send"))
70+
all_allowed_to_send_match = details.get("allowed_to_send") == {"all"}
71+
proper_sender = allowed_to_send_match or all_allowed_to_send_match
72+
73+
allowed_to_receive_match = pattern_match_list(
74+
target_user, details.get("allowed_to_receive")
75+
)
76+
all_allowed_to_receive_match = details.get("allowed_to_receive") == {"all"}
77+
proper_receiver = allowed_to_receive_match or all_allowed_to_receive_match
4878

4979
if (
50-
doc_title_match
51-
and (allowed_for_match or allowed_for_all_match)
80+
proper_title
81+
and proper_sender
82+
and proper_receiver
5283
and current_time < details.get("allowed_until")
5384
):
5485
return False
55-
# No exceptions match.
56-
# Return the event summary (which is True) to alert & use in title.
57-
return {
58-
"actor": actor_email,
59-
"doc_title": doc_title,
60-
"target_user": target_user,
61-
}
86+
# No exceptions match.
87+
# Return the event summary (which is True) to alert & use in title.
88+
return {
89+
"actor": actor_email,
90+
"doc_title": doc_title,
91+
"target_user": target_user,
92+
}
6293
return False
6394

6495

‎rules/gsuite_reports_rules/gsuite_drive_external_share.yml

+50-4
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ Tests:
4848
{ "name": "old_visibility", "value": "private" },
4949
{ "name": "doc_id", "value": "1111111111111111111" },
5050
{ "name": "doc_type", "value": "document" },
51-
{ "name": "doc_title", "value": "Document Title Primary" },
51+
{ "name": "doc_title", "value": "1 Document Title Primary" },
5252
{ "name": "visibility", "value": "shared_externally" },
5353
{
5454
"name": "originating_app_id",
@@ -86,7 +86,7 @@ Tests:
8686
[
8787
{ "name": "primary_event", "boolValue": true },
8888
{ "name": "visibility_change", "value": "external" },
89-
{ "name": "target_user", "value": "alice@external.com" },
89+
{ "name": "target_domain", "value": "external.com" },
9090
{ "name": "old_visibility", "value": "private" },
9191
{ "name": "doc_id", "value": "1111111111111111111" },
9292
{ "name": "doc_type", "value": "document" },
@@ -129,11 +129,11 @@ Tests:
129129
{ "name": "primary_event", "boolValue": true },
130130
{ "name": "billable", "boolValue": true },
131131
{ "name": "visibility_change", "value": "external" },
132-
{ "name": "target_domain", "value": "acme.com" },
132+
{ "name": "target_user", "value": "samuel@abc.com" },
133133
{ "name": "old_visibility", "value": "private" },
134134
{ "name": "doc_id", "value": "1111111111111111111" },
135135
{ "name": "doc_type", "value": "document" },
136-
{ "name": "doc_title", "value": "Document Title Pattern" },
136+
{ "name": "doc_title", "value": "1 Document Title Pattern" },
137137
{ "name": "visibility", "value": "shared_externally" },
138138
{
139139
"name": "originating_app_id",
@@ -150,3 +150,49 @@ Tests:
150150
},
151151
],
152152
}
153+
- Name: Share Allowed by Exception - 2
154+
LogType: GSuite.Reports
155+
ExpectedResult: false
156+
Log:
157+
{
158+
"kind": "admin#reports#activity",
159+
"id":
160+
{
161+
"time": "2020-07-07T15:50:49.617Z",
162+
"uniqueQualifier": "1111111111111111111",
163+
"applicationName": "drive",
164+
"customerId": "C010qxghg",
165+
},
166+
"actor":
167+
{ "email": "[email protected]", "profileId": "1111111111111111111" },
168+
"events":
169+
[
170+
{
171+
"type": "acl_change",
172+
"name": "change_user_access",
173+
"parameters":
174+
[
175+
{ "name": "primary_event", "boolValue": true },
176+
{ "name": "billable", "boolValue": true },
177+
{ "name": "visibility_change", "value": "external" },
178+
{ "name": "target_user", "value": "[email protected]" },
179+
{ "name": "old_visibility", "value": "private" },
180+
{ "name": "doc_id", "value": "1111111111111111111" },
181+
{ "name": "doc_type", "value": "document" },
182+
{ "name": "doc_title", "value": "2 Document Title Pattern" },
183+
{ "name": "visibility", "value": "shared_externally" },
184+
{
185+
"name": "originating_app_id",
186+
"value": "1111111111111111111",
187+
},
188+
{ "name": "owner_is_shared_drive", "boolValue": false },
189+
{ "name": "owner_is_team_drive", "boolValue": false },
190+
{ "name": "old_value", "multiValue": [ "none" ] },
191+
{
192+
"name": "new_value",
193+
"multiValue": [ "people_within_domain_with_link" ],
194+
},
195+
],
196+
},
197+
],
198+
}

0 commit comments

Comments
 (0)