feat: prevent attacks even without HTTP requests

Signed-off-by: Kohei Morita <[email protected]>

Author: mrtc0

exporter/exporter.go

@@ -15,7 +15,9 @@ type eventExporterProvider struct {
 	ep EventExporter
 }
 
+// EventExporter exports WAF detection events to any desired location.
 type EventExporter interface {
+	// Export transforms and transmits event data to any desired location.
 	Export(ctx context.Context, event waf.ReadOnlyDetectionEvents) error
 }
 

internal/emitter/account_takeover/handler.go

@@ -37,7 +37,7 @@ func IsSuspiciousLoginActivity(
 ) error {
 	parent, _ := operation.FindOperationFromContext(ctx)
 	if parent == nil {
-		return nil
+		parent = operation.NewOperation(nil)
 	}
 
 	var wafop *waf.WafOperation

internal/emitter/http/client_handler.go

@@ -44,7 +44,7 @@ var _ http.RoundTripper = &Transport{}
 func ProtectRoundTrip(ctx context.Context, url string) error {
 	parent, _ := operation.FindOperationFromContext(ctx)
 	if parent == nil {
-		return nil
+		parent = operation.NewOperation(nil)
 	}
 
 	var wafop *waf.WafOperation

internal/emitter/http/client_handler_test.go

@@ -35,8 +35,8 @@ func TestWrapClient(t *testing.T) {
 		},
 		"when not through http operation": {
 			ctx:       context.Background(),
-			url:       "https://example.com",
-			expectErr: false,
+			url:       "http://169.254.169.254",
+			expectErr: true,
 		},
 	}
 

internal/emitter/os/handler.go

@@ -32,7 +32,7 @@ func (r *FileOperationResult) IsBlock() bool {
 func ProtectFileOperation(ctx context.Context, path string) error {
 	parent, _ := operation.FindOperationFromContext(ctx)
 	if parent == nil {
-		return nil
+		parent = operation.NewOperation(nil)
 	}
 
 	var wafop *waf.WafOperation

internal/emitter/os/handler_test.go

@@ -9,12 +9,13 @@ import (
 	"github.com/sitebatch/waffle-go/internal/emitter/os"
 	"github.com/sitebatch/waffle-go/waf"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestProtectFileOperation(t *testing.T) {
 	t.Parallel()
 
-	waffle.Start()
+	require.NoError(t, waffle.Start())
 
 	testCases := map[string]struct {
 		ctx       context.Context
@@ -36,6 +37,11 @@ func TestProtectFileOperation(t *testing.T) {
 			filePath:  "file.txt",
 			expectErr: false,
 		},
+		"not through http operation and attack request": {
+			ctx:       context.Background(),
+			filePath:  "/var/run/secrets/kubernetes.io/serviceaccount/token",
+			expectErr: true,
+		},
 	}
 
 	for name, tt := range testCases {

internal/emitter/sql/handler.go

@@ -32,7 +32,7 @@ func (r *SQLOperationResult) IsBlock() bool {
 func ProtectSQLOperation(ctx context.Context, query string) error {
 	parent, _ := operation.FindOperationFromContext(ctx)
 	if parent == nil {
-		return nil
+		parent = operation.NewOperation(nil)
 	}
 
 	var wafop *waf.WafOperation

internal/emitter/sql/handler_test.go

@@ -9,12 +9,13 @@ import (
 	"github.com/sitebatch/waffle-go/internal/emitter/sql"
 	"github.com/sitebatch/waffle-go/waf"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestProtectSQLOperation(t *testing.T) {
 	t.Parallel()
 
-	waffle.Start()
+	require.NoError(t, waffle.Start())
 
 	testCases := map[string]struct {
 		ctx       context.Context
@@ -36,11 +37,14 @@ func TestProtectSQLOperation(t *testing.T) {
 			query:     "SELECT * FROM users",
 			expectErr: false,
 		},
+		"not through http operation and attack request": {
+			ctx:       context.Background(),
+			query:     "SELECT * FROM users WHERE id = '1' OR 1=1--",
+			expectErr: true,
+		},
 	}
 
 	for name, tt := range testCases {
-		tt := tt
-
 		t.Run(name, func(t *testing.T) {
 			t.Parallel()
 

waffle.go

@@ -46,6 +46,7 @@ func WithRule(ruleJSON []byte) Options {
 	}
 }
 
+// Start initializes and starts Waffle with the provided options.
 func Start(opts ...Options) error {
 	response.InitResponseWriterFeature()
 
@@ -90,6 +91,12 @@ func SetErrorHandler(h handler.ErrorHandler) {
 	handler.SetErrorHandler(h)
 }
 
+// SetExporter sets a exporter of WAF detection event.
+//
+// Waffle can export WAF detection events to any desired location using the provided exporter.
+// By default, Waffle uses a no-operation exporter that does not export any events.
+// You can implement your own exporter by implementing the exporter.EventExporter interface
+// and set it using this function.
 func SetExporter(eventExporter exporter.EventExporter) {
 	exporter.SetExporter(eventExporter)
 }