Skip to content

Commit 08e9dd8

Browse files
davidjiglesiasdavidjiglesias
authored
Merge pull request #492 from wazuh/fix-5312-sca-filters
Add new validator for some SCA input fields
2 parents 46ac245 + a6eefbc commit 08e9dd8

File tree

4 files changed

+144
-3
lines changed

4 files changed

+144
-3
lines changed

‎CHANGELOG.md‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ All notable changes to this project will be documented in this file.
33

44
## [v3.13.1]
55

6+
### Added
7+
8+
- New filters in request `GET /sca/:agent_id/checks/:policy_id`:
9+
* `reason`: Filters the SCA checks by 'reason' field ([#492](https://github.com/wazuh/wazuh-api/issues/492)).
10+
* `status`: Filters the SCA checks by 'status' field ([#492](https://github.com/wazuh/wazuh-api/issues/492)).
11+
* `command`: Filters the SCA checks by 'command' field ([#492](https://github.com/wazuh/wazuh-api/issues/492)).
12+
13+
614
## [v3.13.0]
715

816
### Added

‎controllers/security_configuration_assessment.js‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,6 +61,9 @@ router.get('/:agent_id', cache(), function(req, res) {
6161
* @apiParam {Number} [limit=500] Maximum number of elements to return.
6262
* @apiParam {String} [sort] Sorts the collection by a field or fields (separated by comma). Use +/- at the beginning to list in ascending or descending order.
6363
* @apiParam {String} [search] Looks for elements with the specified string.
64+
* @apiParam {String} [command] Looks for elements with the specified command.
65+
* @apiParam {String} [status] Looks for elements with the specified status.
66+
* @apiParam {String} [reason] Looks for elements with the specified reason.
6467
*
6568
* @apiDescription Returns the sca checks of an agent.
6669
*
@@ -69,11 +72,12 @@ router.get('/:agent_id', cache(), function(req, res) {
6972
*
7073
*/
7174
router.get('/:agent_id/checks/:policy_id', cache(), function(req, res) {
72-
query_checks = {'title': 'alphanumeric_param', 'description': 'alphanumeric_param',
73-
'rationale': 'alphanumeric_param', 'remediation': 'alphanumeric_param',
75+
query_checks = {'title': 'symbols_alphanumeric_param', 'description': 'symbols_alphanumeric_param',
76+
'rationale': 'symbols_alphanumeric_param', 'remediation': 'symbols_alphanumeric_param',
7477
'file': 'paths', 'process': 'alphanumeric_param', 'directory': 'paths',
7578
'registry': 'alphanumeric_param', 'references': 'encoded_uri',
76-
'result': 'alphanumeric_param', 'condition': 'alphanumeric_param'
79+
'result': 'alphanumeric_param', 'condition': 'alphanumeric_param', 'command': 'alphanumeric_param',
80+
'status': 'alphanumeric_param', 'reason': 'symbols_alphanumeric_param'
7781
};
7882
templates.array_request("/sca/:agent_id/checks/:policy_id", req, res,
7983
"sca",

‎helpers/input_validation.js‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,10 @@ exports.alphanumeric_param = function(param) {
4747
return input_val(param, /^[a-zA-Z0-9_,\-\.\+\s\:]+$/);
4848
}
4949

50+
exports.symbols_alphanumeric_param = function(param) {
51+
return input_val(param, /^[a-zA-Z0-9_,<>!\-.+\s:\/()'"|=]+$/);
52+
}
53+
5054
exports.sort_param = function(param) {
5155
return input_val(param, /^[a-zA-Z0-9_\-\,\s\+\.]+$/); // + is translated as \s
5256
}

‎test/test_sca.js‎

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -408,6 +408,47 @@ describe('SecurityConfigurationAssessment', function() {
408408
});
409409
});
410410

411+
it('Filters: title', function(done) {
412+
request(common.url)
413+
.get("/sca/000/checks/cis_debian9_L2?&title=Ensure%20events%20that%20modify%20the%20system%27s%20Mandatory%20Access%20Controls%20are%20collected%20%28SELinux%29&limit=1")
414+
.auth(common.credentials.user, common.credentials.password)
415+
.expect("Content-type",/json/)
416+
.expect(200)
417+
.end(function(err,res){
418+
if (err) return done(err);
419+
420+
res.body.should.have.properties(['error', 'data']);
421+
422+
res.body.error.should.equal(0);
423+
res.body.data.totalItems.should.be.above(0);
424+
res.body.data.items.should.be.instanceof(Array);
425+
res.body.data.items[0].should.have.properties(sca_check_fields);
426+
427+
done();
428+
});
429+
430+
});
431+
432+
it('Filters: incomplete title', function(done) {
433+
request(common.url)
434+
.get("/sca/000/checks/cis_debian9_L2?title=Ensure%20events%20that&limit=1")
435+
.auth(common.credentials.user, common.credentials.password)
436+
.expect("Content-type",/json/)
437+
.expect(200)
438+
.end(function(err,res){
439+
if (err) return done(err);
440+
441+
res.body.should.have.properties(['error', 'data']);
442+
443+
res.body.error.should.equal(0);
444+
res.body.data.totalItems.should.be.equal(0);
445+
res.body.data.items.should.be.instanceof(Array);
446+
447+
done();
448+
});
449+
450+
});
451+
411452
it('Filters: description', function(done) {
412453
request(common.url)
413454
.get("/sca/000/checks/unix_audit?description=Turn%20on%20the%20auditd%20daemon%20to%20record%20system%20events.&limit=1")
@@ -429,6 +470,27 @@ describe('SecurityConfigurationAssessment', function() {
429470

430471
});
431472

473+
it('Filters: rationale', function(done) {
474+
request(common.url)
475+
.get("/sca/000/checks/cis_debian9_L2?rationale=In%20high%20security%20contexts%2C%20the%20risk%20of%20detecting%20unauthorized%20access%20or%20nonrepudiation%20exceeds%20the%20benefit%20of%20the%20system%27s%20availability.&limit=1")
476+
.auth(common.credentials.user, common.credentials.password)
477+
.expect("Content-type",/json/)
478+
.expect(200)
479+
.end(function(err,res){
480+
if (err) return done(err);
481+
482+
res.body.should.have.properties(['error', 'data']);
483+
484+
res.body.error.should.equal(0);
485+
res.body.data.totalItems.should.be.above(0);
486+
res.body.data.items.should.be.instanceof(Array);
487+
res.body.data.items[0].should.have.properties(sca_check_fields);
488+
489+
done();
490+
});
491+
492+
});
493+
432494
it('Filters: remediation', function(done) {
433495
request(common.url)
434496
.get("/sca/000/checks/unix_audit?remediation=Change%20the%20Port%20option%20value%20in%20the%20sshd_config%20file.&limit=1")
@@ -513,6 +575,69 @@ describe('SecurityConfigurationAssessment', function() {
513575

514576
});
515577

578+
it('Filters: command', function(done) {
579+
request(common.url)
580+
.get("/sca/000/checks/unix_audit?command=systemctl%20is-enabled%20auditd&limit=1")
581+
.auth(common.credentials.user, common.credentials.password)
582+
.expect("Content-type",/json/)
583+
.expect(200)
584+
.end(function(err,res){
585+
if (err) return done(err);
586+
587+
res.body.should.have.properties(['error', 'data']);
588+
589+
res.body.error.should.equal(0);
590+
res.body.data.totalItems.should.be.above(0);
591+
res.body.data.items.should.be.instanceof(Array);
592+
res.body.data.items[0].should.have.properties(sca_check_fields);
593+
594+
done();
595+
});
596+
597+
});
598+
599+
it('Filters: status', function(done) {
600+
request(common.url)
601+
.get("/sca/000/checks/unix_audit?status=Not%20applicable&limit=1")
602+
.auth(common.credentials.user, common.credentials.password)
603+
.expect("Content-type",/json/)
604+
.expect(200)
605+
.end(function(err,res){
606+
if (err) return done(err);
607+
608+
res.body.should.have.properties(['error', 'data']);
609+
610+
res.body.error.should.equal(0);
611+
res.body.data.totalItems.should.be.above(0);
612+
res.body.data.items.should.be.instanceof(Array);
613+
res.body.data.items[0].should.have.properties(sca_check_fields);
614+
615+
done();
616+
});
617+
618+
});
619+
620+
it('Filters: reason', function(done) {
621+
request(common.url)
622+
.get("/sca/000/checks/cis_debian9_L2?reason=Could%20not%20open%20file%20%27%2Fetc%2Fdefault%2Fgrub%27&limit=1")
623+
.auth(common.credentials.user, common.credentials.password)
624+
.expect("Content-type",/json/)
625+
.expect(200)
626+
.end(function(err,res){
627+
if (err) return done(err);
628+
629+
res.body.should.have.properties(['error', 'data']);
630+
631+
res.body.error.should.equal(0);
632+
res.body.data.totalItems.should.be.above(0);
633+
res.body.data.items.should.be.instanceof(Array);
634+
res.body.data.items[0].should.have.properties(sca_check_fields);
635+
636+
done();
637+
});
638+
639+
});
640+
516641
it('Filters: condition', function(done) {
517642
request(common.url)
518643
.get("/sca/000/checks/unix_audit?condition=all&limit=1")

0 commit comments

Comments
 (0)