Skip to content

Commit 3fb784b

Browse files
jandro996jandro996
committed
WIP
1 parent d85683e commit 3fb784b

File tree

11 files changed

+295
-227
lines changed

11 files changed

+295
-227
lines changed

‎manifests/cpp_nginx.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,11 @@ tests/:
6565
Test_Blocking: v1.2.0
6666
Test_Blocking_strip_response_headers: irrelevant (no response headers on 1st waf run, which is where blocking is possible)
6767
Test_CustomBlockingResponse: v1.2.0
68-
test_blocking_block_id.py:
69-
Test_BlockId_Custom_Redirect: missing_feature
70-
Test_BlockId_HTML_Response: missing_feature
71-
Test_BlockId_JSON_Response: missing_feature
68+
test_blocking_security_response_id.py:
69+
Test_SecurityResponseId_Custom_Redirect: missing_feature
70+
Test_SecurityResponseId_HTML_Response: missing_feature
71+
Test_SecurityResponseId_In_Span_Triggers: missing_feature
72+
Test_SecurityResponseId_JSON_Response: missing_feature
7273
test_custom_rules.py:
7374
Test_CustomRules: v1.2.0
7475
test_exclusions.py:

‎manifests/dotnet.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -302,10 +302,11 @@ tests/:
302302
Test_Blocking: v2.27.0
303303
Test_Blocking_strip_response_headers: missing_feature
304304
Test_CustomBlockingResponse: v3.10.0
305-
test_blocking_block_id.py:
306-
Test_BlockId_Custom_Redirect: missing_feature
307-
Test_BlockId_HTML_Response: missing_feature
308-
Test_BlockId_JSON_Response: missing_feature
305+
test_blocking_security_response_id.py:
306+
Test_SecurityResponseId_Custom_Redirect: missing_feature
307+
Test_SecurityResponseId_HTML_Response: missing_feature
308+
Test_SecurityResponseId_In_Span_Triggers: missing_feature
309+
Test_SecurityResponseId_JSON_Response: missing_feature
309310
test_custom_rules.py:
310311
Test_CustomRules: v2.30.0
311312
test_exclusions.py:

‎manifests/golang.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -350,10 +350,11 @@ tests/:
350350
Test_Blocking: v1.50.0-rc.1
351351
Test_Blocking_strip_response_headers: missing_feature
352352
Test_CustomBlockingResponse: v1.63.0
353-
test_blocking_block_id.py:
354-
Test_BlockId_Custom_Redirect: missing_feature
355-
Test_BlockId_HTML_Response: missing_feature
356-
Test_BlockId_JSON_Response: missing_feature
353+
test_blocking_security_response_id.py:
354+
Test_SecurityResponseId_Custom_Redirect: missing_feature
355+
Test_SecurityResponseId_HTML_Response: missing_feature
356+
Test_SecurityResponseId_In_Span_Triggers: missing_feature
357+
Test_SecurityResponseId_JSON_Response: missing_feature
357358
test_custom_rules.py:
358359
Test_CustomRules: v1.51.0
359360
test_exclusions.py:

‎manifests/java.yml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1148,14 +1148,17 @@ tests/:
11481148
akka-http: v1.22.0
11491149
play: v1.22.0
11501150
spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
1151-
test_blocking_block_id.py:
1152-
Test_BlockId_Custom_Redirect:
1151+
test_blocking_security_response_id.py:
1152+
Test_SecurityResponseId_Custom_Redirect:
11531153
'*': missing_feature
11541154
spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
1155-
Test_BlockId_HTML_Response:
1155+
Test_SecurityResponseId_HTML_Response:
11561156
'*': missing_feature
11571157
spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
1158-
Test_BlockId_JSON_Response:
1158+
Test_SecurityResponseId_In_Span_Triggers:
1159+
'*': missing_feature
1160+
spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
1161+
Test_SecurityResponseId_JSON_Response:
11591162
'*': missing_feature
11601163
spring-boot-3-native: irrelevant (GraalVM. Tracing support only)
11611164
test_custom_rules.py:

‎manifests/nodejs.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -766,10 +766,11 @@ tests/:
766766
Test_Blocking: *ref_3_19_0
767767
Test_Blocking_strip_response_headers: *ref_5_17_0
768768
Test_CustomBlockingResponse: *ref_5_15_0
769-
test_blocking_block_id.py:
770-
Test_BlockId_Custom_Redirect: missing_feature
771-
Test_BlockId_HTML_Response: missing_feature
772-
Test_BlockId_JSON_Response: missing_feature
769+
test_blocking_security_response_id.py:
770+
Test_SecurityResponseId_Custom_Redirect: missing_feature
771+
Test_SecurityResponseId_HTML_Response: missing_feature
772+
Test_SecurityResponseId_In_Span_Triggers: missing_feature
773+
Test_SecurityResponseId_JSON_Response: missing_feature
773774
test_custom_rules.py:
774775
Test_CustomRules:
775776
'*': *ref_4_1_0

‎manifests/php.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -312,10 +312,11 @@ tests/:
312312
Test_Blocking: missing_feature # v0.86.0
313313
Test_Blocking_strip_response_headers: missing_feature
314314
Test_CustomBlockingResponse: missing_feature # v0.86.0
315-
test_blocking_block_id.py:
316-
Test_BlockId_Custom_Redirect: missing_feature
317-
Test_BlockId_HTML_Response: missing_feature
318-
Test_BlockId_JSON_Response: missing_feature
315+
test_blocking_security_response_id.py:
316+
Test_SecurityResponseId_Custom_Redirect: missing_feature
317+
Test_SecurityResponseId_HTML_Response: missing_feature
318+
Test_SecurityResponseId_In_Span_Triggers: missing_feature
319+
Test_SecurityResponseId_JSON_Response: missing_feature
319320
test_custom_rules.py:
320321
Test_CustomRules: v0.87.2
321322
test_exclusions.py:

‎manifests/python.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -452,10 +452,11 @@ tests/:
452452
Test_CustomBlockingResponse:
453453
'*': v1.20.0
454454
fastapi: v2.4.0
455-
test_blocking_block_id.py:
456-
Test_BlockId_Custom_Redirect: missing_feature
457-
Test_BlockId_HTML_Response: missing_feature
458-
Test_BlockId_JSON_Response: missing_feature
455+
test_blocking_security_response_id.py:
456+
Test_SecurityResponseId_Custom_Redirect: missing_feature
457+
Test_SecurityResponseId_HTML_Response: missing_feature
458+
Test_SecurityResponseId_In_Span_Triggers: missing_feature
459+
Test_SecurityResponseId_JSON_Response: missing_feature
459460
test_custom_rules.py:
460461
Test_CustomRules:
461462
'*': v1.16.1

‎manifests/ruby.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -345,10 +345,11 @@ tests/:
345345
Test_Blocking: v1.11.0
346346
Test_Blocking_strip_response_headers: v1.13.0
347347
Test_CustomBlockingResponse: v1.15.0
348-
test_blocking_block_id.py:
349-
Test_BlockId_Custom_Redirect: missing_feature
350-
Test_BlockId_HTML_Response: missing_feature
351-
Test_BlockId_JSON_Response: missing_feature
348+
test_blocking_security_response_id.py:
349+
Test_SecurityResponseId_Custom_Redirect: missing_feature
350+
Test_SecurityResponseId_HTML_Response: missing_feature
351+
Test_SecurityResponseId_In_Span_Triggers: missing_feature
352+
Test_SecurityResponseId_JSON_Response: missing_feature
352353
test_custom_rules.py:
353354
Test_CustomRules: v1.12.0
354355
test_exclusions.py:

‎tests/appsec/waf/test_blocking.py‎

Lines changed: 27 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,11 @@
22

33
from utils import interfaces, bug, scenarios, weblog, rfc, missing_feature, flaky, features
44
from utils._context.core import context
5-
from .test_blocking_block_id import is_valid_uuid4, extract_block_id_from_json, extract_block_id_from_html
5+
from .test_blocking_security_response_id import (
6+
is_valid_uuid4,
7+
extract_security_response_id_from_json,
8+
extract_security_response_id_from_html,
9+
)
610

711

812
BLOCK_TEMPLATE_JSON_MIN_V1 = "blocked.v1.min.json"
@@ -17,35 +21,35 @@ def _read_file(file_path: str) -> str:
1721

1822

1923
def _is_valid_json_v3_template(body: str) -> bool:
20-
"""Check if body matches v3 JSON template with valid dynamic block_id
24+
"""Check if body matches v3 JSON template with valid dynamic security_response_id
2125
22-
RFC-1070: Uses the actual block_id from the response for validation
26+
RFC-1070: Uses the actual security_response_id from the response for validation
2327
"""
24-
# Extract and validate block_id from actual response
25-
block_id = extract_block_id_from_json(body)
26-
if block_id is None or not is_valid_uuid4(block_id):
28+
# Extract and validate security_response_id from actual response
29+
security_response_id = extract_security_response_id_from_json(body)
30+
if security_response_id is None or not is_valid_uuid4(security_response_id):
2731
return False
2832

29-
# Build expected response by injecting the actual block_id into the template
33+
# Build expected response by injecting the actual security_response_id into the template
3034
v3_template = _read_file(BLOCK_TEMPLATE_JSON_MIN_V3).rstrip()
31-
expected_response = v3_template.replace("00000000-0000-4000-8000-000000000000", block_id)
35+
expected_response = v3_template.replace("00000000-0000-4000-8000-000000000000", security_response_id)
3236

3337
return body.rstrip() == expected_response
3438

3539

3640
def _is_valid_html_v3_template(body: str) -> bool:
37-
"""Check if body matches v3 HTML template with valid dynamic block_id
41+
"""Check if body matches v3 HTML template with valid dynamic security_response_id
3842
39-
RFC-1070: Uses the actual block_id from the response for validation
43+
RFC-1070: Uses the actual security_response_id from the response for validation
4044
"""
41-
# Extract and validate block_id from actual response
42-
block_id = extract_block_id_from_html(body)
43-
if block_id is None or not is_valid_uuid4(block_id):
45+
# Extract and validate security_response_id from actual response
46+
security_response_id = extract_security_response_id_from_html(body)
47+
if security_response_id is None or not is_valid_uuid4(security_response_id):
4448
return False
4549

46-
# Build expected response by injecting the actual block_id into the template
50+
# Build expected response by injecting the actual security_response_id into the template
4751
v3_template = _read_file(BLOCK_TEMPLATE_HTML_MIN_V3).rstrip()
48-
expected_response = v3_template.replace("00000000-0000-4000-8000-000000000000", block_id)
52+
expected_response = v3_template.replace("00000000-0000-4000-8000-000000000000", security_response_id)
4953

5054
return body.rstrip() == expected_response
5155

@@ -61,7 +65,7 @@ def assert_valid_html_blocked_template(body: str) -> None:
6165
_read_file(BLOCK_TEMPLATE_HTML_MIN_V2),
6266
}
6367

64-
# Check for v3 template with dynamic block_id
68+
# Check for v3 template with dynamic security_response_id
6569
assert body in valid_templates or _is_valid_html_v3_template(body)
6670

6771

@@ -77,7 +81,7 @@ def assert_valid_json_blocked_template(body: str) -> None:
7781
_read_file(BLOCK_TEMPLATE_JSON_MIN_V1).rstrip(),
7882
}
7983

80-
# Check for v3 template with dynamic block_id
84+
# Check for v3 template with dynamic security_response_id
8185
assert body in valid_templates or _is_valid_json_v3_template(body)
8286

8387

@@ -222,19 +226,19 @@ def setup_json_template_v1(self):
222226
@missing_feature(context.library < "python@2.11.0.dev")
223227
@missing_feature(library="ruby")
224228
def test_json_template_v1(self):
225-
"""JSON block template is v1 minified (or v3 with block_id)"""
229+
"""JSON block template is v1 minified (or v3 with security_response_id)"""
226230
assert self.r_json_v1.status_code == 403
227231
assert self.r_json_v1.headers.get("content-type", "").lower() in JSON_CONTENT_TYPES
228232

229-
# Accept v1 template without block_id or v3 template with block_id
233+
# Accept v1 template without security_response_id or v3 template with security_response_id
230234
response_text = self.r_json_v1.text.rstrip()
231235
v1_template = _read_file(BLOCK_TEMPLATE_JSON_MIN_V1).rstrip()
232236

233237
# Check if it's v1 template
234238
if response_text == v1_template:
235239
return
236240

237-
# Check if it's v3 template with valid block_id
241+
# Check if it's v3 template with valid security_response_id
238242
assert _is_valid_json_v3_template(self.r_json_v1.text), "Response doesn't match v1 or v3 template"
239243

240244
def setup_html_template_v2(self):
@@ -247,19 +251,19 @@ def setup_html_template_v2(self):
247251
@missing_feature(context.library < "python@2.11.0.dev")
248252
@missing_feature(library="ruby")
249253
def test_html_template_v2(self):
250-
"""HTML block template is v2 minified (or v3 with block_id)"""
254+
"""HTML block template is v2 minified (or v3 with security_response_id)"""
251255
assert self.r_html_v2.status_code == 403
252256
assert self.r_html_v2.headers.get("content-type", "").lower() in HTML_CONTENT_TYPES
253257

254-
# Accept v2 template without block_id or v3 template with block_id
258+
# Accept v2 template without security_response_id or v3 template with security_response_id
255259
response_text = self.r_html_v2.text
256260
v2_template = _read_file(BLOCK_TEMPLATE_HTML_MIN_V2)
257261

258262
# Check if it's v2 template
259263
if response_text == v2_template:
260264
return
261265

262-
# Check if it's v3 template with valid block_id
266+
# Check if it's v3 template with valid security_response_id
263267
assert _is_valid_html_v3_template(self.r_html_v2.text), "Response doesn't match v2 or v3 template"
264268

265269

0 commit comments

Comments
 (0)