[8.10] [Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200) (#164317)

# Backport This will backport the following commits from `main` to `8.10`: - [[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (#164200)](https://github.com/elastic/kibana/pull/164200)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  Co-authored-by: Kevin Logan <56395104+kevinlog@users.noreply.github.com>
2025-04-24 01:38:56 -04:00 · 2023-08-21 10:08:52 -04:00 · 2023-08-21 10:08:52 -04:00 · 1a1bdb7a3e
commit 1a1bdb7a3e
parent cff9aa726d
7 changed files with 83 additions and 14 deletions
--- a/packages/kbn-securitysolution-utils/src/path_validations/index.ts
+++ b/packages/kbn-securitysolution-utils/src/path_validations/index.ts
@ -33,7 +33,11 @@ export type TrustedAppConditionEntryField =
  | 'process.hash.*'
  | 'process.executable.caseless'
  | 'process.Ext.code_signature';
-export type BlocklistConditionEntryField = 'file.hash.*' | 'file.path' | 'file.Ext.code_signature';
+export type BlocklistConditionEntryField =
+  | 'file.hash.*'
+  | 'file.path'
+  | 'file.Ext.code_signature'
+  | 'file.path.caseless';
 export type AllConditionEntryFields =
  | TrustedAppConditionEntryField
  | BlocklistConditionEntryField
--- a/x-pack/plugins/security_solution/public/management/cypress/fixtures/artifacts_page.ts
+++ b/x-pack/plugins/security_solution/public/management/cypress/fixtures/artifacts_page.ts
@ -358,7 +358,7 @@ export const getArtifactsListTestsData = (): ArtifactsFixtureType[] => [
        },
        {
          type: 'click',
-          selector: 'blocklist-form-file.path',
+          selector: 'blocklist-form-file.path.caseless',
        },
        {
          type: 'click',
@ -379,7 +379,7 @@ export const getArtifactsListTestsData = (): ArtifactsFixtureType[] => [
        {
          selector: 'blocklistPage-card-criteriaConditions',
          value:
-            'OSIS WindowsAND file.pathis one of\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
+            'OSIS WindowsAND file.path.caselessis one of\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
        },
        {
          selector: 'blocklistPage-card-header-title',
--- a/x-pack/plugins/security_solution/public/management/pages/blocklist/translations.ts
+++ b/x-pack/plugins/security_solution/public/management/pages/blocklist/translations.ts
@ -76,6 +76,12 @@ export const CONDITION_FIELD_TITLE: { [K in BlocklistConditionEntryField]: strin
  'file.path': i18n.translate('xpack.securitySolution.blocklist.entry.field.path', {
    defaultMessage: 'Path',
  }),
+  'file.path.caseless': i18n.translate(
+    'xpack.securitySolution.blocklist.entry.field.path.caseless',
+    {
+      defaultMessage: 'Path',
+    }
+  ),
  'file.Ext.code_signature': i18n.translate(
    'xpack.securitySolution.blocklist.entry.field.signature',
    { defaultMessage: 'Signature' }
@ -89,6 +95,12 @@ export const CONDITION_FIELD_DESCRIPTION: { [K in BlocklistConditionEntryField]:
  'file.path': i18n.translate('xpack.securitySolution.blocklist.entry.field.description.path', {
    defaultMessage: 'The full path of the application',
  }),
+  'file.path.caseless': i18n.translate(
+    'xpack.securitySolution.blocklist.entry.field.description.path.caseless',
+    {
+      defaultMessage: 'The full path of the application (case insenstive)',
+    }
+  ),
  'file.Ext.code_signature': i18n.translate(
    'xpack.securitySolution.blocklist.entry.field.description.signature',
    { defaultMessage: 'The signer of the application' }
--- a/x-pack/plugins/security_solution/public/management/pages/blocklist/view/components/blocklist_form.test.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/blocklist/view/components/blocklist_form.test.tsx
@ -225,6 +225,38 @@ describe('blocklist form', () => {
    userEvent.click(screen.getByRole('option', { name: /path/i }));
    const expected = createOnChangeArgs({
      item: createItem({
+        entries: [createEntry('file.path.caseless', [])],
+      }),
+    });
+    expect(onChangeSpy).toHaveBeenCalledWith(expected);
+  });
+
+  it('should correctly create `file.path.caseless` when Mac OS is selected', async () => {
+    render(createProps({ item: createItem({ os_types: [OperatingSystem.MAC] }) }));
+    expect(screen.getByTestId('blocklist-form-os-select').textContent).toEqual('Mac');
+
+    userEvent.click(screen.getByTestId('blocklist-form-field-select'));
+    await waitForEuiPopoverOpen();
+    userEvent.click(screen.getByRole('option', { name: /path/i }));
+    const expected = createOnChangeArgs({
+      item: createItem({
+        os_types: [OperatingSystem.MAC],
+        entries: [createEntry('file.path.caseless', [])],
+      }),
+    });
+    expect(onChangeSpy).toHaveBeenCalledWith(expected);
+  });
+
+  it('should correctly create `file.path` when Linux is selected', async () => {
+    render(createProps({ item: createItem({ os_types: [OperatingSystem.LINUX] }) }));
+    expect(screen.getByTestId('blocklist-form-os-select').textContent).toEqual('Linux');
+
+    userEvent.click(screen.getByTestId('blocklist-form-field-select'));
+    await waitForEuiPopoverOpen();
+    userEvent.click(screen.getByRole('option', { name: /path/i }));
+    const expected = createOnChangeArgs({
+      item: createItem({
+        os_types: [OperatingSystem.LINUX],
        entries: [createEntry('file.path', [])],
      }),
    });
--- a/x-pack/plugins/security_solution/public/management/pages/blocklist/view/components/blocklist_form.tsx
+++ b/x-pack/plugins/security_solution/public/management/pages/blocklist/view/components/blocklist_form.tsx
@ -178,14 +178,31 @@ export const BlockListForm = memo<ArtifactFormComponentProps>(
    );

    const fieldOptions: Array<EuiSuperSelectOption<BlocklistConditionEntryField>> = useMemo(() => {
-      const selectableFields: Array<EuiSuperSelectOption<BlocklistConditionEntryField>> = (
-        ['file.hash.*', 'file.path'] as BlocklistConditionEntryField[]
-      ).map((field) => ({
-        value: field,
-        inputDisplay: CONDITION_FIELD_TITLE[field],
-        dropdownDisplay: getDropdownDisplay(field),
-        'data-test-subj': getTestId(field),
-      }));
+      const selectableFields: Array<EuiSuperSelectOption<BlocklistConditionEntryField>> = [];
+
+      selectableFields.push({
+        value: 'file.hash.*',
+        inputDisplay: CONDITION_FIELD_TITLE['file.hash.*'],
+        dropdownDisplay: getDropdownDisplay('file.hash.*'),
+        'data-test-subj': getTestId('file.hash.*'),
+      });
+
+      if (selectedOs === OperatingSystem.LINUX) {
+        selectableFields.push({
+          value: 'file.path',
+          inputDisplay: CONDITION_FIELD_TITLE['file.path'],
+          dropdownDisplay: getDropdownDisplay('file.path'),
+          'data-test-subj': getTestId('file.path'),
+        });
+      } else {
+        selectableFields.push({
+          value: 'file.path.caseless',
+          inputDisplay: CONDITION_FIELD_TITLE['file.path.caseless'],
+          dropdownDisplay: getDropdownDisplay('file.path.caseless'),
+          'data-test-subj': getTestId('file.path.caseless'),
+        });
+      }
+
      if (selectedOs === OperatingSystem.WINDOWS) {
        selectableFields.push({
          value: 'file.Ext.code_signature',
--- a/x-pack/plugins/security_solution/server/lists_integration/endpoint/validators/blocklist_validator.ts
+++ b/x-pack/plugins/security_solution/server/lists_integration/endpoint/validators/blocklist_validator.ts
@ -21,12 +21,16 @@ import { isValidHash } from '../../../../common/endpoint/service/artifacts/valid
 import { EndpointArtifactExceptionValidationError } from './errors';

 const allowedHashes: Readonly<string[]> = ['file.hash.md5', 'file.hash.sha1', 'file.hash.sha256'];
+const allowedFilePaths: Readonly<string[]> = ['file.path', 'file.path.caseless'];

 const FileHashField = schema.oneOf(
  allowedHashes.map((hash) => schema.literal(hash)) as [Type<string>]
 );

-const FilePath = schema.literal('file.path');
+const FilePath = schema.oneOf(
+  allowedFilePaths.map((path) => schema.literal(path)) as [Type<string>]
+);
+
 const FileCodeSigner = schema.literal('file.Ext.code_signature');

 const ConditionEntryTypeSchema = schema.literal('match_any');
--- a/x-pack/test/security_solution_endpoint/apps/integrations/mocks.ts
+++ b/x-pack/test/security_solution_endpoint/apps/integrations/mocks.ts
@ -423,7 +423,7 @@ export const getArtifactsListTestsData = () => [
        {
          selector: 'blocklistPage-card-criteriaConditions',
          value:
-            'OSIS Windows\nAND file.pathIS ONE OF\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
+            'OSIS Windows\nAND file.path.caselessIS ONE OF\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
        },
        {
          selector: 'blocklistPage-card-header-title',
@ -499,7 +499,7 @@ export const getArtifactsListTestsData = () => [
              {
                field: 'file.path',
                operator: 'included',
-                type: 'exact_cased_any',
+                type: 'exact_caseless_any',
                value: ['c:\\randomFolder\\randomFile.exe', ' c:\\randomFolder\\randomFile2.exe'],
              },
            ],