github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 01:38:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

[Security Solution] fix blocklist path validation (#129124) (#129141)

Browse source 
(cherry picked from commit 1803cf448a)

Co-authored-by: Joey F. Poon <joey.poon@elastic.co>
This commit is contained in:
Kibana Machine 2022-03-31 17:48:34 -04:00 • committed by GitHub
parent 35db4e188d
commit 611c5238d9
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

14
packages/kbn-securitysolution-utils/src/path_validations/index.ts
View file

@ -34,7 +34,10 @@ export type TrustedAppConditionEntryField =
| 'process.executable.caseless'
| 'process.Ext.code_signature';
export type BlocklistConditionEntryField = 'file.hash.*' | 'file.path' | 'file.Ext.code_signature';
export type AllConditionEntryFields = TrustedAppConditionEntryField | BlocklistConditionEntryField;
export type AllConditionEntryFields =
| TrustedAppConditionEntryField
| BlocklistConditionEntryField
| 'file.path.text';
export const enum OperatingSystem {
LINUX = 'linux',
@ -105,11 +108,16 @@ export const isPathValid = ({
value,
}: {
os: OperatingSystem;
field: AllConditionEntryFields | 'file.path.text';
field: AllConditionEntryFields;
type: EntryTypes;
value: string;
}): boolean => {
if (field === ConditionEntryField.PATH || field === 'file.path.text') {
const pathFields: AllConditionEntryFields[] = [
'process.executable.caseless',
'file.path',
'file.path.text',
];
if (pathFields.includes(field)) {
if (type === 'wildcard') {
return os === OperatingSystem.WINDOWS
? isWindowsWildcardPathValid(value)