module TCellAgent::Instrumentation::Lfi
Public Class Methods
argf_open_handler()
click to toggle source
# File lib/tcell_agent/instrumentation/lfi.rb, line 109 def self.argf_open_handler path, mode = TCellAgent::Instrumentation::Lfi.extract_path_mode_argf raise_if_block(path, mode) end
block_file_access?(path, mode)
click to toggle source
# File lib/tcell_agent/instrumentation/lfi.rb, line 10 def self.block_file_access?(path, mode) TCellAgent::Instrumentation.safe_block('Checking Local Files Policy') do if TCellAgent::Utils::Strings.present?(path) lfi_policy = TCellAgent.policy(TCellAgent::PolicyTypes::LFI) request_env = TCellAgent::Instrumentation::Rails::Middleware::ContextMiddleware::THREADS.fetch( Thread.current.object_id, {} ) tcell_context = request_env[TCellAgent::Instrumentation::TCELL_ID] return lfi_policy.block_file_access?(path, mode, tcell_context) end end false end
cmdi_open_handler(args, override_mode = '')
click to toggle source
# File lib/tcell_agent/instrumentation/lfi.rb, line 115 def self.cmdi_open_handler(args, override_mode = '') path, mode = extract_path_mode(*args) mode = override_mode unless override_mode.empty? raise_if_block(path, mode) return unless path.empty? cmd = TCellAgent::Cmdi.parse_command_from_open(*args) TCellAgent::Cmdi.raise_if_block(cmd) if cmd end
convert_mode(mode)
click to toggle source
# File lib/tcell_agent/instrumentation/lfi.rb, line 84 def self.convert_mode(mode) if mode.is_a? String return 'ReadWrite' if mode.include? '+' return 'Write' if (mode.include? 'w') || (mode.include? 'a') elsif mode.is_a? Numeric return 'ReadWrite' if (mode & ::File::RDWR) != 0 return 'Write' if (mode & ::File::WRONLY) != 0 end 'Read' end
default_open_handler(args, override_mode = '')
click to toggle source
# File lib/tcell_agent/instrumentation/lfi.rb, line 101 def self.default_open_handler(args, override_mode = '') path, mode = extract_path_mode(*args) mode = override_mode unless override_mode.empty? raise_if_block(path, mode) end
extract_path_mode(*args)
click to toggle source
# File lib/tcell_agent/instrumentation/lfi.rb, line 27 def self.extract_path_mode(*args) path = '' mode = '' TCellAgent::Instrumentation.safe_block('LFI Parsing *args') do return ['', ''] if args.nil? || args.empty? args_copy = Array.new(args) path = args_copy.shift mode = args_copy.shift || 'r' if path && path.to_s[0] != '|' path = File.expand_path(path.to_s) mode = if mode && mode.is_a?(Hash) convert_mode(mode[:mode]) else convert_mode(mode) end [path, mode] else ['', ''] end end end
extract_path_mode_argf()
click to toggle source
# File lib/tcell_agent/instrumentation/lfi.rb, line 54 def self.extract_path_mode_argf path = '' mode = 'Read' TCellAgent::Instrumentation.safe_block('LFI Parsing ARGF') do begin return ['', ''] if ARGF.file == $stdin if ARGF.eof? && !ARGV.empty? argv_copy = Array.new(ARGV) path = argv_copy.shift else path = ARGF.filename end if path && path.to_s[0] != '|' [File.expand_path(path.to_s), mode] else ['', ''] end rescue Errno::ENOENT module_logger.debug('LFI Parsing ARGF: attempted to read a non-existent file') ['', ''] rescue Errno::EISDIR module_logger.debug('LFI Parsing ARGF: attempted to read a directory') [ARGF.filename, mode] end end end
raise_if_block(path, mode)
click to toggle source
# File lib/tcell_agent/instrumentation/lfi.rb, line 95 def self.raise_if_block(path, mode) return unless block_file_access?(path, mode) raise IOError, "tCell.io Agent: Attempted access to file #{path} with mode #{mode} denied" end