First release of open-appsec source code

components/security_apps/waap/waap_clib/WaapDecision.cc

@@ -0,0 +1,208 @@
+// Copyright (C) 2022 Check Point Software Technologies Ltd. All rights reserved.
+
+// Licensed under the Apache License, Version 2.0 (the "License");
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "WaapDecision.h"
+#include "OpenRedirectDecision.h"
+#include "debug.h"
+#include <algorithm>
+#include <type_traits>
+
+USE_DEBUG_FLAG(D_WAAP);
+
+WaapDecision::WaapDecision() :
+    m_json(""),
+    m_decisionFactory()
+{
+}
+
+std::shared_ptr<SingleDecision>
+WaapDecision::getDecision(DecisionType type) const
+{
+    return m_decisionFactory.getDecision(type);
+}
+
+void
+WaapDecision::orderDecisions()
+{
+    const DecisionsArr& decisions = m_decisionFactory.getDecisions();
+    dbgTrace(D_WAAP) << "Original: " << decisions;
+    std::copy_if(decisions.begin(),
+                decisions.end(),
+                std::back_inserter(m_ordered_decisions),
+                [](const std::shared_ptr<SingleDecision>& decision) {
+                    return decision && (decision->shouldBlock() || decision->shouldLog());
+                });
+    if (!m_ordered_decisions.empty()) {
+        dbgTrace(D_WAAP) << "Reduced: " << m_ordered_decisions;
+        m_ordered_decisions.sort(sortDecisions);
+        dbgTrace(D_WAAP) << "Sorted: " << m_ordered_decisions;
+    }
+
+    setIteratorToFirstDecisionToLog();
+}
+
+void WaapDecision::setIteratorToFirstDecisionToLog()
+{
+    m_first_decision_to_log =
+        std::find_if(
+            m_ordered_decisions.begin(),
+            m_ordered_decisions.end(),
+            [](const std::shared_ptr<SingleDecision>& decision)
+    {
+        return decision && decision->shouldLog();
+    });
+}
+
+bool
+WaapDecision::sortDecisions(const std::shared_ptr<SingleDecision>& lhs, const std::shared_ptr<SingleDecision>& rhs)
+{
+    if (lhs->shouldBlock() && !rhs->shouldBlock()) {
+        return true;
+    }
+    else if (!lhs->shouldBlock() && rhs->shouldBlock()) {
+        return false;
+    }
+    else if (lhs->shouldLog() && !rhs->shouldLog()) {
+        return true;
+    }
+    else if (!lhs->shouldLog() && rhs->shouldLog()) {
+        return false;
+    }
+    else if (lhs->getType() < rhs->getType()) {
+        return true;
+    }
+    return false;
+}
+
+std::ostream& operator<<(std::ostream& os, const DecisionsArr& decisions)
+{
+    os << "Decision(block, log): ";
+    for (auto decision : decisions)
+    {
+        os << decision->getTypeStr() << "(" << decision->shouldBlock() << ", " <<
+            decision->shouldLog() << ")  ";
+    }
+    return os;
+}
+
+std::ostream& operator<<(std::ostream& os, const std::list<std::shared_ptr<SingleDecision>>& decisions)
+{
+    os << "Decision(block, log): ";
+    for (auto decision : decisions)
+    {
+        os << decision->getTypeStr() << "(" << decision->shouldBlock() << ", " <<
+            decision->shouldLog() << ")  ";
+    }
+    return os;
+}
+
+bool WaapDecision::getShouldBlockFromHighestPriorityDecision() const
+{
+    if (!m_ordered_decisions.empty())
+    {
+        return m_ordered_decisions.front()->shouldBlock();
+    }
+    return false;
+}
+
+bool WaapDecision::anyDecisionsToLogOrBlock() const
+{
+    return !m_ordered_decisions.empty();
+}
+
+DecisionType WaapDecision::getHighestPriorityDecisionToLog() const
+{
+    if (m_first_decision_to_log == m_ordered_decisions.end())
+    {
+        return DecisionType::NO_WAAP_DECISION;
+    }
+    return (*m_first_decision_to_log)->getType();
+}
+
+void WaapDecision::getIncidentLogFields(
+    const std::string& responseStatus,
+    std::string& incidentDetails,
+    std::string& incidentType
+) const
+{
+    incidentDetails.clear();
+    incidentType.clear();
+
+    for (decision_list::const_iterator iter = m_first_decision_to_log; iter != m_ordered_decisions.end(); ++iter)
+    {
+        const std::shared_ptr<SingleDecision>& nextDecision = *iter;
+        std::string tempIncidentDetails;
+        std::string tempIncidentType;
+
+        if (!nextDecision->shouldLog())
+        {
+            continue;
+        }
+
+        bool isRelevant = true;
+        switch (nextDecision->getType())
+        {
+            case OPEN_REDIRECT_DECISION:
+            {
+                tempIncidentDetails = "OpenRedirect attack detected (" +
+                    std::dynamic_pointer_cast<OpenRedirectDecision>(nextDecision)->getLink() + ")";
+                tempIncidentType = "Cross Site Redirect";
+                break;
+            }
+
+            case ERROR_LIMITING_DECISION:
+            {
+                tempIncidentDetails = "Application scanning detected";
+                tempIncidentType = "Error Limit";
+                break;
+            }
+
+            case RATE_LIMITING_DECISION:
+            {
+                tempIncidentDetails = "High request rate detected";
+                tempIncidentType = "Request Rate Limit";
+                break;
+            }
+            case ERROR_DISCLOSURE_DECISION:
+                tempIncidentDetails = "Information disclosure in server response detected";
+                tempIncidentDetails += ", response status code: " + responseStatus;
+                tempIncidentType = "Error Disclosure";
+                break;
+            default:
+                isRelevant = false;
+                break;
+        }
+        if (isRelevant) {
+            if (!incidentDetails.empty())
+            {
+                incidentDetails += " and ";
+            }
+            if (!incidentType.empty())
+            {
+                incidentType += ", ";
+            }
+            incidentDetails += tempIncidentDetails;
+            incidentType += tempIncidentType;
+        }
+    }
+}
+
+void WaapDecision::setJson(const std::string& json)
+{
+    m_json = json;
+}
+
+std::string WaapDecision::getJson() const
+{
+    return m_json;
+}