Skip to content

Commit ceba573

Browse files
y9vy9v
committed
Improve specs for AppSec ActiveRecord instrumentation
1 parent ec03f71 commit ceba573

File tree

4 files changed

+146
-131
lines changed

4 files changed

+146
-131
lines changed

‎spec/datadog/appsec/configuration/settings_spec.rb

+2-2
Original file line numberDiff line numberDiff line change
@@ -90,13 +90,13 @@ def patcher
9090
context 'is not defined' do
9191
let(:rasp_enabled_env_var) { nil }
9292

93-
it { is_expected.to eq true }
93+
it { expect(settings.appsec.rasp_enabled).to eq(true) }
9494
end
9595

9696
context 'is defined' do
9797
let(:rasp_enabled_env_var) { 'false' }
9898

99-
it { is_expected.to eq(false) }
99+
it { expect(settings.appsec.rasp_enabled).to eq(false) }
100100
end
101101
end
102102
end

‎spec/datadog/appsec/contrib/active_record/mysql2_adapter_spec.rb

+46-41
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
let(:ruleset) { Datadog::AppSec::Processor::RuleLoader.load_rules(ruleset: :recommended, telemetry: telemetry) }
1717
let(:processor) { Datadog::AppSec::Processor.new(ruleset: ruleset, telemetry: telemetry) }
1818
let(:context) { Datadog::AppSec::Context.new(trace, span, processor) }
19-
let(:rasp_enabled) { true }
2019

2120
let(:span) { Datadog::Tracing::SpanOperation.new('root') }
2221
let(:trace) { Datadog::Tracing::TraceOperation.new }
@@ -55,8 +54,6 @@
5554

5655
Datadog::AppSec::Context.activate(context)
5756

58-
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(rasp_enabled)
59-
6057
raise_on_rails_deprecation!
6158
end
6259

@@ -68,7 +65,9 @@
6865
end
6966

7067
context 'when RASP is disabled' do
71-
let(:rasp_enabled) { false }
68+
before do
69+
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(false)
70+
end
7271

7372
it 'does not call waf when querying using .where' do
7473
expect(Datadog::AppSec.active_context).not_to receive(:run_rasp)
@@ -83,46 +82,52 @@
8382
end
8483
end
8584

86-
it 'calls waf with correct arguments when querying using .where' do
87-
expect(Datadog::AppSec.active_context).to(
88-
receive(:run_rasp).with(
89-
Datadog::AppSec::Ext::RASP_SQLI,
90-
{},
91-
{
92-
'server.db.statement' => "SELECT `users`.* FROM `users` WHERE `users`.`name` = 'Bob'",
93-
'server.db.system' => 'mysql2'
94-
},
95-
Datadog.configuration.appsec.waf_timeout
96-
).and_call_original
97-
)
98-
99-
User.where(name: 'Bob').to_a
100-
end
85+
context 'when RASP is enabled' do
86+
before do
87+
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(true)
88+
end
10189

102-
it 'calls waf with correct arguments when querying using .find_by_sql' do
103-
expect(Datadog::AppSec.active_context).to(
104-
receive(:run_rasp).with(
105-
Datadog::AppSec::Ext::RASP_SQLI,
106-
{},
107-
{
108-
'server.db.statement' => "SELECT * FROM users WHERE name = 'Bob'",
109-
'server.db.system' => 'mysql2'
110-
},
111-
Datadog.configuration.appsec.waf_timeout
112-
).and_call_original
113-
)
114-
115-
User.find_by_sql("SELECT * FROM users WHERE name = 'Bob'").to_a
116-
end
90+
it 'calls waf with correct arguments when querying using .where' do
91+
expect(Datadog::AppSec.active_context).to(
92+
receive(:run_rasp).with(
93+
Datadog::AppSec::Ext::RASP_SQLI,
94+
{},
95+
{
96+
'server.db.statement' => "SELECT `users`.* FROM `users` WHERE `users`.`name` = 'Bob'",
97+
'server.db.system' => 'mysql2'
98+
},
99+
Datadog.configuration.appsec.waf_timeout
100+
).and_call_original
101+
)
102+
103+
User.where(name: 'Bob').to_a
104+
end
105+
106+
it 'calls waf with correct arguments when querying using .find_by_sql' do
107+
expect(Datadog::AppSec.active_context).to(
108+
receive(:run_rasp).with(
109+
Datadog::AppSec::Ext::RASP_SQLI,
110+
{},
111+
{
112+
'server.db.statement' => "SELECT * FROM users WHERE name = 'Bob'",
113+
'server.db.system' => 'mysql2'
114+
},
115+
Datadog.configuration.appsec.waf_timeout
116+
).and_call_original
117+
)
117118

118-
it 'adds an event to processor context if waf result is a match' do
119-
result = Datadog::AppSec::SecurityEngine::Result::Match.new(
120-
events: [], actions: {}, derivatives: {}, timeout: false, duration_ns: 0, duration_ext_ns: 0
121-
)
119+
User.find_by_sql("SELECT * FROM users WHERE name = 'Bob'").to_a
120+
end
122121

123-
expect(Datadog::AppSec.active_context).to receive(:run_rasp).and_return(result)
124-
expect(Datadog::AppSec.active_context.events).to receive(:<<).and_call_original
122+
it 'adds an event to processor context if waf result is a match' do
123+
result = Datadog::AppSec::SecurityEngine::Result::Match.new(
124+
events: [], actions: {}, derivatives: {}, timeout: false, duration_ns: 0, duration_ext_ns: 0
125+
)
125126

126-
User.where(name: 'Bob').to_a
127+
expect(Datadog::AppSec.active_context).to receive(:run_rasp).and_return(result)
128+
expect(Datadog::AppSec.active_context.events).to receive(:<<).and_call_original
129+
130+
User.where(name: 'Bob').to_a
131+
end
127132
end
128133
end

‎spec/datadog/appsec/contrib/active_record/postgresql_adapter_spec.rb

+52-47
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
let(:ruleset) { Datadog::AppSec::Processor::RuleLoader.load_rules(ruleset: :recommended, telemetry: telemetry) }
1717
let(:processor) { Datadog::AppSec::Processor.new(ruleset: ruleset, telemetry: telemetry) }
1818
let(:context) { Datadog::AppSec::Context.new(trace, span, processor) }
19-
let(:rasp_enabled) { true }
2019

2120
let(:span) { Datadog::Tracing::SpanOperation.new('root') }
2221
let(:trace) { Datadog::Tracing::TraceOperation.new }
@@ -56,8 +55,6 @@
5655

5756
Datadog::AppSec::Context.activate(context)
5857

59-
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(rasp_enabled)
60-
6158
raise_on_rails_deprecation!
6259
end
6360

@@ -69,7 +66,9 @@
6966
end
7067

7168
context 'when RASP is disabled' do
72-
let(:rasp_enabled) { false }
69+
before do
70+
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(false)
71+
end
7372

7473
it 'does not call waf when querying using .where' do
7574
expect(Datadog::AppSec.active_context).not_to receive(:run_rasp)
@@ -84,52 +83,58 @@
8483
end
8584
end
8685

87-
it 'calls waf with correct arguments when querying using .where' do
88-
expected_db_statement = if PlatformHelpers.jruby?
89-
'SELECT "users".* FROM "users" WHERE "users"."name" = ?'
90-
else
91-
'SELECT "users".* FROM "users" WHERE "users"."name" = $1'
92-
end
93-
94-
expect(Datadog::AppSec.active_context).to(
95-
receive(:run_rasp).with(
96-
Datadog::AppSec::Ext::RASP_SQLI,
97-
{},
98-
{
99-
'server.db.statement' => expected_db_statement,
100-
'server.db.system' => 'postgresql'
101-
},
102-
Datadog.configuration.appsec.waf_timeout
103-
).and_call_original
104-
)
105-
106-
User.where(name: 'Bob').to_a
107-
end
86+
context 'when RASP is enabled' do
87+
before do
88+
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(true)
89+
end
10890

109-
it 'calls waf with correct arguments when querying using .find_by_sql' do
110-
expect(Datadog::AppSec.active_context).to(
111-
receive(:run_rasp).with(
112-
Datadog::AppSec::Ext::RASP_SQLI,
113-
{},
114-
{
115-
'server.db.statement' => "SELECT * FROM users WHERE name = 'Bob'",
116-
'server.db.system' => 'postgresql'
117-
},
118-
Datadog.configuration.appsec.waf_timeout
119-
).and_call_original
120-
)
121-
122-
User.find_by_sql("SELECT * FROM users WHERE name = 'Bob'").to_a
123-
end
91+
it 'calls waf with correct arguments when querying using .where' do
92+
expected_db_statement = if PlatformHelpers.jruby?
93+
'SELECT "users".* FROM "users" WHERE "users"."name" = ?'
94+
else
95+
'SELECT "users".* FROM "users" WHERE "users"."name" = $1'
96+
end
97+
98+
expect(Datadog::AppSec.active_context).to(
99+
receive(:run_rasp).with(
100+
Datadog::AppSec::Ext::RASP_SQLI,
101+
{},
102+
{
103+
'server.db.statement' => expected_db_statement,
104+
'server.db.system' => 'postgresql'
105+
},
106+
Datadog.configuration.appsec.waf_timeout
107+
).and_call_original
108+
)
109+
110+
User.where(name: 'Bob').to_a
111+
end
112+
113+
it 'calls waf with correct arguments when querying using .find_by_sql' do
114+
expect(Datadog::AppSec.active_context).to(
115+
receive(:run_rasp).with(
116+
Datadog::AppSec::Ext::RASP_SQLI,
117+
{},
118+
{
119+
'server.db.statement' => "SELECT * FROM users WHERE name = 'Bob'",
120+
'server.db.system' => 'postgresql'
121+
},
122+
Datadog.configuration.appsec.waf_timeout
123+
).and_call_original
124+
)
124125

125-
it 'adds an event to processor context if waf result is a match' do
126-
result = Datadog::AppSec::SecurityEngine::Result::Match.new(
127-
events: [], actions: {}, derivatives: {}, timeout: false, duration_ns: 0, duration_ext_ns: 0
128-
)
126+
User.find_by_sql("SELECT * FROM users WHERE name = 'Bob'").to_a
127+
end
129128

130-
expect(Datadog::AppSec.active_context).to receive(:run_rasp).and_return(result)
131-
expect(Datadog::AppSec.active_context.events).to receive(:<<).and_call_original
129+
it 'adds an event to processor context if waf result is a match' do
130+
result = Datadog::AppSec::SecurityEngine::Result::Match.new(
131+
events: [], actions: {}, derivatives: {}, timeout: false, duration_ns: 0, duration_ext_ns: 0
132+
)
132133

133-
User.where(name: 'Bob').to_a
134+
expect(Datadog::AppSec.active_context).to receive(:run_rasp).and_return(result)
135+
expect(Datadog::AppSec.active_context.events).to receive(:<<).and_call_original
136+
137+
User.where(name: 'Bob').to_a
138+
end
134139
end
135140
end

‎spec/datadog/appsec/contrib/active_record/sqlite3_adapter_spec.rb

+46-41
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
let(:ruleset) { Datadog::AppSec::Processor::RuleLoader.load_rules(ruleset: :recommended, telemetry: telemetry) }
1717
let(:processor) { Datadog::AppSec::Processor.new(ruleset: ruleset, telemetry: telemetry) }
1818
let(:context) { Datadog::AppSec::Context.new(trace, span, processor) }
19-
let(:rasp_enabled) { true }
2019

2120
let(:span) { Datadog::Tracing::SpanOperation.new('root') }
2221
let(:trace) { Datadog::Tracing::TraceOperation.new }
@@ -49,8 +48,6 @@
4948

5049
Datadog::AppSec::Context.activate(context)
5150

52-
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(rasp_enabled)
53-
5451
raise_on_rails_deprecation!
5552
end
5653

@@ -62,7 +59,9 @@
6259
end
6360

6461
context 'when RASP is disabled' do
65-
let(:rasp_enabled) { false }
62+
before do
63+
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(false)
64+
end
6665

6766
it 'does not call waf when querying using .where' do
6867
expect(Datadog::AppSec.active_context).not_to receive(:run_rasp)
@@ -77,46 +76,52 @@
7776
end
7877
end
7978

80-
it 'calls waf with correct arguments when querying using .where' do
81-
expect(Datadog::AppSec.active_context).to(
82-
receive(:run_rasp).with(
83-
Datadog::AppSec::Ext::RASP_SQLI,
84-
{},
85-
{
86-
'server.db.statement' => 'SELECT "users".* FROM "users" WHERE "users"."name" = ?',
87-
'server.db.system' => 'sqlite'
88-
},
89-
Datadog.configuration.appsec.waf_timeout
90-
).and_call_original
91-
)
92-
93-
User.where(name: 'Bob').to_a
94-
end
79+
context 'when RASP is enabled' do
80+
before do
81+
allow(Datadog::AppSec).to receive(:rasp_enabled?).and_return(true)
82+
end
9583

96-
it 'calls waf with correct arguments when querying using .find_by_sql' do
97-
expect(Datadog::AppSec.active_context).to(
98-
receive(:run_rasp).with(
99-
Datadog::AppSec::Ext::RASP_SQLI,
100-
{},
101-
{
102-
'server.db.statement' => "SELECT * FROM users WHERE name = 'Bob'",
103-
'server.db.system' => 'sqlite'
104-
},
105-
Datadog.configuration.appsec.waf_timeout
106-
).and_call_original
107-
)
108-
109-
User.find_by_sql("SELECT * FROM users WHERE name = 'Bob'").to_a
110-
end
84+
it 'calls waf with correct arguments when querying using .where' do
85+
expect(Datadog::AppSec.active_context).to(
86+
receive(:run_rasp).with(
87+
Datadog::AppSec::Ext::RASP_SQLI,
88+
{},
89+
{
90+
'server.db.statement' => 'SELECT "users".* FROM "users" WHERE "users"."name" = ?',
91+
'server.db.system' => 'sqlite'
92+
},
93+
Datadog.configuration.appsec.waf_timeout
94+
).and_call_original
95+
)
96+
97+
User.where(name: 'Bob').to_a
98+
end
99+
100+
it 'calls waf with correct arguments when querying using .find_by_sql' do
101+
expect(Datadog::AppSec.active_context).to(
102+
receive(:run_rasp).with(
103+
Datadog::AppSec::Ext::RASP_SQLI,
104+
{},
105+
{
106+
'server.db.statement' => "SELECT * FROM users WHERE name = 'Bob'",
107+
'server.db.system' => 'sqlite'
108+
},
109+
Datadog.configuration.appsec.waf_timeout
110+
).and_call_original
111+
)
111112

112-
it 'adds an event to processor context if waf result is a match' do
113-
result = Datadog::AppSec::SecurityEngine::Result::Match.new(
114-
events: [], actions: {}, derivatives: {}, timeout: false, duration_ns: 0, duration_ext_ns: 0
115-
)
113+
User.find_by_sql("SELECT * FROM users WHERE name = 'Bob'").to_a
114+
end
116115

117-
expect(Datadog::AppSec.active_context).to receive(:run_rasp).and_return(result)
118-
expect(Datadog::AppSec.active_context.events).to receive(:<<).and_call_original
116+
it 'adds an event to processor context if waf result is a match' do
117+
result = Datadog::AppSec::SecurityEngine::Result::Match.new(
118+
events: [], actions: {}, derivatives: {}, timeout: false, duration_ns: 0, duration_ext_ns: 0
119+
)
119120

120-
User.where(name: 'Bob').to_a
121+
expect(Datadog::AppSec.active_context).to receive(:run_rasp).and_return(result)
122+
expect(Datadog::AppSec.active_context.events).to receive(:<<).and_call_original
123+
124+
User.where(name: 'Bob').to_a
125+
end
121126
end
122127
end

0 commit comments

Comments
 (0)