Sha256: 5bbc4088cb3960e681b9d8cf52ed78d39ec86be6473998d641cbcf4ac47804ff
Contents?: true
Size: 927 Bytes
Versions: 63
Compression:
Stored size: 927 Bytes
Contents
# Copyright (c) 2015 Sqreen. All Rights Reserved.
# Please refer to our terms for more information: https://www.sqreen.io/terms.html
require 'sqreen/rules_callbacks/regexp_rule'
module Sqreen
module Rules
# Callback that detect nifty env in system calls
class ShellEnvCB < RegexpRuleCB
def pre(_inst, *args, &_block)
return if args.size == 0
env = args.first
return unless env.is_a?(Hash)
return if env.size == 0
found = nil
var, value = env.find do |_, val|
next unless val.is_a?(String)
found = match_regexp(val)
end
return unless var
infos = {
:variable_name => var,
:variable_value => value,
:found => found,
}
Sqreen.log.warn "presence of a shell env tampering: #{infos.inspect}"
record_event(infos)
advise_action(:raise)
end
end
end
end
Version data entries
63 entries across 63 versions & 2 rubygems