mirror of
https://github.com/FunnyWolf/agentic-soc-platform.git
synced 2026-08-22 13:12:56 +02:00
SebastionandGitHub
6ef92fd1ec
Validate Splunk index names before interpolating them into SPL queries and return 400 for invalid SIEM requests.
27 lines
1004 B
Python
27 lines
1004 B
Python
from django.test import SimpleTestCase
|
|
|
|
from integrations.siem.query_builders import format_splunk_index
|
|
|
|
|
|
class SplunkIndexFormattingTests(SimpleTestCase):
|
|
def test_allows_valid_index_names_and_wildcard_sentinel(self):
|
|
for index_name in ("main", "wineventlog", "linux_secure", "os:linux", "prod-web.1", "*"):
|
|
with self.subTest(index_name=index_name):
|
|
self.assertEqual(format_splunk_index(index_name), index_name)
|
|
|
|
def test_rejects_values_that_can_escape_splunk_index_clause(self):
|
|
malicious_values = (
|
|
'main" | delete index=* | search index="x',
|
|
"main | stats count",
|
|
"main; delete",
|
|
"main search",
|
|
"",
|
|
"a" * 81,
|
|
123,
|
|
)
|
|
|
|
for index_name in malicious_values:
|
|
with self.subTest(index_name=index_name):
|
|
with self.assertRaisesMessage(ValueError, "Invalid Splunk index name"):
|
|
format_splunk_index(index_name)
|