From cf25e65c64684c89102b6c510607c85ed63aee8e Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 9 Jul 2024 07:41:08 -0700 Subject: [PATCH] testing with python --- .github/workflows/format_test_results.py | 42 +++++++++++++++++++ .github/workflows/unit-testing.yml | 5 ++- ...vanti_connect_secure_bookmark_endpoint.yml | 2 +- ...adobe_coldfusion_access_control_bypass.yml | 2 +- 4 files changed, 47 insertions(+), 4 deletions(-) create mode 100644 .github/workflows/format_test_results.py diff --git a/.github/workflows/format_test_results.py b/.github/workflows/format_test_results.py new file mode 100644 index 0000000000..55ee78bd26 --- /dev/null +++ b/.github/workflows/format_test_results.py @@ -0,0 +1,42 @@ +""" +A simple script formatting test_results/summary.yml to display on github actions +""" + +import yaml +import re + +def main(): + # Load the YAML file + with open('test_results/summary.yml', 'r') as file: + data = yaml.safe_load(file) + + # Extract total_fail value and debug print it + total_fail = data['summary']['total_fail'] + print(f"Extracted total_fail: [{total_fail}]") + + # Print all unit test details first + print("Unit Test Details:") + print(f"{'Name':<80} | {'Status':<6} | {'Test Type':<10} | {'Exception':<50}") + print(f"{'----':<80} | {'------':<6} | {'---------':<10} | {'---------':<50}") + for detection in data['tested_detections']: + for test in detection['tests']: + if test['test_type'].strip() == "unit": # Check if the test type is "unit" + name = detection['name'].strip() + status = 'PASS' if test['success'] else 'FAIL' + test_type = test['test_type'].strip() + exception = test.get('exception', 'N/A') # Get exception if exists, else 'N/A' + if status == 'FAIL': + print(f"{name:<80} | {status:<6} | {test_type:<10} | {exception:<50}") + else: + print(f"{name:<80} | {status:<6} | {test_type:<10} | {'-':<50}") + + # Check if total_fail is a valid integer and greater than or equal to one + if re.match(r'^[0-9]+$', str(total_fail)) and int(total_fail) >= 1: + print("CI Failure: There are failed tests.") + exit(1) # Fail the CI job + else: + print("CI Success: No failed tests.\n\n") + + print("Download the job artifacts of this run and view complete summary in test_results/summary.yml for troubleshooting failures .\n") +if __name__ == "__main__": + main() \ No newline at end of file diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index ef3cfbf30e..ccabc836e2 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -51,5 +51,6 @@ jobs: - name: Formatted Final Report run: | - chmod +x .github/workflows/format_test_summary.sh - ./.github/workflows/format_test_summary.sh >> $GITHUB_STEP_SUMMARY \ No newline at end of file + pip install pyyaml + pip install re + python .github/workflows/format_test_results.py >> $GITHUB_STEP_SUMMARY \ No newline at end of file diff --git a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml index 2ee10a8f52..e9e20c80d9 100644 --- a/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml +++ b/detections/web/access_to_vulnerable_ivanti_connect_secure_bookmark_endpoint.yml @@ -1,6 +1,6 @@ name: Access to Vulnerable Ivanti Connect Secure Bookmark Endpoint id: 15838756-f425-43fa-9d88-a7f88063e81a -version: 2 +version: 3 date: '2024-05-14' author: Michael Haag, Splunk status: production diff --git a/detections/web/adobe_coldfusion_access_control_bypass.yml b/detections/web/adobe_coldfusion_access_control_bypass.yml index 5828ebffb2..f344db1e74 100644 --- a/detections/web/adobe_coldfusion_access_control_bypass.yml +++ b/detections/web/adobe_coldfusion_access_control_bypass.yml @@ -15,7 +15,7 @@ description: The following analytic detects potential exploitation attempts agai unauthorized access to ColdFusion administration endpoints. If confirmed malicious, this could result in data theft, brute force attacks, or further exploitation of other vulnerabilities, posing a serious security risk to the environment. -search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web +search: 'x| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("//restplay*", "//CFIDE/restplay*", "//CFIDE/administrator*", "//CFIDE/adminapi*", "//CFIDE/main*", "//CFIDE/componentutils*", "//CFIDE/wizards*", "//CFIDE/servermanager*","/restplay*", "/CFIDE/restplay*", "/CFIDE/administrator*",