[8.9] [Security Solution] File paths for Blocklist Windows and Mac sh…

…ould be case insensitive (elastic#164200) (elastic#164319) # Backport This will backport the following commits from `main` to `8.9`: - [[Security Solution] File paths for Blocklist Windows and Mac should be case insensitive (elastic#164200)](elastic#164200)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sqren/backport)  --------- Co-authored-by: Kevin Logan <[email protected]> Co-authored-by: Kevin Logan <[email protected]>
juliaElastic · Aug 22, 2023 · 2ac7591 · 2ac7591
1 parent fd35b9a
commit 2ac7591
Show file tree

Hide file tree

Showing 7 changed files with 91 additions and 22 deletions.
diff --git a/packages/kbn-securitysolution-utils/src/path_validations/index.ts b/packages/kbn-securitysolution-utils/src/path_validations/index.ts
@@ -33,7 +33,11 @@ export type TrustedAppConditionEntryField =
   | 'process.hash.*'
   | 'process.executable.caseless'
   | 'process.Ext.code_signature';
-export type BlocklistConditionEntryField = 'file.hash.*' | 'file.path' | 'file.Ext.code_signature';
+export type BlocklistConditionEntryField =
+  | 'file.hash.*'
+  | 'file.path'
+  | 'file.Ext.code_signature'
+  | 'file.path.caseless';
 export type AllConditionEntryFields =
   | TrustedAppConditionEntryField
   | BlocklistConditionEntryField

diff --git a/x-pack/plugins/security_solution/public/management/cypress/fixtures/artifacts_page.ts b/x-pack/plugins/security_solution/public/management/cypress/fixtures/artifacts_page.ts
@@ -361,7 +361,7 @@ export const getArtifactsListTestsData = (): ArtifactsFixtureType[] => [
         },
         {
           type: 'click',
-          selector: 'blocklist-form-file.path',
+          selector: 'blocklist-form-file.path.caseless',
         },
         {
           type: 'click',
@@ -382,7 +382,7 @@ export const getArtifactsListTestsData = (): ArtifactsFixtureType[] => [
         {
           selector: 'blocklistPage-card-criteriaConditions',
           value:
-            'OSIS WindowsAND file.pathis one of\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
+            'OSIS WindowsAND file.path.caselessis one of\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
         },
         {
           selector: 'blocklistPage-card-header-title',

diff --git a/x-pack/plugins/security_solution/public/management/pages/blocklist/translations.ts b/x-pack/plugins/security_solution/public/management/pages/blocklist/translations.ts
@@ -76,6 +76,12 @@ export const CONDITION_FIELD_TITLE: { [K in BlocklistConditionEntryField]: strin
   'file.path': i18n.translate('xpack.securitySolution.blocklist.entry.field.path', {
     defaultMessage: 'Path',
   }),
+  'file.path.caseless': i18n.translate(
+    'xpack.securitySolution.blocklist.entry.field.path.caseless',
+    {
+      defaultMessage: 'Path',
+    }
+  ),
   'file.Ext.code_signature': i18n.translate(
     'xpack.securitySolution.blocklist.entry.field.signature',
     { defaultMessage: 'Signature' }
@@ -89,6 +95,12 @@ export const CONDITION_FIELD_DESCRIPTION: { [K in BlocklistConditionEntryField]:
   'file.path': i18n.translate('xpack.securitySolution.blocklist.entry.field.description.path', {
     defaultMessage: 'The full path of the application',
   }),
+  'file.path.caseless': i18n.translate(
+    'xpack.securitySolution.blocklist.entry.field.description.path.caseless',
+    {
+      defaultMessage: 'The full path of the application (case insenstive)',
+    }
+  ),
   'file.Ext.code_signature': i18n.translate(
     'xpack.securitySolution.blocklist.entry.field.description.signature',
     { defaultMessage: 'The signer of the application' }

diff --git a/...curity_solution/public/management/pages/blocklist/view/components/blocklist_form.test.tsx b/...curity_solution/public/management/pages/blocklist/view/components/blocklist_form.test.tsx
@@ -225,6 +225,38 @@ describe('blocklist form', () => {
     userEvent.click(screen.getByRole('option', { name: /path/i }));
     const expected = createOnChangeArgs({
       item: createItem({
+        entries: [createEntry('file.path.caseless', [])],
+      }),
+    });
+    expect(onChangeSpy).toHaveBeenCalledWith(expected);
+  });
+
+  it('should correctly create `file.path.caseless` when Mac OS is selected', async () => {
+    render(createProps({ item: createItem({ os_types: [OperatingSystem.MAC] }) }));
+    expect(screen.getByTestId('blocklist-form-os-select').textContent).toEqual('Mac');
+
+    userEvent.click(screen.getByTestId('blocklist-form-field-select'));
+    await waitForEuiPopoverOpen();
+    userEvent.click(screen.getByRole('option', { name: /path/i }));
+    const expected = createOnChangeArgs({
+      item: createItem({
+        os_types: [OperatingSystem.MAC],
+        entries: [createEntry('file.path.caseless', [])],
+      }),
+    });
+    expect(onChangeSpy).toHaveBeenCalledWith(expected);
+  });
+
+  it('should correctly create `file.path` when Linux is selected', async () => {
+    render(createProps({ item: createItem({ os_types: [OperatingSystem.LINUX] }) }));
+    expect(screen.getByTestId('blocklist-form-os-select').textContent).toEqual('Linux');
+
+    userEvent.click(screen.getByTestId('blocklist-form-field-select'));
+    await waitForEuiPopoverOpen();
+    userEvent.click(screen.getByRole('option', { name: /path/i }));
+    const expected = createOnChangeArgs({
+      item: createItem({
+        os_types: [OperatingSystem.LINUX],
         entries: [createEntry('file.path', [])],
       }),
     });

diff --git a/...ns/security_solution/public/management/pages/blocklist/view/components/blocklist_form.tsx b/...ns/security_solution/public/management/pages/blocklist/view/components/blocklist_form.tsx
@@ -177,14 +177,31 @@ export const BlockListForm = memo<ArtifactFormComponentProps>(
     );
 
     const fieldOptions: Array<EuiSuperSelectOption<BlocklistConditionEntryField>> = useMemo(() => {
-      const selectableFields: Array<EuiSuperSelectOption<BlocklistConditionEntryField>> = (
-        ['file.hash.*', 'file.path'] as BlocklistConditionEntryField[]
-      ).map((field) => ({
-        value: field,
-        inputDisplay: CONDITION_FIELD_TITLE[field],
-        dropdownDisplay: getDropdownDisplay(field),
-        'data-test-subj': getTestId(field),
-      }));
+      const selectableFields: Array<EuiSuperSelectOption<BlocklistConditionEntryField>> = [];
+
+      selectableFields.push({
+        value: 'file.hash.*',
+        inputDisplay: CONDITION_FIELD_TITLE['file.hash.*'],
+        dropdownDisplay: getDropdownDisplay('file.hash.*'),
+        'data-test-subj': getTestId('file.hash.*'),
+      });
+
+      if (selectedOs === OperatingSystem.LINUX) {
+        selectableFields.push({
+          value: 'file.path',
+          inputDisplay: CONDITION_FIELD_TITLE['file.path'],
+          dropdownDisplay: getDropdownDisplay('file.path'),
+          'data-test-subj': getTestId('file.path'),
+        });
+      } else {
+        selectableFields.push({
+          value: 'file.path.caseless',
+          inputDisplay: CONDITION_FIELD_TITLE['file.path.caseless'],
+          dropdownDisplay: getDropdownDisplay('file.path.caseless'),
+          'data-test-subj': getTestId('file.path.caseless'),
+        });
+      }
+
       if (selectedOs === OperatingSystem.WINDOWS) {
         selectableFields.push({
           value: 'file.Ext.code_signature',

diff --git a/...ins/security_solution/server/lists_integration/endpoint/validators/blocklist_validator.ts b/...ins/security_solution/server/lists_integration/endpoint/validators/blocklist_validator.ts
@@ -21,12 +21,16 @@ import { isValidHash } from '../../../../common/endpoint/service/artifacts/valid
 import { EndpointArtifactExceptionValidationError } from './errors';
 
 const allowedHashes: Readonly<string[]> = ['file.hash.md5', 'file.hash.sha1', 'file.hash.sha256'];
+const allowedFilePaths: Readonly<string[]> = ['file.path', 'file.path.caseless'];
 
 const FileHashField = schema.oneOf(
   allowedHashes.map((hash) => schema.literal(hash)) as [Type<string>]
 );
 
-const FilePath = schema.literal('file.path');
+const FilePath = schema.oneOf(
+  allowedFilePaths.map((path) => schema.literal(path)) as [Type<string>]
+);
+
 const FileCodeSigner = schema.literal('file.Ext.code_signature');
 
 const ConditionEntryTypeSchema = schema.literal('match_any');

diff --git a/x-pack/test/security_solution_endpoint/apps/integrations/mocks.ts b/x-pack/test/security_solution_endpoint/apps/integrations/mocks.ts
@@ -401,7 +401,7 @@ export const getArtifactsListTestsData = () => [
         },
         {
           type: 'click',
-          selector: 'blocklist-form-file.path',
+          selector: 'blocklist-form-file.path.caseless',
         },
         {
           type: 'clear',
@@ -422,7 +422,7 @@ export const getArtifactsListTestsData = () => [
         {
           selector: 'blocklistPage-card-criteriaConditions',
           value:
-            'OSIS Windows\nAND file.pathIS ONE OF\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
+            'OSIS Windows\nAND file.path.caselessIS ONE OF\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
         },
         {
           selector: 'blocklistPage-card-header-title',
@@ -434,7 +434,7 @@ export const getArtifactsListTestsData = () => [
         },
       ],
       waitForValue:
-        'OSIS Windows\nAND file.pathIS ONE OF\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
+        'OSIS Windows\nAND file.path.caselessIS ONE OF\nc:\\randomFolder\\randomFile.exe\nc:\\randomFolder\\randomFile2.exe',
     },
     delete: {
       confirmSelector: 'blocklistDeletionConfirm',
@@ -479,14 +479,14 @@ export const getArtifactsListTestsData = () => [
         type: 'blocklist',
         identifier: 'endpoint-blocklist-windows-v1',
         relative_url:
-          '/api/fleet/artifacts/endpoint-blocklist-windows-v1/2df413b3c01b54be7e9106e92c39297ca72d32bcd626c3f7eb7d395db8e905fe',
-        body: 'eJx9jcEKwjAQRH9F9iwePOYD/IlWypKdYmCbhCSVltJ/dysieJE5zbxhZiPEVgIquW6jtmaQoxqmrKDzDxsDVAyOQXHJ3B7GU0bhlorFIXqdBWLpZwUL+zZ4rpCB42rgyTob6ci7vi8cJU23pILydcc2luP69K9zfZfu+6EXorpEbA==',
+          '/api/fleet/artifacts/endpoint-blocklist-windows-v1/3ead6ce4e34cb4411083a44bfe813d9442d296981ee8d56e727e6cff14dea0f0',
+        body: 'eJx9jUEKwzAQA79S9lx66NEP6CeSEhZboYaNbWynJIT8vetSArkUnaQR0kYINXsUMt1GdU0gQ8VPSUDXExs9xCkcveCWuL6Ux4TMNWaNfbAyOzhNfytY2NbBcoGglIHDquzNMivsyJq+zxxcnB5RHPLh2jyW9n7517l/S8+96QOI6kW/',
         encryption_algorithm: 'none',
         package_name: 'endpoint',
-        encoded_size: 130,
-        encoded_sha256: '3fb42b56c16ef38f8ecb62c082a7f3dddf4a52998a83c97d16688e854e15a502',
-        decoded_size: 194,
-        decoded_sha256: '2df413b3c01b54be7e9106e92c39297ca72d32bcd626c3f7eb7d395db8e905fe',
+        encoded_size: 132,
+        encoded_sha256: '9f81934389ff29599c0b0f16aa91b9f5cebd95d51271a47ea469662a61a29884',
+        decoded_size: 197,
+        decoded_sha256: '3ead6ce4e34cb4411083a44bfe813d9442d296981ee8d56e727e6cff14dea0f0',
         compression_algorithm: 'zlib',
         created: '2000-01-01T00:00:00.000Z',
       }),
@@ -498,7 +498,7 @@ export const getArtifactsListTestsData = () => [
               {
                 field: 'file.path',
                 operator: 'included',
-                type: 'exact_cased_any',
+                type: 'exact_caseless_any',
                 value: ['c:\\randomFolder\\randomFile.exe', ' c:\\randomFolder\\randomFile2.exe'],
               },
             ],