Module: Threatstack::Constants

Included in:: Control, Events::DependencyEvent, Events::EnvironmentEvent, Instrumentation, Instrumentation::Frameworks::TSRails::TSActionController, Jobs::EventSubmitter, Utils::Aws

Defined in:: lib/constants.rb,
lib/constants.rb

Constant Summary collapse

TRUTHY =

['true', '1', 'yes'].freeze

RUBY = AGENT

'ruby'

AGENT_NAME =

'threatstack-agent-ruby'

AGENT_ID = main agent id

self.env('AGENT_ID', '')

AGENT_INSTANCE_ID = autogenerated Id for this agent instance

SecureRandom.uuid

DISABLED = whether or not the agent is disabled, defaults to false

self.is_truthy('DISABLED')

MANUAL_INIT = whether or not initialization is done manually, defaults to false

self.is_truthy('MANUAL_INIT')

BLOCK_XSS = whether or not requests containing XSS payloads should be blocked, defaults to false

self.is_truthy('BLOCK_XSS')

BLOCK_SQLI = whether or not requests containing SQLI payloads should be blocked, defaults to false

self.is_truthy('BLOCK_SQLI')

BLOCK_PATH_TRAVERSAL = whether or not requests containing Path Traversal payloads should be blocked, defaults to false

self.is_truthy('BLOCK_PATH_TRAVERSAL')

DETECT_PATH_TRAVERSAL = whether or not requests should be checked for Path Traversal payloads, defaults to true

self.is_truthy('DETECT_PATH_TRAVERSAL', true)

DROP_FIELDS = specifies which user fields should be omitted from event payloads

self.env('DROP_FIELDS', false) ? self.env('DROP_FIELDS').split(',').each_with_object({}) do |val, h|
  h[val] = true
end : nil

FILTER_BY_PATH = specifies which user fields should be omitted from event payloads

self.env('FILTER_BY_PATH', false) ? self.env('FILTER_BY_PATH').split(',') : nil

REDACTED = string to use when redacting fields

self.env('REDACTED', '#REDACTED#')

DETECT_ATTACKS_ONLY = send up attack events only to the platform

self.is_truthy('DETECT_ATTACKS_ONLY')

JOB_INTERVAL = EVENT SUBMITTER event reporting frequency

Integer(self.env('SUBMISSION_INTERVAL', 10))

EVENTS_PER_REQ = max number of events per request

Integer(self.env('EVENTS_PER_REQ', 1000))

MAX_QUEUED_EVENTS = max number of events to keep in memory

Integer(self.env('MAX_QUEUED_EVENTS', 1000))

APPSEC_BASE_URL = base url

self.env('API_COLLECTOR_URL', 'https://appsec-sensors.threatstack.com')

APPSEC_EVENTS_URL = event collector path

'/api/events'

LOG_LEVEL = LOGGING logging level threshold

self.env('LOG_LEVEL', 'UNKNOWN')

LOG_COLORS = toggle color output for logging

self.is_truthy('LOG_COLORS')

AWS_METADATA_URL = AWS

self.env('AWS_METADATA_BASE_URL', 'http://169.254.169.254/latest/dynamic/instance-identity/document')

INSTRUMENTATION = EVENTS

'instrumentation'

DEPENDENCIES =

'dependencies'

ENVIRONMENT =

'environment'

ATTACK =

'attack'

IPV4 = IP

'IPv4'

IPV6 =

'IPv6'

XSS = Strings

'xss'

SQLI =

'sqli'

PATH_TRAVERSAL =

'path_traversal'

REQUEST_BLOCKED =

'Request blocked'

DETECTED_NOT_BLOCKED =

'Detected not blocked'

CGI_VARIABLES =

Set.new(%w[ AUTH_TYPE CONTENT_LENGTH CONTENT_TYPE GATEWAY_INTERFACE HTTPS PATH_INFO
PATH_TRANSLATED REMOTE_ADDR REMOTE_HOST REMOTE_IDENT REMOTE_USER
REQUEST_METHOD SCRIPT_NAME SERVER_NAMESERVER_PORT SERVER_PROTOCOL
SERVER_SOFTWARE]).freeze

ROOT_DIR = Utils

self.app_root_dir.nil? ? nil : self.app_root_dir.to_s

AGENT_VERSION =

spec.nil? || !spec.respond_to?(:version) ? 'N/A' : spec.version.to_s

Class Method Summary collapse

Class Method Details

.app_root_dir ⇒ `Object`

# File 'lib/constants.rb', line 23

def self.app_root_dir
  return Bundler.root if defined?(Bundler)

  return ENV['RAILS_ROOT'] if defined?(ENV['RAILS_ROOT']) && ENV['RAILS_ROOT'].to_s.strip.length != 0

  return Rails.root if defined?(Rails) && Rails.root.to_s.strip.length != 0

  Dir.pwd
end

.env(name, default = nil) ⇒ `Object`

# File 'lib/constants.rb', line 8

def self.env(name, default = nil)
  ts_var = "THREATSTACK_#{name}"
  bf_var = "BLUEFYRE_#{name}"
  bf_or_default = ENV.has_key?(bf_var) ? ENV[bf_var] : default
  ENV.has_key?(ts_var) ? ENV[ts_var] : bf_or_default
end

.is_truthy(name, default = false) ⇒ `Object`

# File 'lib/constants.rb', line 15

def self.is_truthy(name, default = false)
  ts_var = "THREATSTACK_#{name}"
  bf_var = "BLUEFYRE_#{name}"
  bf_or_default = ENV.has_key?(bf_var) ? ENV[bf_var] : default
  val = ENV.has_key?(ts_var) ? ENV[ts_var] : bf_or_default
  TRUTHY.include?(val.to_s.downcase)
end