From 49aa1ddae21de89fd63359bddef85d498953a368 Mon Sep 17 00:00:00 2001 From: Court Ewing Date: Tue, 13 Aug 2019 17:16:03 -0400 Subject: [PATCH 1/2] csp: telemetry for csp configuration We collect the boolean configurations which can be derived by any end-user of Kibana by making any HTTP request. Since the rules configuration involves strings that can leak identifiable information, we only collect whether the rules have been changed from their defaults. --- .../lib/collectors/csp/csp_collector.test.ts | 73 +++++++++++++++++++ .../lib/collectors/csp/csp_collector.ts | 39 ++++++++++ .../server/lib/collectors/csp/index.ts | 7 ++ .../server/lib/collectors/index.ts | 2 + .../plugins/oss_telemetry/test_utils/index.ts | 11 ++- 5 files changed, 130 insertions(+), 2 deletions(-) create mode 100644 x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.test.ts create mode 100644 x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.ts create mode 100644 x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/index.ts diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.test.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.test.ts new file mode 100644 index 0000000000000..e060b84e44763 --- /dev/null +++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.test.ts @@ -0,0 +1,73 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +import sinon from 'sinon'; +import { + DEFAULT_CSP_RULES, + DEFAULT_CSP_STRICT, + DEFAULT_CSP_WARN_LEGACY_BROWSERS, +} from '../../../../../../../../src/legacy/server/csp'; +import { + getMockCallWithInternal, + getMockKbnServer, + getMockTaskFetch, +} from '../../../../test_utils'; +import { createCspCollector } from './csp_collector'; + +test('fetches whether strict mode is enabled', async () => { + const { collector, mockConfig } = setupCollector(); + + expect((await collector.fetch()).strict).toEqual(true); + + mockConfig.get.withArgs('csp.strict').returns(false); + expect((await collector.fetch()).strict).toEqual(false); +}); + +test('fetches whether the legacy browser warning is enabled', async () => { + const { collector, mockConfig } = setupCollector(); + + expect((await collector.fetch()).warnLegacyBrowsers).toEqual(true); + + mockConfig.get.withArgs('csp.warnLegacyBrowsers').returns(false); + expect((await collector.fetch()).warnLegacyBrowsers).toEqual(false); +}); + +test('fetches whether the csp rules have been changed or not', async () => { + const { collector, mockConfig } = setupCollector(); + + expect((await collector.fetch()).rulesChangedFromDefault).toEqual(false); + + mockConfig.get.withArgs('csp.rules').returns(['not', 'default']); + expect((await collector.fetch()).rulesChangedFromDefault).toEqual(true); +}); + +test('does not include raw csp.rules', async () => { + const { collector, mockConfig } = setupCollector(); + + expect(await collector.fetch()).not.toHaveProperty('rules'); + + mockConfig.get.withArgs('csp.rules').returns(['not', 'default']); + expect(await collector.fetch()).not.toHaveProperty('rules'); +}); + +test('does not arbitrarily fetch other csp configurations (e.g. whitelist only)', async () => { + const { collector, mockConfig } = setupCollector(); + + mockConfig.get.withArgs('csp.foo').returns('bar'); + + expect(await collector.fetch()).not.toHaveProperty('foo'); +}); + +function setupCollector() { + const mockConfig = { get: sinon.stub() }; + mockConfig.get.withArgs('csp.rules').returns(DEFAULT_CSP_RULES); + mockConfig.get.withArgs('csp.strict').returns(DEFAULT_CSP_STRICT); + mockConfig.get.withArgs('csp.warnLegacyBrowsers').returns(DEFAULT_CSP_WARN_LEGACY_BROWSERS); + + const mockKbnServer = getMockKbnServer(getMockCallWithInternal(), getMockTaskFetch(), mockConfig); + + return { mockConfig, collector: createCspCollector(mockKbnServer) }; +} diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.ts new file mode 100644 index 0000000000000..3bacde22bdbc4 --- /dev/null +++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.ts @@ -0,0 +1,39 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +import { + createCSPRuleString, + DEFAULT_CSP_RULES, +} from '../../../../../../../../src/legacy/server/csp'; +import { HapiServer } from '../../../../'; + +export function createCspCollector(server: HapiServer) { + return { + type: 'csp', + isReady: () => true, + async fetch() { + const config = server.config(); + + // It's important that we do not send the value of csp.rules here as it + // can be customized with values that can be identifiable to given + // installs, such as URLs + const defaultRulesString = createCSPRuleString([...DEFAULT_CSP_RULES]); + const actualRulesString = createCSPRuleString(config.get('csp.rules')); + + return { + strict: config.get('csp.strict'), + warnLegacyBrowsers: config.get('csp.warnLegacyBrowsers'), + rulesChangedFromDefault: defaultRulesString !== actualRulesString, + }; + }, + }; +} + +export function registerCspCollector(server: HapiServer): void { + const { usage } = server; + const collector = usage.collectorSet.makeUsageCollector(createCspCollector(server)); + usage.collectorSet.register(collector); +} diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/index.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/index.ts new file mode 100644 index 0000000000000..a7c1088f9961b --- /dev/null +++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/index.ts @@ -0,0 +1,7 @@ +/* + * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one + * or more contributor license agreements. Licensed under the Elastic License; + * you may not use this file except in compliance with the Elastic License. + */ + +export { registerCspCollector } from './csp_collector'; diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts index 8b825b13178f2..abe96fe061faa 100644 --- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts +++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/index.ts @@ -5,8 +5,10 @@ */ import { HapiServer } from '../../../'; +import { registerCspCollector } from './csp'; import { registerVisualizationsCollector } from './visualizations/register_usage_collector'; export function registerCollectors(server: HapiServer) { registerVisualizationsCollector(server); + registerCspCollector(server); } diff --git a/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts b/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts index 7659f0d3516f9..7168f598dca23 100644 --- a/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts +++ b/x-pack/legacy/plugins/oss_telemetry/test_utils/index.ts @@ -30,9 +30,16 @@ export const getMockTaskFetch = (docs: TaskInstance[] = defaultMockTaskDocs) => return () => Promise.resolve({ docs }); }; +export const getMockConfig = () => { + return { + get: () => '', + }; +}; + export const getMockKbnServer = ( mockCallWithInternal = getMockCallWithInternal(), - mockTaskFetch = getMockTaskFetch() + mockTaskFetch = getMockTaskFetch(), + mockConfig = getMockConfig() ): HapiServer => ({ plugins: { elasticsearch: { @@ -53,6 +60,6 @@ export const getMockKbnServer = ( register: () => undefined, }, }, - config: () => ({ get: () => '' }), + config: () => mockConfig, log: () => undefined, }); From c65676b574c1a69ddb589c14de9197f7bc13f91a Mon Sep 17 00:00:00 2001 From: Court Ewing Date: Wed, 14 Aug 2019 14:35:52 -0400 Subject: [PATCH 2/2] more comprehensive csp tests --- .../lib/collectors/csp/csp_collector.test.ts | 33 +++++++++++-------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.test.ts b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.test.ts index e060b84e44763..caea9fd49fed6 100644 --- a/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.test.ts +++ b/x-pack/legacy/plugins/oss_telemetry/server/lib/collectors/csp/csp_collector.test.ts @@ -5,11 +5,7 @@ */ import sinon from 'sinon'; -import { - DEFAULT_CSP_RULES, - DEFAULT_CSP_STRICT, - DEFAULT_CSP_WARN_LEGACY_BROWSERS, -} from '../../../../../../../../src/legacy/server/csp'; +import { DEFAULT_CSP_RULES } from '../../../../../../../../src/legacy/server/csp'; import { getMockCallWithInternal, getMockKbnServer, @@ -44,13 +40,22 @@ test('fetches whether the csp rules have been changed or not', async () => { expect((await collector.fetch()).rulesChangedFromDefault).toEqual(true); }); -test('does not include raw csp.rules', async () => { - const { collector, mockConfig } = setupCollector(); - - expect(await collector.fetch()).not.toHaveProperty('rules'); - - mockConfig.get.withArgs('csp.rules').returns(['not', 'default']); - expect(await collector.fetch()).not.toHaveProperty('rules'); +test('does not include raw csp.rules under any property names', async () => { + const { collector } = setupCollector(); + + // It's important that we do not send the value of csp.rules here as it + // can be customized with values that can be identifiable to given + // installs, such as URLs + // + // We use a snapshot here to ensure csp.rules isn't finding its way into the + // payload under some new and unexpected variable name (e.g. cspRules). + expect(await collector.fetch()).toMatchInlineSnapshot(` + Object { + "rulesChangedFromDefault": false, + "strict": true, + "warnLegacyBrowsers": true, + } + `); }); test('does not arbitrarily fetch other csp configurations (e.g. whitelist only)', async () => { @@ -64,8 +69,8 @@ test('does not arbitrarily fetch other csp configurations (e.g. whitelist only)' function setupCollector() { const mockConfig = { get: sinon.stub() }; mockConfig.get.withArgs('csp.rules').returns(DEFAULT_CSP_RULES); - mockConfig.get.withArgs('csp.strict').returns(DEFAULT_CSP_STRICT); - mockConfig.get.withArgs('csp.warnLegacyBrowsers').returns(DEFAULT_CSP_WARN_LEGACY_BROWSERS); + mockConfig.get.withArgs('csp.strict').returns(true); + mockConfig.get.withArgs('csp.warnLegacyBrowsers').returns(true); const mockKbnServer = getMockKbnServer(getMockCallWithInternal(), getMockTaskFetch(), mockConfig);