8425819861

Committed 25 Mar 2024 07:25PM UTC coverage: 63.615% (-0.4%) from 64.043%

Build # 8425819861

Build Type

Pull #1304

github

Committed by

web-flow

Commit Message

Merge 95c1351b2 into 57fc2b025

Pull Request Pull Request #1304: Update SNTPolicyProcessor to use a map

Run Details

4615 of 9506 branches covered (48.55%)

Branch coverage included in aggregate %.

86 of 108 new or added lines in 1 file covered. (79.63%)

127 existing lines in 7 files now uncovered.

16196 of 23208 relevant lines covered (69.79%)

11136.15 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

40.91

/Source/common/SNTBlockMessage.m

/// Copyright 2016 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/common/SNTBlockMessage.h"

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTFileAccessEvent.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTStoredEvent.h"
#import "Source/common/SNTSystemInfo.h"

@implementation SNTBlockMessage

+ (NSAttributedString *)formatMessage:(NSString *)message {
  NSString *htmlHeader =
    @"<html><head><style>"
    @"body {"
    @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
    @"  font-size: 13px;"
    @"  color: %@;"
    @"  text-align: center;"
    @"}"

    // Supported in beta WebKit. Not sure if it is dynamic when used with NSAttributedString.
    @"@media (prefers-color-scheme: dark) {"
    @"  body {"
    @"    color: #ddd;"
    @"  }"
    @"}"
    @"</style></head><body>";

  // Support Dark Mode. Note, the returned NSAttributedString is static and does not update when
  // the OS switches modes.
  NSString *mode = [NSUserDefaults.standardUserDefaults stringForKey:@"AppleInterfaceStyle"];
  BOOL dark = [mode isEqualToString:@"Dark"];
  htmlHeader = [NSString stringWithFormat:htmlHeader, dark ? @"#ddd" : @"#333"];

  NSString *htmlFooter = @"</body></html>";

  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];

#ifdef SANTAGUI
  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
#else
  NSString *strippedHTML = [self stringFromHTML:fullHTML];
  if (!strippedHTML) {
    return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];
  }
  return [[NSAttributedString alloc] initWithString:strippedHTML];
#endif
}

+ (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
                                         customMessage:(NSString *)customMessage {
  NSString *message;
  if (customMessage.length) {
    message = customMessage;
  } else if (event.decision == SNTEventStateBlockUnknown) {
    message = [[SNTConfigurator configurator] unknownBlockMessage];
    if (!message) {
      message = @"The following application has been blocked from executing<br />"
                @"because its trustworthiness cannot be determined.";
    }
  } else {
    message = [[SNTConfigurator configurator] bannedBlockMessage];
    if (!message) {
      message = @"The following application has been blocked from executing<br />"
                @"because it has been deemed malicious.";
    }
  }
  return [SNTBlockMessage formatMessage:message];
}

+ (NSAttributedString *)attributedBlockMessageForFileAccessEvent:(SNTFileAccessEvent *)event
                                                   customMessage:(NSString *)customMessage {
  NSString *message = customMessage;
  if (!message.length) {
    message = [[SNTConfigurator configurator] fileAccessBlockMessage];
    if (!message.length) {
      message = @"Access to a file has been denied.";
    }
  }
  return [SNTBlockMessage formatMessage:message];
}

+ (NSString *)stringFromHTML:(NSString *)html {
  NSError *error;
  NSXMLDocument *xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];

  if (!xml && error.code == NSXMLParserEmptyDocumentError) {
    html = [NSString stringWithFormat:@"<html><body>%@</body></html>", html];
    xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];
    if (!xml) return html;
  }

  // Strip any HTML tags out of the message. Also remove any content inside <style> tags and
  // replace <br> elements with a newline.
  NSString *stripXslt =
    @"<?xml version='1.0' encoding='utf-8'?>"
    @"<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'"
    @"                              xmlns:xhtml='http://www.w3.org/1999/xhtml'>"
    @"<xsl:output method='text'/>"
    @"<xsl:template match='br'><xsl:text>\n</xsl:text></xsl:template>"
    @"<xsl:template match='style'/>"
    @"</xsl:stylesheet>";
  NSData *data = [xml objectByApplyingXSLTString:stripXslt arguments:NULL error:&error];
  if (error || ![data isKindOfClass:[NSData class]]) {
    return html;
  }
  return [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
}

+ (NSString *)replaceFormatString:(NSString *)str
                         withDict:(NSDictionary<NSString *, NSString * (^)()> *)replacements {
  __block NSString *formatStr = str;

  [replacements
    enumerateKeysAndObjectsUsingBlock:^(NSString *key, NSString * (^computeValue)(), BOOL *stop) {
      NSString *value = computeValue();
      if (value) {
        formatStr = [formatStr stringByReplacingOccurrencesOfString:key withString:value];
      }
    }];

  return formatStr;
}

// Returns either the generated URL for the passed in event, or an NSURL from the passed in custom
// URL string. If the custom URL string is the string "null", nil will be returned. If no custom
// URL is passed and there is no configured EventDetailURL template, nil will be returned.
// The following "format strings" will be replaced in the URL, if they are present:
//
//   %file_identifier%           - The SHA-256 of the binary being executed.
//   %bundle_or_file_identifier% - The hash of the bundle containing this file or the file itself,
//                                 if no bundle hash is present.
//   %username%                  - The executing user's name.
//   %machine_id%                - The configured machine ID for this host.
//   %hostname%                  - The machine's FQDN.
//   %uuid%                      - The machine's UUID.
//   %serial%                    - The machine's serial number.
//
+ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event customURL:(NSString *)url {
  SNTConfigurator *config = [SNTConfigurator configurator];

  NSString *formatStr = url;
  if (!formatStr.length) {
    formatStr = config.eventDetailURL;
    if (!formatStr.length) {
      return nil;
    }
  }

  if ([formatStr isEqualToString:@"null"]) {
    return nil;
  }

  // Disabling clang-format. See comment in `eventDetailURLForFileAccessEvent:customURL:`
  // clang-format off
  NSDictionary<NSString *, NSString * (^)()> *kvReplacements =
    [NSDictionary dictionaryWithObjectsAndKeys:
      // This key is deprecated, use %file_identifier% or %bundle_or_file_identifier%
      ^{ return event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil; },
                                                 @"%file_sha%",
      ^{ return event.fileSHA256; },             @"%file_identifier%",
      ^{ return event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil; },
                                                 @"%bundle_or_file_identifier%",
      ^{ return event.executingUser; },          @"%username%",
      ^{ return config.machineID; },             @"%machine_id%",
      ^{ return [SNTSystemInfo longHostname]; }, @"%hostname%",
      ^{ return [SNTSystemInfo hardwareUUID]; }, @"%uuid%",
      ^{ return [SNTSystemInfo serialNumber]; }, @"%serial%",
      nil];
  // clang-format on

  formatStr = [SNTBlockMessage replaceFormatString:formatStr withDict:kvReplacements];

  NSURL *u = [NSURL URLWithString:formatStr];
  if (!u) {
    LOGW(@"Unable to generate event detail URL for string '%@'", formatStr);
  }

  return u;
}

// Returns either the generated URL for the passed in event, or an NSURL from the passed in custom
// URL string. If the custom URL string is the string "null", nil will be returned. If no custom
// URL is passed and there is no configured EventDetailURL template, nil will be returned.
// The following "format strings" will be replaced in the URL, if they are present:
//
//   %rule_version%    - The version of the rule that was violated.
//   %rule_name%       - The name of the rule that was violated.
//   %file_identifier% - The SHA-256 of the binary being executed.
//   %accessed_path%   - The path accessed by the binary.
//   %username%        - The executing user's name.
//   %machine_id%      - The configured machine ID for this host.
//   %hostname%        - The machine's FQDN.
//   %uuid%            - The machine's UUID.
//   %serial%          - The machine's serial number.
//
+ (NSURL *)eventDetailURLForFileAccessEvent:(SNTFileAccessEvent *)event customURL:(NSString *)url {
  if (!url.length || [url isEqualToString:@"null"]) {
    return nil;
  }

  SNTConfigurator *config = [SNTConfigurator configurator];

  // Clang format goes wild here. If you use the container literal syntax `@{}` with a block value
  // type, it seems to break the clang format on/off functionality and breaks formatting for the
  // remainder of the file.
  // Using `dictionaryWithObjectsAndKeys` and disabling clang format as a workaround.
  // clang-format off
  NSDictionary<NSString *, NSString * (^)()> *kvReplacements =
    [NSDictionary dictionaryWithObjectsAndKeys:
      ^{ return event.ruleVersion; },            @"%rule_version%",
      ^{ return event.ruleName; },               @"%rule_name%",
      ^{ return event.fileSHA256; },             @"%file_identifier%",
      ^{ return event.accessedPath; },           @"%accessed_path%",
      ^{ return event.executingUser; },          @"%username%",
      ^{ return config.machineID; },             @"%machine_id%",
      ^{ return [SNTSystemInfo longHostname]; }, @"%hostname%",
      ^{ return [SNTSystemInfo hardwareUUID]; }, @"%uuid%",
      ^{ return [SNTSystemInfo serialNumber]; }, @"%serial%",
      nil];
  // clang-format on

  NSString *formatStr = [SNTBlockMessage replaceFormatString:url withDict:kvReplacements];

  NSURL *u = [NSURL URLWithString:formatStr];
  if (!u) {
    LOGW(@"Unable to generate event detail URL for string '%@'", formatStr);
  }

  return u;
}

@end

1	/// Copyright 2016 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/common/SNTBlockMessage.h"
16
17	#import "Source/common/SNTConfigurator.h"
18	#import "Source/common/SNTFileAccessEvent.h"
19	#import "Source/common/SNTLogging.h"
20	#import "Source/common/SNTStoredEvent.h"
21	#import "Source/common/SNTSystemInfo.h"
22
23	@implementation SNTBlockMessage
24
UNCOV 25	+ (NSAttributedString )formatMessage:(NSString )message {	×
UNCOV 26	NSString *htmlHeader =	×
UNCOV 27	@"<html><head><style>"	×
UNCOV 28	@"body {"	×
UNCOV 29	@" font-family: 'Lucida Grande', 'Helvetica', sans-serif;"	×
UNCOV 30	@" font-size: 13px;"	×
UNCOV 31	@" color: %@;"	×
UNCOV 32	@" text-align: center;"	×
UNCOV 33	@"}"	×
34
35	// Supported in beta WebKit. Not sure if it is dynamic when used with NSAttributedString.
UNCOV 36	@"@media (prefers-color-scheme: dark) {"	×
UNCOV 37	@" body {"	×
UNCOV 38	@" color: #ddd;"	×
UNCOV 39	@" }"	×
UNCOV 40	@"}"	×
UNCOV 41	@"</style></head><body>";	×
42
43	// Support Dark Mode. Note, the returned NSAttributedString is static and does not update when
44	// the OS switches modes.
UNCOV 45	NSString *mode = [NSUserDefaults.standardUserDefaults stringForKey:@"AppleInterfaceStyle"];	×
UNCOV 46	BOOL dark = [mode isEqualToString:@"Dark"];	×
UNCOV 47	htmlHeader = [NSString stringWithFormat:htmlHeader, dark ? @"#ddd" : @"#333"];	×
48
UNCOV 49	NSString *htmlFooter = @"</body></html>";	×
50
UNCOV 51	NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];	×
52
UNCOV 53	#ifdef SANTAGUI	×
UNCOV 54	NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];	×
UNCOV 55	return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];	×
56	#else
57	NSString *strippedHTML = [self stringFromHTML:fullHTML];	×
58	if (!strippedHTML) {	×
59	return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];	×
60	}	×
61	return [[NSAttributedString alloc] initWithString:strippedHTML];	×
62	#endif	×
UNCOV 63	}	×
64
65	+ (NSAttributedString )attributedBlockMessageForEvent:(SNTStoredEvent )event
UNCOV 66	customMessage:(NSString *)customMessage {	×
UNCOV 67	NSString *message;	×
UNCOV 68	if (customMessage.length) {	×
69	message = customMessage;	×
UNCOV 70	} else if (event.decision == SNTEventStateBlockUnknown) {	×
71	message = [[SNTConfigurator configurator] unknownBlockMessage];	×
72	if (!message) {	×
73	message = @"The following application has been blocked from executing<br />"	×
74	@"because its trustworthiness cannot be determined.";	×
75	}	×
UNCOV 76	} else {	×
UNCOV 77	message = [[SNTConfigurator configurator] bannedBlockMessage];	×
UNCOV 78	if (!message) {	×
UNCOV 79	message = @"The following application has been blocked from executing<br />"	×
UNCOV 80	@"because it has been deemed malicious.";	×
UNCOV 81	}	×
UNCOV 82	}	×
UNCOV 83	return [SNTBlockMessage formatMessage:message];	×
UNCOV 84	}	×
85
86	+ (NSAttributedString )attributedBlockMessageForFileAccessEvent:(SNTFileAccessEvent )event
87	customMessage:(NSString *)customMessage {	×
88	NSString *message = customMessage;	×
89	if (!message.length) {	×
90	message = [[SNTConfigurator configurator] fileAccessBlockMessage];	×
91	if (!message.length) {	×
92	message = @"Access to a file has been denied.";	×
93	}	×
94	}	×
95	return [SNTBlockMessage formatMessage:message];	×
96	}	×
97
98	+ (NSString )stringFromHTML:(NSString )html {	×
99	NSError *error;	×
100	NSXMLDocument *xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];	×
101
102	if (!xml && error.code == NSXMLParserEmptyDocumentError) {	×
103	html = [NSString stringWithFormat:@"<html><body>%@</body></html>", html];	×
104	xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];	×
105	if (!xml) return html;	×
106	}	×
107
108	// Strip any HTML tags out of the message. Also remove any content inside <style> tags and
109	// replace <br> elements with a newline.
110	NSString *stripXslt =	×
111	@"<?xml version='1.0' encoding='utf-8'?>"	×
112	@"<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'"	×
113	@" xmlns:xhtml='http://www.w3.org/1999/xhtml'>"	×
114	@"<xsl:output method='text'/>"	×
115	@"<xsl:template match='br'><xsl:text>\n</xsl:text></xsl:template>"	×
116	@"<xsl:template match='style'/>"	×
117	@"</xsl:stylesheet>";	×
118	NSData *data = [xml objectByApplyingXSLTString:stripXslt arguments:NULL error:&error];	×
119	if (error \|\| ![data isKindOfClass:[NSData class]]) {	×
120	return html;	×
121	}	×
122	return [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];	×
123	}	×
124
125	+ (NSString )replaceFormatString:(NSString )str
126	withDict:(NSDictionary<NSString , NSString (^)()> *)replacements {	3✔
127	__block NSString *formatStr = str;	3✔
128
129	[replacements	3✔
130	enumerateKeysAndObjectsUsingBlock:^(NSString key, NSString (^computeValue)(), BOOL *stop) {	25✔
131	NSString *value = computeValue();	25✔
132	if (value) {	25!
133	formatStr = [formatStr stringByReplacingOccurrencesOfString:key withString:value];	25✔
134	}	25✔
135	}];	25✔
136
137	return formatStr;	3✔
138	}	3✔
139
140	// Returns either the generated URL for the passed in event, or an NSURL from the passed in custom
141	// URL string. If the custom URL string is the string "null", nil will be returned. If no custom
142	// URL is passed and there is no configured EventDetailURL template, nil will be returned.
143	// The following "format strings" will be replaced in the URL, if they are present:
144	//
145	// %file_identifier% - The SHA-256 of the binary being executed.
146	// %bundle_or_file_identifier% - The hash of the bundle containing this file or the file itself,
147	// if no bundle hash is present.
148	// %username% - The executing user's name.
149	// %machine_id% - The configured machine ID for this host.
150	// %hostname% - The machine's FQDN.
151	// %uuid% - The machine's UUID.
152	// %serial% - The machine's serial number.
153	//
154	+ (NSURL )eventDetailURLForEvent:(SNTStoredEvent )event customURL:(NSString *)url {	4✔
155	SNTConfigurator *config = [SNTConfigurator configurator];	4✔
156
157	NSString *formatStr = url;	4✔
158	if (!formatStr.length) {	4✔
159	formatStr = config.eventDetailURL;	1✔
160	if (!formatStr.length) {	1!
161	return nil;	1✔
162	}	1✔
163	}	3✔
164
165	if ([formatStr isEqualToString:@"null"]) {	3✔
166	return nil;	1✔
167	}	1✔
168
169	// Disabling clang-format. See comment in `eventDetailURLForFileAccessEvent:customURL:`
170	// clang-format off
171	NSDictionary<NSString , NSString (^)()> *kvReplacements =	2✔
172	[NSDictionary dictionaryWithObjectsAndKeys:	2✔
173	// This key is deprecated, use %file_identifier% or %bundle_or_file_identifier%
174	^{ return event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil; },	2!
175	@"%file_sha%",	2✔
176	^{ return event.fileSHA256; }, @"%file_identifier%",	2✔
177	^{ return event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil; },	2!
178	@"%bundle_or_file_identifier%",	2✔
179	^{ return event.executingUser; }, @"%username%",	2✔
180	^{ return config.machineID; }, @"%machine_id%",	2✔
181	^{ return [SNTSystemInfo longHostname]; }, @"%hostname%",	2✔
182	^{ return [SNTSystemInfo hardwareUUID]; }, @"%uuid%",	2✔
183	^{ return [SNTSystemInfo serialNumber]; }, @"%serial%",	2✔
184	nil];	2✔
185	// clang-format on
186
187	formatStr = [SNTBlockMessage replaceFormatString:formatStr withDict:kvReplacements];	2✔
188
189	NSURL *u = [NSURL URLWithString:formatStr];	2✔
190	if (!u) {	2!
191	LOGW(@"Unable to generate event detail URL for string '%@'", formatStr);	×
192	}	×
193
194	return u;	2✔
195	}	2✔
196
197	// Returns either the generated URL for the passed in event, or an NSURL from the passed in custom
198	// URL string. If the custom URL string is the string "null", nil will be returned. If no custom
199	// URL is passed and there is no configured EventDetailURL template, nil will be returned.
200	// The following "format strings" will be replaced in the URL, if they are present:
201	//
202	// %rule_version% - The version of the rule that was violated.
203	// %rule_name% - The name of the rule that was violated.
204	// %file_identifier% - The SHA-256 of the binary being executed.
205	// %accessed_path% - The path accessed by the binary.
206	// %username% - The executing user's name.
207	// %machine_id% - The configured machine ID for this host.
208	// %hostname% - The machine's FQDN.
209	// %uuid% - The machine's UUID.
210	// %serial% - The machine's serial number.
211	//
212	+ (NSURL )eventDetailURLForFileAccessEvent:(SNTFileAccessEvent )event customURL:(NSString *)url {	3✔
213	if (!url.length \|\| [url isEqualToString:@"null"]) {	3✔
214	return nil;	2✔
215	}	2✔
216
217	SNTConfigurator *config = [SNTConfigurator configurator];	1✔
218
219	// Clang format goes wild here. If you use the container literal syntax `@{}` with a block value
220	// type, it seems to break the clang format on/off functionality and breaks formatting for the
221	// remainder of the file.
222	// Using `dictionaryWithObjectsAndKeys` and disabling clang format as a workaround.
223	// clang-format off
224	NSDictionary<NSString , NSString (^)()> *kvReplacements =	1✔
225	[NSDictionary dictionaryWithObjectsAndKeys:	1✔
226	^{ return event.ruleVersion; }, @"%rule_version%",	1✔
227	^{ return event.ruleName; }, @"%rule_name%",	1✔
228	^{ return event.fileSHA256; }, @"%file_identifier%",	1✔
229	^{ return event.accessedPath; }, @"%accessed_path%",	1✔
230	^{ return event.executingUser; }, @"%username%",	1✔
231	^{ return config.machineID; }, @"%machine_id%",	1✔
232	^{ return [SNTSystemInfo longHostname]; }, @"%hostname%",	1✔
233	^{ return [SNTSystemInfo hardwareUUID]; }, @"%uuid%",	1✔
234	^{ return [SNTSystemInfo serialNumber]; }, @"%serial%",	1✔
235	nil];	1✔
236	// clang-format on
237
238	NSString *formatStr = [SNTBlockMessage replaceFormatString:url withDict:kvReplacements];	1✔
239
240	NSURL *u = [NSURL URLWithString:formatStr];	1✔
241	if (!u) {	1!
242	LOGW(@"Unable to generate event detail URL for string '%@'", formatStr);	×
243	}	×
244
245	return u;	1✔
246	}	1✔
247
248	@end

google / santa / 8425819861

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous