8986161147

Committed 07 May 2024 01:20PM UTC coverage: 62.218% (+0.1%) from 62.098%

Build # 8986161147

Build Type

push

github

Committed by

web-flow

Commit Message

SNTBlockMessage: add more template options (#1337)

* update event detail url

* refactor template mappings

* re-enable testEventDetailURLForFileAccessEvent

* null

* missed one

* update comment

Run Details

5234 of 12616 branches covered (41.49%)

Branch coverage included in aggregate %.

75 of 75 new or added lines in 2 files covered. (100.0%)

2 existing lines in 1 file now uncovered.

17226 of 23483 relevant lines covered (73.36%)

7225.64 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

63.08

/Source/common/SNTBlockMessage.m

/// Copyright 2016 Google Inc. All rights reserved.
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///    http://www.apache.org/licenses/LICENSE-2.0
///
///    Unless required by applicable law or agreed to in writing, software
///    distributed under the License is distributed on an "AS IS" BASIS,
///    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
///    See the License for the specific language governing permissions and
///    limitations under the License.

#import "Source/common/SNTBlockMessage.h"

#import "Source/common/SNTConfigurator.h"
#import "Source/common/SNTFileAccessEvent.h"
#import "Source/common/SNTLogging.h"
#import "Source/common/SNTStoredEvent.h"
#import "Source/common/SNTSystemInfo.h"

static id ValueOrNull(id value) {
  return value ?: [NSNull null];
}

@implementation SNTBlockMessage

+ (NSAttributedString *)formatMessage:(NSString *)message {
  NSString *htmlHeader =
    @"<html><head><style>"
    @"body {"
    @"  font-family: 'Lucida Grande', 'Helvetica', sans-serif;"
    @"  font-size: 13px;"
    @"  color: %@;"
    @"  text-align: center;"
    @"}"

    // Supported in beta WebKit. Not sure if it is dynamic when used with NSAttributedString.
    @"@media (prefers-color-scheme: dark) {"
    @"  body {"
    @"    color: #ddd;"
    @"  }"
    @"}"
    @"</style></head><body>";

  // Support Dark Mode. Note, the returned NSAttributedString is static and does not update when
  // the OS switches modes.
  NSString *mode = [NSUserDefaults.standardUserDefaults stringForKey:@"AppleInterfaceStyle"];
  BOOL dark = [mode isEqualToString:@"Dark"];
  htmlHeader = [NSString stringWithFormat:htmlHeader, dark ? @"#ddd" : @"#333"];

  NSString *htmlFooter = @"</body></html>";

  NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];

#ifdef SANTAGUI
  NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];
  return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];
#else
  NSString *strippedHTML = [self stringFromHTML:fullHTML];
  if (!strippedHTML) {
    return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];
  }
  return [[NSAttributedString alloc] initWithString:strippedHTML];
#endif
}

+ (NSAttributedString *)attributedBlockMessageForEvent:(SNTStoredEvent *)event
                                         customMessage:(NSString *)customMessage {
  NSString *message;
  if (customMessage.length) {
    message = customMessage;
  } else if (event.decision == SNTEventStateBlockUnknown) {
    message = [[SNTConfigurator configurator] unknownBlockMessage];
    if (!message) {
      message = @"The following application has been blocked from executing<br />"
                @"because its trustworthiness cannot be determined.";
    }
  } else {
    message = [[SNTConfigurator configurator] bannedBlockMessage];
    if (!message) {
      message = @"The following application has been blocked from executing<br />"
                @"because it has been deemed malicious.";
    }
  }
  return [SNTBlockMessage formatMessage:message];
}

+ (NSAttributedString *)attributedBlockMessageForFileAccessEvent:(SNTFileAccessEvent *)event
                                                   customMessage:(NSString *)customMessage {
  NSString *message = customMessage;
  if (!message.length) {
    message = [[SNTConfigurator configurator] fileAccessBlockMessage];
    if (!message.length) {
      message = @"Access to a file has been denied.";
    }
  }
  return [SNTBlockMessage formatMessage:message];
}

+ (NSString *)stringFromHTML:(NSString *)html {
  NSError *error;
  NSXMLDocument *xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];

  if (!xml && error.code == NSXMLParserEmptyDocumentError) {
    html = [NSString stringWithFormat:@"<html><body>%@</body></html>", html];
    xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];
    if (!xml) return html;
  }

  // Strip any HTML tags out of the message. Also remove any content inside <style> tags and
  // replace <br> elements with a newline.
  NSString *stripXslt =
    @"<?xml version='1.0' encoding='utf-8'?>"
    @"<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'"
    @"                              xmlns:xhtml='http://www.w3.org/1999/xhtml'>"
    @"<xsl:output method='text'/>"
    @"<xsl:template match='br'><xsl:text>\n</xsl:text></xsl:template>"
    @"<xsl:template match='style'/>"
    @"</xsl:stylesheet>";
  NSData *data = [xml objectByApplyingXSLTString:stripXslt arguments:NULL error:&error];
  if (error || ![data isKindOfClass:[NSData class]]) {
    return html;
  }
  return [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];
}

+ (NSString *)replaceFormatString:(NSString *)str
                         withDict:(NSDictionary<NSString *, NSString *> *)replacements {
  __block NSString *formatStr = str;

  [replacements enumerateKeysAndObjectsUsingBlock:^(NSString *key, NSString *value, BOOL *stop) {
    if ((id)value != [NSNull null]) {
      formatStr = [formatStr stringByReplacingOccurrencesOfString:key withString:value];
    }
  }];

  return formatStr;
}

//
//   The following "format strings" will be replaced in the URL provided by
//   `+eventDetailURLForEvent:customURL:templateMapping:`.
//
//   %file_identifier%           - The SHA-256 of the binary being executed.
//   %bundle_or_file_identifier% - The hash of the bundle containing this file or the file itself,
//                                 if no bundle hash is present.
//   %file_bundle_id%            - The bundle id of the binary, if any.
//   %team_id%                   - The Team ID if present in the signature information.
//   %signing_id%                - The Signing ID if present in the signature information.
//   %cdhash%                    - If signed, the CDHash.
//   %username%                  - The executing user's name.
//   %machine_id%                - The configured machine ID for this host.
//   %hostname%                  - The machine's FQDN.
//   %uuid%                      - The machine's UUID.
//   %serial%                    - The machine's serial number.
//
+ (NSDictionary *)eventDetailTemplateMappingForEvent:(SNTStoredEvent *)event {
  SNTConfigurator *config = [SNTConfigurator configurator];
  return @{
    @"%file_sha%" : ValueOrNull(event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil),
    @"%file_identifier%" : ValueOrNull(event.fileSHA256),
    @"%bundle_or_file_identifier%" :
      ValueOrNull(event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil),
    @"%username%" : ValueOrNull(event.executingUser),
    @"%file_bundle_id%" : ValueOrNull(event.fileBundleID),
    @"%team_id%" : ValueOrNull(event.teamID),
    @"%signing_id%" : ValueOrNull(event.signingID),
    @"%cdhash%" : ValueOrNull(event.cdhash),
    @"%machine_id%" : ValueOrNull(config.machineID),
    @"%hostname%" : ValueOrNull([SNTSystemInfo longHostname]),
    @"%uuid%" : ValueOrNull([SNTSystemInfo hardwareUUID]),
    @"%serial%" : ValueOrNull([SNTSystemInfo serialNumber]),
  };
}

//
//   Everything from `+eventDetailTemplateMappingForEvent:` with the following file access
//   specific templates.
//
//   %rule_version%    - The version of the rule that was violated.
//   %rule_name%       - The name of the rule that was violated.
//   %accessed_path%   - The path accessed by the binary.
//
+ (NSDictionary *)fileAccessEventDetailTemplateMappingForEvent:(SNTFileAccessEvent *)event {
  NSMutableDictionary *d = [self eventDetailTemplateMappingForEvent:event].mutableCopy;
  [d addEntriesFromDictionary:@{
    @"%rule_version%" : ValueOrNull(event.ruleVersion),
    @"%rule_name%" : ValueOrNull(event.ruleName),
    @"%accessed_path%" : ValueOrNull(event.accessedPath),
  }];
  return d;
}

// Returns either the generated URL for the passed in event, or an NSURL from the passed in custom
// URL string. If the custom URL string is the string "null", nil will be returned. If no custom
// URL is passed and there is no configured EventDetailURL template, nil will be returned.
// The "format strings" in `templateMapping` will be replaced in the URL, if they are present.
+ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event
                        customURL:(NSString *)url
                  templateMapping:(NSDictionary *)templateMapping {
  SNTConfigurator *config = [SNTConfigurator configurator];

  NSString *formatStr = url;
  if (!formatStr.length) {
    formatStr = config.eventDetailURL;
    if (!formatStr.length) {
      return nil;
    }
  }

  if ([formatStr isEqualToString:@"null"]) {
    return nil;
  }

  formatStr = [SNTBlockMessage replaceFormatString:formatStr withDict:templateMapping];
  NSURL *u = [NSURL URLWithString:formatStr];
  if (!u) {
    LOGW(@"Unable to generate event detail URL for string '%@'", formatStr);
  }

  return u;
}

+ (NSURL *)eventDetailURLForEvent:(SNTStoredEvent *)event customURL:(NSString *)url {
  return [self eventDetailURLForEvent:event
                            customURL:url
                      templateMapping:[self eventDetailTemplateMappingForEvent:event]];
}

+ (NSURL *)eventDetailURLForFileAccessEvent:(SNTFileAccessEvent *)event customURL:(NSString *)url {
  return [self eventDetailURLForEvent:event
                            customURL:url
                      templateMapping:[self fileAccessEventDetailTemplateMappingForEvent:event]];
}

@end

1	/// Copyright 2016 Google Inc. All rights reserved.
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// http://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14
15	#import "Source/common/SNTBlockMessage.h"
16
17	#import "Source/common/SNTConfigurator.h"
18	#import "Source/common/SNTFileAccessEvent.h"
19	#import "Source/common/SNTLogging.h"
20	#import "Source/common/SNTStoredEvent.h"
21	#import "Source/common/SNTSystemInfo.h"
22
23	static id ValueOrNull(id value) {	117✔
24	return value ?: [NSNull null];	117✔
25	}	117✔
26
27	@implementation SNTBlockMessage
28
29	+ (NSAttributedString )formatMessage:(NSString )message {	1✔
30	NSString *htmlHeader =	1✔
31	@"<html><head><style>"	1✔
32	@"body {"	1✔
33	@" font-family: 'Lucida Grande', 'Helvetica', sans-serif;"	1✔
34	@" font-size: 13px;"	1✔
35	@" color: %@;"	1✔
36	@" text-align: center;"	1✔
37	@"}"	1✔
38
39	// Supported in beta WebKit. Not sure if it is dynamic when used with NSAttributedString.
40	@"@media (prefers-color-scheme: dark) {"	1✔
41	@" body {"	1✔
42	@" color: #ddd;"	1✔
43	@" }"	1✔
44	@"}"	1✔
45	@"</style></head><body>";	1✔
46
47	// Support Dark Mode. Note, the returned NSAttributedString is static and does not update when
48	// the OS switches modes.
49	NSString *mode = [NSUserDefaults.standardUserDefaults stringForKey:@"AppleInterfaceStyle"];	1✔
50	BOOL dark = [mode isEqualToString:@"Dark"];	1✔
51	htmlHeader = [NSString stringWithFormat:htmlHeader, dark ? @"#ddd" : @"#333"];	1!
52
53	NSString *htmlFooter = @"</body></html>";	1✔
54
55	NSString *fullHTML = [NSString stringWithFormat:@"%@%@%@", htmlHeader, message, htmlFooter];	1✔
56
57	#ifdef SANTAGUI	1✔
58	NSData *htmlData = [fullHTML dataUsingEncoding:NSUTF8StringEncoding];	1✔
59	return [[NSAttributedString alloc] initWithHTML:htmlData documentAttributes:NULL];	1✔
60	#else
61	NSString *strippedHTML = [self stringFromHTML:fullHTML];	×
62	if (!strippedHTML) {	×
63	return [[NSAttributedString alloc] initWithString:@"This binary has been blocked."];	×
64	}	×
65	return [[NSAttributedString alloc] initWithString:strippedHTML];	×
66	#endif	×
67	}	1✔
68
69	+ (NSAttributedString )attributedBlockMessageForEvent:(SNTStoredEvent )event
70	customMessage:(NSString *)customMessage {	1✔
71	NSString *message;	1✔
72	if (customMessage.length) {	1!
73	message = customMessage;	×
74	} else if (event.decision == SNTEventStateBlockUnknown) {	1!
75	message = [[SNTConfigurator configurator] unknownBlockMessage];	×
76	if (!message) {	×
77	message = @"The following application has been blocked from executing<br />"	×
78	@"because its trustworthiness cannot be determined.";	×
79	}	×
80	} else {	1✔
81	message = [[SNTConfigurator configurator] bannedBlockMessage];	1✔
82	if (!message) {	1!
83	message = @"The following application has been blocked from executing<br />"	1✔
84	@"because it has been deemed malicious.";	1✔
85	}	1✔
86	}	1✔
87	return [SNTBlockMessage formatMessage:message];	1✔
88	}	1✔
89
90	+ (NSAttributedString )attributedBlockMessageForFileAccessEvent:(SNTFileAccessEvent )event
91	customMessage:(NSString *)customMessage {	×
92	NSString *message = customMessage;	×
93	if (!message.length) {	×
94	message = [[SNTConfigurator configurator] fileAccessBlockMessage];	×
95	if (!message.length) {	×
96	message = @"Access to a file has been denied.";	×
97	}	×
98	}	×
99	return [SNTBlockMessage formatMessage:message];	×
100	}	×
101
102	+ (NSString )stringFromHTML:(NSString )html {	×
103	NSError *error;	×
104	NSXMLDocument *xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];	×
105
106	if (!xml && error.code == NSXMLParserEmptyDocumentError) {	×
107	html = [NSString stringWithFormat:@"<html><body>%@</body></html>", html];	×
108	xml = [[NSXMLDocument alloc] initWithXMLString:html options:0 error:&error];	×
109	if (!xml) return html;	×
110	}	×
111
112	// Strip any HTML tags out of the message. Also remove any content inside <style> tags and
113	// replace <br> elements with a newline.
114	NSString *stripXslt =	×
115	@"<?xml version='1.0' encoding='utf-8'?>"	×
116	@"<xsl:stylesheet version='1.0' xmlns:xsl='http://www.w3.org/1999/XSL/Transform'"	×
117	@" xmlns:xhtml='http://www.w3.org/1999/xhtml'>"	×
118	@"<xsl:output method='text'/>"	×
119	@"<xsl:template match='br'><xsl:text>\n</xsl:text></xsl:template>"	×
120	@"<xsl:template match='style'/>"	×
121	@"</xsl:stylesheet>";	×
122	NSData *data = [xml objectByApplyingXSLTString:stripXslt arguments:NULL error:&error];	×
123	if (error \|\| ![data isKindOfClass:[NSData class]]) {	×
124	return html;	×
125	}	×
126	return [[NSString alloc] initWithData:data encoding:NSUTF8StringEncoding];	×
127	}	×
128
129	+ (NSString )replaceFormatString:(NSString )str
130	withDict:(NSDictionary<NSString , NSString > *)replacements {	4✔
131	__block NSString *formatStr = str;	4✔
132
133	[replacements enumerateKeysAndObjectsUsingBlock:^(NSString key, NSString value, BOOL *stop) {	51✔
134	if ((id)value != [NSNull null]) {	51✔
135	formatStr = [formatStr stringByReplacingOccurrencesOfString:key withString:value];	46✔
136	}	46✔
137	}];	51✔
138
139	return formatStr;	4✔
140	}	4✔
141
142	//
143	// The following "format strings" will be replaced in the URL provided by
144	// `+eventDetailURLForEvent:customURL:templateMapping:`.
145	//
146	// %file_identifier% - The SHA-256 of the binary being executed.
147	// %bundle_or_file_identifier% - The hash of the bundle containing this file or the file itself,
148	// if no bundle hash is present.
149	// %file_bundle_id% - The bundle id of the binary, if any.
150	// %team_id% - The Team ID if present in the signature information.
151	// %signing_id% - The Signing ID if present in the signature information.
152	// %cdhash% - If signed, the CDHash.
153	// %username% - The executing user's name.
154	// %machine_id% - The configured machine ID for this host.
155	// %hostname% - The machine's FQDN.
156	// %uuid% - The machine's UUID.
157	// %serial% - The machine's serial number.
158	//
159	+ (NSDictionary )eventDetailTemplateMappingForEvent:(SNTStoredEvent )event {	9✔
160	SNTConfigurator *config = [SNTConfigurator configurator];	9✔
161	return @{	9✔
162	@"%file_sha%" : ValueOrNull(event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil),	9!
163	@"%file_identifier%" : ValueOrNull(event.fileSHA256),	9✔
164	@"%bundle_or_file_identifier%" :	9✔
165	ValueOrNull(event.fileSHA256 ? event.fileBundleHash ?: event.fileSHA256 : nil),	9!
166	@"%username%" : ValueOrNull(event.executingUser),	9✔
167	@"%file_bundle_id%" : ValueOrNull(event.fileBundleID),	9✔
168	@"%team_id%" : ValueOrNull(event.teamID),	9✔
169	@"%signing_id%" : ValueOrNull(event.signingID),	9✔
170	@"%cdhash%" : ValueOrNull(event.cdhash),	9✔
171	@"%machine_id%" : ValueOrNull(config.machineID),	9✔
172	@"%hostname%" : ValueOrNull([SNTSystemInfo longHostname]),	9✔
173	@"%uuid%" : ValueOrNull([SNTSystemInfo hardwareUUID]),	9✔
174	@"%serial%" : ValueOrNull([SNTSystemInfo serialNumber]),	9✔
175	};	9✔
176	}	9✔
177
178	//
179	// Everything from `+eventDetailTemplateMappingForEvent:` with the following file access
180	// specific templates.
181	//
182	// %rule_version% - The version of the rule that was violated.
183	// %rule_name% - The name of the rule that was violated.
184	// %accessed_path% - The path accessed by the binary.
185	//
186	+ (NSDictionary )fileAccessEventDetailTemplateMappingForEvent:(SNTFileAccessEvent )event {	3✔
187	NSMutableDictionary *d = [self eventDetailTemplateMappingForEvent:event].mutableCopy;	3✔
188	[d addEntriesFromDictionary:@{	3✔
189	@"%rule_version%" : ValueOrNull(event.ruleVersion),	3✔
190	@"%rule_name%" : ValueOrNull(event.ruleName),	3✔
191	@"%accessed_path%" : ValueOrNull(event.accessedPath),	3✔
192	}];	3✔
193	return d;	3✔
194	}	3✔
195
196	// Returns either the generated URL for the passed in event, or an NSURL from the passed in custom
197	// URL string. If the custom URL string is the string "null", nil will be returned. If no custom
198	// URL is passed and there is no configured EventDetailURL template, nil will be returned.
199	// The "format strings" in `templateMapping` will be replaced in the URL, if they are present.
200	+ (NSURL )eventDetailURLForEvent:(SNTStoredEvent )event
201	customURL:(NSString *)url
202	templateMapping:(NSDictionary *)templateMapping {	9✔
203	SNTConfigurator *config = [SNTConfigurator configurator];	9✔
204
205	NSString *formatStr = url;	9✔
206	if (!formatStr.length) {	9✔
207	formatStr = config.eventDetailURL;	3✔
208	if (!formatStr.length) {	3!
209	return nil;	3✔
210	}	3✔
211	}	3✔
212
213	if ([formatStr isEqualToString:@"null"]) {	6✔
214	return nil;	2✔
215	}	2✔
216
217	formatStr = [SNTBlockMessage replaceFormatString:formatStr withDict:templateMapping];	4✔
218	NSURL *u = [NSURL URLWithString:formatStr];	4✔
219	if (!u) {	4!
UNCOV 220	LOGW(@"Unable to generate event detail URL for string '%@'", formatStr);	×
UNCOV 221	}	×
222
223	return u;	4✔
224	}	6✔
225
226	+ (NSURL )eventDetailURLForEvent:(SNTStoredEvent )event customURL:(NSString *)url {	6✔
227	return [self eventDetailURLForEvent:event	6✔
228	customURL:url	6✔
229	templateMapping:[self eventDetailTemplateMappingForEvent:event]];	6✔
230	}	6✔
231
232	+ (NSURL )eventDetailURLForFileAccessEvent:(SNTFileAccessEvent )event customURL:(NSString *)url {	3✔
233	return [self eventDetailURLForEvent:event	3✔
234	customURL:url	3✔
235	templateMapping:[self fileAccessEventDetailTemplateMappingForEvent:event]];	3✔
236	}	3✔
237
238	@end

google / santa / 8986161147

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous