New Rule (Attachment): Fake attachment image lure #2740
Workflow file for this run
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Rules PR CI | |
| on: | |
| push: | |
| branches: [ "main", "test-rules" ] | |
| pull_request_target: | |
| branches: [ "**" ] | |
| workflow_dispatch: {} | |
| concurrency: | |
| # For pull_request_target workflows we want to use head_ref -- the branch triggering the workflow. Otherwise, | |
| # use ref, which is the branch for a push event. | |
| group: ${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| tests: | |
| name: Run Rule Validation | |
| runs-on: ubuntu-20.04 | |
| permissions: | |
| contents: write | |
| checks: write | |
| steps: | |
| - name: Set up yq | |
| uses: mikefarah/[email protected] | |
| - name: Checkout | |
| uses: actions/checkout@v3 | |
| with: | |
| ref: ${{ github.head_ref }} | |
| repository: ${{ github.event.pull_request.head.repo.full_name }} | |
| depth: 0 | |
| - uses: actions/setup-python@v4 | |
| with: | |
| python-version: '3.10' | |
| - name: Add Rule IDs as Needed & Check for Duplicates | |
| # Run before testing, just in case this could invalidate the rule itself | |
| run: | | |
| pip install -r scripts/generate-rule-ids/requirements.txt | |
| python scripts/generate-rule-ids/main.py | |
| - name: Validate Rules | |
| run: | | |
| for f in *-rules/*.yml | |
| do | |
| echo "Processing $f" | |
| http_code=$(yq -o=json eval 'del(.type)' "$f" | curl -H "Content-Type: application/json" -X POST --data-binary @- -o response.txt -w "%{http_code}" --silent https://playground.sublimesecurity.com/v1/rules/validate) | |
| echo '' >> response.txt | |
| cat response.txt | |
| if [[ "$http_code" != "200" ]]; then | |
| echo "Unexpected response $http_code" | |
| exit 1 | |
| fi | |
| done | |
| - name: Validate Insights and Signals | |
| run: | | |
| for f in {insights,signals}/**/*.yml | |
| do | |
| echo "Processing $f" | |
| http_code=$(yq eval 'del(.type) | .source = "length([\n\n" + .source + "\n]) >= 0"' "$f" -o=json | curl -H "Content-Type: application/json" -X POST --data-binary @- -o response.txt -w "%{http_code}" --silent https://playground.sublimesecurity.com/v1/rules/validate) | |
| echo '' >> response.txt | |
| cat response.txt | |
| if [[ "$http_code" != "200" ]]; then | |
| echo "Unexpected response $http_code" | |
| exit 1 | |
| fi | |
| done | |
| - name: Verify no .yaml files exist | |
| run: | | |
| ! /bin/sh -c 'ls **/*.yaml' | |
| - name: Commit & Push Results, if needed | |
| run: | | |
| rm response.txt | |
| if [ -z "$(git status --porcelain)" ]; then | |
| echo "No files changed, nothing to do" | |
| exit 0 | |
| fi | |
| git config user.name 'ID Generator' | |
| git config user.email '[email protected]' | |
| git add **/*.yml | |
| git commit -m "Auto add rule ID" | |
| git push origin ${{ github.head_ref }} | |
| - name: Get the head SHA | |
| id: get_head | |
| run: echo "##[set-output name=HEAD;]$(git rev-parse HEAD)" | |
| - name: Get changed detection-rules | |
| id: changed-files | |
| uses: tj-actions/changed-files@v39 | |
| with: | |
| files: "detection-rules/**" | |
| recover_deleted_files: true | |
| - name: "Find updated rule IDs" | |
| id: find_ids | |
| run: | | |
| for file in ${{ steps.changed-files.outputs.all_changed_and_modified_files }}; do | |
| echo "$file was changed" | |
| rule_id=$(yq '.id' $file) | |
| echo "$file has rule ID $rule_id" | |
| altered_rule_ids=$(echo "$rule_id"" ""$altered_rule_ids") | |
| done | |
| echo "Altered Ruled IDs: [$altered_rule_ids]" | |
| echo "##[set-output name=rule_ids;]$(echo $altered_rule_ids)" | |
| # TODO: This doesn't solve for a modified rule_id. We could merge with any files known on 'main', but changing | |
| # a rule ID is a separate problem. | |
| - name: "Trigger MQL Mimic Tests" | |
| env: | |
| trigger_url: '${{ secrets.MQL_MOCK_TRIGGER }}' | |
| branch: ${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }} | |
| repo: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.full_name || github.repository }} | |
| token: '${{ secrets.GITHUB_TOKEN }}' | |
| sha: '${{ steps.get_head.outputs.HEAD }}' | |
| only_rule_ids: '${{ steps.find_ids.outputs.rule_ids }}' | |
| run: | | |
| body='{"branch":"'$branch'","repo":"'$repo'","token":"'$token'","sha":"'$sha'","only_rule_ids":"'$only_rule_ids'"}' | |
| echo $body | |
| curl -X POST $trigger_url \ | |
| -H 'Content-Type: application/json' \ | |
| -d "$body" | |
| # When we add a commit, GitHub won't trigger actions on the auto commit, so we're missing a required check on the | |
| # HEAD commit. | |
| # Various alternatives were explored, but all run into issues when dealing with forks. This sets a "Check" for | |
| # the latest commit, and we can depend on that as a required check. | |
| - name: "Create a check run" | |
| uses: actions/github-script@v6 | |
| if: github.event_name == 'pull_request_target' | |
| env: | |
| parameter_url: '${{ github.event.pull_request.html_url }}' | |
| with: | |
| debug: ${{ secrets.ACTIONS_STEP_DEBUG || false }} | |
| retries: 3 | |
| # Default includes 422 which GitHub returns when it doesn't know about the head_sha we set the status for. | |
| # This occurs when the previous push succeeds, but the checks/pull request component of GitHub isn't yet aware | |
| # of the new commit. This isn't the common case, but it comes up enough to be annoying. | |
| retry-exempt-status-codes: 400, 401, 403, 404 | |
| script: | | |
| // any JavaScript code can go here, you can use Node JS APIs too. | |
| // Docs: https://docs.github.com/en/rest/checks/runs#create-a-check-run | |
| // Rest: https://octokit.github.io/rest.js/v18#checks-create | |
| await github.rest.checks.create({ | |
| owner: context.repo.owner, | |
| repo: context.repo.repo, | |
| head_sha: "${{ steps.get_head.outputs.HEAD }}", | |
| name: "Rule Tests and ID Updated", | |
| status: "completed", | |
| conclusion: "success", | |
| details_url: process.env.parameter_url, | |
| output: { | |
| title: "Rule Tests and ID Updated", | |
| summary: "Rule Tests and ID Updated", | |
| text: "Rule Tests and ID Updated", | |
| }, | |
| }); | |
| - name: Wait for MQL Mimic check to be completed | |
| uses: fountainhead/[email protected] | |
| id: wait-for-build | |
| # Wait for results so that the token remains valid while the test suite is executing and posting a check here. | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| checkName: "MQL Mimic Tests" | |
| ref: ${{ steps.get_head.outputs.HEAD }} | |
| timeoutSeconds: 3600 | |