[Security Solution][Endpoint] Allow wildcard in trusted app paths

x-pack/plugins/lists/common/schemas/common/schemas.test.ts

@@ -53,6 +53,15 @@ describe('Common schemas', () => {
       expect(message.schema).toEqual(payload);
     });
 
+    test('it should validate for "wildcard_caseless"', () => {
+      const payload = 'wildcard_caseless';
+      const decoded = operator.decode(payload);
+      const message = pipe(decoded, foldLeftRight);
+
+      expect(getPaths(left(message.errors))).toEqual([]);
+      expect(message.schema).toEqual(payload);
+    });
+
     test('it should contain same amount of keys as enum', () => {
       // Might seem like a weird test, but its meant to
       // ensure that if operator is updated, you

x-pack/plugins/lists/common/schemas/common/schemas.ts

@@ -287,6 +287,7 @@ export enum OperatorTypeEnum {
   NESTED = 'nested',
   MATCH = 'match',
   MATCH_ANY = 'match_any',
+  WILDCARD = 'wildcard',
   EXISTS = 'exists',
   LIST = 'list',
 }

x-pack/plugins/lists/common/schemas/types/entries.ts

@@ -12,12 +12,27 @@ import { entriesMatch } from './entry_match';
 import { entriesExists } from './entry_exists';
 import { entriesList } from './entry_list';
 import { entriesNested } from './entry_nested';
+import { entriesMatchWildcard } from './entry_match_wildcard';
 
-export const entry = t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists]);
+export const entry = t.union([
+  entriesMatch,
+  entriesMatchAny,
+  entriesList,
+  entriesExists,
+  entriesNested,
+  entriesMatchWildcard,
+]);
 export type Entry = t.TypeOf<typeof entry>;
 
 export const entriesArray = t.array(
-  t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists, entriesNested])
+  t.union([
+    entriesMatch,
+    entriesMatchAny,
+    entriesList,
+    entriesExists,
+    entriesNested,
+    entriesMatchWildcard,
+  ])
 );
 export type EntriesArray = t.TypeOf<typeof entriesArray>;
 

x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../shared_imports';
+import { operator } from '../common/schemas';
+
+export const entriesMatchWildcard = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator,
+    type: t.keyof({ wildcard: null }),
+    value: NonEmptyString,
+  })
+);
+export type EntryMatchWildcard = t.TypeOf<typeof entriesMatchWildcard>;

x-pack/plugins/lists/common/schemas/types/index.ts

@@ -15,6 +15,7 @@ export * from './default_namespace';
 export * from './entries';
 export * from './entry_match';
 export * from './entry_match_any';
+export * from './entry_match_wildcard';
 export * from './entry_list';
 export * from './entry_exists';
 export * from './entry_nested';

x-pack/plugins/lists/common/shared_exports.ts

@@ -20,6 +20,7 @@ export {
   EntryExists,
   EntryMatch,
   EntryMatchAny,
+  EntryMatchWildcard,
   EntryNested,
   EntryList,
   EntriesArray,
@@ -39,6 +40,7 @@ export {
   nestedEntryItem,
   entriesMatch,
   entriesMatchAny,
+  entriesMatchWildcard,
   entriesExists,
   entriesList,
   namespaceType,

x-pack/plugins/lists/public/exceptions/components/builder/types.ts

@@ -13,6 +13,7 @@ import {
   EntryExists,
   EntryMatch,
   EntryMatchAny,
+  EntryMatchWildcard,
   EntryNested,
   ExceptionListItemSchema,
   OperatorEnum,
@@ -34,7 +35,7 @@ export interface EmptyEntry {
   id: string;
   field: string | undefined;
   operator: OperatorEnum;
-  type: OperatorTypeEnum.MATCH | OperatorTypeEnum.MATCH_ANY;
+  type: OperatorTypeEnum.MATCH | OperatorTypeEnum.MATCH_ANY | OperatorTypeEnum.WILDCARD;
   value: string | string[] | undefined;
 }
 
@@ -53,6 +54,7 @@ export interface EmptyNestedEntry {
   entries: Array<
     | (EntryMatch & { id?: string })
     | (EntryMatchAny & { id?: string })
+    | (EntryMatchWildcard & { id?: string })
     | (EntryExists & { id?: string })
   >;
 }
@@ -69,6 +71,7 @@ export type BuilderEntryNested = Omit<EntryNested, 'entries'> & {
   entries: Array<
     | (EntryMatch & { id?: string })
     | (EntryMatchAny & { id?: string })
+    | (EntryMatchWildcard & { id?: string })
     | (EntryExists & { id?: string })
   >;
 };

x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts

@@ -247,6 +247,30 @@ describe('When invoking Trusted Apps Schema', () => {
         expect(() => body.validate(bodyMsg)).not.toThrow();
       });
 
+      it('should validate `entry.type` does not accept `wildcard` when field is NOT PATH', () => {
+        const bodyMsg = createNewTrustedApp({
+          entries: [
+            createConditionEntry({
+              field: ConditionEntryField.HASH,
+              type: 'wildcard',
+            }),
+          ],
+        });
+        expect(() => body.validate(bodyMsg)).toThrow();
+      });
+
+      it('should validate `entry.type` accepts `wildcard` when field is PATH', () => {
+        const bodyMsg = createNewTrustedApp({
+          entries: [
+            createConditionEntry({
+              field: ConditionEntryField.PATH,
+              type: 'wildcard',
+            }),
+          ],
+        });
+        expect(() => body.validate(bodyMsg)).not.toThrow();
+      });
+
       it('should validate `entry.value` required', () => {
         const { value, ...entry } = createConditionEntry();
         expect(() => body.validate(createNewTrustedApp({ entries: [entry] }))).toThrow();

x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts

@@ -29,8 +29,13 @@ export const GetTrustedAppsRequestSchema = {
   }),
 };
 
-const ConditionEntryTypeSchema = schema.literal('match');
-const ConditionEntryOperatorSchema = schema.literal('included');
+const ConditionEntryTypeSchema = schema.conditional(
+  schema.siblingRef('field'),
+  ConditionEntryField.PATH,
+  schema.oneOf([schema.literal('match'), schema.literal('wildcard')]),
+  schema.literal('match')
+);
+const ConditionEntryOperatorSchema = schema.literal('included' as ConditionEntry['operator']);
 
 /*
  * A generic Entry schema to be used for a specific entry schema depending on the OS

x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts

@@ -7,6 +7,8 @@
 
 import { TypeOf } from '@kbn/config-schema';
 import { ApplicationStart } from 'kibana/public';
+
+import { Entry } from '../../../../lists/common/schemas/types/entries';
 import {
   DeleteTrustedAppsRequestSchema,
   GetOneTrustedAppRequestSchema,
@@ -69,9 +71,14 @@ export enum ConditionEntryField {
   SIGNER = 'process.Ext.code_signature',
 }
 
+export enum OperatorFieldIds {
+  is = 'is',
+  matches = 'matches',
+}
+
 export interface ConditionEntry<T extends ConditionEntryField = ConditionEntryField> {
   field: T;
-  type: 'match';
+  type: Entry['type'];
   operator: 'included';
   value: string;
 }

x-pack/plugins/security_solution/common/shared_imports.ts

@@ -20,6 +20,7 @@ export {
   EntryExists,
   EntryMatch,
   EntryMatchAny,
+  EntryMatchWildcard,
   EntryNested,
   EntryList,
   EntriesArray,
@@ -38,6 +39,7 @@ export {
   nestedEntryItem,
   entriesMatch,
   entriesMatchAny,
+  entriesMatchWildcard,
   entriesExists,
   entriesList,
   namespaceType,

x-pack/plugins/security_solution/public/common/components/exceptions/types.ts

@@ -15,6 +15,7 @@ import {
   Entry,
   EntryMatch,
   EntryMatchAny,
+  EntryMatchWildcard,
   EntryExists,
   ExceptionListItemSchema,
   CreateExceptionListItemSchema,
@@ -92,6 +93,7 @@ export interface EmptyNestedEntry {
   type: OperatorTypeEnum.NESTED;
   entries: Array<
     | (EntryMatch & { id?: string })
+    | (EntryMatchWildcard & { id?: string })
     | (EntryMatchAny & { id?: string })
     | (EntryExists & { id?: string })
   >;
@@ -108,6 +110,7 @@ export type BuilderEntryNested = Omit<EntryNested, 'entries'> & {
   id?: string;
   entries: Array<
     | (EntryMatch & { id?: string })
+    | (EntryMatchWildcard & { id?: string })
     | (EntryMatchAny & { id?: string })
     | (EntryExists & { id?: string })
   >;

x-pack/plugins/security_solution/public/management/pages/trusted_apps/view/components/condition_entry_input/index.test.tsx

@@ -21,7 +21,7 @@ let onRemoveMock: jest.Mock;
 let onChangeMock: jest.Mock;
 let onVisitedMock: jest.Mock;
 
-const entry: Readonly<ConditionEntry> = {
+const baseEntry: Readonly<ConditionEntry> = {
   field: ConditionEntryField.HASH,
   type: 'match',
   operator: 'included',
@@ -38,7 +38,8 @@ describe('Condition entry input', () => {
   const getElement = (
     subject: string,
     os: OperatingSystem = OperatingSystem.WINDOWS,
-    isRemoveDisabled: boolean = false
+    isRemoveDisabled: boolean = false,
+    entry: ConditionEntry = baseEntry
   ) => (
     <ConditionEntryInput
       os={os}
@@ -64,10 +65,10 @@ describe('Condition entry input', () => {
       expect(onChangeMock).toHaveBeenCalledTimes(1);
       expect(onChangeMock).toHaveBeenCalledWith(
         {
-          ...entry,
+          ...baseEntry,
           field: { target: { value: field } },
         },
-        entry
+        baseEntry
       );
     }
   );
@@ -77,7 +78,7 @@ describe('Condition entry input', () => {
     expect(onRemoveMock).toHaveBeenCalledTimes(0);
     element.find('[data-test-subj="testOnRemove-remove"]').first().simulate('click');
     expect(onRemoveMock).toHaveBeenCalledTimes(1);
-    expect(onRemoveMock).toHaveBeenCalledWith(entry);
+    expect(onRemoveMock).toHaveBeenCalledWith(baseEntry);
   });
 
   it('should not be able to call on remove for field input because disabled', () => {
@@ -92,7 +93,7 @@ describe('Condition entry input', () => {
     expect(onVisitedMock).toHaveBeenCalledTimes(0);
     element.find('[data-test-subj="testOnVisited-value"]').first().simulate('blur');
     expect(onVisitedMock).toHaveBeenCalledTimes(1);
-    expect(onVisitedMock).toHaveBeenCalledWith(entry);
+    expect(onVisitedMock).toHaveBeenCalledWith(baseEntry);
   });
 
   it('should change value for field input', () => {
@@ -105,10 +106,10 @@ describe('Condition entry input', () => {
     expect(onChangeMock).toHaveBeenCalledTimes(1);
     expect(onChangeMock).toHaveBeenCalledWith(
       {
-        ...entry,
+        ...baseEntry,
         value: 'new value',
       },
-      entry
+      baseEntry
     );
   });
 
@@ -138,4 +139,24 @@ describe('Condition entry input', () => {
       .props() as EuiSuperSelectProps<string>;
     expect(superSelectProps.options.length).toBe(2);
   });
+
+  it('should have operator value selected when field is HASH', () => {
+    const element = shallow(getElement('testOperatorOptions'));
+    const inputField = element.find('[data-test-subj="testOperatorOptions-operator"]');
+    expect(inputField.contains('is'));
+  });
+
+  it('should show operator dorpdown with two values when field is PATH', () => {
+    const element = shallow(
+      getElement('testOperatorOptions', undefined, undefined, {
+        ...baseEntry,
+        field: ConditionEntryField.PATH,
+      })
+    );
+    const superSelectProps = element
+      .find('[data-test-subj="testOperatorOptions-operator"]')
+      .first()
+      .props() as EuiSuperSelectProps<string>;
+    expect(superSelectProps.options.length).toBe(2);
+  });
 });