[Security Solution][Endpoint] Allow wildcard in trusted app paths

api_docs/security_solution.json

@@ -207,7 +207,7 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/security_solution/public/plugin.tsx",
-                  "lineNumber": 353
+                  "lineNumber": 346
                 }
               },
               {
@@ -221,15 +221,15 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/security_solution/public/plugin.tsx",
-                  "lineNumber": 353
+                  "lineNumber": 346
                 }
               }
             ],
             "tags": [],
             "returnComment": [],
             "source": {
               "path": "x-pack/plugins/security_solution/public/plugin.tsx",
-              "lineNumber": 353
+              "lineNumber": 346
             }
           },
           {
@@ -245,7 +245,7 @@
             "returnComment": [],
             "source": {
               "path": "x-pack/plugins/security_solution/public/plugin.tsx",
-              "lineNumber": 398
+              "lineNumber": 391
             }
           }
         ],
@@ -276,7 +276,7 @@
           "description": [],
           "source": {
             "path": "x-pack/plugins/security_solution/public/types.ts",
-            "lineNumber": 69
+            "lineNumber": 68
           },
           "signature": [
             "() => Promise<",
@@ -287,7 +287,7 @@
       ],
       "source": {
         "path": "x-pack/plugins/security_solution/public/types.ts",
-        "lineNumber": 68
+        "lineNumber": 67
       },
       "lifecycle": "setup",
       "initialIsOpen": true
@@ -301,7 +301,7 @@
       "children": [],
       "source": {
         "path": "x-pack/plugins/security_solution/public/types.ts",
-        "lineNumber": 72
+        "lineNumber": 71
       },
       "lifecycle": "start",
       "initialIsOpen": true
@@ -453,15 +453,15 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 147
+                  "lineNumber": 145
                 }
               }
             ],
             "tags": [],
             "returnComment": [],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 147
+              "lineNumber": 145
             }
           },
           {
@@ -521,7 +521,7 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 159
+                  "lineNumber": 157
                 }
               },
               {
@@ -535,15 +535,15 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 159
+                  "lineNumber": 157
                 }
               }
             ],
             "tags": [],
             "returnComment": [],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 159
+              "lineNumber": 157
             }
           },
           {
@@ -582,7 +582,7 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 341
+                  "lineNumber": 338
                 }
               },
               {
@@ -596,15 +596,15 @@
                 "description": [],
                 "source": {
                   "path": "x-pack/plugins/security_solution/server/plugin.ts",
-                  "lineNumber": 341
+                  "lineNumber": 338
                 }
               }
             ],
             "tags": [],
             "returnComment": [],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 341
+              "lineNumber": 338
             }
           },
           {
@@ -620,13 +620,13 @@
             "returnComment": [],
             "source": {
               "path": "x-pack/plugins/security_solution/server/plugin.ts",
-              "lineNumber": 423
+              "lineNumber": 412
             }
           }
         ],
         "source": {
           "path": "x-pack/plugins/security_solution/server/plugin.ts",
-          "lineNumber": 131
+          "lineNumber": 129
         },
         "initialIsOpen": false
       }
@@ -1484,7 +1484,7 @@
       "children": [],
       "source": {
         "path": "x-pack/plugins/security_solution/server/plugin.ts",
-        "lineNumber": 107
+        "lineNumber": 105
       },
       "lifecycle": "setup",
       "initialIsOpen": true
@@ -1498,7 +1498,7 @@
       "children": [],
       "source": {
         "path": "x-pack/plugins/security_solution/server/plugin.ts",
-        "lineNumber": 110
+        "lineNumber": 108
       },
       "lifecycle": "start",
       "initialIsOpen": true

x-pack/plugins/lists/common/constants.mock.ts

@@ -51,6 +51,7 @@ export const OPERATOR_EXCLUDED = 'excluded';
 export const ENTRY_VALUE = 'some host name';
 export const MATCH = 'match';
 export const MATCH_ANY = 'match_any';
+export const WILDCARD = 'wildcard';
 export const MAX_IMPORT_PAYLOAD_BYTES = 9000000;
 export const IMPORT_BUFFER_SIZE = 1000;
 export const LIST = 'list';

x-pack/plugins/lists/common/schemas/common/schemas.ts

@@ -287,6 +287,7 @@ export enum OperatorTypeEnum {
   NESTED = 'nested',
   MATCH = 'match',
   MATCH_ANY = 'match_any',
+  WILDCARD = 'wildcard',
   EXISTS = 'exists',
   LIST = 'list',
 }

x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_wildcard.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../../shared_imports';
+import { operatorIncluded } from '../../common/schemas';
+
+export const endpointEntryMatchWildcard = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator: operatorIncluded,
+    type: t.keyof({ wildcard: null }),
+    value: NonEmptyString,
+  })
+);
+export type EndpointEntryMatchWildcard = t.TypeOf<typeof endpointEntryMatchWildcard>;

x-pack/plugins/lists/common/schemas/types/entries.ts

@@ -12,12 +12,28 @@ import { entriesMatch } from './entry_match';
 import { entriesExists } from './entry_exists';
 import { entriesList } from './entry_list';
 import { entriesNested } from './entry_nested';
+import { entriesMatchWildcard } from './entry_match_wildcard';
 
-export const entry = t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists]);
+// NOTE: Type nested is not included here to denote it's non-recursive nature.
+// So a nested entry is really just a collection of `Entry` types.
+export const entry = t.union([
+  entriesMatch,
+  entriesMatchAny,
+  entriesList,
+  entriesExists,
+  entriesMatchWildcard,
+]);
 export type Entry = t.TypeOf<typeof entry>;
 
 export const entriesArray = t.array(
-  t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists, entriesNested])
+  t.union([
+    entriesMatch,
+    entriesMatchAny,
+    entriesList,
+    entriesExists,
+    entriesNested,
+    entriesMatchWildcard,
+  ])
 );
 export type EntriesArray = t.TypeOf<typeof entriesArray>;
 

x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.mock.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ENTRY_VALUE, FIELD, OPERATOR, WILDCARD } from '../../constants.mock';
+
+import { EntryMatchWildcard } from './entry_match_wildcard';
+
+export const getEntryMatchWildcardMock = (): EntryMatchWildcard => ({
+  field: FIELD,
+  operator: OPERATOR,
+  type: WILDCARD,
+  value: ENTRY_VALUE,
+});
+
+export const getEntryMatchWildcardExcludeMock = (): EntryMatchWildcard => ({
+  ...getEntryMatchWildcardMock(),
+  operator: 'excluded',
+});

x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts

@@ -0,0 +1,106 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../shared_imports';
+
+import { getEntryMatchWildcardMock } from './entry_match_wildcard.mock';
+import { EntryMatchWildcard, entriesMatchWildcard } from './entry_match_wildcard';
+
+describe('entriesMatchWildcard', () => {
+  test('it should validate an entry', () => {
+    const payload = getEntryMatchWildcardMock();
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when operator is "included"', () => {
+    const payload = getEntryMatchWildcardMock();
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when "operator" is "excluded"', () => {
+    const payload = getEntryMatchWildcardMock();
+    payload.operator = 'excluded';
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should FAIL validation when "field" is empty string', () => {
+    const payload: Omit<EntryMatchWildcard, 'field'> & { field: string } = {
+      ...getEntryMatchWildcardMock(),
+      field: '',
+    };
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "field"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should FAIL validation when "value" is not string', () => {
+    const payload: Omit<EntryMatchWildcard, 'value'> & { value: string[] } = {
+      ...getEntryMatchWildcardMock(),
+      value: ['some value'],
+    };
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "["some value"]" supplied to "value"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should FAIL validation when "value" is empty string', () => {
+    const payload: Omit<EntryMatchWildcard, 'value'> & { value: string } = {
+      ...getEntryMatchWildcardMock(),
+      value: '',
+    };
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "value"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should FAIL validation when "type" is not "wildcard"', () => {
+    const payload: Omit<EntryMatchWildcard, 'type'> & { type: string } = {
+      ...getEntryMatchWildcardMock(),
+      type: 'match',
+    };
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "match" supplied to "type"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: EntryMatchWildcard & {
+      extraKey?: string;
+    } = getEntryMatchWildcardMock();
+    payload.extraKey = 'some value';
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getEntryMatchWildcardMock());
+  });
+});

x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../shared_imports';
+import { operator } from '../common/schemas';
+
+export const entriesMatchWildcard = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator,
+    type: t.keyof({ wildcard: null }),
+    value: NonEmptyString,
+  })
+);
+export type EntryMatchWildcard = t.TypeOf<typeof entriesMatchWildcard>;

x-pack/plugins/lists/common/schemas/types/index.ts

@@ -15,6 +15,7 @@ export * from './default_namespace';
 export * from './entries';
 export * from './entry_match';
 export * from './entry_match_any';
+export * from './entry_match_wildcard';
 export * from './entry_list';
 export * from './entry_exists';
 export * from './entry_nested';