[Security Solution][Endpoint] Allow wildcard in trusted app paths

x-pack/plugins/lists/common/constants.mock.ts

@@ -51,6 +51,7 @@ export const OPERATOR_EXCLUDED = 'excluded';
 export const ENTRY_VALUE = 'some host name';
 export const MATCH = 'match';
 export const MATCH_ANY = 'match_any';
+export const WILDCARD = 'wildcard';
 export const MAX_IMPORT_PAYLOAD_BYTES = 9000000;
 export const IMPORT_BUFFER_SIZE = 1000;
 export const LIST = 'list';

x-pack/plugins/lists/common/schemas/common/schemas.ts

@@ -287,6 +287,7 @@ export enum OperatorTypeEnum {
   NESTED = 'nested',
   MATCH = 'match',
   MATCH_ANY = 'match_any',
+  WILDCARD = 'wildcard',
   EXISTS = 'exists',
   LIST = 'list',
 }

x-pack/plugins/lists/common/schemas/types/endpoint/entry_match_wildcard.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../../shared_imports';
+import { operatorIncluded } from '../../common/schemas';
+
+export const endpointEntryMatchWildcard = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator: operatorIncluded,
+    type: t.keyof({ wildcard: null }),
+    value: NonEmptyString,
+  })
+);
+export type EndpointEntryMatchWildcard = t.TypeOf<typeof endpointEntryMatchWildcard>;

x-pack/plugins/lists/common/schemas/types/entries.ts

@@ -12,12 +12,26 @@ import { entriesMatch } from './entry_match';
 import { entriesExists } from './entry_exists';
 import { entriesList } from './entry_list';
 import { entriesNested } from './entry_nested';
+import { entriesMatchWildcard } from './entry_match_wildcard';
 
-export const entry = t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists]);
+export const entry = t.union([
+  entriesMatch,
+  entriesMatchAny,
+  entriesList,
+  entriesExists,
+  entriesMatchWildcard,
+]);
 export type Entry = t.TypeOf<typeof entry>;
 
 export const entriesArray = t.array(
-  t.union([entriesMatch, entriesMatchAny, entriesList, entriesExists, entriesNested])
+  t.union([
+    entriesMatch,
+    entriesMatchAny,
+    entriesList,
+    entriesExists,
+    entriesNested,
+    entriesMatchWildcard,
+  ])
 );
 export type EntriesArray = t.TypeOf<typeof entriesArray>;
 

x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.mock.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { ENTRY_VALUE, FIELD, OPERATOR, WILDCARD } from '../../constants.mock';
+
+import { EntryMatchWildcard } from './entry_match_wildcard';
+
+export const getEntryMatchWildcardMock = (): EntryMatchWildcard => ({
+  field: FIELD,
+  operator: OPERATOR,
+  type: WILDCARD,
+  value: ENTRY_VALUE,
+});
+
+export const getEntryMatchWildcardExcludeMock = (): EntryMatchWildcard => ({
+  ...getEntryMatchWildcardMock(),
+  operator: 'excluded',
+});

x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.test.ts

@@ -0,0 +1,106 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import { pipe } from 'fp-ts/lib/pipeable';
+import { left } from 'fp-ts/lib/Either';
+
+import { foldLeftRight, getPaths } from '../../shared_imports';
+
+import { getEntryMatchWildcardMock } from './entry_match_wildcard.mock';
+import { EntryMatchWildcard, entriesMatchWildcard } from './entry_match_wildcard';
+
+describe('entriesMatchWildcard', () => {
+  test('it should validate an entry', () => {
+    const payload = getEntryMatchWildcardMock();
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when operator is "included"', () => {
+    const payload = getEntryMatchWildcardMock();
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should validate when "operator" is "excluded"', () => {
+    const payload = getEntryMatchWildcardMock();
+    payload.operator = 'excluded';
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(payload);
+  });
+
+  test('it should FAIL validation when "field" is empty string', () => {
+    const payload: Omit<EntryMatchWildcard, 'field'> & { field: string } = {
+      ...getEntryMatchWildcardMock(),
+      field: '',
+    };
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "field"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should FAIL validation when "value" is not string', () => {
+    const payload: Omit<EntryMatchWildcard, 'value'> & { value: string[] } = {
+      ...getEntryMatchWildcardMock(),
+      value: ['some value'],
+    };
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([
+      'Invalid value "["some value"]" supplied to "value"',
+    ]);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should FAIL validation when "value" is empty string', () => {
+    const payload: Omit<EntryMatchWildcard, 'value'> & { value: string } = {
+      ...getEntryMatchWildcardMock(),
+      value: '',
+    };
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "" supplied to "value"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should FAIL validation when "type" is not "wildcard"', () => {
+    const payload: Omit<EntryMatchWildcard, 'type'> & { type: string } = {
+      ...getEntryMatchWildcardMock(),
+      type: 'match',
+    };
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual(['Invalid value "match" supplied to "type"']);
+    expect(message.schema).toEqual({});
+  });
+
+  test('it should strip out extra keys', () => {
+    const payload: EntryMatchWildcard & {
+      extraKey?: string;
+    } = getEntryMatchWildcardMock();
+    payload.extraKey = 'some value';
+    const decoded = entriesMatchWildcard.decode(payload);
+    const message = pipe(decoded, foldLeftRight);
+
+    expect(getPaths(left(message.errors))).toEqual([]);
+    expect(message.schema).toEqual(getEntryMatchWildcardMock());
+  });
+});

x-pack/plugins/lists/common/schemas/types/entry_match_wildcard.ts

@@ -0,0 +1,21 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import * as t from 'io-ts';
+
+import { NonEmptyString } from '../../shared_imports';
+import { operator } from '../common/schemas';
+
+export const entriesMatchWildcard = t.exact(
+  t.type({
+    field: NonEmptyString,
+    operator,
+    type: t.keyof({ wildcard: null }),
+    value: NonEmptyString,
+  })
+);
+export type EntryMatchWildcard = t.TypeOf<typeof entriesMatchWildcard>;

x-pack/plugins/lists/common/schemas/types/index.ts

@@ -15,6 +15,7 @@ export * from './default_namespace';
 export * from './entries';
 export * from './entry_match';
 export * from './entry_match_any';
+export * from './entry_match_wildcard';
 export * from './entry_list';
 export * from './entry_exists';
 export * from './entry_nested';

x-pack/plugins/lists/common/shared_exports.ts

@@ -20,6 +20,7 @@ export {
   EntryExists,
   EntryMatch,
   EntryMatchAny,
+  EntryMatchWildcard,
   EntryNested,
   EntryList,
   EntriesArray,
@@ -39,6 +40,7 @@ export {
   nestedEntryItem,
   entriesMatch,
   entriesMatchAny,
+  entriesMatchWildcard,
   entriesExists,
   entriesList,
   namespaceType,

x-pack/plugins/lists/public/exceptions/components/builder/helpers.ts

@@ -591,7 +591,7 @@ export const getEntryOnOperatorChange = (
           },
           ...parent.parent.entries.slice(entryIndex + 1),
         ],
-      },
+      } as BuilderEntry,
     };
   } else {
     return { index: entryIndex, updatedEntry: newEntry };

x-pack/plugins/lists/public/exceptions/components/builder/types.ts

@@ -13,6 +13,7 @@ import {
   EntryExists,
   EntryMatch,
   EntryMatchAny,
+  EntryMatchWildcard,
   EntryNested,
   ExceptionListItemSchema,
   OperatorEnum,
@@ -34,7 +35,7 @@ export interface EmptyEntry {
   id: string;
   field: string | undefined;
   operator: OperatorEnum;
-  type: OperatorTypeEnum.MATCH | OperatorTypeEnum.MATCH_ANY;
+  type: OperatorTypeEnum.MATCH | OperatorTypeEnum.MATCH_ANY | OperatorTypeEnum.WILDCARD;
   value: string | string[] | undefined;
 }
 
@@ -53,6 +54,7 @@ export interface EmptyNestedEntry {
   entries: Array<
     | (EntryMatch & { id?: string })
     | (EntryMatchAny & { id?: string })
+    | (EntryMatchWildcard & { id?: string })
     | (EntryExists & { id?: string })
   >;
 }
@@ -69,6 +71,7 @@ export type BuilderEntryNested = Omit<EntryNested, 'entries'> & {
   entries: Array<
     | (EntryMatch & { id?: string })
     | (EntryMatchAny & { id?: string })
+    | (EntryMatchWildcard & { id?: string })
     | (EntryExists & { id?: string })
   >;
 };

x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.test.ts

@@ -247,6 +247,30 @@ describe('When invoking Trusted Apps Schema', () => {
         expect(() => body.validate(bodyMsg)).not.toThrow();
       });
 
+      it('should validate `entry.type` does not accept `wildcard` when field is NOT PATH', () => {
+        const bodyMsg = createNewTrustedApp({
+          entries: [
+            createConditionEntry({
+              field: ConditionEntryField.HASH,
+              type: 'wildcard',
+            }),
+          ],
+        });
+        expect(() => body.validate(bodyMsg)).toThrow();
+      });
+
+      it('should validate `entry.type` accepts `wildcard` when field is PATH', () => {
+        const bodyMsg = createNewTrustedApp({
+          entries: [
+            createConditionEntry({
+              field: ConditionEntryField.PATH,
+              type: 'wildcard',
+            }),
+          ],
+        });
+        expect(() => body.validate(bodyMsg)).not.toThrow();
+      });
+
       it('should validate `entry.value` required', () => {
         const { value, ...entry } = createConditionEntry();
         expect(() => body.validate(createNewTrustedApp({ entries: [entry] }))).toThrow();

x-pack/plugins/security_solution/common/endpoint/schema/trusted_apps.ts

@@ -29,8 +29,13 @@ export const GetTrustedAppsRequestSchema = {
   }),
 };
 
-const ConditionEntryTypeSchema = schema.literal('match');
-const ConditionEntryOperatorSchema = schema.literal('included');
+const ConditionEntryTypeSchema = schema.conditional(
+  schema.siblingRef('field'),
+  ConditionEntryField.PATH,
+  schema.oneOf([schema.literal('match'), schema.literal('wildcard')]),
+  schema.literal('match')
+);
+const ConditionEntryOperatorSchema = schema.literal('included' as ConditionEntry['operator']);
 
 /*
  * A generic Entry schema to be used for a specific entry schema depending on the OS

x-pack/plugins/security_solution/common/endpoint/types/trusted_apps.ts

@@ -7,6 +7,7 @@
 
 import { TypeOf } from '@kbn/config-schema';
 import { ApplicationStart } from 'kibana/public';
+
 import {
   DeleteTrustedAppsRequestSchema,
   GetOneTrustedAppRequestSchema,
@@ -69,9 +70,15 @@ export enum ConditionEntryField {
   SIGNER = 'process.Ext.code_signature',
 }
 
+export enum OperatorFieldIds {
+  is = 'is',
+  matches = 'matches',
+}
+
+export type TrustedAppEntryTypes = 'match' | 'wildcard';
 export interface ConditionEntry<T extends ConditionEntryField = ConditionEntryField> {
   field: T;
-  type: 'match';
+  type: TrustedAppEntryTypes;
   operator: 'included';
   value: string;
 }

x-pack/plugins/security_solution/common/shared_imports.ts

@@ -20,6 +20,7 @@ export {
   EntryExists,
   EntryMatch,
   EntryMatchAny,
+  EntryMatchWildcard,
   EntryNested,
   EntryList,
   EntriesArray,
@@ -38,6 +39,7 @@ export {
   nestedEntryItem,
   entriesMatch,
   entriesMatchAny,
+  entriesMatchWildcard,
   entriesExists,
   entriesList,
   namespaceType,

x-pack/plugins/security_solution/public/common/components/exceptions/types.ts

@@ -15,6 +15,7 @@ import {
   Entry,
   EntryMatch,
   EntryMatchAny,
+  EntryMatchWildcard,
   EntryExists,
   ExceptionListItemSchema,
   CreateExceptionListItemSchema,
@@ -92,6 +93,7 @@ export interface EmptyNestedEntry {
   type: OperatorTypeEnum.NESTED;
   entries: Array<
     | (EntryMatch & { id?: string })
+    | (EntryMatchWildcard & { id?: string })
     | (EntryMatchAny & { id?: string })
     | (EntryExists & { id?: string })
   >;
@@ -108,6 +110,7 @@ export type BuilderEntryNested = Omit<EntryNested, 'entries'> & {
   id?: string;
   entries: Array<
     | (EntryMatch & { id?: string })
+    | (EntryMatchWildcard & { id?: string })
     | (EntryMatchAny & { id?: string })
     | (EntryExists & { id?: string })
   >;