arian/anubis-mirror
1
0
Fork 0
mirror of https://github.com/TecharoHQ/anubis.git synced 2026-04-11 02:58:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: rename and/or to all/any

Browse Source 
Signed-off-by: Xe Iaso <me@xeiaso.net>
This commit is contained in:
Xe Iaso
2025-04-25 10:52:45 -04:00
parent 65cbc6922c
commit 92a3e5ba81
10 changed files with 41 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
data/apps/git-client.yaml
View File

@@ -1,7 +1,14 @@
- name: allow-git-clients
action: ALLOW
expression:
and:
- userAgent.startsWith("git/") || userAgent.contains("libgit") || userAgent.startsWith("go-git") || userAgent.startsWith("JGit/") || userAgent.startsWith("JGit-")
all:
- >
"Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"
(
userAgent.startsWith("git/") ||
userAgent.contains("libgit") ||
userAgent.startsWith("go-git") ||
userAgent.startsWith("JGit/") ||
userAgent.startsWith("JGit-")
)
- '"Git-Protocol" in headers'
- headers["Git-Protocol"] == "version=2"

2
data/clients/go-get.yaml
View File

@@ -1,7 +1,7 @@
- name: go-get
action: ALLOW
expression:
and:
all:
- userAgent.startsWith("Go-http-client/")
- '"go-get" in query'
- query["go-get"] == "1"

2
data/common/allow-api-like.yaml
View File

@@ -1,6 +1,6 @@
- name: allow-api-routes
action: ALLOW
expression:
and:
all:
- '!(method == "HEAD" || method == "GET")'
- path.startsWith("/api/")

15
lib/policy/celchecker.go
View File

@@ -28,18 +28,23 @@ func NewCELChecker(cfg *config.ExpressionOrList) (*CELChecker, error) {
if cfg.Expression != "" {
src = cfg.Expression
var iss *cel.Issues
ast, iss = env.Compile(src)
interm, iss := env.Compile(src)
if iss != nil {
return nil, iss.Err()
}
ast, iss = env.Check(interm)
if iss != nil {
return nil, iss.Err()
}
}
if len(cfg.And) != 0 {
ast, err = expressions.Join(env, expressions.JoinAnd, cfg.And...)
if len(cfg.All) != 0 {
ast, err = expressions.Join(env, expressions.JoinAnd, cfg.All...)
}
if len(cfg.Or) != 0 {
ast, err = expressions.Join(env, expressions.JoinOr, cfg.Or...)
if len(cfg.Any) != 0 {
ast, err = expressions.Join(env, expressions.JoinOr, cfg.Any...)
}
if err != nil {

14
lib/policy/config/expressionorlist.go
View File

@@ -14,8 +14,8 @@ var (
type ExpressionOrList struct {
Expression string `json:"-"`
And []string `json:"and"`
Or []string `json:"or"`
All []string `json:"all"`
Any []string `json:"any"`
}
func (eol ExpressionOrList) Equal(rhs *ExpressionOrList) bool {
@@ -23,11 +23,11 @@ func (eol ExpressionOrList) Equal(rhs *ExpressionOrList) bool {
return false
}
if !slices.Equal(eol.And, rhs.And) {
if !slices.Equal(eol.All, rhs.All) {
return false
}
if !slices.Equal(eol.Or, rhs.Or) {
if !slices.Equal(eol.Any, rhs.Any) {
return false
}
@@ -44,8 +44,8 @@ func (eol *ExpressionOrList) UnmarshalJSON(data []byte) error {
if err := json.Unmarshal(data, &val); err != nil {
return err
}
eol.And = val.And
eol.Or = val.Or
eol.All = val.All
eol.Any = val.Any
return nil
}
@@ -54,7 +54,7 @@ func (eol *ExpressionOrList) UnmarshalJSON(data []byte) error {
}
func (eol *ExpressionOrList) Valid() error {
if len(eol.And) != 0 && len(eol.Or) != 0 {
if len(eol.All) != 0 && len(eol.Any) != 0 {
return ErrExpressionCantHaveBoth
}

12
lib/policy/config/expressionorlist_test.go
View File

@@ -24,10 +24,10 @@ func TestExpressionOrListUnmarshal(t *testing.T) {
{
name: "object-and",
inp: `{
"and": ["\"User-Agent\" in headers"]
"all": ["\"User-Agent\" in headers"]
}`,
result: &ExpressionOrList{
And: []string{
All: []string{
`"User-Agent" in headers`,
},
},
@@ -35,10 +35,10 @@ func TestExpressionOrListUnmarshal(t *testing.T) {
{
name: "object-or",
inp: `{
"or": ["\"User-Agent\" in headers"]
"any": ["\"User-Agent\" in headers"]
}`,
result: &ExpressionOrList{
Or: []string{
Any: []string{
`"User-Agent" in headers`,
},
},
@@ -46,8 +46,8 @@ func TestExpressionOrListUnmarshal(t *testing.T) {
{
name: "both-or-and",
inp: `{
"and": ["\"User-Agent\" in headers"],
"or": ["\"User-Agent\" in headers"]
"all": ["\"User-Agent\" in headers"],
"any": ["\"User-Agent\" in headers"]
}`,
validErr: ErrExpressionCantHaveBoth,
},

4
lib/policy/config/testdata/bad/multiple_expression_types.json vendored
View File

@@ -4,11 +4,11 @@
"name": "multiple-expression-types",
"action": "ALLOW",
"expression": {
"and": [
"all": [
"userAgent.startsWith(\"git/\") || userAgent.contains(\"libgit\")",
"\"Git-Protocol\" in headers && headers[\"Git-Protocol\"] == \"version=2\"\n"
],
"or": [
"any": [
"userAgent.startsWith(\"evilbot/\")"
]
}

4
lib/policy/config/testdata/bad/multiple_expression_types.yaml vendored
View File

@@ -2,9 +2,9 @@ bots:
- name: multiple-expression-types
action: ALLOW
expression:
and:
all:
- userAgent.startsWith("git/") || userAgent.contains("libgit")
- >
"Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"
or:
any:
- userAgent.startsWith("evilbot/")

2
lib/policy/config/testdata/good/git_client.json vendored
View File

@@ -4,7 +4,7 @@
"name": "allow-git-clients",
"action": "ALLOW",
"expression": {
"and": [
"all": [
"userAgent.startsWith(\"git/\") || userAgent.contains(\"libgit\")",
"\"Git-Protocol\" in headers && headers[\"Git-Protocol\"] == \"version=2\""
]

2
lib/policy/config/testdata/good/git_client.yaml vendored
View File

@@ -2,7 +2,7 @@ bots:
- name: allow-git-clients
action: ALLOW
expression:
and:
all:
- userAgent.startsWith("git/") || userAgent.contains("libgit")
- >
"Git-Protocol" in headers && headers["Git-Protocol"] == "version=2"