Before the Files & Folders classes would actually create directories
such as "/tmp". Now that logic has been stripped away, these unit tests
throw errors as they should've for a long time already.
Finally introduce the per-user temporary directory usage, i.e., if
multiple users on a system run Cuckoo, they'll not share the same
temporary directory which would almost always break one of the two
setups.
Also slightly move the tmpdir verification (and creation!) as it was
called too early before. Namely, before the check_config() and other
similar code was executed, leaving us with odd errors.
Besides the fact that it is slow, it's also causing exceptions on one
specific "function(p,a,c,k,e,d){...}" payload as can be seen in the new
unit test. We should revisit the beautification once again later on, and
perhaps introduce those blobs as Extracted Artifacts.
Adds some CWD migrations and unit tests to #1791. Also replaces the
custom domain whitelist logic in the network.py processing module with
the already existing is_whitelisted_domain() method as well as fixes an
issue when calling is_whitelisted_domain() the first time.
Due to code refactoring a little while ago a vulnerability had been
introduced in the way that the Cuckoo API accepts submitted files.
Particularly, the /tasks/create/file API endpoint wouldn't properly
sanitize the filepath provided by the user.
Before validate_hash() would accept any string with the correct length
and strip out any non-alphabet characters basically, turning, e.g.,
"http://cuckoosandbox.org/1234567" (a URL with length 32) into
"httpcuckoosandboxorg1234567", which naturally isn't a valid hash.
* From now on we'll be masking URLs with hxxp:// & hxxps:// as per
the "industry standard" on not revealing a clickable URL directly.
* Represent archive analyses with the filename & archive name.
* Kill off a couple of path disclosure items that were in plain sight.
* Update to SFlock 0.2.5 which features a "filepath" sanitize flag.
* Properly merge analysis options provided by the Web Interface.
* Actually show the filename / URL in the postsubmission screen.
* Some minor tweaks.
Just in case we ever get to a stage where our current Signature version
criteria is not good enough (e.g., support for multiple major releases)
we will be able to provide backwards compatibility through the enable()
method. With the new Signature inheritance support it will be possible
to backport certain features into the Cuckoo Community repository
(again, if this will ever be necessary).
This merge commit also performs the following changes:
* Introduce "sanitize" flag for configuration values.
* Add "feedback" to configuration.
* Normalize configuration-related changes of the feedback module.
* Adjust unit tests to adhere to changes from this PR.
* Code cleanup.
Conflicts:
cuckoo/common/config.py
This commit has been manually verified to result in pretty much the same
configuration as we'd expect before this commit took place. It affects a
bit of the abstract Machinery class and as such introduces unit testing
in that area.
Aside from moving all default values to cuckoo/common/config.py and
reusing the *.conf files as jinja2 templates this commit also introduces
the concept of having, e.g., comma-separated, lists in *.conf files.
The only todo item with regards to configuration checking is ensuring
that all referenced sections in these section lists actually exist.
Due to the need of extra packages during the unit testing, namely the
responses library, we switch from invoking py.test directly to using
pytest-runner. This will transparently install any required unit testing
related packages for us.
Note that pytest-related libraries don't have hardcoded version numbers,
as those may already have been installed on continuous integration
servers (i.e., Travis CI) and therefore end up throwing around issues.
Also reintroduce the capability to provide a custom connection string to
the Database (which is possible now that making the connection is no
longer part of __init__).
Nex