Stage/v5.11.0 (#655)

* docs: fix certify and rubeus commands (#646)

* refactor: abstract static handler + move RemoteContent to BHE (#651)

* Bed 4464: Update pre-saved queries (#654)

* Update pre-defined queries

* Typos

* Update pre-defined queries

* Typos

* updates

* typos, round 2

* too many typos

---------

Co-authored-by: Jonas Bülow Knudsen <12843299+JonasBK@users.noreply.github.com>
Co-authored-by: mistahj67 <26472282+mistahj67@users.noreply.github.com>
Co-authored-by: Stephen Hinck <shinck@specterops.io>

cmd/api/src/api/registration/registration.go

@@ -74,7 +74,7 @@ func RegisterFossRoutes(
 		}),
 
 		// Static asset handling for the UI
-		routerInst.PathPrefix("/ui", static.Handler()),
+		routerInst.PathPrefix("/ui", static.AssetHandler),
 	)
 
 	var resources = v2.NewResources(rdms, graphDB, cfg, apiCache, graphQuery, collectorManifests, taskNotifier, authorizer)

cmd/api/src/api/static/assets.go

@@ -0,0 +1,21 @@
+package static
+
+import (
+	"embed"
+	"github.com/specterops/bloodhound/src/api"
+)
+
+const (
+	assetBasePath  = "assets"
+	indexAssetPath = "index.html"
+)
+
+//go:embed assets
+var assets embed.FS
+
+var AssetHandler = MakeAssetHandler(AssetConfig{
+	FS: assets,
+	BasePath: assetBasePath,
+	IndexPath: indexAssetPath,
+	PrefixPath: api.UserInterfacePath,
+})

cmd/api/src/api/static/static.go

@@ -1,23 +1,22 @@
 // Copyright 2023 Specter Ops, Inc.
-// 
+//
 // Licensed under the Apache License, Version 2.0
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// 
+//
 //     http://www.apache.org/licenses/LICENSE-2.0
-// 
+//
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-// 
+//
 // SPDX-License-Identifier: Apache-2.0
 
 package static
 
 import (
-	"embed"
 	"io"
 	"io/fs"
 	"mime"
@@ -27,49 +26,51 @@ import (
 
 	"github.com/specterops/bloodhound/src/utils"
 
-	"github.com/specterops/bloodhound/src/api"
 	"github.com/specterops/bloodhound/headers"
 	"github.com/specterops/bloodhound/log"
+	"github.com/specterops/bloodhound/src/api"
 )
 
-const (
-	assetBasePath  = "assets"
-	indexAssetPath = "index.html"
-)
+type AssetConfig struct {
+	FS         fs.FS
+	PrefixPath string
+	BasePath   string
+	IndexPath  string
+}
 
-//go:embed assets
-var assets embed.FS
+func MakeAssetHandler(cfg AssetConfig) http.Handler {
+	return http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
+		serve(cfg, response, request)
+	})
+}
 
 // fetchAsset will attempt to find a static asset at the given path. If the asset does not exist, fetchAsset will instead
 // return the index.html asset. This is done because the UI will change with the browser URI depending on the UI view.
 // This results in the browser asking for assets that do not exist upon browser refresh.
-func fetchAsset(fs fs.FS, assetPath string) (io.ReadCloser, error) {
-	if fin, err := fs.Open(filepath.Join(assetBasePath, assetPath)); err != nil {
-		return fs.Open(filepath.Join(assetBasePath, indexAssetPath))
+func fetchAsset(cfg AssetConfig, assetPath string) (io.ReadCloser, error) {
+	if fin, err := cfg.FS.Open(filepath.Join(cfg.BasePath, assetPath)); err != nil {
+		if cfg.IndexPath != "" {
+			return cfg.FS.Open(filepath.Join(cfg.BasePath, cfg.IndexPath))
+		}
+		return nil, err
 	} else {
 		return fin, nil
 	}
 }
 
-func Handler() http.Handler {
-	return http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
-		serve(assets, response, request)
-	})
-}
-
-func serve(fs fs.FS, response http.ResponseWriter, request *http.Request) {
+func serve(cfg AssetConfig, response http.ResponseWriter, request *http.Request) {
 	var (
 		// Strip off the ui path prefix from the request URI path
-		assetPath = strings.TrimPrefix(request.RequestURI, api.UserInterfacePath)
+		assetPath = strings.TrimPrefix(request.RequestURI, cfg.PrefixPath)
 	)
 
 	// Rewrite references to root as "index.html" - without this, the embed.FS will happily return a "directory" FD
 	// instead of failing to open the path
 	if assetPath == "" || assetPath == "/" {
-		assetPath = indexAssetPath
+		assetPath = cfg.IndexPath
 	}
 
-	if fin, err := fetchAsset(fs, assetPath); err != nil {
+	if fin, err := fetchAsset(cfg, assetPath); err != nil {
 		api.WriteErrorResponse(request.Context(), api.BuildErrorResponse(http.StatusNotFound, api.ErrorResponseDetailsResourceNotFound, request), response)
 	} else {
 		defer fin.Close()

cmd/api/src/api/static/static_internal_test.go

@@ -1,22 +1,23 @@
 // Copyright 2023 Specter Ops, Inc.
-// 
+//
 // Licensed under the Apache License, Version 2.0
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
-// 
+//
 //     http://www.apache.org/licenses/LICENSE-2.0
-// 
+//
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
-// 
+//
 // SPDX-License-Identifier: Apache-2.0
 
 package static
 
 import (
+	"github.com/specterops/bloodhound/src/api"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -28,79 +29,85 @@ import (
 	"go.uber.org/mock/gomock"
 )
 
-func TestHandler(t *testing.T) {
+func TestBHCEStaticHandler(t *testing.T) {
 	const expectedOutput = "test"
 
 	var (
 		mockController      = gomock.NewController(t)
 		assetsTestMockFile  = fs.NewMockFile(mockController)
 		assetsIndexMockFile = fs.NewMockFile(mockController)
 		mockFS              = fs.NewMockFS(mockController)
-		handler             = http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
-			serve(mockFS, response, request)
-		})
-	)
-
-	assetsIndexMockFile.EXPECT().Read(gomock.AssignableToTypeOf([]byte{})).DoAndReturn(func(target []byte) (int, error) {
-		for idx, b := range []byte(expectedOutput) {
-			target[idx] = b
+		mockAssetCfg        = AssetConfig{
+			FS:         mockFS,
+			BasePath:   assetBasePath,
+			IndexPath:  indexAssetPath,
+			PrefixPath: api.UserInterfacePath,
 		}
+		handler = MakeAssetHandler(mockAssetCfg)
+	)
 
-		return len(expectedOutput), io.EOF
-	}).Times(2)
-	assetsIndexMockFile.EXPECT().Close().Times(2)
+	t.Run("Test case for an asset that exists", func(t *testing.T) {
+		assetsTestMockFile.EXPECT().Read(gomock.AssignableToTypeOf([]byte{})).DoAndReturn(func(target []byte) (int, error) {
+			for idx, b := range []byte(expectedOutput) {
+				target[idx] = b
+			}
 
-	assetsTestMockFile.EXPECT().Read(gomock.AssignableToTypeOf([]byte{})).DoAndReturn(func(target []byte) (int, error) {
-		for idx, b := range []byte(expectedOutput) {
-			target[idx] = b
-		}
+			return len(expectedOutput), io.EOF
+		})
+		mockFS.EXPECT().Open(gomock.Eq("assets/test")).Return(assetsTestMockFile, nil)
+		assetsTestMockFile.EXPECT().Close()
 
-		return len(expectedOutput), io.EOF
-	})
-	assetsTestMockFile.EXPECT().Close()
+		if req, err := http.NewRequest("GET", "", nil); err != nil {
+			t.Fatalf("Failed to create request: %v", err)
+		} else {
+			response := httptest.NewRecorder()
 
-	mockFS.EXPECT().Open(gomock.Eq("assets/test")).Return(assetsTestMockFile, nil)
-	mockFS.EXPECT().Open(gomock.Eq("assets/missing")).Return(nil, os.ErrNotExist)
-	mockFS.EXPECT().Open(gomock.Eq("assets/index.html")).Return(assetsIndexMockFile, nil)
+			req.RequestURI = "/ui/test"
 
-	// Test case for an asset that exists
-	if req, err := http.NewRequest("GET", "http://example.com/ui/test", nil); err != nil {
-		t.Fatalf("Failed to create request: %v", err)
-	} else {
-		response := httptest.NewRecorder()
+			handler.ServeHTTP(response, req)
+			require.Equal(t, http.StatusOK, response.Code)
+			require.Equal(t, response.Body.String(), expectedOutput)
+		}
+	})
 
-		req.RequestURI = "/ui/test"
+	t.Run("Mocks for index fallback in asset does not exist cases", func(t *testing.T) {
+		assetsIndexMockFile.EXPECT().Read(gomock.AssignableToTypeOf([]byte{})).DoAndReturn(func(target []byte) (int, error) {
+			for idx, b := range []byte(expectedOutput) {
+				target[idx] = b
+			}
 
-		handler.ServeHTTP(response, req)
-		require.Equal(t, http.StatusOK, response.Code)
-		require.Equal(t, response.Body.String(), expectedOutput)
-	}
+			return len(expectedOutput), io.EOF
+		}).Times(2)
+		mockFS.EXPECT().Open(gomock.Eq("assets/index.html")).Return(assetsIndexMockFile, nil).Times(2)
+		assetsIndexMockFile.EXPECT().Close().Times(2)
 
-	// Test case for an asset that does not exist
-	if req, err := http.NewRequest("GET", "http://example.com/ui/missing", nil); err != nil {
-		t.Fatalf("Failed to create request: %v", err)
-	} else {
-		response := httptest.NewRecorder()
+		// Test case for an asset that does not exist
+		mockFS.EXPECT().Open(gomock.Eq("assets/missing")).Return(nil, os.ErrNotExist)
 
-		req.RequestURI = "/ui/missing"
+		if req, err := http.NewRequest("GET", "", nil); err != nil {
+			t.Fatalf("Failed to create request: %v", err)
+		} else {
+			response := httptest.NewRecorder()
 
-		handler.ServeHTTP(response, req)
-		require.Equal(t, http.StatusOK, response.Code)
-		require.Equal(t, response.Body.String(), expectedOutput)
-	}
+			req.RequestURI = "/ui/missing"
 
-	mockFS.EXPECT().Open(gomock.Eq("assets/index.html")).Return(assetsIndexMockFile, nil)
+			handler.ServeHTTP(response, req)
+			require.Equal(t, http.StatusOK, response.Code)
+			require.Equal(t, response.Body.String(), expectedOutput)
+		}
+	})
 
-	// Test case for an asset that does not exist
-	if req, err := http.NewRequest("GET", "http://example.com/ui/", nil); err != nil {
-		t.Fatalf("Failed to create request: %v", err)
-	} else {
-		response := httptest.NewRecorder()
+	t.Run("Test case for an asset that does not exist", func(t *testing.T) {
+		if req, err := http.NewRequest("GET", "", nil); err != nil {
+			t.Fatalf("Failed to create request: %v", err)
+		} else {
+			response := httptest.NewRecorder()
 
-		req.RequestURI = "/ui/"
+			req.RequestURI = "/ui/"
 
-		handler.ServeHTTP(response, req)
-		require.Equal(t, http.StatusOK, response.Code)
-		require.Equal(t, response.Body.String(), expectedOutput)
-	}
+			handler.ServeHTTP(response, req)
+			require.Equal(t, http.StatusOK, response.Code)
+			require.Equal(t, response.Body.String(), expectedOutput)
+		}
+	})
 }

cmd/api/src/go.mod

@@ -89,7 +89,6 @@ require (
 	github.com/prometheus/common v0.44.0 // indirect
 	github.com/prometheus/procfs v0.11.0 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	golang.org/x/mod v0.17.0 // indirect
 	golang.org/x/sys v0.21.0 // indirect
 	golang.org/x/text v0.16.0 // indirect
 	golang.org/x/time v0.3.0 // indirect