CSEC_PUBLIC/WELA
1
0 Fork 0
mirror of https://github.com/Yamato-Security/WELA.git synced 2026-10-24 15:08:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

Accept native UInt16 CIM domain roles in registry probe preflight

Browse Source
This commit is contained in:
Shirofune-Security committed 2026-09-22 15:32:00 +09:00
1 parent 7e1b076254
commit 32cfb460a2
2 files changed
+11 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/RegistryValueProbe.Tests.ps1
+4
View File
@@ -16,6 +16,10 @@ function Xml {
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"><System><Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}"/><EventID>4657</EventID><Version>0</Version><Level>0</Level><Task>12801</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime="2026-09-21T00:00:00.0001500Z"/><EventRecordID>11</EventRecordID><Channel>Security</Channel><Computer>FIXTURE</Computer></System><EventData><Data Name="SubjectUserSid">S-1-5-21-1-2-3-1001</Data><Data Name="SubjectUserName">Reader</Data><Data Name="SubjectDomainName">FIXTURE</Data><Data Name="SubjectLogonId">0x1234</Data><Data Name="ObjectName">\REGISTRY\USER\S-1-5-21-1-2-3-1001\Software\WELA\AuditProbe</Data><Data Name="ObjectValueName">$($script:operation.Native.Name)</Data><Data Name="HandleId">0x888</Data><Data Name="OperationType">%%1905</Data><Data Name="OldValueType">%%1873</Data><Data Name="OldValue">$($script:operation.Native.BeforeValue)</Data><Data Name="NewValueType">%%1873</Data><Data Name="NewValue">$($script:operation.Native.AfterValue)</Data><Data Name="ProcessId">0x4d2</Data><Data Name="ProcessName">C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe</Data></EventData></Event>
"@
}
# The live CIM schema uses UInt16; JSON fixtures normalize numbers to Int32.
foreach($role in @([uint16]2,[int]2)) {Assert-WelaRegistryValueProbeComputerRole ([pscustomobject]@{DomainRole=$role;PartOfDomain=$false});Assert $true 'Native UInt16 and normalized Int32 roles are accepted.'}
foreach($role in @($null,$true,'2',2.5,6,-1)) {Reject {Assert-WelaRegistryValueProbeComputerRole ([pscustomobject]@{DomainRole=$role;PartOfDomain=$false})}}
Reject {Assert-WelaRegistryValueProbeComputerRole ([pscustomobject]@{DomainRole=[uint16]2;PartOfDomain='false'})}
Fixture;$null=Get-WelaRegistryValueProbeStateKey $script:state;Assert-WelaRegistryValueProbeOperation $script:operation $script:state;Assert $true 'Complete fixed-key operation with cleanup is accepted.'
foreach($bad in @('path','mask','precedence','channel','role','group','inherit-only','failure','callback','right','descriptor','sources','token')){
Fixture