From ecd8036dc024ff49842068e39999ea2a13245b68 Mon Sep 17 00:00:00 2001 From: Oliver Kieselbach Date: Thu, 18 Jun 2026 17:40:07 +0200 Subject: [PATCH] updated guardrails --- rules/scripts/combine.js | 6 +- .../lib/guardrails.generated.ts | 248 ------------------ .../utils/guardrails.generated.ts | 16 ++ 3 files changed, 21 insertions(+), 249 deletions(-) delete mode 100644 src/Web/autopilot-monitor-web/lib/guardrails.generated.ts diff --git a/rules/scripts/combine.js b/rules/scripts/combine.js index a74efcae..b95b3f6e 100644 --- a/rules/scripts/combine.js +++ b/rules/scripts/combine.js @@ -63,8 +63,12 @@ for (const config of configs) { // ── Guardrails generation ─────────────────────────────────────────────────── const guardrailsPath = path.join(rulesRoot, 'guardrails.json'); +// NOTE: consumers import from "@/utils/guardrails.generated" (see guardValidation.ts +// and SectionGatherRules.tsx). The web re-org (commit a3e8e044) moved this file to +// utils/ but left this output path pointing at the now-orphaned lib/ copy, which +// silently froze the live allowlist. Keep this in sync with the import path. const guardrailsOutput = path.resolve( - rulesRoot, '..', 'src', 'Web', 'autopilot-monitor-web', 'lib', 'guardrails.generated.ts' + rulesRoot, '..', 'src', 'Web', 'autopilot-monitor-web', 'utils', 'guardrails.generated.ts' ); if (fs.existsSync(guardrailsPath)) { diff --git a/src/Web/autopilot-monitor-web/lib/guardrails.generated.ts b/src/Web/autopilot-monitor-web/lib/guardrails.generated.ts deleted file mode 100644 index 1495c7b9..00000000 --- a/src/Web/autopilot-monitor-web/lib/guardrails.generated.ts +++ /dev/null @@ -1,248 +0,0 @@ -/** - * AUTO-GENERATED from rules/guardrails.json — DO NOT EDIT. - * Run: node rules/scripts/combine.js - */ - -// --------------------------------------------------------------------------- -// Categorized data (for documentation / UI display) -// --------------------------------------------------------------------------- - -export interface GuardrailCategory { - readonly category: string; - readonly items: readonly string[]; -} - -export const REGISTRY_PREFIX_CATEGORIES: readonly GuardrailCategory[] = [ - { - category: "MDM / Enrollment", - items: [ - "SOFTWARE\\Microsoft\\Enrollments", - "SOFTWARE\\Microsoft\\EnterpriseDesktopAppManagement", - "SOFTWARE\\Microsoft\\Provisioning", - "SOFTWARE\\Microsoft\\PolicyManager", - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\MDM", - ], - }, - { - category: "AAD / Entra Join", - items: [ - "SOFTWARE\\Microsoft\\IdentityStore", - "SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin", - ], - }, - { - category: "Windows Update / WUfB", - items: [ - "SOFTWARE\\Microsoft\\WindowsUpdate", - "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate", - ], - }, - { - category: "BitLocker", - items: [ - "SOFTWARE\\Microsoft\\BitLocker", - "SYSTEM\\CurrentControlSet\\Control\\BitLockerStatus", - ], - }, - { - category: "Network / Proxy", - items: [ - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", - "SYSTEM\\CurrentControlSet\\Services\\Tcpip", - ], - }, - { - category: "Autopilot / OOBE / Setup", - items: [ - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup", - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE", - "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", - ], - }, - { - category: "TPM", - items: [ - "SYSTEM\\CurrentControlSet\\Services\\TPM", - "SOFTWARE\\Microsoft\\Tpm", - ], - }, - { - category: "Secure Boot", - items: [ - "SYSTEM\\CurrentControlSet\\Control\\SecureBoot", - ], - }, - { - category: "Intune IME", - items: [ - "SOFTWARE\\Microsoft\\IntuneManagementExtension", - ], - }, - { - category: "Certificates (SCEP)", - items: [ - "SOFTWARE\\Microsoft\\SystemCertificates", - "SOFTWARE\\Policies\\Microsoft\\SystemCertificates", - ], - }, - { - category: "Servicing", - items: [ - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing", - ], - }, - { - category: "RealmJoin", - items: [ - "SYSTEM\\CurrentControlSet\\Services\\realmjoin", - "SOFTWARE\\RealmJoin", - ], - }, -]; - -export const COMMAND_CATEGORIES: readonly GuardrailCategory[] = [ - { - category: "TPM and Security", - items: [ - "Get-Tpm", - "Get-SecureBootPolicy", - "Get-SecureBootUEFI -Name SetupMode", - ], - }, - { - category: "BitLocker", - items: [ - "Get-BitLockerVolume -MountPoint C:", - ], - }, - { - category: "Network", - items: [ - "Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed", - "Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses", - "Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer", - "netsh winhttp show proxy", - "ipconfig /all", - ], - }, - { - category: "Domain / Identity", - items: [ - "nltest /dsgetdc:", - "dsregcmd /status", - ], - }, - { - category: "Certificate", - items: [ - "certutil -store My", - "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }", - ], - }, - { - category: "Windows Update", - items: [ - "Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description", - ], - }, - { - category: "Autopilot / Hardware Identity", - items: [ - "try { $cs = Get-CimInstance -ClassName Win32_ComputerSystem; $bios = Get-CimInstance -ClassName Win32_BIOS; $hash = $null; try { $hash = (Get-CimInstance -Namespace root/cimv2/mdm/dmmap -ClassName MDM_DevDetail_Ext01 -Filter \"InstanceID='Ext' AND ParentID='./DevDetail'\" -ErrorAction Stop).DeviceHardwareData } catch { $hash = \"ERROR: $($_.Exception.Message)\" }; [pscustomobject]@{ Manufacturer = $cs.Manufacturer; Model = $cs.Model; SystemSKU = $cs.SystemSKUNumber; SerialNumber = $bios.SerialNumber; BiosVersion = $bios.SMBIOSBIOSVersion; HardwareHash = $hash } | ConvertTo-Json -Compress } catch { @{ error = $_.Exception.Message } | ConvertTo-Json -Compress }", - ], - }, -]; - -// --------------------------------------------------------------------------- -// Flat arrays (for validation logic) -// --------------------------------------------------------------------------- - -export const ALLOWED_REGISTRY_PREFIXES: readonly string[] = [ - "SOFTWARE\\Microsoft\\Enrollments", - "SOFTWARE\\Microsoft\\EnterpriseDesktopAppManagement", - "SOFTWARE\\Microsoft\\Provisioning", - "SOFTWARE\\Microsoft\\PolicyManager", - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\MDM", - "SOFTWARE\\Microsoft\\IdentityStore", - "SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin", - "SOFTWARE\\Microsoft\\WindowsUpdate", - "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate", - "SOFTWARE\\Microsoft\\BitLocker", - "SYSTEM\\CurrentControlSet\\Control\\BitLockerStatus", - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings", - "SYSTEM\\CurrentControlSet\\Services\\Tcpip", - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup", - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE", - "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", - "SYSTEM\\CurrentControlSet\\Services\\TPM", - "SOFTWARE\\Microsoft\\Tpm", - "SYSTEM\\CurrentControlSet\\Control\\SecureBoot", - "SOFTWARE\\Microsoft\\IntuneManagementExtension", - "SOFTWARE\\Microsoft\\SystemCertificates", - "SOFTWARE\\Policies\\Microsoft\\SystemCertificates", - "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing", - "SYSTEM\\CurrentControlSet\\Services\\realmjoin", - "SOFTWARE\\RealmJoin", -]; - -export const ALLOWED_FILE_PREFIXES: readonly string[] = [ - "C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs", - "C:\\Windows\\CCM\\Logs", - "C:\\Windows\\Logs", - "C:\\Windows\\Panther", - "C:\\Windows\\SetupDiag", - "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP", - "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log", -]; - -export const ALLOWED_WMI_QUERY_PREFIXES: readonly string[] = [ - "SELECT * FROM Win32_OperatingSystem", - "SELECT * FROM Win32_ComputerSystem", - "SELECT * FROM Win32_BIOS", - "SELECT * FROM Win32_Processor", - "SELECT * FROM Win32_BaseBoard", - "SELECT * FROM Win32_Battery", - "SELECT * FROM Win32_TPM", - "SELECT * FROM Win32_NetworkAdapter", - "SELECT * FROM Win32_NetworkAdapterConfiguration", - "SELECT * FROM Win32_DiskDrive", - "SELECT * FROM Win32_LogicalDisk", - "SELECT * FROM SoftwareLicensingProduct", -]; - -export const ALLOWED_COMMANDS_LIST: readonly string[] = [ - "Get-Tpm", - "Get-SecureBootPolicy", - "Get-SecureBootUEFI -Name SetupMode", - "Get-BitLockerVolume -MountPoint C:", - "Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed", - "Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses", - "Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer", - "netsh winhttp show proxy", - "ipconfig /all", - "nltest /dsgetdc:", - "dsregcmd /status", - "certutil -store My", - "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }", - "Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description", - "try { $cs = Get-CimInstance -ClassName Win32_ComputerSystem; $bios = Get-CimInstance -ClassName Win32_BIOS; $hash = $null; try { $hash = (Get-CimInstance -Namespace root/cimv2/mdm/dmmap -ClassName MDM_DevDetail_Ext01 -Filter \"InstanceID='Ext' AND ParentID='./DevDetail'\" -ErrorAction Stop).DeviceHardwareData } catch { $hash = \"ERROR: $($_.Exception.Message)\" }; [pscustomobject]@{ Manufacturer = $cs.Manufacturer; Model = $cs.Model; SystemSKU = $cs.SystemSKUNumber; SerialNumber = $bios.SerialNumber; BiosVersion = $bios.SMBIOSBIOSVersion; HardwareHash = $hash } | ConvertTo-Json -Compress } catch { @{ error = $_.Exception.Message } | ConvertTo-Json -Compress }", -]; - -export const ALLOWED_DIAGNOSTICS_PATH_PREFIXES: readonly string[] = [ - "C:\\ProgramData\\AutopilotMonitor", - "C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs", - "C:\\Windows\\Panther", - "C:\\Windows\\Logs", - "C:\\Windows\\SetupDiag", - "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log", - "C:\\Windows\\System32\\winevt\\Logs", - "C:\\Windows\\CCM\\Logs", - "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP", - "C:\\ProgramData\\Microsoft\\Windows\\WER", - "C:\\Windows\\Logs\\CBS", - "C:\\Install\\Log", -]; - -export const BLOCKED_FILE_PREFIXES: readonly string[] = [ - "C:\\Users", -]; diff --git a/src/Web/autopilot-monitor-web/utils/guardrails.generated.ts b/src/Web/autopilot-monitor-web/utils/guardrails.generated.ts index 2d64e64f..1495c7b9 100644 --- a/src/Web/autopilot-monitor-web/utils/guardrails.generated.ts +++ b/src/Web/autopilot-monitor-web/utils/guardrails.generated.ts @@ -91,6 +91,13 @@ export const REGISTRY_PREFIX_CATEGORIES: readonly GuardrailCategory[] = [ "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing", ], }, + { + category: "RealmJoin", + items: [ + "SYSTEM\\CurrentControlSet\\Services\\realmjoin", + "SOFTWARE\\RealmJoin", + ], + }, ]; export const COMMAND_CATEGORIES: readonly GuardrailCategory[] = [ @@ -138,6 +145,12 @@ export const COMMAND_CATEGORIES: readonly GuardrailCategory[] = [ "Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description", ], }, + { + category: "Autopilot / Hardware Identity", + items: [ + "try { $cs = Get-CimInstance -ClassName Win32_ComputerSystem; $bios = Get-CimInstance -ClassName Win32_BIOS; $hash = $null; try { $hash = (Get-CimInstance -Namespace root/cimv2/mdm/dmmap -ClassName MDM_DevDetail_Ext01 -Filter \"InstanceID='Ext' AND ParentID='./DevDetail'\" -ErrorAction Stop).DeviceHardwareData } catch { $hash = \"ERROR: $($_.Exception.Message)\" }; [pscustomobject]@{ Manufacturer = $cs.Manufacturer; Model = $cs.Model; SystemSKU = $cs.SystemSKUNumber; SerialNumber = $bios.SerialNumber; BiosVersion = $bios.SMBIOSBIOSVersion; HardwareHash = $hash } | ConvertTo-Json -Compress } catch { @{ error = $_.Exception.Message } | ConvertTo-Json -Compress }", + ], + }, ]; // --------------------------------------------------------------------------- @@ -168,6 +181,8 @@ export const ALLOWED_REGISTRY_PREFIXES: readonly string[] = [ "SOFTWARE\\Microsoft\\SystemCertificates", "SOFTWARE\\Policies\\Microsoft\\SystemCertificates", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing", + "SYSTEM\\CurrentControlSet\\Services\\realmjoin", + "SOFTWARE\\RealmJoin", ]; export const ALLOWED_FILE_PREFIXES: readonly string[] = [ @@ -210,6 +225,7 @@ export const ALLOWED_COMMANDS_LIST: readonly string[] = [ "certutil -store My", "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }", "Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description", + "try { $cs = Get-CimInstance -ClassName Win32_ComputerSystem; $bios = Get-CimInstance -ClassName Win32_BIOS; $hash = $null; try { $hash = (Get-CimInstance -Namespace root/cimv2/mdm/dmmap -ClassName MDM_DevDetail_Ext01 -Filter \"InstanceID='Ext' AND ParentID='./DevDetail'\" -ErrorAction Stop).DeviceHardwareData } catch { $hash = \"ERROR: $($_.Exception.Message)\" }; [pscustomobject]@{ Manufacturer = $cs.Manufacturer; Model = $cs.Model; SystemSKU = $cs.SystemSKUNumber; SerialNumber = $bios.SerialNumber; BiosVersion = $bios.SMBIOSBIOSVersion; HardwareHash = $hash } | ConvertTo-Json -Compress } catch { @{ error = $_.Exception.Message } | ConvertTo-Json -Compress }", ]; export const ALLOWED_DIAGNOSTICS_PATH_PREFIXES: readonly string[] = [