fix: hide redundant RDP workstation line when it matches server host
Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
@@ -82,6 +82,31 @@ def host_label(host: Host | None, *, fallback: str = "unknown") -> str:
|
||||
return html_escape(host.hostname)
|
||||
|
||||
|
||||
def _host_display_name_base(display_name: str | None) -> str:
|
||||
if not display_name or not display_name.strip():
|
||||
return ""
|
||||
return display_name.strip().split("(", 1)[0].strip()
|
||||
|
||||
|
||||
def _rdp_workstation_is_redundant(workstation: str, host: Host | None) -> bool:
|
||||
"""Скрыть Workstation Name, если пусто/«-» или совпадает с hostname/display_name сервера."""
|
||||
ws = (workstation or "").strip()
|
||||
if not ws or ws in ("-", "N/A", "?"):
|
||||
return True
|
||||
if host is None:
|
||||
return False
|
||||
ws_key = ws.casefold()
|
||||
if host.hostname and ws_key == host.hostname.strip().casefold():
|
||||
return True
|
||||
dn = (host.display_name or "").strip()
|
||||
if dn and ws_key == dn.casefold():
|
||||
return True
|
||||
base = _host_display_name_base(host.display_name)
|
||||
if base and ws_key == base.casefold():
|
||||
return True
|
||||
return False
|
||||
|
||||
|
||||
def format_time(dt: datetime | None) -> str:
|
||||
if dt is None:
|
||||
return "-"
|
||||
@@ -175,13 +200,15 @@ def format_rdp_login_html(event: Event) -> str:
|
||||
|
||||
user = html_escape(_detail(details, "user", "username"))
|
||||
ip = html_escape(_detail(details, "ip_address", "source_ip", "ip"))
|
||||
workstation = html_escape(_detail(details, "workstation_name", "computer_name"))
|
||||
workstation_raw = _detail(details, "workstation_name", "computer_name")
|
||||
workstation = html_escape(workstation_raw)
|
||||
process = html_escape(_detail(details, "process_name", "process", default=""))
|
||||
logon = logon_type_label(details.get("logon_type"))
|
||||
|
||||
msg = f"<b>{header}</b>\n"
|
||||
msg += _line("👤", "Пользователь", user)
|
||||
msg += _line("🏢", "Сервер", host_label(event.host))
|
||||
if not _rdp_workstation_is_redundant(workstation_raw, event.host):
|
||||
msg += _line("🖥️", "Рабочая станция", workstation)
|
||||
msg += _line("🌐", "IP адрес", ip)
|
||||
if process and process != "-":
|
||||
|
||||
@@ -49,6 +49,64 @@ def test_rdp_failed_template_includes_user_ip_logon():
|
||||
assert "<b>" in text
|
||||
|
||||
|
||||
def test_rdp_login_hides_redundant_workstation_when_matches_hostname():
|
||||
host = Host(
|
||||
hostname="ITIS198",
|
||||
display_name="ITIS (192.168.160.198)",
|
||||
os_family="windows",
|
||||
)
|
||||
event = Event(
|
||||
event_id="00000000-0000-4000-8000-000000000508",
|
||||
host_id=1,
|
||||
host=host,
|
||||
occurred_at=datetime(2026, 5, 31, 18, 48, 52, tzinfo=timezone.utc),
|
||||
category="auth",
|
||||
type="rdp.login.success",
|
||||
severity="info",
|
||||
title="RDP login",
|
||||
summary="papatramp",
|
||||
details={
|
||||
"user": "papatramp",
|
||||
"ip_address": "192.168.160.3",
|
||||
"logon_type": 10,
|
||||
"workstation_name": "ITIS198",
|
||||
"event_id_windows": 4624,
|
||||
},
|
||||
payload={},
|
||||
)
|
||||
text = format_rdp_login_html(event)
|
||||
assert "ITIS" in text
|
||||
assert "192.168.160.3" in text
|
||||
assert "Рабочая станция" not in text
|
||||
assert "ITIS198" not in text
|
||||
|
||||
|
||||
def test_rdp_login_shows_workstation_when_client_differs():
|
||||
host = Host(hostname="ITIS198", display_name="ITIS", os_family="windows")
|
||||
event = Event(
|
||||
event_id="00000000-0000-4000-8000-000000000509",
|
||||
host_id=1,
|
||||
host=host,
|
||||
occurred_at=datetime(2026, 5, 31, 18, 48, 52, tzinfo=timezone.utc),
|
||||
category="auth",
|
||||
type="rdp.login.success",
|
||||
severity="info",
|
||||
title="RDP login",
|
||||
summary="papatramp",
|
||||
details={
|
||||
"user": "papatramp",
|
||||
"ip_address": "192.168.160.3",
|
||||
"logon_type": 10,
|
||||
"workstation_name": "NEW-ADMIN-PC",
|
||||
"event_id_windows": 4624,
|
||||
},
|
||||
payload={},
|
||||
)
|
||||
text = format_rdp_login_html(event)
|
||||
assert "Рабочая станция" in text
|
||||
assert "NEW-ADMIN-PC" in text
|
||||
|
||||
|
||||
def test_rdp_success_template():
|
||||
event = Event(
|
||||
event_id="00000000-0000-4000-8000-000000000502",
|
||||
|
||||
Reference in New Issue
Block a user