contrast-agent 3.8.4

data/lib/contrast/agent/assess/rule.rb

@@ -0,0 +1,18 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      # This is the base module for our assess rule classes. It is intended to
+      # facilitate the patching of the application for Assess functionality. Any
+      # class under this namespace should be required here, providing a single
+      # point of require for this functionality.
+      module Rule
+      end
+    end
+  end
+end
+
+cs__scoped_require 'contrast/agent/assess/rule/base'
+cs__scoped_require 'contrast/agent/assess/rule/provider'

data/lib/contrast/agent/assess/rule/base.rb

@@ -0,0 +1,72 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+cs__scoped_require 'zlib'
+cs__scoped_require 'digest'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        # The base class for each of our Assess Rules
+        class Base
+          include Contrast::Components::Interface
+          access_component :logging, :analysis, :agent, :settings
+
+          def initialize
+            SETTINGS.assess_rules[name] = self
+          end
+
+          # Should return the name as it is known to Teamserver; defaults to
+          # class
+          def name
+            cs__class.name
+          end
+
+          def enabled?
+            ASSESS.enabled? && !ASSESS.rule_disabled?(name)
+          end
+
+          def prefilter _context; end
+
+          # If a rule needs to inspect the response body it is not stream safe
+          # The rule should override this and return false
+          def stream_safe?
+            true
+          end
+
+          def postfilter _context; end
+
+          # this rule is excluded if any of the given exclusions have a
+          # protection rule that matches this rule name
+          def excluded? exclusions
+            Array(exclusions).any? do |ex|
+              ex.assess_rule?(name)
+            end
+          end
+
+          def send_report finding
+            finding.rule_id = name
+            finding.hash_code = generate_hash(finding)
+            finding.preflight = Contrast::Utils::PreflightUtil.create_preflight(finding)
+            finding.version = Contrast::Agent::Assess::Policy::TriggerMethod::CURRENT_FINDING_VERSION
+            finding.tags = ASSESS.tags.to_s
+
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            current_context.activity.findings << finding
+          end
+
+          def generate_hash finding
+            Contrast::Utils::HashDigest.generate_trigger_hash(finding)
+          end
+
+          def trace_tags
+            @_trace_tags ||= ASSESS.tags.to_s
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/csrf.rb

@@ -0,0 +1,66 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        # The Ruby implementation of the CSRF Assess Rule.
+        class Csrf < Contrast::Agent::Assess::Rule::ResponseScanningRule
+          NAME = 'csrf'
+          def name
+            NAME
+          end
+
+          DB_STATE_CHANGE = 'db'
+          ACTION_LIMIT = 3
+          QUERY_SIZE_LIMIT = 50
+          STATE_CHANGING_ACTIONS_KEY = 'csrf.statechange.actions'
+          def record_db_state_change context, query
+            return unless context
+
+            changes = context.get_property(STATE_CHANGING_ACTIONS_KEY)
+            changes ||= []
+            return unless changes.length < ACTION_LIMIT
+
+            return unless state_change?(query)
+
+            action = Contrast::Agent::Assess::Rule::Csrf::CsrfAction.new
+            action.type = DB_STATE_CHANGE
+            action.evidence = query[0..QUERY_SIZE_LIMIT]
+
+            changes << action
+
+            context.add_property(STATE_CHANGING_ACTIONS_KEY, changes)
+          end
+
+          STATE_CHANGE_QUERY_ACTIONS = %w[
+            insert
+            update
+            delete
+            drop
+            create
+            alter
+            upsert
+          ].cs__freeze
+          # Returns true if the given query starts with any
+          # of the STATE_CHANGE_QUERY_ACTIONS listed above
+          def state_change? query
+            return false unless query.is_a?(String) && !query.empty?
+
+            query.downcase.start_with?(*STATE_CHANGE_QUERY_ACTIONS)
+          end
+
+          # some watchers keep state and need to be reset in each request.
+          # this one is not one of those.
+          def watcher
+            @_watcher ||= Contrast::Agent::Assess::Rule::Csrf::Watcher.new
+          end
+
+          # Indicates if this request has been checked for a CSRF token
+          CHECKED = 'csrf.token.checked'
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/csrf/csrf_action.rb

@@ -0,0 +1,28 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        class Csrf
+          # CSRF is only reported on those Requests which also result in a
+          # state changing action (database call). This class servers as a
+          # record of that action.
+          class CsrfAction
+            attr_accessor :type, :evidence
+
+            TYPE = 'type'
+            EVIDENCE = 'evidence'
+            def to_h
+              {
+                  TYPE => type,
+                  EVIDENCE => evidence
+              }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb

@@ -0,0 +1,69 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        class Csrf
+          # This class is called by our patches to determine if a CSRF
+          # vulnerability exists within an application. It is used through a
+          # CUSTOM propagation in order to capture that a Database call was
+          # made in response to a request that did not have the Contrast CSRF
+          # token.
+          class CsrfApplicator
+            include Contrast::Components::Interface
+            access_component :logging, :analysis, :scope
+
+            CS__CSRF_LOG_MSG = 'applying CSRF assess rule'
+
+            def self.rule
+              @_rule ||= Contrast::Agent::FeatureState.instance.assess_rule(
+                  Contrast::Agent::Assess::Rule::Csrf::NAME)
+            end
+
+            def self.csrf_tagger patcher, preshift, _ret, _block
+              return unless rule&.enabled?
+
+              idx = patcher.sources[0].to_i
+              args = preshift.args
+              return unless args&.length.to_i > idx
+
+              sql = args[idx]
+              return unless sql
+
+              with_contrast_scope do
+                logger.debug(nil, CS__CSRF_LOG_MSG)
+                rule.record_db_state_change(
+                    Contrast::Agent::REQUEST_TRACKER.current,
+                    sql)
+              end
+            end
+
+            def self.cs__assess_apply_csrf_rule sql
+              context = Contrast::Agent::REQUEST_TRACKER.current
+
+              return unless context&.app_loaded?
+              return unless ASSESS.enabled?
+              return unless sql
+
+              rule = Contrast::Agent::FeatureState.instance.assess_rule(
+                  Contrast::Agent::Assess::Rule::Csrf::NAME)
+              return unless rule&.enabled?
+
+              with_contrast_scope do
+                logger.debug(CS__CSRF_LOG_MSG)
+                rule.record_db_state_change(context, sql)
+              end
+            rescue StandardError => e
+              logger.warn(e, 'Error running CSRF assess rule')
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb

@@ -0,0 +1,132 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/assess/rule/response_watcher'
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        class Csrf
+          # Watchers are how those Rules which do not act on dataflow function.
+          # This one is used by the CSRF rule to determine if a request was
+          # made in a way that is susceptible to a CSRF attack.
+          class Watcher < Contrast::Agent::Assess::Rule::ResponseWatcher
+            def supports? context
+              return false unless super(context)
+              return false unless user_agent?(context)
+              return false unless form_content_type?(context)
+              return false unless form_method?(context)
+              return false if empty_get?(context)
+
+              true
+            end
+
+            X_REQUESTED_WITH = 'X-REQUESTED-WITH'
+            # ignore this request if X-Requested-With is set
+            def x_requested_with? context
+              !context.request.normalized_request_headers[X_REQUESTED_WITH].nil?
+            end
+
+            USER_AGENT = 'USER-AGENT'
+            # ignore this request if User-Agent is NOT set
+            # since that indicates this isn't a browser interaction
+            def user_agent? context
+              !context.request.normalized_request_headers[USER_AGENT].nil?
+            end
+
+            CONTENT_TYPE = 'CONTENT-TYPE'
+            FORM_TYPES = %w[
+              text/plain
+              multipart/form-data
+              application/x-www-form-urlencoded
+            ].cs__freeze
+            # ignore this request if the Content-Type is NOT set
+            # to a form content type
+            def form_content_type? context
+              type = context.request.content_type
+              # We need to account for the charset being part of the header. It doesn't
+              # affect how we determine CSRF-ability or not
+              type = type.split(Contrast::Utils::ObjectShare::SEMICOLON)[0] if type
+              FORM_TYPES.include?(type)
+            end
+
+            FORM_METHODS = %w[GET POST].cs__freeze
+            # ignore this request if the request method
+            # is not one that can be set with forms
+            def form_method? context
+              FORM_METHODS.include?(context.request.request_method)
+            end
+
+            GET = 'GET'
+            # ignore this request if the method is get
+            # and the query string is empty
+            def empty_get? context
+              request = context.request
+              request.request_method ==
+                  GET &&
+                  (request.query_string.nil? || request.query_string.empty?)
+            end
+
+            # If a parameter contains 'csrf' or 'token', we consider
+            # it to be a guard against CSRF and therefore determine
+            # that this request is not vulnerable.
+            CSRF_PATTERN = /csrf/i.cs__freeze
+            TOKEN_PATTERN = /token/i.cs__freeze
+            def vulnerable? context
+              # having the property 'csrf.token.checked' indicates
+              # that a CSRF check was preformed at some point during
+              # this request, so we consider it to not be vulnerable
+              return false if context.get_property(CHECKED)
+
+              params = context.request.parameters
+              params.each_key do |key|
+                return false if key.match?(CSRF_PATTERN)
+                return false if key.match?(TOKEN_PATTERN) && looks_like_token?(params[key])
+              end
+              # having no actions means there's no vulnerability
+              return false unless context.get_property(STATE_CHANGING_ACTIONS_KEY)&.any?
+
+              true
+            end
+
+            MINIMUM_CSRF_TOKEN_SIZE = 8
+            MAXIMUM_CSRF_TOKEN_SIZE = 24
+            TOKEN_REGEXP = /^[A-Za-z0-9]*$/.cs__freeze
+            def looks_like_token? value
+              return false unless value
+
+              values = [value]
+              values.each do |parameter|
+                next unless parameter
+
+                length = parameter.length
+                next if length < MINIMUM_CSRF_TOKEN_SIZE
+                next if length > MAXIMUM_CSRF_TOKEN_SIZE
+                return true if parameter.match?(TOKEN_REGEXP)
+              end
+              false
+            end
+
+            DATA_KEY = 'actions'
+            def build_finding context
+              actions = context.get_property(STATE_CHANGING_ACTIONS_KEY)
+              return if actions.nil? || actions.empty?
+
+              string = actions.map(&:to_h).to_json
+              finding = Contrast::Api::Dtm::Finding.new
+              finding.rule_id = Contrast::Agent::Assess::Rule::Csrf::NAME
+              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
+              hash_code = Contrast::Utils::HashDigest.generate_response_hash(finding)
+              finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash_code)
+              finding.properties[DATA_KEY] = Contrast::Utils::StringUtils.force_utf8(string)
+              finding
+            rescue StandardError => e
+              logger.error(e, 'Unable to build a finding for CSRF')
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/rule/provider.rb

@@ -0,0 +1,21 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        # Provider rules are those which do not fit into the standard dataflow
+        # paradigm. For our purposes, these rules are currently those which
+        # function on class definition to determine if there are dangerous
+        # constants defined therein.
+        module Provider
+        end
+      end
+    end
+  end
+end
+
+cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_value_rule'
+cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_key'
+cs__scoped_require 'contrast/agent/assess/rule/provider/hardcoded_password'

data/lib/contrast/agent/assess/rule/provider/hardcoded_key.rb

@@ -0,0 +1,62 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Rule
+        module Provider
+          # Determine if there are any cryptographic keys hardcoded into the sourcecode
+          # of the application. A constant is a cryptographic key if:
+          # 1) the name contains a KEY_FIELD_NAME value
+          # 2) the value is a non-empty array of only Fixnums
+          class HardcodedKey
+            include Contrast::Agent::Assess::Rule::Provider::HardcodedValueRule
+
+            NAME = 'hardcoded-key'
+            def rule_id
+              NAME
+            end
+
+            # These are names, determined by the security team (Matt & Ar), that
+            # indicate a field is likely to be a password or secret token of some
+            # sort.
+            KEY_FIELD_NAMES = %w[KEY AES DES IV SECRET].cs__freeze
+
+            # These are markers whose presence indicates that a field is more
+            # likely to be a descriptor or requirement than an actual key.
+            # We should ignore fields that contain them.
+            NON_KEY_PARTIAL_NAMES = %w[CONTENT_CODES RESPONSE_CODES ERROR_CODES].cs__freeze
+
+            def name_passes? constant_string
+              KEY_FIELD_NAMES.any? { |name| constant_string.index(name) } &&
+                  NON_KEY_PARTIAL_NAMES.none? { |name| constant_string.index(name) }
+            end
+
+            # If the value is a byte array, or at least an array of numbers, it
+            # passes for this rule
+            def value_type_passes? value
+              return false unless value.is_a?(Array) && value.any?
+
+              value.each do |byte|
+                return false unless byte.is_a?(Integer)
+              end
+              true
+            end
+
+            # There isn't a filter for the byte value. The check is not evaluated
+            # for this rule
+            def value_passes? _value
+              true
+            end
+
+            REDACTED_MARKER = ' = [**REDACTED**]'
+            def redacted_marker
+              REDACTED_MARKER
+            end
+          end
+        end
+      end
+    end
+  end
+end