contrast-agent 3.8.4

data/lib/contrast/agent/at_exit_hook.rb

@@ -0,0 +1,33 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    # This module adds an at_exit hook for us to send messages that may be lost at process exit
+    module AtExitHook
+      include Contrast::Components::Interface
+      access_component :logging, :contrast_service
+
+      TERMINATION_NOTICE = 'at_exit invoked, host application terminating'
+
+      def self.exit_hook
+        @_exit_hook ||= begin
+                          at_exit do
+                            logger.debug(TERMINATION_NOTICE)
+
+                            context = Contrast::Agent::REQUEST_TRACKER.current
+                            CONTRAST_SERVICE.send_message(context.activity) if context
+
+                            logger.debug(" - current PID  #{ @pid  }")
+                            logger.debug(" - current PPID #{ @ppid }")
+                            logger.debug(" - process PID  #{ Process.pid  }")
+                            logger.debug(" - process PPID #{ Process.ppid }")
+                          end
+                          true
+                        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/class_reopener.rb

@@ -0,0 +1,195 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: false
+
+cs__scoped_require 'ripper'
+cs__scoped_require 'contrast/core_extensions/module'
+cs__scoped_require 'contrast/components/interface'
+
+# This method is left purposefully at the top level namespace. Moving it
+# elsewhere will break functionality as it executes evaluations against the
+# namespace from which it is called -- ie putting it in Contrast would make all
+# changes it intends for Foo happen to Contrast::Foo instead
+#
+# @param class_name [String] the name of the class in which the eval will
+#   redefine functionality
+# @param content [String] the String content that will function as the code in
+#   the given class
+def unbound_eval class_name, content
+  # Yuck, this is a top-level method that has to break encapsulation
+  # in order to access scoping!
+  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.enter_contrast_scope
+  eval(content) # rubocop:disable Security/Eval
+rescue Exception # rubocop:disable Lint/RescueException
+  Contrast::Agent::SettingsState.log_error("Unable to perform unbound eval of new content for #{ class_name }.")
+ensure
+  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.exit_contrast_scope
+end
+
+module Contrast
+  module Agent
+    # Used for Ruby 2.4 & 2.5 to allow us to rewrite those methods which have
+    # interpolation in them.
+    # @deprecated Changes to this class are discouraged as this approach is
+    #   being phased out with support for those language versions.
+    class ClassReopener
+      END_NEW_LINE = "end\n".cs__freeze
+      PROTECTED_WITH_NEW_LINE = "protected\n".cs__freeze
+      PRIVATE_WITH_NEW_LINE = "private\n".cs__freeze
+      CLASS_SELF_LINE = "class << self\n".cs__freeze
+
+      attr_reader :public_singleton_methods, :class_module_path, :class_name, :files, :is_class, :name_space,
+                  :public_instance_methods, :protected_instance_methods, :private_instance_methods, :locations
+
+      def initialize module_data
+        @class_module_path = module_data.name
+        clazz = module_data.mod
+        @is_class = clazz.is_a?(Class)
+        @public_instance_methods = []
+        @protected_instance_methods = []
+        @private_instance_methods = []
+        @public_singleton_methods = []
+        @files = {}
+        @name_space = []
+        @class_name = nil
+        @locations = Hash.new { |h, k| h[k] = [] }
+        gather_modules
+      end
+
+      def gather_modules
+        return if class_module_path.nil?
+
+        segments = class_module_path.split(Contrast::Utils::ObjectShare::DOUBLE_COLON)
+        @class_name = segments.last
+        current = nil
+        segments[0..-2].each do |chunk|
+          defined = current ? current.cs__const_defined?(chunk) : Module.cs__const_defined?(chunk)
+          next unless defined
+
+          current = current ? current.cs__const_get(chunk) : Module.cs__const_get(chunk)
+          if current.is_a?(Class)
+            name_space << [chunk, Class]
+          elsif current.is_a?(Module)
+            name_space << [chunk, Module]
+          end
+        end
+      end
+
+      def staged_changes?
+        public_singleton_methods.any? ||
+            public_instance_methods.any? ||
+            protected_instance_methods.any? ||
+            private_instance_methods.any?
+      end
+
+      def written_from_location? source_location
+        return false unless source_location
+
+        file = source_location[0]
+        location = source_location[1]
+        locs = locations[file]
+        return true if locs.include?(location)
+
+        locs << location
+        false
+      end
+
+      def commit_patches
+        return unless staged_changes?
+
+        content = build_content
+        valid = Ripper.sexp(content)
+        unbound_eval(class_name, content) if !!valid && !class_name.empty?
+      end
+
+      def source_code location, method_name
+        file_name = location[0]
+        line_number = location[1]
+        return unless file_name && line_number
+
+        unless files.key?(file_name)
+          return unless File.exist?(file_name)
+
+          files[file_name] = File.readlines(file_name)
+        end
+
+        lines = files[file_name]
+
+        old_verbose = $VERBOSE
+        $VERBOSE = nil
+        code = ''
+        complete = false
+        # location#line_number is 1 based, arrays are 0 based
+        line_number -= 1
+        lines[line_number..-1].each do |line|
+          begin
+            code << line
+            RubyVM::InstructionSequence.compile(code) # this will raise SyntaxError for malformed code
+            # Assert that a line which ends with a , or \ is incomplete.
+            complete = code !~ /[,\\]\s*\z/
+            break if complete
+          rescue SyntaxError
+            code.gsub(/\#\{.*?\}/, 'temp')
+          end
+        end
+        $VERBOSE = old_verbose
+        raise SyntaxError, "Failure: method #{ method_name } in #{ file_name } at #{ line_number }" unless complete
+
+        code
+      end
+
+      private
+
+      def build_content
+        content = ''
+        name_space.each do |arr|
+          name = arr[0]
+          type = arr[1]
+          if type == Class
+            content << "class #{ name }\n"
+          elsif type == Module
+            content << "module #{ name }\n"
+          end
+        end
+
+        # Set the name to be a class or module
+        content << if is_class
+                     "class #{ class_name }\n"
+                   else
+                     "module #{ class_name }\n"
+                   end
+
+        # Recreate the updated class methods
+        if public_singleton_methods.any?
+          content << CLASS_SELF_LINE
+          content << public_singleton_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
+          content << Contrast::Utils::ObjectShare::NEW_LINE
+          content << END_NEW_LINE
+        end
+
+        # Recreate the updated instance methods
+        if public_instance_methods.any?
+          content << public_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
+          content << Contrast::Utils::ObjectShare::NEW_LINE
+        end
+
+        if protected_instance_methods.any?
+          content << PROTECTED_WITH_NEW_LINE
+          content << protected_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
+          content << Contrast::Utils::ObjectShare::NEW_LINE
+        end
+
+        if private_instance_methods.any?
+          content << PRIVATE_WITH_NEW_LINE
+          content << private_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
+          content << Contrast::Utils::ObjectShare::NEW_LINE
+        end
+
+        content << END_NEW_LINE
+        name_space.length.times do
+          content << END_NEW_LINE
+        end
+        content
+      end
+    end
+  end
+end

data/lib/contrast/agent/deadzone/policy/deadzone_node.rb

@@ -0,0 +1,26 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/policy_node'
+
+module Contrast
+  module Agent
+    module Deadzone
+      module Policy
+        # This class functions to translate our policy.json into an actionable
+        # Ruby object, allowing for dynamic patching over hardcoded patching,
+        # specifically for those methods in which other Contrast operations
+        # should not apply
+        class DeadzoneNode < Contrast::Agent::Patching::Policy::PolicyNode
+          def node_class
+            'Deadzone'
+          end
+
+          def feature
+            'Deadzone'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/deadzone/policy/policy.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/deadzone/policy/deadzone_node'
+cs__scoped_require 'contrast/agent/patching/policy/policy'
+
+module Contrast
+  module Agent
+    module Deadzone
+      module Policy
+        # This is just a holder for our policy. Takes the policy JSON and
+        # converts it into hashes that we can access nicely
+        class Policy < Contrast::Agent::Patching::Policy::Policy
+          def self.policy_folder
+            'deadzone'
+          end
+
+          DEADZONES_KEY = 'deadzones'
+          attr_reader :deadzones
+
+          def initialize
+            @deadzones = []
+            super
+          end
+
+          def node_type
+            Contrast::Agent::Deadzone::Policy::DeadzoneNode
+          end
+
+          def from_hash_string string
+            policy_data = JSON.parse(string)
+
+            policy_data[DEADZONES_KEY].each do |deadzone_hash|
+              add_node(node_type.new(deadzone_hash))
+            end
+          end
+
+          def add_node node, _node_type = :deadzones
+            unless node
+              logger.error(nil, 'Node was nil when adding node to policy')
+              return
+            end
+
+            begin
+              node.validate
+            rescue ArgumentError => e
+              logger.error(e, e.message)
+              return
+            end
+
+            @deadzones << node
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/disable_reaction.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    # A Reaction from TeamServer which indicates the Agent should be disabled,
+    # typically because some configuration setting did not satisfy requirements
+    # set by the Organization's Administrator
+    class DisableReaction
+      include Contrast::Components::Interface
+      access_component :logging, :agent
+
+      def self.run _reaction, level
+        logger.with_level(
+            nil,
+            'Contrast received instructions to disable itself - Disabling now',
+            level)
+        AGENT.disable!
+      end
+    end
+  end
+end

data/lib/contrast/agent/exclusion_matcher.rb

@@ -0,0 +1,190 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    # Exclusions are ways for the User to tell the Agent to ignore sections of
+    # the Application. If a request or an event matches one of these, the
+    # functions of the Agent are suppressed for that request or event.
+    class ExclusionMatcher
+      include Contrast::Components::Interface
+      access_component :logging
+
+      def initialize excl
+        @exclusion = excl
+        @protect = @exclusion.protect
+        @assess = @exclusion.assess
+
+        handle_wildcard_input
+        handle_wildcard_url
+        handle_wildcard_code
+      end
+
+      # According to the docs for exclusions, user input applies to all inputs if
+      # the name supplied is an '*' or '.*'. The name matcher does NOT support
+      # regexp beyond this.
+      # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
+      def handle_wildcard_input
+        return unless @exclusion.input_name
+
+        @wildcard_input = @exclusion.input_name == '.*' ||
+            @exclusion.input_name == Contrast::Utils::ObjectShare::ASTERISK
+      end
+
+      # According to the docs for exclusions, urls apply to all urls if the url
+      # supplied is '/.*' or if the URL mode is all. Otherwise, the URL supplied is
+      # to be treated as a regular expression that must match the entire URL
+      # against which it is tested.
+      # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
+      def handle_wildcard_url
+        @wildcard_url = match_all?
+        return if @wildcard_url
+        return unless @exclusion.urls&.any?
+
+        @wildcard_url ||= @exclusion.urls.any? { |test| test == '/.*' }
+        return if @wildcard_url
+
+        @urls = []
+        @exclusion.urls.each do |url|
+          url_pattern = build_regexp(url, true, true)
+          @urls << url_pattern if url_pattern
+        end
+      end
+
+      # According to the docs for exclusions, code applies to the entire stacktrace
+      # of the caller, and can act as a regexp. Per our user instructions in the
+      # Contrast UI, these comparisons must be done at the end of the input.
+      # https://docs.contrastsecurity.com/admin-policymgmt.html#exclude
+      def handle_wildcard_code
+        return unless @exclusion.blacklist&.any?
+
+        @wildcard_exclusions = []
+        @exclusion.blacklist.each do |code|
+          class_name, method_name = code.split(Contrast::Utils::ObjectShare::COLON)
+          class_pattern = build_regexp(class_name, false, true)
+          method_pattern = build_regexp(method_name)
+          next unless class_pattern && method_pattern
+
+          @wildcard_exclusions << [class_pattern, method_pattern]
+        end
+      end
+
+      def build_regexp pattern, start_anchor = false, end_anchor = false
+        pattern = Contrast::Utils::ObjectShare::CARROT + pattern if start_anchor
+        pattern += Contrast::Utils::ObjectShare::DOLLAR_SIGN if end_anchor
+        Regexp.compile(pattern)
+      rescue RegexpError => e
+        logger.error(e, "Unable to generate a pattern for #{ pattern }. It will not be used for exclusion matching.")
+      end
+
+      def protect?
+        @protect
+      end
+
+      def assess?
+        @assess
+      end
+
+      def url?
+        @exclusion.type == :URL
+      end
+
+      def input?
+        @exclusion.type == :INPUT
+      end
+
+      def code?
+        @exclusion.type == :CODE
+      end
+
+      def name
+        @exclusion.name
+      end
+
+      def match_all?
+        @exclusion.match_strategy == :ALL
+      end
+
+      # Determine if the given rule is excluded by this exclusion.
+      # In this case, the `protection_rules` being empty means apply to all rules,
+      # not no rules
+      #
+      # @param rule - the id of the rule which we're checking for exclusion
+      def protection_rule? rule
+        protect? &&
+            (@exclusion.protection_rules.empty? ||
+                @exclusion.protection_rules.include?(rule)
+            )
+      end
+
+      # Determine if the given rule is excluded by this exclusion.
+      # In this case, the `assessment_rules` being empty means apply to all rules,
+      # not no rules
+      #
+      # @param rule - the id of the rule which we're checking for exclusion
+      def assess_rule? rule
+        assess? &&
+            (@exclusion.assessment_rules.empty? ||
+                @exclusion.assessment_rules.include?(rule)
+            )
+      end
+
+      def match_url? url
+        return false unless url?
+        return true if @wildcard_url
+
+        @urls.any? { |test| url.match?(test) }
+      end
+
+      def match_input? value, type
+        return false unless input?
+
+        exclusion_type = @exclusion.input_type
+        case type
+        when :PARAMETER_NAME, :PARAMETER_VALUE
+          return exclusion_type == :PARAMETER && value_match?(value)
+        when :COOKIE_NAME, :COOKIE_VALUE
+          return exclusion_type == :COOKIE && value_match?(value)
+        when :HEADER
+          return exclusion_type == :HEADER && value_match?(value, false)
+        when :BODY
+          return exclusion_type == :BODY
+        when :QUERYSTRING
+          return exclusion_type == :QUERYSTRING
+        end
+
+        false
+      end
+
+      def value_match? value, case_sensitive = true
+        return true if @wildcard_input
+
+        if case_sensitive
+          value == @exclusion.input_name
+        else
+          @exclusion.input_name.casecmp(value).zero?
+        end
+      end
+
+      def match_code? stack_trace
+        return false unless code?
+        return false if @wildcard_exclusions&.empty?
+
+        @wildcard_exclusions.each do |code|
+          class_name = code[0]
+          method_name = code[1]
+          stack_trace.each do |location|
+            next unless location.base_label.match?(method_name)
+            next unless location.path.match?(class_name)
+
+            return true
+          end
+        end
+
+        false
+      end
+    end
+  end
+end