contrast-agent 3.8.4

data/lib/contrast/agent/protect/rule/csrf.rb

@@ -0,0 +1,118 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'rack'
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/agent/request'
+cs__scoped_require 'contrast/agent/response'
+cs__scoped_require 'contrast/utils/stack_trace_utils'
+cs__scoped_require 'contrast/utils/timer'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect Cross-Site Request Forgery
+        # rule.
+        class Csrf < Contrast::Agent::Protect::Rule::Base
+          NAME = 'csrf'
+
+          def name
+            NAME
+          end
+
+          def stream_safe?
+            false
+          end
+
+          def request_evaluator
+            @_request_evaluator ||= Contrast::Agent::Protect::Rule::Csrf::CsrfEvaluator.new
+          end
+
+          def token_injector
+            @_token_injector ||= Contrast::Agent::Protect::Rule::Csrf::CsrfTokenInjector.new
+          end
+
+          BLOCK_MESSAGE = 'CSRF rule triggered. Request blocked.'
+
+          def prefilter context
+            return unless enabled? && mode != :NO_ACTION
+
+            request = context.request
+            return if request_evaluator.can_ignore_check?(request)
+
+            parameters = request.parameters
+            return unless parameters&.any?
+
+            tokens = parameters[token_injector.token_name]
+            expected_token = token_injector.get_expected_token(context)
+            return if valid_token?(expected_token, tokens)
+
+            # unexpected token is interpreted as an attack with a match
+            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
+            ia_result.input_type = :BODY
+            ia_result.value = build_attack_string(context.request)
+
+            result = build_attack_with_match(
+                context,
+                ia_result,
+                nil,
+                expected_token,
+                details: build_details(expected_token, tokens))
+
+            append_to_activity(context, result)
+
+            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
+          end
+
+          def valid_token? expected, actual_tokens
+            actual_tokens&.include?(expected)
+          end
+
+          def postfilter context
+            return unless enabled? && POSTFILTER_MODES.include?(mode)
+
+            token_injector.do_injection(context)
+          end
+
+          def build_sample context, evaluation, _url, **kwargs
+            sample = build_base_sample(context, evaluation)
+            sample.csrf = kwargs[:details]
+            sample
+          end
+
+          # Build a subclass of the RaspRuleSample using the query string and the
+          # evaluation
+          def build_details expected, actual_tokens
+            details = Contrast::Api::Dtm::CsrfDetails.new
+            details.name = Contrast::Utils::StringUtils.protobuf_safe_string(token_injector.token_name)
+            details.expected = Contrast::Utils::StringUtils.protobuf_safe_string(expected)
+            presented = build_presented_token(actual_tokens)
+            details.presented = Contrast::Utils::StringUtils.protobuf_safe_string(presented)
+            details
+          end
+
+          def build_presented_token actual_tokens
+            return Contrast::Utils::ObjectShare::EMPTY_STRING unless actual_tokens&.any?
+
+            actual_tokens.first
+          end
+
+          # Convert the request parameters into an attack string
+          def build_attack_string request
+            arr = []
+            request.dtm.normalized_request_params.each_with_index do |(name, value), index|
+              arr << Contrast::Utils::ObjectShare::AND unless index.zero?
+              arr += [name.to_s, Contrast::Utils::ObjectShare::EQUALS, value.values.to_s]
+            end
+            if arr.empty?
+              request.query_string
+            else
+              arr.join
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb

@@ -0,0 +1,103 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'uri'
+
+# This class is used by the CSRF rule to determine if the given Request is
+# susceptible to CSRF / if the rule applies to it.
+class Contrast::Agent::Protect::Rule::Csrf::CsrfEvaluator # rubocop:disable Style/ClassAndModuleChildren
+  include Contrast::Components::Interface
+  access_component :logging
+
+  def can_ignore_check? request
+    if !form_submittable_method?(request)
+      logger.debug("Ignoring method #{ request.request_method } for URI #{ request.uri }")
+      true
+    elsif ajax_request?(request)
+      logger.debug("Ignoring Ajax request for URI #{ request.uri }")
+      true
+    elsif empty_post?(request)
+      logger.debug("Ignoring empty POST request for URI #{ request.uri }")
+      true
+    elsif !form_content_type?(request)
+      logger.debug("Ignoring POST request with Content-Type #{ request.content_type } for URI #{ request.uri }")
+      true
+    elsif request.static_request?
+      logger.debug("Ignoring static request for URI #{ request.uri }")
+      true
+    elsif origin_is_referer?(request)
+      logger.debug("Ignoring equivalent origin-referer for URI #{ request.uri }")
+      true
+    elsif login_page?(request)
+      logger.debug("Ignoring possible login page for URI #{ request.uri }")
+      true
+    else
+      false
+    end
+  rescue StandardError => e
+    logger.warn(e, 'Unable to determine if CSRF can be ignored')
+  end
+
+  POST_METHOD = 'POST'
+  def form_submittable_method? request
+    POST_METHOD == request.request_method
+  end
+
+  REQUESTED_WITH = 'X-REQUESTED-WITH'
+  def ajax_request? request
+    requested_with = request.header_value(REQUESTED_WITH)
+    !requested_with.nil? && !requested_with.empty?
+  end
+
+  USER_AGENT = 'USER-AGENT'
+  def empty_user_agent? request
+    agent = request.header_value(USER_AGENT)
+    agent.nil? || agent.empty?
+  end
+
+  def empty_post? request
+    request.request_body_str.empty? && (request.query_string.nil? || request.query_string.empty?)
+  end
+
+  FORM_CONTENT_TYPES = %w[text/plain multipart/form-data application/x-www-form-urlencoded].cs__freeze
+
+  def form_content_type? request
+    content_type = request.content_type
+    return true if content_type.nil? || content_type.empty?
+
+    content_type.start_with?(*FORM_CONTENT_TYPES)
+  end
+
+  ORIGIN = 'ORIGIN'
+  REFERER = 'REFERER'
+  def origin_is_referer? request
+    origin = request.header_value(ORIGIN)
+    referer = request.header_value(REFERER)
+    return false unless origin && referer
+    return false if origin.empty? || referer.empty?
+
+    origin = trim_origin(origin)
+    referer = URI(referer).host
+    origin == referer
+  end
+
+  HTTP = 'http://'
+  HTTPS = 'https://'
+  def trim_origin origin_header
+    origin_header = if origin_header.to_s.start_with?(HTTP, HTTPS)
+                      URI(origin_header).host
+                    else
+                      idx = origin_header.index(Contrast::Utils::ObjectShare::COLON)
+                      idx.nil? ? origin_header : origin_header[0, idx]
+                    end
+    origin_header
+  end
+
+  LOGIN_MARKERS = %w[login auth j_security verify validate sessions].cs__freeze
+  def login_page? request
+    url = request.url.downcase
+    LOGIN_MARKERS.any? { |marker| url.index(marker) }
+  end
+end

data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb

@@ -0,0 +1,85 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/utils/random_util'
+
+# This class is used by the CSRF rule to inject the Contrast CSRF token into
+# the Response's body, allowing for the detection of CSRF attacks.
+class Contrast::Agent::Protect::Rule::Csrf::CsrfTokenInjector # rubocop:disable Style/ClassAndModuleChildren
+  TKN_NAME = 'cs_csrf_tkn'
+  def token_name
+    TKN_NAME
+  end
+
+  SESSION_TOKEN_PREFIX = '__CONTRAST__'
+  def token_key
+    @_token_key ||= SESSION_TOKEN_PREFIX + token_name
+  end
+
+  def javascript
+    @_javascript ||= build_javascript
+  end
+
+  SCRIPT_LOC = File.join('csrf', 'inject.js').cs__freeze
+  NAME_MARKER = '!TOKEN_NAME!'
+  VALUE_MARKER = '!TOKEN_VALUE!'
+  def build_javascript
+    script = Contrast::Utils::ResourceLoader.load(SCRIPT_LOC)
+    script&.sub!(NAME_MARKER, TKN_NAME)
+    script
+  end
+
+  CSRF_TOKEN_LENGTH = 8
+  def get_expected_token context
+    cookies = context.request.request_cookies
+    token = cookies[token_key]
+    return token if token
+    return unless context.response
+
+    build_token(context)
+  end
+
+  def build_token context
+    token = Contrast::Utils::RandomUtil.secure_random_string(CSRF_TOKEN_LENGTH)
+    context&.response&.set_header(token_key, token)
+    token
+  end
+
+  CONTENT_TYPE = 'CONTENT-TYPE'
+
+  def wedge_token? response
+    return true unless response
+
+    content_type = response.header(CONTENT_TYPE)
+    return true unless content_type
+
+    content_type = content_type.to_s
+    !content_type.start_with?(*DATA_CONTENT_TYPES)
+  end
+
+  END_BODY_TAG = %r{</body>}i.cs__freeze
+  def do_injection context
+    return unless wedge_token?(context&.response)
+
+    body_string = context&.response&.body
+    return unless body_string
+
+    index = body_string.index(END_BODY_TAG)
+    return unless index
+
+    injection = get_expected_token(context)
+    return unless injection
+
+    injection = javascript.sub(VALUE_MARKER, injection)
+    body_string.insert(index, injection)
+    context&.response&.update_body(body_string)
+  end
+
+  DATA_CONTENT_TYPES = [
+    'image/', 'audio/', 'video/',
+    'application/json', 'application/xml',
+    'application/octet', 'application/force',
+    'text/json', 'text/xml'
+  ].cs__freeze
+end

data/lib/contrast/agent/protect/rule/default_scanner.rb

@@ -0,0 +1,300 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# The base class used to determine if a user input crosses a token boundary or
+# state, indicating a successful attack using SQL or NoSQL Injection.
+#
+# @deprecated RUBY-356: this class and those that extend it are being phased out
+#   in favor of the more performant code in the Service.
+class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/ClassAndModuleChildren
+  # Potential states
+  # :STATE_INSIDE_TOKEN
+  # :STATE_INSIDE_NUMBER
+  # :STATE_EXPECTING_TOKEN
+  # :STATE_INSIDE_DOUBLEQUOTE
+  # :STATE_INSIDE_SINGLEQUOTE
+  # :STATE_INSIDE_STRING_ESCAPE_BLOCK
+  # :STATE_INSIDE_LINE_COMMENT  # inside a comment that will continue to the end of the line
+  # :STATE_INSIDE_BLOCK_COMMENT # inside a commend that will end with a closing tag
+  # :STATE_SKIP_NEXT_CHARACTER
+
+  def crosses_boundary query, index, input
+    last_boundary = 0
+    token_boundaries(query).each do |boundary|
+      if boundary > index
+        return last_boundary, boundary if boundary < index + input.length
+
+        break
+      end
+      last_boundary = boundary
+    end
+    nil
+  end
+
+  def token_boundaries query
+    @_token_boundaries ||= scan_token_boundaries(query)
+  end
+
+  CANARY = "select * from tbl where bar='bar';#' and pwd='sec3r3t'; # CANARY"
+  def scan_token_boundaries query
+    boundaries = []
+    return boundaries unless query && !query.empty?
+
+    state = :STATE_EXPECTING_TOKEN
+    index = 0
+
+    while index < query.length
+      char = query[index]
+
+      previous_state = state
+
+      state = process_state(boundaries, state, char, index, query)
+
+      case state
+      when :STATE_SKIP_NEXT_CHARACTER
+        index += 1
+        state = previous_state
+      when :STATE_INSIDE_STRING_ESCAPE_BLOCK
+        index = find_escape_sequence_boundary(query, index + 1)
+        state = previous_state
+      when :STATE_INSIDE_BLOCK_COMMENT
+        index = find_block_comment_boundary(query, index + 2)
+        index += 1
+        state = previous_state
+        boundaries << index
+      when :STATE_INSIDE_LINE_COMMENT
+        index = find_new_line_boundary(query, index + 1)
+        state = previous_state
+        boundaries << index
+      end
+      index += 1
+    end
+    boundaries
+  end
+
+  def process_state boundaries, current_state, char, index, query
+    case current_state
+    when :STATE_EXPECTING_TOKEN
+      process_expecting_token(boundaries, char, index, query)
+    when :STATE_INSIDE_NUMBER
+      process_number(boundaries, char, index, query)
+    when :STATE_INSIDE_TOKEN
+      process_inside_token(boundaries, char, index, query)
+    when :STATE_INSIDE_DOUBLEQUOTE
+      process_double_quote(boundaries, char, index, query)
+    when :STATE_INSIDE_SINGLEQUOTE
+      process_single_quote(boundaries, char, index, query)
+    end
+  end
+
+  def process_expecting_token boundaries, char, index, query
+    if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
+      boundaries << index
+      :STATE_INSIDE_SINGLEQUOTE
+    elsif char == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
+      boundaries << index
+      :STATE_INSIDE_DOUBLEQUOTE
+    elsif char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP)
+      boundaries << index
+      :STATE_INSIDE_NUMBER
+    elsif start_line_comment?(char, index, query)
+      boundaries << index
+      :STATE_INSIDE_LINE_COMMENT
+    elsif start_block_comment?(char, index, query)
+      boundaries << index
+      :STATE_INSIDE_BLOCK_COMMENT
+    elsif char.match?(Contrast::Utils::ObjectShare::NOT_WHITE_SPACE_REGEXP)
+      boundaries << index
+      :STATE_INSIDE_TOKEN
+    else
+      :STATE_EXPECTING_TOKEN
+    end
+  end
+
+  def process_inside_token boundaries, char, index, query
+    if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
+      boundaries << index
+      :STATE_INSIDE_SINGLEQUOTE
+    elsif char == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
+      boundaries << index
+      :STATE_INSIDE_DOUBLEQUOTE
+    elsif start_line_comment?(char, index, query)
+      boundaries << index
+      :STATE_INSIDE_LINE_COMMENT
+    elsif start_block_comment?(char, index, query)
+      boundaries << index
+      :STATE_INSIDE_BLOCK_COMMENT
+    elsif operator?(char)
+      boundaries << index
+      :STATE_EXPECTING_TOKEN
+    elsif char.match?(Contrast::Utils::ObjectShare::WHITE_SPACE_REGEXP)
+      boundaries << index
+      :STATE_EXPECTING_TOKEN
+    else
+      :STATE_INSIDE_TOKEN
+    end
+  end
+
+  def process_number boundaries, char, index, _query
+    if char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP) || char == Contrast::Utils::ObjectShare::PERIOD
+      :STATE_INSIDE_NUMBER
+    else
+      boundaries << index
+      :STATE_EXPECTING_TOKEN
+    end
+  end
+
+  def process_double_quote boundaries, char, index, query
+    if escape_char?(char)
+      :STATE_SKIP_NEXT_CHARACTER
+    elsif escape_sequence_start?(char)
+      :STATE_INSIDE_STRING_ESCAPE_BLOCK
+    elsif char == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
+      if double_quote_escape_in_double_quote? && double_quote?(query, index + 1)
+        :STATE_SKIP_NEXT_CHARACTER
+      else
+        boundaries << index
+        :STATE_EXPECTING_TOKEN
+      end
+    else
+      :STATE_INSIDE_DOUBLEQUOTE
+    end
+  end
+
+  def process_single_quote boundaries, char, index, query
+    if escape_char?(char)
+      :STATE_SKIP_NEXT_CHARACTER
+    elsif escape_sequence_start?(char)
+      :STATE_INSIDE_STRING_ESCAPE_BLOCK
+    elsif char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
+      if singe_quote_escape_in_singe_quote? && single_quote?(query, index + 1)
+        :STATE_SKIP_NEXT_CHARACTER
+      else
+        boundaries << index
+        :STATE_EXPECTING_TOKEN
+      end
+    else
+      :STATE_INSIDE_SINGLEQUOTE
+    end
+  end
+
+  def double_quote? query, index
+    return false unless index >= 0 && index < query.length
+
+    query[index] == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
+  end
+
+  def single_quote? query, index
+    return false unless index >= 0 && index < query.length
+
+    query[index] == Contrast::Utils::ObjectShare::SINGLE_QUOTE
+  end
+
+  def find_escape_sequence_boundary query, index
+    idx = index
+    while idx < query.length
+      char = query[idx]
+      break if escape_sequence_end?(char)
+
+      idx += 1
+    end
+    idx
+  end
+
+  def find_block_comment_boundary query, index
+    idx = index
+    while idx < query.length
+      char = query[idx]
+      break if end_block_comment?(char, idx, query)
+
+      idx += 1
+    end
+    idx
+  end
+
+  def find_new_line_boundary query, index
+    idx = index
+    while idx < query.length
+      char = query[idx]
+      break if char == Contrast::Utils::ObjectShare::NEW_LINE
+      break if char == Contrast::Utils::ObjectShare::RETURN
+
+      idx += 1
+    end
+    idx
+  end
+
+  OPERATOR_PATTERN = %r{[+=*^/%><!-]}.cs__freeze
+  def operator? char
+    char.match?(OPERATOR_PATTERN)
+  end
+
+  # @note: Any class extending this module should override these methods as needed
+  # Are the current and subsequent characters both '-' ?
+  def start_line_comment? char, index, query
+    return false unless char == Contrast::Utils::ObjectShare::DASH
+    return false unless (query.length - 2) >= index
+
+    query[index + 1] == Contrast::Utils::ObjectShare::DASH
+  end
+
+  # Is the current character / sequence of characters the start of a block comment
+  # We assume '/*' starts the comment by default
+  def start_block_comment? char, index, query
+    return false unless char == Contrast::Utils::ObjectShare::SLASH
+    return false unless (query.length - 2) >= index
+
+    query[index + 1] == Contrast::Utils::ObjectShare::ASTERISK
+  end
+
+  # Is the current character / sequence of characters the end of a block comment
+  # We assume '*/' ends the comment by default
+  def end_block_comment? char, index, query
+    return false unless char == Contrast::Utils::ObjectShare::ASTERISK
+    return false unless (query.length - 2) >= index
+
+    query[index + 1] == Contrast::Utils::ObjectShare::SLASH
+  end
+
+  # Indicates if '""' inside of double quotes is the equivalent of '\"'
+  # We assume no by default
+  def double_quote_escape_in_double_quote?
+    false
+  end
+
+  # Indicates if "''" inside of single quotes is the equivalent of "\'"
+  # We assume yes by default
+  def singe_quote_escape_in_singe_quote?
+    true
+  end
+
+  # Does this language let the user redefine the escape character
+  # We assume no by default
+  def redefines_escape_char?
+    false
+  end
+
+  # Is the character provided an escape character?
+  # By default, we'll assume
+  def escape_char? char
+    char == Contrast::Utils::ObjectShare::BACK_SLASH
+  end
+
+  # Does this language support string escape sequences?
+  # We assume no by default
+  def support_string_escape_sequence?
+    false
+  end
+
+  # Is this the start of a string escape sequence?
+  # Since escape sequences aren't supported, the answer is always false
+  def escape_sequence_start? _char
+    false
+  end
+
+  # Is this the end of a string escape sequence?
+  # Since escape sequences aren't supported, the answer is always false
+  def escape_sequence_end? _char
+    false
+  end
+end