contrast-agent 3.8.4

data/lib/contrast/agent/protect/rule/sqli.rb

@@ -0,0 +1,101 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/core_extensions/protect/applies_sqli_rule'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect SQL Injection rule.
+        class Sqli < Contrast::Agent::Protect::Rule::BaseService
+          NAME = 'sql-injection'
+          BLOCK_MESSAGE = 'SQLi rule triggered. Response blocked.'
+
+          def name
+            NAME
+          end
+
+          def block_message
+            BLOCK_MESSAGE
+          end
+
+          def infilter context, database, query_string
+            return nil unless infilter?(context)
+
+            result = find_attacker(context, query_string, database: database)
+            return nil unless result
+
+            append_to_activity(context, result)
+
+            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
+          end
+
+          def build_attack_with_match context, input_analysis_result, result, query_string, **kwargs
+            attack_string = input_analysis_result.value
+            regexp = Regexp.new(Regexp.escape(attack_string), Regexp::IGNORECASE)
+
+            return nil unless query_string.match?(regexp)
+
+            database = kwargs[:database]
+            scanner = select_scanner(database)
+
+            ss = StringScanner.new(query_string)
+            length = attack_string.length
+            while ss.scan_until(regexp)
+              # the pos of StringScanner is at the end of the regexp (input string),
+              # we need the beginning
+              idx = ss.pos - attack_string.length
+              last_boundary, boundary = scanner.crosses_boundary(query_string, idx, input_analysis_result.value)
+              next unless last_boundary && boundary
+
+              input_analysis_result.attack_count = input_analysis_result.attack_count + 1
+
+              kwargs[:start_idx] = idx
+              kwargs[:end_idx] = idx + length
+              kwargs[:boundary_overrun_idx] = boundary
+              kwargs[:input_boundary_idx] = last_boundary
+
+              result ||= build_attack_result(context)
+              update_successful_attack_response(context, input_analysis_result, result, query_string)
+              append_sample(context, input_analysis_result, result, query_string, **kwargs)
+            end
+
+            result
+          end
+
+          protected
+
+          def build_sample context, input_analysis_result, candidate_string, **kwargs
+            input = input_analysis_result.value
+
+            sample = build_base_sample(context, input_analysis_result)
+            sample.sqli = Contrast::Api::Dtm::SqlInjectionDetails.new
+            sample.sqli.query = Contrast::Utils::StringUtils.protobuf_safe_string(candidate_string)
+            sample.sqli.start_idx = sample.sqli.query.index(input).to_i
+            sample.sqli.end_idx = sample.sqli.start_idx + input.length
+            sample.sqli.boundary_overrun_idx = kwargs[:boundary].to_i
+            sample.sqli.input_boundary_idx = kwargs[:last_boundary].to_i
+            sample
+          end
+
+          private
+
+          def select_scanner database
+            @sql_scanners ||= {
+                Contrast::CoreExtensions::Protect::AppliesSqliRule::DATABASE_MYSQL =>
+                    Contrast::Agent::Protect::Rule::Sqli::MysqlSqlScanner.new,
+                Contrast::CoreExtensions::Protect::AppliesSqliRule::DATABASE_PG =>
+                    Contrast::Agent::Protect::Rule::Sqli::PostgresSqlScanner.new,
+                Contrast::CoreExtensions::Protect::AppliesSqliRule::DATABASE_SQLITE =>
+                    Contrast::Agent::Protect::Rule::Sqli::SqliteSqlScanner.new
+            }.cs__freeze
+
+            @default_sql_scanner ||= Contrast::Agent::Protect::Rule::Sqli::DefaultSqlScanner.new
+            @sql_scanners[database.to_s] || @default_sql_scanner
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/sqli/default_sql_scanner.rb

@@ -0,0 +1,16 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # @deprecated RUBY-356
+        class Sqli
+          class DefaultSqlScanner < Contrast::Agent::Protect::Rule::DefaultScanner
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/sqli/mysql_sql_scanner.rb

@@ -0,0 +1,38 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# This class is the concrete implementation of the DefaultSqlScanner designed
+# to support the customizations of MySQL.
+#
+# @deprecated RUBY-356
+# rubocop:disable Style/ClassAndModuleChildren
+class Contrast::Agent::Protect::Rule::Sqli::MysqlSqlScanner <
+    Contrast::Agent::Protect::Rule::Sqli::DefaultSqlScanner
+  # rubocop:enable Style/ClassAndModuleChildren
+
+  # Is the current character '#' or are the current and
+  # subsequent characters both '-' ?
+  def start_line_comment? char, index, query
+    return true if char == Contrast::Utils::ObjectShare::POUND_SIGN
+    return false unless char == Contrast::Utils::ObjectShare::DASH
+    return false unless (query.length - 2) >= index
+
+    query[index + 1] == Contrast::Utils::ObjectShare::DASH
+  end
+
+  # Is the current character / sequence of characters the start of a block
+  # comment. In MySQL, '/*!' is an inline comment that has code that's
+  # executed, so it does not count as a block comment start
+  def start_block_comment? char, index, query
+    return false unless char == Contrast::Utils::ObjectShare::SLASH
+    return false unless (query.length - 3) >= index
+
+    query[index + 1] == Contrast::Utils::ObjectShare::ASTERISK &&
+        query[index + 2] != Contrast::Utils::ObjectShare::EXCLAMATION
+  end
+
+  # Indicates if '""' inside of double quotes is the equivalent of '\"'
+  def double_quote_escape_in_double_quote?
+    true
+  end
+end

data/lib/contrast/agent/protect/rule/sqli/postgres_sql_scanner.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        class Sqli
+          # This class is the concrete implementation of the DefaultSqlScanner designed
+          # to support the customizations of MySQL.
+          #
+          # @deprecated RUBY-356
+          class PostgresSqlScanner < Contrast::Agent::Protect::Rule::Sqli::DefaultSqlScanner
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/sqli/sqlite_sql_scanner.rb

@@ -0,0 +1,19 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        class Sqli
+          # This class is the concrete implementation of the DefaultSqlScanner designed
+          # to support the customizations of MySQL.
+          #
+          # @deprecated RUBY-356
+          class SqliteSqlScanner < Contrast::Agent::Protect::Rule::Sqli::DefaultSqlScanner
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect Unsafe File Upload rule.
+        class UnsafeFileUpload < Contrast::Agent::Protect::Rule::BaseService
+          NAME = 'unsafe-file-upload'
+          BLOCK_MESSAGE = 'Unsafe file upload rule triggered. Request blocked.'
+
+          def name
+            NAME
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/xss.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect Cross-Site Scripting rule.
+        class Xss < Contrast::Agent::Protect::Rule::BaseService
+          NAME = 'reflected-xss'
+          BLOCK_MESSAGE = 'XSS rule triggered. Response blocked.'
+
+          def name
+            NAME
+          end
+
+          def stream_safe?
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/xxe.rb

@@ -0,0 +1,120 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/timer'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # Implementation of the XXE Protect Rule used to evaluate XML calls for exploit
+        # of unsafe external entity resolution.
+        class Xxe < Contrast::Agent::Protect::Rule::Base
+          NAME = 'xxe'
+          EXPLOIT_CHARACTERS = Contrast::Utils::ObjectShare::EMPTY_ARRAY
+          BLOCK_MESSAGE = 'XXE rule triggered. Response blocked.'
+          EXTERNAL_ENTITY_PATTERN = /<!ENTITY\s+[a-zA-Z0-f]+\s+(?:SYSTEM|PUBLIC)\s+(.*?)>/.cs__freeze
+
+          def name
+            NAME
+          end
+
+          def infilter context, framework, xml
+            result = find_attacker(context, xml, framework: framework)
+            return nil unless result
+
+            append_to_activity(context, result)
+            return unless blocked?
+
+            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE)
+          end
+
+          protected
+
+          def find_attacker context, xml, **kwargs
+            return nil unless xml
+            return nil if protect_excluded_by_code?
+
+            logger.debug("checking: #{ name } in '#{ kwargs[:framework] }'")
+
+            xxe_details, last_idx = build_details(xml)
+            return nil unless xxe_details
+
+            # For our definition, the prolog goes from the start of the XML
+            # string to the end of the last entity declaration.
+            xxe_details.xml = Contrast::Utils::StringUtils.protobuf_safe_string(xml[0, last_idx])
+            ia_result = build_evaluation(xxe_details.xml)
+            result = build_attack_with_match(
+                context,
+                ia_result,
+                nil,
+                nil,
+                details: xxe_details)
+
+            result
+          end
+
+          def build_details xml, _evaluation = nil
+            last_idx = 0
+            ss = StringScanner.new(xml)
+            while ss.scan_until(EXTERNAL_ENTITY_PATTERN)
+              last_idx = ss.pos
+              entity_wrapper = Contrast::Agent::Protect::Rule::Xxe::EntityWrapper.new(ss.matched)
+              next unless entity_wrapper.external_entity?
+
+              xxe_details ||= Contrast::Api::Dtm::XxeDetails.new
+              xxe_details.declared_entities << build_match(ss)
+              xxe_details.entities_resolved << build_wrapper(entity_wrapper)
+            end
+            [xxe_details, last_idx]
+          end
+
+          def build_sample context, ia_result, _url, **kwargs
+            sample = build_base_sample(context, ia_result)
+            sample.xxe = kwargs[:details]
+            sample
+          end
+
+          INPUT_NAME = 'XML Prolog'
+          def build_user_input ia_result
+            input = Contrast::Api::Dtm::UserInput.new
+            input.key = INPUT_NAME
+            input.input_type = :UNKNOWN
+            input.document_type = :XML
+            input.value = ia_result.value
+            input
+          end
+
+          private
+
+          # We know that this attack happened, so the result is always matched
+          # and the level is always critical. Only variable is the XML value
+          # supplied by the attacker.
+          def build_evaluation xml
+            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
+            ia_result.rule_id = name
+            ia_result.input_type = :UNKNOWN
+            ia_result.value = Contrast::Utils::StringUtils.protobuf_safe_string(xml)
+            ia_result
+          end
+
+          def build_match string_scanner
+            match = Contrast::Api::Dtm::XxeMatch.new
+            match.end_idx = string_scanner.pos.to_i
+            match.start_idx = match.end_idx - string_scanner.matched_size
+            match
+          end
+
+          def build_wrapper entity_wrapper
+            wrapper = Contrast::Api::Dtm::XxeWrapper.new
+            wrapper.system_id = Contrast::Utils::StringUtils.protobuf_safe_string(
+                entity_wrapper.system_id)
+            wrapper.public_id = Contrast::Utils::StringUtils.protobuf_safe_string(
+                entity_wrapper.public_id)
+            wrapper
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb

@@ -0,0 +1,82 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        class Xxe
+          # A holder for the external entity which was determined to be an
+          # attack.
+          class EntityWrapper
+            attr_reader :system_id, :public_id
+
+            def initialize entity
+              @system_id = parse_system_id(entity)
+              # an entity cannot be system and public
+              @public_id = parse_public_id(entity) unless @system_id
+            end
+
+            def external_entity?
+              @_external_entity ||= begin
+                return external_id?(@system_id) if @system_id
+                return external_id?(@public_id) if @public_id
+
+                false
+              end
+            end
+
+            # <!ENTITY name SYSTEM "URI">
+            SYSTEM_ID_REGEXP = /<!ENTITY\s+([a-zA-Z0-f]+)\s+SYSTEM\s+"(?<id>.*?)">/.cs__freeze
+            def parse_system_id entity
+              match = SYSTEM_ID_REGEXP.match(entity)
+              match[:id] if match
+            end
+
+            # <!ENTITY name PUBLIC "public_ID" "URI">
+            PUBLIC_ID_REGEXP = /<!ENTITY\s+([a-zA-Z0-f]+)\s+PUBLIC\s+".*?"\s+"(?<id>.*?)">/.cs__freeze
+            def parse_public_id entity
+              match = PUBLIC_ID_REGEXP.match(entity)
+              match[:id] if match
+            end
+
+            DTD_MARKER =   '.dtd'
+            FILE_START =   'file:'
+            FTP_START =    'ftp:'
+            GOPHER_START = 'gopher:'
+            JAR_START =    'jar:'
+            UP_DIR_LINUX = '../'
+            UP_DIR_WIN =   '..\\'
+            # we only use this against lowercase strings, removed A-Z for speed
+            FILE_PATTERN_WINDOWS = /^[\\\\]*[a-z]{1,3}:.*/.cs__freeze
+            def external_id? entity_id
+              return false unless entity_id
+
+              # downcase this since we don't have an ignore case compare
+              tmp_id = entity_id.to_s.downcase
+
+              # external if http(s) and not a dtd file
+              http = tmp_id.start_with?(Contrast::Utils::ObjectShare::HTTP_START,
+                                        Contrast::Utils::ObjectShare::HTTPS_START)
+              return true if http && !tmp_id.end_with?(DTD_MARKER)
+
+              # external if using external protocol
+              return true if tmp_id.start_with?(FTP_START, FILE_START,
+                                                JAR_START, GOPHER_START)
+
+              # external if start with path marker (/ or .)
+              return true if tmp_id.start_with?(Contrast::Utils::ObjectShare::SLASH,
+                                                Contrast::Utils::ObjectShare::PERIOD)
+
+              # external if start with path up marker (../ or ..\)
+              return true if tmp_id.start_with?(UP_DIR_LINUX, UP_DIR_WIN)
+
+              # external if matches windows file pattern
+              tmp_id.match?(FILE_PATTERN_WINDOWS)
+            end
+          end
+        end
+      end
+    end
+  end
+end