contrast-agent 3.8.4

data/lib/contrast/agent/railtie.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/operating_environment'
+
+module Contrast
+  module Agent
+    # A Railtie to allow for the automatic hooking of the Agent into a Rails
+    # application.
+    class Railtie < Rails::Railtie
+      initializer 'Contrast Ruby Agent Initializer' do |app|
+        if defined?(Rails) && defined?(Rails.logger)
+          Rails.logger.debug('In railtie ::')
+          Rails.logger.debug(app.middleware.inspect)
+        end
+
+        if Contrast::Utils::OperatingEnvironment.unsupported?
+          Rails.logger.debug('Detected a non-webserver context, skipping Contrast middleware insertion.')
+        else
+          # Keep our middleware at the outermost layer of the onion
+          app.middleware.insert_before 0, Contrast::Agent::Middleware
+        end
+      end
+
+      rake_tasks do
+        load 'contrast/tasks/service.rb'
+      end
+    end
+  end
+end

data/lib/contrast/agent/reaction_processor.rb

@@ -0,0 +1,47 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/disable_reaction'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    # Because communication between the Agent/Service and TeamServer can only
+    # be initiated by outbound connections from the Agent/Service, we must
+    # provide a mechanism for the TeamServer to direct the Agent to take a
+    # specific action. This action is referred to as a Reaction. This class is
+    # how we handle those Reaction messages.
+    class ReactionProcessor
+      include Contrast::Components::Interface
+      access_component :logging
+
+      # Process the given Reactions from the application settings based on what
+      # TeamServer has indicated. Each Reaction will result in a log message
+      # and, optionally, an action.
+      #
+      # @param application_settings [Contrast::Api::Settings::ApplicationSettings]
+      #   those settings which the Service has relayed from TeamServer.
+      def self.process application_settings
+        return nil unless application_settings&.reactions&.any?
+
+        application_settings.reactions.each do |reaction|
+          logger.debug(nil, "Received the following reaction: #{ reaction.operation }")
+
+          # the enums are all uppercase, we need to downcase them before attempting to log
+          level = reaction.log_level.nil? ? :error : reaction.log_level.downcase
+
+          logger.with_level(nil, reaction.message, level) if reaction.message
+
+          case reaction.operation
+          when :DISABLE
+            Contrast::Agent::DisableReaction.run reaction, level
+          when :NOOP # rubocop:disable Lint/EmptyWhen
+            # NOOP
+          else
+            logger.warn(nil, "ReactionProcessor received a reaction with an unknown operation: #{ reaction.operation }")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/request.rb

@@ -0,0 +1,493 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'resolv'
+cs__scoped_require 'timeout'
+
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/comment_range'
+cs__scoped_require 'contrast/utils/hash_digest'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    # This class is the Contrast representation of the Rack::Request object. It
+    # provides access to the original Rack::Request object as well as extracts
+    # data in a format that the Agent expects, caching those transformations in
+    # order to avoid repeatedly creating Strings & thrashing GC.
+    class Request
+      include Contrast::Components::Interface
+      access_component :logging, :scope
+
+      extend Forwardable
+
+      INNER_REST_TOKEN = %r{/[\d]+/}.cs__freeze
+      LAST_REST_TOKEN = %r{/[\d]+$}.cs__freeze
+      INNER_NUMBER_MARKER = '/{n}/'
+      LAST_NUMBER_MARKER = '/{n}'
+      OMITTED_BODY = '{{body-omitted-by-contrast}}'
+
+      attr_reader :rack_request
+
+      def_delegators :@rack_request,
+                     :env,
+                     :query_string,
+                     :user_agent,
+                     :path,
+                     :base_url
+
+      # receiver is memoized because it is the address/host/port of the server, once we
+      # resolve this for the first time, it shouldn't change
+      def self.receiver
+        @_receiver ||= build_receiver
+      end
+
+      def initialize rack_request
+        @rack_request = rack_request
+      end
+
+      ACCEPT = 'ACCEPT'
+      def accept_headers
+        accepts = Array(normalized_request_headers[ACCEPT])
+        accepts.any? ? accepts : nil
+      end
+
+      STATIC_SUFFIXES = /\.(?:js|css|jpeg|jpg|gif|png|ico|woff|svg|pdf|eot|ttf|jar)$/i.cs__freeze
+      WILDCARD = '*/*'
+      # Utility method for checking if a request is for a static resource.
+      # @return [Boolean] true, if the request is for a well-known static
+      #  type, like the following, and false otherwise: .js, .css, .jpg,
+      # .gif, .png, .ico
+      def static_request?
+        return true if trimmed_uri&.match?(STATIC_SUFFIXES)
+
+        accepts = accept_headers
+        if accepts
+          return false if accepts[0].to_s.start_with?(WILDCARD)
+          return true if media_content_type?(accepts[0])
+        end
+
+        false
+      end
+
+      MEDIA_TYPE_MARKERS = %w[image/ text/css text/javascript].cs__freeze
+      def media_content_type? str
+        str = str.to_s
+        str.start_with?(*MEDIA_TYPE_MARKERS)
+      end
+
+      def trimmed_uri
+        @_trimmed_uri ||= begin
+          raise ArgumentError, 'url was nil when attempting to trim' unless uri
+
+          trimmed = uri.split(Contrast::Utils::ObjectShare::SEMICOLON).first # remove ;jsessionid
+          trimmed.split(Contrast::Utils::ObjectShare::QUESTION_MARK).first # remove ?query_string=
+        end
+      end
+
+      # Returns a normalized form of the URI. In "normal" URIs
+      # this will return an unchanged String, but in REST-y
+      # URIs this will normalize the digit path tokens, e.g.:
+      #
+      # /accounts/5/view
+      # ...becomes:
+      # /accounts/{n}/view
+      #
+      # Should also handle the ;jsessionid.
+      def normalized_uri
+        @_normalized_uri ||= begin
+          uri = trimmed_uri
+          uri = uri.gsub(INNER_REST_TOKEN, INNER_NUMBER_MARKER) # replace interior tokens
+          uri.gsub(LAST_REST_TOKEN, LAST_NUMBER_MARKER) # replace last token
+        end
+      end
+
+      UNKNOWN_REQUEST_METHOD = 'UNKNOWN'
+
+      def request_method
+        rack_request.get_header(Rack::REQUEST_METHOD)
+      rescue StandardError => e
+        logger.warn("Unable to extract request method: #{ e }")
+        UNKNOWN_REQUEST_METHOD
+      end
+
+      def document_type_from_header
+        case content_type
+        when /xml/i
+          :XML
+        when /json/i
+          :JSON
+        when /html/i
+          :NORMAL
+        end
+      end
+
+      def document_type
+        @_document_type ||= begin
+          type = document_type_from_header
+          if type
+            type
+          elsif request_body_str.start_with?('<?xml')
+            :XML
+          elsif request_body_str.match?(/\s*[{\[]/)
+            :JSON
+          else
+            :NORMAL
+          end
+        end
+      end
+
+      def request_headers
+        @_request_headers ||= begin
+          with_contrast_scope do
+            headers = header_pairs(env).each_with_object({}) do |pair, h|
+              h[pair[0]] = pair[1]
+            end
+            headers
+          end
+        end
+      end
+
+      # Header keys upcased and any underscores replaced with dashes
+      def normalized_request_headers
+        @_normalized_request_headers ||= begin
+          hash = {}
+          request_headers.each_pair do |header_name, header_value|
+            hash[Contrast::Utils::StringUtils.normalized_key(header_name)] = header_value
+          end
+          hash
+        end
+      end
+
+      def header_value key
+        normalized_request_headers[Contrast::Utils::StringUtils.normalized_key(key)]
+      end
+
+      # Return a flattened hash of params with realized paths for keys, in
+      # addition to a separate, valueless, entry for each nest key.
+      # See RUBY-621 for more details.
+      # { key : { nested_key : ['x','y','z' ] } }
+      # becomes
+      # {
+      #   key[nested_key][0] : 'x'
+      #   key[nested_key][1] : 'y'
+      #   key[nested_key][2] : 'z'
+      #   key :                ''
+      #   nested_key :         ''
+      # }
+      def normalize_params val, prefix: nil
+        # In non-recursive invocations, val should always be a Hash
+        # (rather than breaking this out into two methods)
+        case val
+        when Tempfile
+          { prefix => Contrast::Utils::StringUtils.force_utf8(val.path) }
+        when Hash
+          res = val.each_with_object({}) do |(k, v), hash|
+            k = Contrast::Utils::StringUtils.force_utf8(k)
+            nested_prefix = prefix.nil? ? k : "#{ prefix }[#{ k }]"
+            hash[k] = Contrast::Utils::ObjectShare::EMPTY_STRING
+            hash.merge! normalize_params(v, prefix: nested_prefix)
+          end
+          res[prefix] = Contrast::Utils::ObjectShare::EMPTY_STRING if prefix
+          res
+        when Enumerable
+          res = val.each_with_index.each_with_object({}) do |(v, i), hash|
+            hash.merge! normalize_params(v, prefix: "#{ prefix }[#{ i }]")
+          end
+          res[prefix] = Contrast::Utils::ObjectShare::EMPTY_STRING if prefix
+          res
+        else
+          { prefix => Contrast::Utils::StringUtils.force_utf8(val) }
+        end
+      end
+
+      def request_body
+        # Memoize a flag indicating whether we've tried to read the body or not
+        # (can't use body because it might be nil)
+        @_request_body_read ||= begin
+          body = @rack_request.body
+          if defined?(Rack::Multipart)
+            if defined?(Rack::Multipart::UploadedFile) && body.is_a?(Rack::Multipart::UploadedFile)
+              logger.debug("not parsing uploaded file body :: #{ body.original_filename }::#{ body.content_type }")
+              @_request_body = nil
+            else
+              logger.debug("parsing body from request :: #{ body.cs__class.cs__name }")
+              @_request_body = Contrast::Utils::StringUtils.force_utf8(read_body(body), logger)
+            end
+          else
+            logger.debug('Rack before 1.3.x does not support Rack::Multipart')
+            @_request_body = Contrast::Utils::StringUtils.force_utf8(read_body(body), logger)
+          end
+
+          true
+        end
+
+        # Return memoized body (which might be nil)
+        @_request_body
+      end
+
+      def request_body_str
+        request_body.to_s || Contrast::Utils::ObjectShare::EMPTY_STRING
+      end
+
+      # This will become to_protobuf
+      # Expectation is that all data from a previous phase will be populated
+      # before the subsequent one begins
+      def dtm
+        @_dtm ||= begin
+          with_contrast_scope do
+            http_request = Contrast::Api::Dtm::HttpRequest.new
+            http_request.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
+            http_request.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
+
+            append_receiver(http_request)
+            append_connection(http_request)
+            append_params(http_request)
+            append_headers(http_request)
+            append_body(http_request)
+
+            http_request
+          end
+        end
+      end
+
+      def append_receiver http_request
+        r = cs__class.receiver
+        r.port = port.to_i if port
+        http_request.receiver = r unless r.nil?
+      end
+
+      def append_connection http_request
+        http_request.sender = Contrast::Api::Dtm::Address.new
+        http_request.sender.ip = Contrast::Utils::StringUtils.force_utf8(ip)
+        http_request.protocol = Contrast::Utils::StringUtils.force_utf8(scheme)
+        http_request.version = '1.1' # currently not in rack request; hard-coding
+        http_request.method = Contrast::Utils::StringUtils.force_utf8(request_method)
+        http_request.raw = Contrast::Utils::StringUtils.force_utf8(@rack_request.path_info)
+        http_request.parsed_connection = true
+        http_request.uri = Contrast::Utils::StringUtils.force_utf8(path)
+        http_request.normalized_uri = Contrast::Utils::StringUtils.force_utf8(normalized_uri)
+        http_context = if http_request.uri == Contrast::Utils::ObjectShare::SLASH
+                         Contrast::Utils::ObjectShare::SLASH
+                       else
+                         http_request.uri.split(Contrast::Utils::ObjectShare::SLASH).first
+                       end
+        http_request.context = Contrast::Utils::StringUtils.force_utf8(http_context)
+        http_request.path = Contrast::Utils::StringUtils.force_utf8(http_request.uri)
+        http_request.query_string = Contrast::Utils::StringUtils.force_utf8(query_string)
+      end
+
+      def append_params http_request
+        parameters.each do |k, v|
+          next unless k && v
+          next if v.is_a?(Hash)
+
+          key = Contrast::Utils::StringUtils.force_utf8(k)
+          val = Contrast::Utils::StringUtils.force_utf8(v)
+          params = http_request.normalized_request_params
+          params[key] = Contrast::Api::Dtm::Pair.new unless params[key].is_a?(Contrast::Api::Dtm::Pair)
+          params[key].key = key
+          params[key].values << val
+        end
+      end
+
+      def append_headers http_request
+        request_headers.each do |k, v|
+          next unless k && v
+          next if v.is_a?(Hash)
+
+          key = Contrast::Utils::StringUtils.force_utf8(k)
+          val = Contrast::Utils::StringUtils.force_utf8(v)
+          http_request.request_headers[key] = val
+        end
+
+        http_request.parsed_request_headers = true
+
+        normalized_request_headers.each do |k, v|
+          next unless k && v
+          next if v.is_a?(Hash)
+
+          key = Contrast::Utils::StringUtils.force_utf8(k)
+          val = Contrast::Utils::StringUtils.force_utf8(v)
+          http_request.normalized_request_headers[key] ||= Contrast::Api::Dtm::Pair.new
+          http_request.normalized_request_headers[key].key = key
+          http_request.normalized_request_headers[key].values << val
+        end
+
+        request_cookies.each do |k, v|
+          next unless k && v
+          next if v.is_a?(Hash)
+
+          key = Contrast::Utils::StringUtils.force_utf8(k)
+          val = Contrast::Utils::StringUtils.force_utf8(v)
+          http_request.normalized_cookies[key] ||= Contrast::Api::Dtm::Pair.new
+          http_request.normalized_cookies[key].key = key
+          http_request.normalized_cookies[key].values << val
+        end
+      end
+
+      def append_body http_request
+        http_request.document_type = Contrast::Utils::StringUtils.force_utf8(document_type)
+
+        http_request.request_body = if omit_body?
+                                      OMITTED_BODY
+                                    else
+                                      Contrast::Utils::StringUtils.force_utf8(request_body)
+                                    end
+        return if file_names.empty?
+
+        file_names.each do |name, filename|
+          pair = Contrast::Api::Dtm::SimplePair.new
+          pair.key = Contrast::Utils::StringUtils.force_utf8(name)
+          pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
+          http_request.multipart_headers << pair
+        end
+      end
+
+      def omit_body?
+        return true if Contrast::Agent::FeatureState.instance.omit_body?
+        return false if document_type == :XML
+        return false if document_type == :JSON
+
+        content_type&.include?('multipart/form-data')
+      end
+
+      def self.build_receiver
+        address = Contrast::Api::Dtm::Address.new
+        address.host = 'localhost'
+        address.ip = '127.0.0.1'
+        begin
+          Timeout.timeout(1) do
+            address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
+            address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
+          end
+        rescue Timeout::Error
+          logger.warn(nil, "Timeout resolving host or ip in #{ address }")
+        rescue StandardError => e
+          logger.warn(e, "Error resolving address for #{ address }")
+        end
+        address
+      end
+
+      # Memoized Rack Request Values
+      def ip
+        @_ip ||= @rack_request.ip
+      end
+
+      def scheme
+        @_scheme ||= @rack_request.scheme
+      end
+
+      def port
+        @_port ||= @rack_request.port
+      end
+
+      def uri
+        @_uri ||= @rack_request.path
+      end
+
+      def url
+        @_url ||= @rack_request.url
+      end
+
+      def content_type
+        @_content_type ||= @rack_request.content_type
+      end
+
+      def path
+        @_path ||= @rack_request.path
+      end
+
+      def request_cookies
+        @_request_cookies ||= @rack_request.cookies
+      end
+
+      def parameters
+        @_parameters ||= with_contrast_scope { normalize_params(@rack_request.params) }
+      end
+
+      def base_url
+        @_base_url ||= @rack_request.base_url
+      end
+
+      # End of Rack Request memoized values
+
+      def file_names
+        @_file_names ||= begin
+                           names = {}
+                           parsed_data = Rack::Multipart.parse_multipart(@rack_request.env)
+                           traverse_parsed_multipart(parsed_data, names)
+                         rescue StandardError => _e
+                           logger.warn('Unable to parse multipart request!')
+                           {}
+                         end
+      end
+
+      def hash_id
+        @_hash_id ||= Contrast::Utils::HashDigest.generate_request_hash(self)
+      end
+
+      # we just need to map length to a repeatable value
+      # unlike Java, we hash with strings, so we'll use single character
+      # strings for our purposes.
+      CHARS = %w[a b c d e f g].cs__freeze
+      def normalized_length_header chr
+        chr = chr.to_s
+        tmp = CHARS[Math.log10(chr.length).to_i] if chr
+        tmp ||= CHARS[6]
+        tmp
+      end
+
+      private
+
+      HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
+
+      def header_pairs env
+        selected = env.select do |k, _v|
+          k.to_s.start_with?(Contrast::Utils::ObjectShare::HTTP_SCORE)
+        end
+        selected.map do |k, v|
+          name = k.to_s.sub(HTTP_PREFIX, Contrast::Utils::ObjectShare::EMPTY_STRING)
+          [name, v]
+        end
+      end
+
+      def read_body body
+        return body if body.is_a?(String)
+
+        begin
+          can_rewind = Contrast::Utils::DuckUtils.quacks_to?(body, :rewind)
+          # if we are after a middleware that failed to rewind
+          body.rewind if can_rewind
+          body.read
+        rescue StandardError => e
+          logger.error("Error in attempt to read body :: #{ e.message }")
+          logger.debug(e.backtrace.join(Contrast::Utils::ObjectShare::NEW_LINE))
+          body.to_s
+        ensure
+          # be a good citizen and rewind
+          body.rewind if can_rewind
+        end
+      end
+
+      def traverse_parsed_multipart multipart_data, current_names
+        return current_names unless multipart_data
+
+        multipart_data.each_value do |data_value|
+          next unless data_value.is_a?(Hash)
+
+          tempfile = data_value[:tempfile]
+          if tempfile.nil?
+            traverse_parsed_multipart(data_value, current_names)
+          else
+            name = data_value[:name].to_s
+            file_name = data_value[:filename].to_s
+            current_names[name] = file_name
+          end
+        end
+        current_names
+      end
+    end
+  end
+end