contrast-agent 3.8.4

data/lib/contrast/agent/request_context.rb

@@ -0,0 +1,225 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/timer'
+cs__scoped_require 'contrast/agent/request'
+cs__scoped_require 'contrast/agent/response'
+cs__scoped_require 'contrast/utils/comment_range'
+cs__scoped_require 'contrast/utils/inventory_util'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    # This class acts to encapsulate information about the currently executed
+    # request, making it available to the Agent for the duration of the request
+    # in a standardized and normalized format which the Agent understands.
+    class RequestContext
+      include Contrast::Components::Interface
+      access_component :logging, :analysis, :scope, :contrast_service
+
+      EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
+
+      attr_reader :timer,
+                  :speedracer_input_analysis,
+                  :request,
+                  :response,
+                  :activity,
+                  :server_activity,
+                  :route,
+                  :observed_route
+
+      def initialize rack_request, app_loaded = true
+        with_contrast_scope do
+          # all requests get a timer
+          @timer = Contrast::Utils::Timer.new
+
+          # instantiate helper for request and response
+          @request = Contrast::Agent::Request.new(rack_request)
+
+          @activity = Contrast::Api::Dtm::Activity.new
+          @activity.http_request = request.dtm
+
+          @server_activity = Contrast::Api::Dtm::ServerActivity.new
+
+          @observed_route = Contrast::Api::Dtm::ObservedRoute.new
+
+          # build analyzer
+          @do_not_track = false
+          @speedracer_input_analysis = EMPTY_INPUT_ANALYSIS_PB
+
+          # flag to indicate whether the app is fully loaded
+          @app_loaded = !!app_loaded
+
+          # generic holder for properties that can be set throughout this request
+          @_properties = {}
+
+          @sample = true
+
+          @sample_request, @sample_response = Contrast::Utils::Assess::SamplingUtil.instance.sample?(@request) if ASSESS.enabled?
+
+          @sample_response &&= ASSESS.scan_response?
+
+          append_route_coverage(Contrast::Utils::PathUtil.get_route(@request))
+        end
+      end
+
+      def app_loaded?
+        @app_loaded
+      end
+
+      def analyze?
+        @sample_request || @sample_response
+      end
+
+      def analyze_request?
+        @sample_request
+      end
+
+      def analyze_response?
+        @sample_response
+      end
+
+      # Convert the discovered route for this request to appropriate forms and
+      # disseminate it to those locations where it is necessary for our route
+      # coverage and finding vulnerability discovery features to function.
+      def append_route_coverage route
+        return unless route
+
+        # For our findings
+        @route = route
+
+        # For SR findings
+        @activity.routes << route
+
+        # For TS routes
+        @observed_route.signature  = route.route
+        @observed_route.verb       = route.verb
+        @observed_route.session_id = Contrast::Agent::FeatureState.instance.current_session_id
+
+        # TODO: SPEED-273: deprecate when SR handles this. ContrastUI API currently does not allow empty url, so we have to provide a default
+        @observed_route.url        = route.url.empty? ? Contrast::Utils::ObjectShare::SLASH : route.url
+      end
+
+      # Collect the results for the given rule with the given action
+      #
+      # @param rule [String] the id of the rule to which the results apply
+      # @param response_type [Symbol] the result of the response, matching a
+      #   value of Contrast::Api::Dtm::AttackResult::ResponseType
+      # @return [Array<Contrast::Api::Dtm::AttackResult>]
+      def results_for rule, response_type = nil
+        if response_type.nil?
+          activity.results.select { |r| r.rule_id == rule }
+        else
+          activity.results.select { |r| r.rule_id == rule && r.response == response_type }
+        end
+      end
+
+      def service_extract_request
+        return false if @do_not_track
+
+        service_response = CONTRAST_SERVICE.send_message(@activity.http_request)
+        return false unless service_response
+
+        handle_protect_state(service_response)
+        ia = service_response.input_analysis
+        if ia
+          logger.debug(nil, "Analysis from Contrast Service: evaluations=#{ ia.results.length }")
+          logger.debug(nil, "IA=#{ ia.inspect }")
+          @speedracer_input_analysis = ia
+        else
+          logger.debug(nil, 'Analysis from Contrast Service was empty.')
+          false
+        end
+      rescue Contrast::SecurityException
+        raise
+      rescue StandardError => e
+        logger.warn(e, 'Unable to extract Contrast Service information from request')
+        false
+      end
+
+      # NOTE: this method is only used as a backstop if Speedracer sends Input Evaluations
+      # when the protect state indicates a security exception should be thrown. This method
+      # ensures that the attack reports are generated. Normally these should be generated on
+      # Speedracer for any attacks detected during prefilter.
+      def handle_protect_state agent_settings
+        return unless agent_settings
+        return unless agent_settings.protect_state
+
+        @uuid = agent_settings.protect_state.uuid
+        @do_not_track = true unless agent_settings.protect_state.track_request
+
+        return unless agent_settings.protect_state.security_exception
+
+        # If Contrast Service has NOT handled the input analysis, handle them here
+        build_attack_results(agent_settings)
+
+        msg = agent_settings.protect_state.security_message
+        logger.warn(nil, 'Contrast Service said to block this request')
+        raise Contrast::SecurityException.new(nil, (msg || 'Blocking suspicious behavior'))
+      end
+
+      # append anything we've learned to the request seen message
+      # this is the sum-total of all inventory information that has
+      # been accumulated since the last request
+      def extract_after rack_response
+        @response = Contrast::Agent::Response.new(rack_response)
+        activity.http_response = @response.dtm if @sample_response
+      rescue StandardError => e
+        logger.error(e, 'Unable to extract information after request')
+      end
+
+      def add_property key, value
+        @_properties[key] = value
+      end
+
+      def get_property key
+        @_properties[key]
+      end
+
+      def reset_activity
+        @activity = Contrast::Api::Dtm::Activity.new(http_request: request.dtm)
+        @server_activity = Contrast::Api::Dtm::ServerActivity.new # it doesn't look like this is ever actually used?
+        @observed_route = Contrast::Api::Dtm::ObservedRoute.new
+      end
+
+      private
+
+      # Generate attack results directly from any evaluations on the
+      # agent settings object.
+      def build_attack_results agent_settings
+        return unless agent_settings&.input_analysis&.results&.any?
+
+        attack_results_by_rule = {}
+        agent_settings.input_analysis.results.each do |ia_result|
+          rule_id = ia_result.rule_id
+          rule = PROTECT.rule(rule_id)
+          next unless rule
+
+          logger.debug(nil, "Building attack result from Contrast Service input analysis: result=#{ ia_result.inspect }")
+
+          attack_result = if rule.mode == :BLOCK
+                            # special case for rules (like reflected xss)
+                            # that used to have an infilter / block
+                            # mode but now are just block at perimeter
+                            rule.build_attack_with_match(
+                                self,
+                                ia_result,
+                                attack_results_by_rule[rule_id],
+                                ia_result.value)
+                          else
+                            rule.build_attack_without_match(
+                                self,
+                                ia_result,
+                                attack_results_by_rule[rule_id])
+                          end
+          attack_results_by_rule[rule_id] = attack_result
+        end
+
+        attack_results_by_rule.each_pair do |_, attack_result|
+          logger.debug(nil, "Blocking for #{ attack_result.rule_id }")
+          activity.results << attack_result
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/require_state.rb

@@ -0,0 +1,61 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    # Thread local way to access the current RequireState. Used as a convenient
+    # wrapper to ensure specific key is used and that we handle the case when
+    # we try to enter a previously unset require scope.
+    # (Note that 'require scopes' track nested requires.  This is distinct
+    # from 'contrast scope', which tracks instrumentation.)
+    module RequireStates
+      class << self
+        KEY = :thread_local_contrast_require_scope
+
+        def enter
+          scope = current_scope
+          unless current_scope
+            scope = RequireState.new
+            Thread.current[KEY] = scope
+          end
+          scope.enter
+        end
+
+        def exit
+          current_scope.exit
+        end
+
+        def current_scope
+          Thread.current[KEY]
+        end
+
+        def status
+          current_scope&.scope.to_s
+        end
+
+        def in_scope?
+          scope = current_scope
+          scope && scope.scope > 1
+        end
+      end
+    end
+
+    # Simple counter class for tracking how deep in nested requires / file
+    # load operations we currently are.
+    class RequireState
+      attr_reader :scope
+
+      def initialize
+        @scope = 0
+      end
+
+      def enter
+        @scope += 1
+      end
+
+      def exit
+        @scope -= 1
+      end
+    end
+  end
+end

data/lib/contrast/agent/response.rb

@@ -0,0 +1,215 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'resolv'
+cs__scoped_require 'timeout'
+
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/comment_range'
+cs__scoped_require 'contrast/utils/hash_digest'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Agent
+    # This class is the Contrast representation of the Rack::Response object. It
+    # provides access to the original Rack::Response object as well as extracts
+    # data in a format that the Agent expects, caching those transformations in
+    # order to avoid repeatedly creating Strings & thrashing GC.
+    class Response
+      include Contrast::Components::Interface
+      access_component :logging
+
+      extend Forwardable
+
+      attr_reader :rack_response
+
+      def initialize rack_response
+        @rack_response = rack_response
+        @is_array = !rack_response.is_a?(Rack::Response)
+      end
+
+      def document_type
+        case content_type
+        when /xml/i
+          :XML
+        when /json/i
+          :JSON
+        when /html/i
+          :NORMAL
+        end
+      end
+
+      # B/c the response can change, we can't memoize this :(
+      def dtm
+        context_response = Contrast::Api::Dtm::HttpResponse.new
+        context_response.response_code = response_code.to_i
+        headers.each_pair do |key, value|
+          k = Contrast::Utils::StringUtils.force_utf8(key)
+          v = Contrast::Utils::StringUtils.force_utf8(value)
+          context_response.response_headers[k] = v
+        end
+        context_response.parsed_response_headers = true
+
+        context_response.response_body = Contrast::Utils::StringUtils.force_utf8(body)
+        context_response.parsed_response_body = true
+
+        doc_type = document_type
+        context_response.document_type = doc_type if doc_type
+
+        context_response
+      end
+
+      def response_code
+        return unless @rack_response
+
+        @is_array ? @rack_response[0].to_i : @rack_response.status
+      end
+
+      def headers
+        return unless @rack_response
+
+        if @is_array
+          @rack_response[1]
+        else
+          @rack_response.headers
+        end
+      end
+
+      # Header keys upcased and any underscores replaced with dashes
+      # We cannot memoize this, b/c response headers can change during the
+      # request lifecycle.
+      def normalized_headers
+        hash = {}
+        headers.each_pair do |header_name, header_value|
+          hash[Contrast::Utils::StringUtils.normalized_key(header_name)] = header_value
+        end
+        hash
+      end
+
+      CONTENT_TYPE_HEADER = 'CONTENT-TYPE'.cs__freeze
+      def content_type
+        return unless @rack_response
+
+        if @is_array
+          normalized_headers[CONTENT_TYPE_HEADER]
+        else
+          @rack_response.content_type
+        end
+      end
+
+      def header key
+        return unless @rack_response
+
+        if @is_array
+          normalized_headers[Contrast::Utils::StringUtils.normalized_key(key)]
+        else
+          @rack_response.get_header(key)
+        end
+      end
+
+      def set_header key, value
+        return unless @rack_response
+
+        if @is_array
+          Rack::Utils.set_cookie_header!(@rack_response[1], key, value)
+        elsif @rack_response.is_a?(Rack::Response)
+          @rack_response.set_header(key, value)
+        end
+      end
+
+      # The response body can change during the request lifecycle
+      # We should not extract it out as a variable here, or we'll miss those
+      # changes. (headdesk)
+      def body
+        return unless @rack_response
+
+        if @is_array
+          extract_body(@rack_response[2])
+        elsif Contrast::Utils::DuckUtils.quacks_to?(@rack_response, :body)
+          extract_body(@rack_response.body)
+        end
+      end
+
+      def update_body body_string
+        return unless @rack_response
+
+        successfully_updated_body = true
+        if @is_array
+          if @rack_response[2].is_a?(Rack::BodyProxy)
+            successfully_updated_body = update_rack_body_proxy(body_string, true)
+          else
+            @rack_response[2] = [body_string]
+          end
+        elsif @rack_response.body.is_a?(Rack::BodyProxy)
+          successfully_updated_body = update_rack_body_proxy(body_string)
+        else
+          @rack_response.body = body_string
+        end
+        update_content_length(body_string.bytesize) if successfully_updated_body
+      end
+
+      # Set the length header for this response. This value should be set ot the
+      # bytesize, NOT THE LENGTH, of the response body. Otherwise, we may get
+      # got by the Lint thing.
+      CONTENT_LENGTH_HEADER = 'Content-Length'.cs__freeze
+      def update_content_length length
+        headers[CONTENT_LENGTH_HEADER] = length.to_s
+      end
+
+      private
+
+      HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
+
+      def update_rack_body_proxy body_string, is_array = false
+        top_body_proxy = is_array ? @rack_response[2] : @rack_response
+        parent_body_proxy = top_body_proxy
+        until (next_body = parent_body_proxy.instance_variable_get(:@body)).cs__class != Rack::BodyProxy
+          parent_body_proxy = next_body
+        end
+
+        if next_body.cs__class.to_s == 'ActionDispatch::Response::RackBody'
+          modified_response = next_body.instance_variable_defined?(:@response) ? next_body.instance_variable_get(:@response) : nil
+          if modified_response
+            modified_response.body = body_string
+            next_body.instance_variable_set(:@response, modified_response)
+          end
+        elsif next_body.is_a?(Array) && next_body[0].cs__class.to_s == 'ActionView::OutputBuffer'
+          new_body = ActionView::OutputBuffer.new(body_string)
+          next_body[0] = new_body
+        else
+          logger.warn("Detected unsupported Rack::BodyProxy internal response class #{ next_body.cs__class }")
+          return false
+        end
+        true
+      end
+
+      def extract_body body
+        return nil unless body
+
+        if defined?(Rack::File) && body.is_a?(Rack::File)
+          # not sure what to do in this situation, so don't do anything.
+          nil
+        elsif Contrast::Utils::DuckUtils.quacks_to?(body, :each)
+          acc = []
+          body.each { |tmp| acc << read_or_string(tmp) }
+          acc.compact.join(Contrast::Utils::ObjectShare::NEW_LINE)
+        else
+          read_or_string(body)
+        end
+      end
+
+      def read_or_string obj
+        return nil unless obj
+
+        if Contrast::Utils::DuckUtils.quacks_to?(obj, :read)
+          tmp = obj.read
+          obj.rewind
+          tmp
+        else
+          obj.to_s
+        end
+      end
+    end
+  end
+end