contrast-agent 3.8.4

data/lib/contrast/config/agent_configuration.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # core functionality of the Agent.
+    class AgentConfiguration < BaseConfiguration
+      KEYS = {
+          enable: EMPTY_VALUE,
+          start_bundled_service: Contrast::Config::DefaultValue.new(true),
+          omit_body: EMPTY_VALUE,
+          service: Contrast::Config::ServiceConfiguration,
+          logger: Contrast::Config::LoggerConfiguration,
+          ruby: Contrast::Config::RubyConfiguration,
+          heap_dump: Contrast::Config::HeapDumpConfiguration
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/application_configuration.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # application identification functionality of the Agent.
+    class ApplicationConfiguration < BaseConfiguration
+      KEYS = {
+          name: EMPTY_VALUE,
+          version: EMPTY_VALUE,
+          language: EMPTY_VALUE,
+          path: EMPTY_VALUE,
+          group: EMPTY_VALUE,
+          tags: EMPTY_VALUE,
+          code: EMPTY_VALUE,
+          metadata: EMPTY_VALUE,
+          session_id: EMPTY_VALUE,
+          session_metadata: EMPTY_VALUE
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/assess_configuration.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # assess functionality of the Agent.
+    class AssessConfiguration < BaseConfiguration
+      KEYS = {
+          tags: EMPTY_VALUE,
+          enable: EMPTY_VALUE,
+          enable_scan_response: Contrast::Config::DefaultValue.new('true'),
+          sampling: Contrast::Config::SamplingConfiguration,
+          rules: Contrast::Config::AssessRulesConfiguration
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/assess_rules_configuration.rb

@@ -0,0 +1,18 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # disabled assess rule functionality of the Agent.
+    class AssessRulesConfiguration < BaseConfiguration
+      KEYS = {
+          disabled_rules: EMPTY_VALUE
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/base_configuration.rb

@@ -0,0 +1,105 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'forwardable'
+cs__scoped_require 'contrast/utils/object_share'
+
+module Contrast
+  module Config
+    # This is the base for our configuration classes. It is intended to
+    # facilitate the translation of the Common Configuration settings to usable
+    # Ruby classes.
+    class BaseConfiguration
+      extend Forwardable
+
+      BOOLEANS = [true, false].cs__freeze
+
+      attr_reader :map
+      alias_method :to_hash, :map
+      def_delegators :@map, :empty?, :key?,
+                     :delete,
+                     :fetch, :[], :[]=,
+                     :each, :each_pair, :each_key, :each_value
+
+      EMPTY_VALUE = :EMPTY_VALUE
+
+      def initialize hsh = {}, keys = {}
+        @map = {}
+        traverse_config(hsh, keys)
+      end
+
+      def assign_value_to_path_array dot_path_array, value
+        current_level = self
+        dot_path_array[0...-1].each do |segment|
+          current_level = current_level.send(segment) if current_level.cs__respond_to?(segment)
+        end
+        last_entry = dot_path_array[-1]
+        current_level.send("#{ last_entry }=", value) if current_level.nil? == false && current_level.cs__respond_to?(last_entry)
+        nil
+      end
+
+      def nil?
+        @map.empty?
+      end
+
+      private
+
+      # Traverse the given entity to build out the configuration graph.
+      #
+      # The values will be either a hash, indicating internal nodes to
+      # traverse, or a value to set or the EMPTY_VALUE symbol, indicating a
+      # leaf node.
+      #
+      # The spec_keys are the Contrast defined keys used to access a given
+      # configuration. Each child of this class maintains its own set of keys,
+      # as well as Objects to which those keys map.
+      def traverse_config values, spec_keys
+        internal_nodes = values.cs__respond_to?(:has_key?)
+        spec_keys.each_pair do |spec_key, spec_value|
+          user_provided_value = internal_nodes ? value_from_key_config(spec_key, values) : EMPTY_VALUE
+          define_methods(spec_key, spec_value, user_provided_value)
+        end
+      end
+
+      def define_methods spec_key, spec_value, user_provided_value
+        str_key = spec_key.to_s
+        assign_config_value(str_key, spec_value, user_provided_value)
+        define_getter(str_key)
+        define_setter(str_key)
+      end
+
+      def assign_config_value str_key, spec_value, user_provided_value
+        @map[str_key] = if spec_value.is_a?(Class) && spec_value <= Contrast::Config::BaseConfiguration
+                          spec_value.new(user_provided_value)
+                        elsif spec_value.is_a?(Contrast::Config::DefaultValue) && user_provided_value == EMPTY_VALUE
+                          spec_value.value
+                        elsif BOOLEANS.include?(user_provided_value)
+                          user_provided_value.to_s
+                        else
+                          user_provided_value
+                        end
+      end
+
+      def value_from_key_config key, config_hash
+        return config_hash[key] if config_hash.key?(key)
+        return config_hash.fetch(key.to_sym, EMPTY_VALUE) if key.is_a?(String)
+
+        config_hash.fetch(key.to_s, EMPTY_VALUE)
+      end
+
+      def define_getter str_key
+        define_singleton_method str_key.to_sym do
+          @map[str_key] == EMPTY_VALUE ? nil : @map[str_key]
+        end
+      end
+
+      def define_setter str_key
+        define_singleton_method "#{ str_key }=".to_sym do |new_value|
+          boolean_value = new_value == true
+          boolean_value ||= new_value == false
+          @map[str_key] = boolean_value ? new_value.to_s : new_value
+        end
+      end
+    end
+  end
+end

data/lib/contrast/config/default_value.rb

@@ -0,0 +1,16 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # This is the wrapper for the default values in the configurations, used to
+    # differentiate between nil or false defaults and things being set
+    # explicitly to false.
+    class DefaultValue
+      attr_reader :value
+      def initialize value
+        @value = value
+      end
+    end
+  end
+end

data/lib/contrast/config/exception_configuration.rb

@@ -0,0 +1,21 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # exception handling in Ruby, allowing for the override of Response Code
+    # and Message when Security Exceptions are raised.
+    class ExceptionConfiguration < BaseConfiguration
+      KEYS = {
+          capture: EMPTY_VALUE,
+          override_status: EMPTY_VALUE,
+          override_message: EMPTY_VALUE
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/heap_dump_configuration.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # Heap Dump collection functionality of the Agent.
+    class HeapDumpConfiguration < BaseConfiguration
+      KEYS = {
+          enable: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::FALSE), # should dumps be taken
+          path: Contrast::Config::DefaultValue.new('contrast_heap_dumps'),                 # dir to which dumps should be saved
+          delay_ms: Contrast::Config::DefaultValue.new(10_000),                            # time, in ms, after initialization to delay before taking dump
+          window_ms: Contrast::Config::DefaultValue.new(10_000),                           # ms between each dump
+          count: Contrast::Config::DefaultValue.new(5),                                    # number of dumps to take
+          clean: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::FALSE)   # remove temporary objects
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/inventory_configuration.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # inventory functionality of the Agent.
+    class InventoryConfiguration < BaseConfiguration
+      KEYS = {
+          enable: EMPTY_VALUE,
+          record_used_classes: EMPTY_VALUE,
+          tags: EMPTY_VALUE
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/logger_configuration.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # logging in the Agent.
+    class LoggerConfiguration < BaseConfiguration
+      KEYS = {
+          path: EMPTY_VALUE,
+          level: EMPTY_VALUE,
+          progname: EMPTY_VALUE
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/protect_configuration.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # protect functionality of the Agent.
+    class ProtectConfiguration < BaseConfiguration
+      KEYS = {
+          exceptions: Contrast::Config::ExceptionConfiguration,
+          rules: Contrast::Config::ProtectRulesConfiguration,
+          enable: EMPTY_VALUE
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/protect_rule_configuration.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'set'
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # rule mode of a single protect rule in the Agent.
+    class ProtectRuleConfiguration < BaseConfiguration
+      # rubocop:disable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
+      BLOCKING_RULES   = ::Set.new([:BLOCK , :BLOCK_AT_PERIMETER                  ]).cs__freeze
+      PREFILTER_RULES  = ::Set.new([         :BLOCK_AT_PERIMETER                  ]).cs__freeze
+      POSTFILTER_RULES = ::Set.new([:BLOCK , :PERMIT, :MONITOR]).cs__freeze
+      # rubocop:enable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
+
+      KEYS = {
+          enable: EMPTY_VALUE,
+          mode: EMPTY_VALUE,
+          disable_system_commands: EMPTY_VALUE,
+          detect_custom_code_accessing_system_files: Contrast::Config::DefaultValue.new('true')
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+
+      def off?
+        mode == 'off'
+      end
+
+      def on?
+        !off?
+      end
+    end
+  end
+end

data/lib/contrast/config/protect_rules_configuration.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # protect rule modes of the Agent.
+    class ProtectRulesConfiguration < BaseConfiguration
+      KEYS = {
+          disabled_rules: EMPTY_VALUE,
+          'bot-blocker' => Contrast::Config::ProtectRuleConfiguration,
+          'cmd-injection' => Contrast::Config::ProtectRuleConfiguration,
+          'sql-injection' => Contrast::Config::ProtectRuleConfiguration,
+          'nosql-injection' => Contrast::Config::ProtectRuleConfiguration,
+          'untrusted-deserialization' => Contrast::Config::ProtectRuleConfiguration,
+          'method-tampering' => Contrast::Config::ProtectRuleConfiguration,
+          csrf: Contrast::Config::ProtectRuleConfiguration,
+          xxe: Contrast::Config::ProtectRuleConfiguration,
+          'path-traversal' => Contrast::Config::ProtectRuleConfiguration,
+          'reflected-xss' => Contrast::Config::ProtectRuleConfiguration,
+          'unsafe-file-upload' => Contrast::Config::ProtectRuleConfiguration,
+          'Contrast::Agent::Protect::Rule::Base' => Contrast::Config::ProtectRuleConfiguration
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/root_configuration.rb

@@ -0,0 +1,26 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # The base of the Common Configuration settings.
+    class RootConfiguration < BaseConfiguration
+      KEYS = {
+          enable: BaseConfiguration::EMPTY_VALUE,
+          agent: Contrast::Config::AgentConfiguration,
+          application: Contrast::Config::ApplicationConfiguration,
+          server: Contrast::Config::ServerConfiguration,
+          assess: Contrast::Config::AssessConfiguration,
+          inventory: Contrast::Config::InventoryConfiguration,
+          protect: Contrast::Config::ProtectConfiguration,
+          service: Contrast::Config::ServiceConfiguration
+      }.cs__freeze
+
+      def initialize hsh = {}
+        raise ArgumentError, 'Expected a hash' unless hsh.is_a?(Hash)
+
+        super(hsh, KEYS)
+      end
+    end
+  end
+end

data/lib/contrast/config/ruby_configuration.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Common Configuration settings. Those in this section pertain to the
+    # specific settings that apply to Ruby
+    class RubyConfiguration < BaseConfiguration
+      # These commands being detected will result the agent disabling instrumentation, generally any command
+      # that doesn't result in the application listening on a port can be added here, this normally includes tasks
+      # that are ran pre-startup(like migrations) or to show information about the application(such as routes)
+      DISABLED_RAKE_TASK_LIST = %w[
+        about assets:clean assets:clobber assets:environment
+        assets:precompile assets:precompile:all db:create db:drop db:fixtures:load db:migrate
+        db:migrate:status db:rollback db:schema:cache:clear db:schema:cache:dump db:schema:dump
+        db:schema:load db:seed db:setup db:structure:dump db:version doc:app graphql:install graphql:object
+        log:clear middleware notes notes:custom rails:template rails:update routes secret spec spec:features
+        spec:requests spec:controllers spec:helpers spec:models spec:views spec:routing spec:rcov stats
+        test test:all test:all:db test:recent test:single test:uncommitted time:zones:all tmp:clear
+        tmp:create webpacker:compile contrast:service:start contrast:service:status contrast:service:stop
+      ].cs__freeze
+
+      DEFAULT_UNINSTRUMENTED_NAMESPACES = %w[FactoryGirl FactoryBot].cs__freeze
+
+      KEYS = {
+          disabled_agent_rake_tasks: Contrast::Config::DefaultValue.new(DISABLED_RAKE_TASK_LIST),
+          exceptions: Contrast::Config::ExceptionConfiguration,
+          interpolate: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE), # :-(
+          require_scan: Contrast::Config::DefaultValue.new(Contrast::Utils::ObjectShare::TRUE), # control whether or not we run file scanning rules
+          track_frozen_sources: EMPTY_VALUE,
+          uninstrument_namespace: Contrast::Config::DefaultValue.new(DEFAULT_UNINSTRUMENTED_NAMESPACES)
+      }.cs__freeze
+
+      def initialize hsh
+        super(hsh, KEYS)
+      end
+    end
+  end
+end