contrast-agent 3.8.4

data/lib/contrast/core_extensions/assess/string.rb

@@ -0,0 +1,75 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+# This patch installs our extension as early as possible. The alternative is to
+# litter our code with responds_to? checks.
+class String
+  include Contrast::CoreExtensions::Assess::AssessExtension
+end
+
+module Contrast
+  module CoreExtensions
+    module Assess
+      # This Class provides us with a way to invoke String propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # String Class or exposing our methods there.
+      class StringPropagator
+        include Contrast::Components::Interface
+
+        access_component :analysis, :agent, :logging, :scope
+
+        NODE_HASH = {
+            'class_name' => 'String',
+            'instance_method' => true,
+            'method_name' => 'interpolate',
+            'method_visibility' => 'public',
+            'action' => 'CUSTOM',
+            'source' => 'O,P0',
+            'target' => 'R',
+            'patch_class' => 'NOOP',
+            'patch_method' => 'track_interpolation'
+        }.cs__freeze
+        INTERPOLATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
+
+        class << self
+          def track_interpolation inputs, result
+            return unless AGENT.interpolation_enabled?
+            return if in_contrast_scope?
+            return unless inputs.any?(&:cs__tracked?)
+
+            with_contrast_scope do
+              offset = 0
+              inputs.each do |input|
+                result.cs__copy_from(input, offset)
+                offset += input.length
+              end
+              result.cs__properties.build_event(INTERPOLATION_NODE, result, inputs, result, inputs)
+            end
+          end
+
+          def instrument_string_interpolation
+            if @_instrument_string_interpolation.nil?
+              @_instrument_string_interpolation = begin
+                                                    if AGENT.patch_interpolation?
+                                                      cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
+                                                    end
+                                                    true
+                                                  rescue StandardError => e
+                                                    logger.error(e, 'Error loading interpolation patch')
+                                                    false
+                                                  end
+            end
+            @_instrument_string_interpolation
+          end
+        end
+      end
+    end
+  end
+end
+
+cs__scoped_require 'cs__assess_string/cs__assess_string'
+
+Contrast::CoreExtensions::Assess::StringPropagator.instrument_string_interpolation

data/lib/contrast/core_extensions/assess/tilt_template_trigger.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+# This module acts a trigger & propagator for Tilt::Template evaluation
+module TiltTemplateTrigger
+  include Contrast::Components::Interface
+  access_component :logging
+  class << self
+    NODE_HASH = {
+        'class_name' => 'Tilt::Template',
+        'instance_method' => true,
+        'method_name' => 'render',
+        'method_visibility' => 'public',
+        'action' => 'CUSTOM',
+        'source' => 'O,P0',
+        'target' => 'R',
+        'patch_class' => 'NOOP',
+        'patch_method' => 'track_template_evaluation'
+    }.cs__freeze
+    TEMPLATE_PROPAGATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
+
+    def render_trigger_check context, trigger_node, _source, object, ret, invoked, *args
+      logger.debug { 'Tilt::Template Trigger - running propagation' }
+
+      scope = args[0]
+      binding_variables = scope.instance_variables
+      erb_template_prerender = object.instance_variable_get(:@data)
+      interpolated_inputs = []
+      binding_variables.each do |bound_variable_sym|
+        bound_variable_value = scope.instance_variable_get(bound_variable_sym)
+
+        next unless bound_variable_value.cs__respond_to?(:cs__tracked?) && bound_variable_value.cs__tracked?
+        next unless erb_template_prerender.include?(bound_variable_sym.to_s)
+
+        start_index = ret.index(bound_variable_value)
+        next if start_index.nil?
+
+        logger.debug('Tilt::Template Trigger - found bound_variable in erb template result')
+        ret.cs__copy_from(bound_variable_value, start_index)
+        interpolated_inputs << bound_variable_sym
+      end
+
+      locals = args[1]
+      locals.each do |local_name, local_value|
+        next unless local_value.cs__respond_to?(:cs__tracked?) && local_value.cs__tracked?
+        next unless erb_template_prerender.include?(local_name.to_s)
+
+        start_index = ret.index(local_value)
+        next if start_index.nil?
+
+        logger.debug('Tilt:Template Trigger - found local_value in erb template result')
+        ret.cs__copy_from(local_value, start_index)
+        interpolated_inputs << local_name
+      end
+
+      unless interpolated_inputs.empty?
+        interpolated_inputs.each do |input|
+          input.cs__properties.events.each do |event|
+            ret.cs__properties.events << event
+          end
+        end
+        ret.cs__properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs, invoked + 1)
+      end
+
+      if ret.cs__tracked?
+        Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, ret, erb_template_prerender, ret, invoked + 1, interpolated_inputs)
+      end
+
+      ret
+    end
+  end
+end

data/lib/contrast/core_extensions/delegator.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# Some developers override various methods on Delegator, which can often
+# involve changing expected method parity/behavior which in turn prevents us
+# from being able to reliably use affected methods. Let's alias these methods
+# so that we always have access to them.
+#
+# This is a special case in that we're those developers, so we violate the cs__
+# namespacing here to avoid that.
+class Delegator
+  # breaks from convention to not conflict w/ Object#respond_to?
+  alias_method :cs__delegator_respond_to?, :respond_to?
+end

data/lib/contrast/core_extensions/eval_trigger.rb

@@ -0,0 +1,52 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module CoreExtensions
+    module Assess
+      # This Module allows us to track calls to the BasicObject#eval method,
+      # which violates the design of most methods we track in that we have to
+      # apply the trigger in a custom patch over one of the generic triggers in
+      # TriggerMethod.
+      module EvalTrigger
+        def instance_eval_trigger_check source, ret
+          apply_trigger(source, ret, 'BasicObject', :instance_eval)
+        end
+
+        def eval_trigger_check source, ret, method
+          apply_trigger(source, ret, 'Module', method)
+        end
+
+        def apply_trigger source, ret, clazz, method
+          current_context = Contrast::Agent::REQUEST_TRACKER.current
+          return unless current_context
+
+          # Since we know this is the source of the trigger, we can do some
+          # optimization here and return when it is not tracked
+          return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
+
+          # source might not be all the args passed in, but it is the one we care
+          # about. we could pass in all the args in the last param here if it
+          # becomes an issue in rendering on TS
+          Contrast::Agent::Assess::Policy::TriggerMethod.cs__apply_trigger(
+              current_context,
+              trigger_node(clazz, method),
+              source,
+              self,
+              ret,
+              1,
+              source)
+        end
+
+        private
+
+        def trigger_node clazz, method
+          triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+          return unless triggers
+
+          triggers.find { |node| node.class_name == clazz && node.method_name == method }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/core_extensions/inventory.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module CoreExtensions
+    # Our top level Inventory namespace in the Core Extensions section of our
+    # code. These patches are those that are invoked directly from a patched
+    # Class.
+    #
+    # @deprecated This is one of our earliest designs and is not nearly as
+    #   relevant given the move to C based patching and the lessons learned
+    #   therein.
+    module Inventory
+      cs__scoped_require 'contrast/internal_exception'
+      cs__scoped_require 'contrast/security_exception'
+      # patching
+      cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'
+      cs__scoped_require 'contrast/agent/inventory/policy/policy'
+      cs__scoped_require 'contrast/agent/patching/policy/patcher'
+    end
+  end
+end

data/lib/contrast/core_extensions/inventory/datastores.rb

@@ -0,0 +1,37 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/data_store_util'
+
+module Contrast
+  module CoreExtensions
+    module Inventory
+      # This Module is how we apply the Data Store detection required for the
+      # FlowMap feature. It is called from our patches of the targeted methods
+      # in which database operations occur. It is responsible for deciding if
+      # the given invocation is worth reporting or not.
+      module DataStores
+        class << self
+          include Contrast::Components::Interface
+
+          access_component :logging, :analysis
+          # The key used in policy.json to indicate the database type to
+          # report.
+          DATA_STORE_MARKER = 'data_store'
+
+          def cs__patched_report_data_store _method, _exception, properties, object, _args
+            return unless INVENTORY.enabled?
+
+            marker = properties[DATA_STORE_MARKER]
+            return unless marker
+
+            Contrast::Utils::DataStoreUtil.report_data_store(marker)
+          rescue StandardError => e
+            logger.error(e, "Error reporting database call in #{ object }")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/core_extensions/module.rb

@@ -0,0 +1,42 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+
+# Some developers override various methods on Module, which can often involve
+# changing expected method parity/behavior which in turn prevents us from being
+# able to reliably use affected methods. Let's alias these method so that we
+# always have access to them.
+class Module
+  alias_method :cs__name, :name
+  alias_method :cs__constants, :constants
+  alias_method :cs__const_defined?, :const_defined?
+  alias_method :cs__const_get, :const_get
+  alias_method :cs__const_set, :const_set
+  alias_method :cs__autoload?, :autoload?
+
+  # The method const_defined? can cause autoload, which is bad for us. The
+  # method autoload? doesn't traverse namespaces. This method lets us provide a
+  # constant, as a String, and parse it to determine if it has been truly
+  # truly defined, meaning it existed before this method was invoked, not as a
+  # result of it.
+  #
+  # @param name [String] the name of the constant to look up
+  # @return [Boolean]
+  def cs__truly_defined? name
+    return false unless name
+
+    segments = name.split(Contrast::Utils::ObjectShare::DOUBLE_COLON)
+    previous_module = Module
+    segments.each do |segment|
+      return false if previous_module.cs__autoload?(segment)
+      return false unless previous_module.cs__const_defined?(segment)
+
+      previous_module = previous_module.cs__const_get(segment)
+    end
+
+    true
+  rescue NameError # account for nonsense / poorly formatted constants
+    false
+  end
+end

data/lib/contrast/core_extensions/object.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+
+# Some aliases within Object have to happen especially early, because they're
+# core to class definitions.  See lib/contrast.rb.
+# ONLY very core aliasing should go there.  All the routine extension should
+# happen here, where you'd expect it.
+class Object
+  # Return a String representing the self invoking this method.
+  def cs__inspect
+    if cs__is_a?(String)
+      return Contrast::Utils::ObjectShare::EMPTY_STRING if empty?
+
+      dup
+    elsif cs__is_a?(Symbol)
+      ":#{ self }"
+    elsif cs__is_a?(Numeric)
+      to_s
+    elsif cs__is_a?(Module)
+      "#{ cs__name }@#{ __id__ }"
+    else
+      "#{ cs__class.cs__name }@#{ __id__ }"
+    end
+  end
+end

data/lib/contrast/core_extensions/protect.rb

@@ -0,0 +1,20 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module CoreExtensions
+    # Our top level Protect namespace in the Core Extensions section of our
+    # code. These patches are those that are invoked directly from a patched
+    # Class.
+    #
+    # @deprecated This is one of our earliest designs and is not nearly as
+    #   relevant given the move to C based patching and the lessons learned
+    #   therein.
+    module Protect
+      cs__scoped_require 'contrast/security_exception'
+      # patching
+      cs__scoped_require 'contrast/agent/protect/policy/trigger_node'
+      cs__scoped_require 'contrast/agent/protect/policy/policy'
+    end
+  end
+end

data/lib/contrast/core_extensions/protect/applies_command_injection_rule.rb

@@ -0,0 +1,70 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/core_extensions/protect/applies_deserialization_rule'
+
+module Contrast
+  module CoreExtensions
+    module Protect
+      # This Module is how we apply the Command Injection rule. It is called
+      # from our patches of the targeted methods in which command execution
+      # occurs. It is responsible for deciding if the infilter methods of the
+      # rule should be invoked.
+      # In addition, b/c of the nature of Deserialization's sand boxing
+      # function, this Module's apply methods call through to the
+      # {#cs__patched_apply_deserialization_command_check} method of the
+      # Deserialization applicator.
+      module AppliesCommandInjectionRule
+        CS__SEMICOLON = '; '
+
+        class << self
+          include Contrast::Components::Interface
+          access_component :logging, :analysis
+
+          def cs__patched_apply_command_injection_rule method, _exception, _properties, object, args
+            return unless valid_command?(args)
+
+            command = build_command(args)
+            Contrast::CoreExtensions::Protect::AppliesDeserializationRule.cs__patched_apply_deserialization_command_check(command)
+            return if cs__skip_analysis?
+
+            begin
+              clazz = object.is_a?(Module) ? object : object.cs__class
+              class_name = clazz.cs__name
+              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
+            end
+          rescue Contrast::SecurityException => e
+            raise e
+          rescue StandardError => e
+            msg = "command injection: class=#{ object }.#{ method }"
+            logger.error(e, msg)
+          end
+
+          def rule
+            PROTECT.rule Contrast::Agent::Protect::Rule::CmdInjection::NAME
+          end
+
+          def cs__skip_analysis?
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return true unless context&.app_loaded?
+            return true unless rule&.enabled?
+
+            false
+          end
+
+          def valid_command? command
+            command && (command.is_a?(String) || command.is_a?(Array))
+          end
+
+          def build_command command
+            return command if command.is_a?(String)
+
+            command = command.drop(1) if command.length > 1
+            command.join(CS__SEMICOLON)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/core_extensions/protect/applies_deserialization_rule.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module CoreExtensions
+    module Protect
+      # This Module is how we apply the Deserialization rule. It is called from
+      # our patches of the targeted methods in which deserialization occurs.
+      # It is responsible for deciding if the infilter methods of the rule
+      # should be invoked.
+      module AppliesDeserializationRule
+        include Contrast::Components::Interface
+        access_component :logging, :analysis
+
+        class << self
+          def cs__patched_apply_deserialization_rule method, _exception, _properties, object, args
+            return unless valid_input?(args)
+            return if cs__skip_analysis?
+
+            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, args[0])
+          rescue Contrast::SecurityException => e
+            raise e
+          rescue StandardError => e
+            logger.error(e, "Error running untrusted-deserialization rule in #{ object }.#{ method }")
+          end
+
+          def cs__patched_apply_deserialization_command_check command
+            return unless command
+            return if cs__skip_analysis?
+
+            rule.check_command_scope(command)
+          end
+
+          def rule
+            PROTECT.rule Contrast::Agent::Protect::Rule::Deserialization::NAME
+          end
+
+          def valid_input? args
+            return false unless args&.any?
+
+            input = args[0]
+            input.is_a?(String)
+          end
+
+          def cs__skip_analysis?
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return true unless context&.app_loaded?
+            return true unless rule&.enabled?
+
+            false
+          end
+        end
+      end
+    end
+  end
+end