contrast-agent 3.8.4

data/lib/contrast/core_extensions/protect/applies_no_sqli_rule.rb

@@ -0,0 +1,81 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module CoreExtensions
+    module Protect
+      # This Module is how we apply the NoSQL Injection rule. It is called from
+      # our patches of the targeted methods in which the execution of String
+      # based NoSQL queries occur. It is responsible for deciding if the
+      # infilter methods of the rule should be invoked.
+      module AppliesNoSqliRule
+        DATABASE_MONGO = 'MongoDB'
+        ACTION_DISPATCH = 'dispatch'
+        ACTION_READ = 'read'
+        ACTION_WRITE = 'write'
+        ACTION_PROCESS = 'process'
+
+        class << self
+          include Contrast::Components::Interface
+          access_component :logging, :analysis
+
+          def cs__patched_apply_nosql_rule method, _exception, properties, _object, args
+            return unless valid_input?(args)
+            return if cs__skip_analysis?
+
+            database = properties['database']
+            operations = args[0]
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            if operations.is_a?(Array)
+              operations.each do |m|
+                handle_operation(context, database, method, m)
+              end
+            else
+              handle_operation(context, database, method, operations)
+            end
+          rescue Contrast::SecurityException => e
+            raise e
+          rescue StandardError => e
+            logger.error(e, "Error running NoSQLi rule in #{ properties['database'] }")
+          end
+
+          def rule
+            PROTECT.rule Contrast::Agent::Protect::Rule::NoSqli::NAME
+          end
+
+          def valid_input? args
+            return false unless args&.any?
+
+            args[0]
+          end
+
+          def cs__skip_analysis?
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return true unless context&.app_loaded?
+            return true unless rule&.enabled?
+
+            false
+          end
+
+          def handle_operation context, database, action, operation
+            data = extract_mongo_data(operation)
+            return unless data && !data.empty?
+
+            logger.debug(nil, "applying nosqli rule #{ database }##{ action }")
+            rule.infilter(context, database, data)
+          end
+
+          def extract_mongo_data operation
+            if operation.cs__respond_to? :selector
+              operation.selector
+            elsif operation.cs__respond_to? :documents
+              operation.documents
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/core_extensions/protect/applies_path_traversal_rule.rb

@@ -0,0 +1,119 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module CoreExtensions
+    module Protect
+      # This Module is how we apply the Path Traversal rule. It is called from
+      # our patches of the targeted methods in which File or IO access occur.
+      # It is responsible for deciding if the infilter methods of the rule
+      # should be invoked.
+      module AppliesPathTraversalRule
+        include Contrast::Components::Interface
+
+        access_component :logging, :analysis
+
+        class << self
+          def cs__possible_write input
+            input.cs__respond_to?(:to_s) &&
+                input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
+          end
+
+          def rule
+            PROTECT.rule Contrast::Agent::Protect::Rule::PathTraversal::NAME
+          end
+
+          def cs__skip_analysis?
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return true unless context&.app_loaded?
+            return true unless rule&.enabled?
+          end
+
+          def cs__patched_apply_path_traversal_rule method, _exception, properties, _object, args
+            return unless args&.any?
+
+            path = args[0]
+            return unless path.is_a?(String)
+            return if cs__skip_analysis?
+
+            action = properties['action']
+            write_marker = write?(action, *args)
+            possible_write = write_marker && cs__possible_write(write_marker)
+            cs__patched_path_traversal_rule(path, possible_write, method)
+
+            # If the action was copy, we need to handle the write half of it.
+            # We handled read in line above.
+            return unless action == COPY
+            return unless args.length > 1
+
+            dst = args[1]
+            return unless dst.is_a?(String)
+
+            cs__patched_path_traversal_rule(dst, true, method)
+          end
+
+          READ = 'read'
+          WRITE = 'write'
+          COPY = 'copy'
+          def write? action, *args
+            return false if action == READ
+            return false if action == COPY
+            return true if action == WRITE
+
+            write_marker = args.length > 1 ? args[1] : nil
+            write_marker && cs__possible_write(write_marker)
+          end
+
+          def cs__patched_path_traversal_rule path, possible_write, method
+            return unless cs__patched_applies_to?(path, possible_write)
+
+            logger.debug(nil, "checking path traversal: write=true path=#{ path }")
+            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, method, path)
+          rescue Contrast::SecurityException => e
+            raise e
+          rescue StandardError => e
+            logger.error(e, 'path traversal')
+          end
+
+          CS__SAFER_REL_PATHS = %w[public app log tmp].cs__freeze
+          def cs__patched_safer_abs_paths
+            @_cs__patched_safer_abs_paths ||= begin
+              pwd = ENV['PWD']
+              if pwd
+                tmp = CS__SAFER_REL_PATHS.map { |r| "#{ pwd }/#{ r }" }
+                gems = ENV['GEM_PATH']
+                tmp += gems.split(Contrast::Utils::ObjectShare::COLON) if gems
+                tmp
+              else
+                []
+              end
+            end
+          end
+
+          def cs__patched_applies_to? path, possible_write = false
+            # any possible write is a potential risk
+            return true if possible_write
+
+            # any path that moves 'up' is a potential risk
+            return true if path.index(Contrast::Utils::ObjectShare::PARENT_PATH)
+
+            path = path.downcase
+            if path.start_with?(Contrast::Utils::ObjectShare::SLASH)
+              cs__patched_safer_abs_paths.each do |prefix|
+                return false if path.start_with?(prefix)
+              end
+            else
+              CS__SAFER_REL_PATHS.each do |prefix|
+                return false if path.start_with?(prefix)
+              end
+            end
+            true
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/core_extensions/protect/applies_sqli_rule.rb

@@ -0,0 +1,63 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/data_store_util'
+
+module Contrast
+  module CoreExtensions
+    module Protect
+      # This Module is how we apply the SQL Injection rule. It is called from
+      # our patches of the targeted methods in which the execution of String
+      # based SQL queries occur. It is responsible for deciding if the infilter
+      # methods of the rule should be invoked.
+      module AppliesSqliRule
+        DATABASE_MYSQL =    'MySQL'
+        DATABASE_SQLITE =   'SQLite3'
+        DATABASE_PG =       'PostgreSQL'
+
+        class << self
+          include Contrast::Components::Interface
+
+          access_component :logging, :analysis
+
+          def cs__patched_apply_sql_rule method, _exception, properties, object, args
+            database = properties['database']
+            return unless database
+
+            index = properties[Contrast::Utils::ObjectShare::INDEX]
+            return unless valid_input?(index, args)
+            return if cs__skip_analysis?
+
+            sql = args[index]
+            logger.debug(nil, "applying sqli rule on #{ object } for #{ method }")
+            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, database, sql)
+          rescue Contrast::SecurityException => e
+            raise e
+          rescue StandardError => e
+            logger.error(e, "Error running SQLi rule in #{ object }")
+          end
+
+          def rule
+            PROTECT.rule Contrast::Agent::Protect::Rule::Sqli::NAME
+          end
+
+          def valid_input? index, args
+            return false unless args && args.length > index
+
+            sql = args[index]
+            sql && !sql.empty?
+          end
+
+          def cs__skip_analysis?
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return true unless context&.app_loaded?
+            return true unless rule&.enabled?
+
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/core_extensions/protect/applies_xxe_rule.rb

@@ -0,0 +1,141 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/object_share'
+
+module Contrast
+  module CoreExtensions
+    module Protect
+      # This Module is how we apply the XXE rule. It is called from our patches
+      # of the targeted methods in which XML parsing and entity resolution
+      # occurs. It is responsible for deciding if the infilter methods of the
+      # rule should be invoked.
+      module AppliesXxeRule
+        include Contrast::Components::Interface
+        access_component :logging, :analysis
+
+        class << self
+          def cs__patched_apply_xxe_rule _method, _exception, _properties, object, args
+            return unless valid_input?(args)
+            return if cs__skip_analysis?
+
+            xml = args.first
+            parser = determine_parser(object)
+            return unless parser
+
+            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, xml)
+          rescue Contrast::SecurityException => e
+            raise e
+          rescue StandardError => e
+            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
+            logger.error(e, "Error running XXE rule in #{ parser }")
+          end
+
+          # IO is tricky. If we can't rewind it, we can't fix it back to the
+          # original state. To be safe, we'll skip non-rewindable IO objects.
+          def cs__patched_apply_xxe_rule__io _method, _exception, _properties, object, args
+            need_rewind = false
+            return unless valid_io_input?(args)
+            return if cs__skip_analysis?
+
+            need_rewind = true
+            xml = args.first.read
+            parser = determine_parser(object)
+            return unless parser
+
+            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, xml)
+          rescue Contrast::SecurityException => e
+            raise e
+          rescue StandardError => e
+            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
+            logger.error(e, "Error running XXE rule in #{ parser }")
+          ensure
+            args.first.rewind if need_rewind
+          end
+
+          # Oga's Lexer is a special case b/c the information we need is on the
+          # object itself -- specifically in the @data instance variable
+          def cs__patched_apply_xxe_rule__lexer _method, _exception, _properties, object, _args
+            return unless valid_data_input?(object)
+            return if cs__skip_analysis?
+
+            parser = determine_parser(object)
+            return unless parser
+
+            data = object.instance_variable_get(DATA_KEY)
+
+            if data.cs__is_a?(String)
+              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, data)
+            elsif data.cs__respond_to?(:each_line)
+              data.each_line do |line|
+                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, line)
+              end
+              data.rewind if data.cs__respond_to?(:rewind)
+            elsif data.cs__respond_to?(:each)
+              data.each do |chunk|
+                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, chunk)
+              end
+              data.rewind if data.cs__respond_to?(:rewind)
+            end
+          rescue Contrast::SecurityException => e
+            raise e
+          rescue StandardError => e
+            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
+            logger.error(e, "Error running XXE rule in #{ parser }")
+          end
+
+          def rule
+            PROTECT.rule Contrast::Agent::Protect::Rule::Xxe::NAME
+          end
+
+          def valid_input? args
+            return false unless args&.any?
+
+            args.first
+          end
+
+          def valid_io_input? args
+            return false unless valid_input?(args)
+
+            io = args.first
+            io&.respond_to?(:rewind)
+          end
+
+          DATA_KEY = '@data'.to_sym
+          def valid_data_input? object
+            object.instance_variable_defined?(DATA_KEY) &&
+                object.instance_variable_get(DATA_KEY)
+          end
+
+          def cs__skip_analysis?
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return true unless context&.app_loaded?
+            return true unless rule&.enabled?
+
+            false
+          end
+
+          NOKOGIRI_MARKER = 'Nokogiri::'
+          PARSER_NOKOGIRI = 'Nokogiri'
+          OX_MARKER = 'Ox' # breaks marker pattern b/c Ox is entire classname
+          PARSER_OX = 'Ox'
+          OGA_MARKER = 'Oga::'
+          PARSER_OGA = 'Oga'
+          def determine_parser object
+            clazz = object.is_a?(Module) ? object : object.cs__class
+            name = clazz.cs__name
+
+            if name.start_with?(NOKOGIRI_MARKER)
+              PARSER_NOKOGIRI
+            elsif name.start_with?(OX_MARKER)
+              PARSER_OX
+            elsif name.start_with?(OGA_MARKER)
+              PARSER_OGA
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/core_extensions/protect/kernel.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+# This Module functions as our patch into the Kernel class for Protect,
+# allowing us to track activity as it crosses spawned processes.
+module Kernel
+  class << self
+    include Contrast::Components::Interface
+    access_component :contrast_service
+
+    def cs__protect_build_wrapper
+      lambda {
+        Kernel.cs__protect_proc_start
+        yield
+        # AtExitHook handles sending any messages generated in the new forked process
+      }
+    end
+
+    def cs__protect_proc_start
+      context = Contrast::Agent::REQUEST_TRACKER.current
+      return unless context
+
+      context.reset_activity
+    end
+  end
+end
+
+cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'

data/lib/contrast/core_extensions/protect/psych.rb

@@ -0,0 +1,7 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+if defined?(Psych)
+  cs__scoped_require 'contrast/core_extensions/protect/applies_deserialization_rule'
+  cs__scoped_require 'cs__patched_psych/cs__patched_psych'
+end

data/lib/contrast/core_extensions/thread.rb

@@ -0,0 +1,31 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+# ensure that we're being loaded with an agent
+# NOTE: THIS CLASS WILL NOT BE RELOADED B/C WE CANNOT RELOAD THE STANDARD
+# thread file
+
+# Request context is still tracked per-thread.  There isn't anything
+# particularly order-dependent or stateful about request contexts.  It
+# exists mostly for reference.
+#
+# Scope HAS to exist per-fiber.
+
+# Monkey-patching Thread#initialize.
+class Thread
+  alias_method :cs__initialize, :initialize
+
+  def initialize *args, &block
+    # Thread.current still references the original(callee) thread that is
+    # instantiating this new fiber during initialization
+    Contrast::Components::Scope::MONITOR.synchronize do
+      if (current_context = Thread.current[:current_context])
+        self[:current_context] = current_context.dup
+      end
+
+      Contrast::Components::Scope.sweep_dead_ecs
+    end
+
+    cs__initialize(*args, &block)
+  end
+end