contrast-agent 3.8.4

data/lib/contrast/internal_exception.rb

@@ -0,0 +1,8 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  # Used to type a StandardError raised by Contrast code.
+  class InternalException < StandardError
+  end
+end

data/lib/contrast/rails_extensions/assess/action_controller_inheritance.rb

@@ -0,0 +1,48 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+if defined?(ActionController) &&
+      defined?(ActionController::Railties) &&
+      defined?(ActionController::Railties::Helpers)
+  module ActionController
+    module Railties
+      # Used to monkey patch all the inherited calls in action_pack
+      #
+      # This is the usual entry point for Rails inheritance work, so it should
+      # catch most of the calls to inherited.
+      module Helpers
+        alias_method :cs__patched_inherited, :inherited
+        def inherited klass
+          klass&.instance_variable_set(:@cs__defining_class, true)
+          cs__patched_inherited(klass)
+        ensure
+          klass&.instance_variable_set(:@cs__defining_class, false)
+        end
+      end
+    end
+  end
+end
+
+if defined?(ActiveRecord) &&
+      defined?(ActiveRecord::AttributeMethods) &&
+      defined?(ActiveRecord::AttributeMethods::TimeZoneConversion) &&
+      defined?(ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods)
+  module ActiveRecord
+    module AttributeMethods
+      # Used to monkey patch all the inherited calls in action_pack
+      module TimeZoneConversion
+        module ClassMethods #:nodoc:
+          private
+
+          alias_method :cs__patched_inherited, :inherited
+          def inherited klass
+            klass&.instance_variable_set(:@cs__defining_class, true)
+            cs__patched_inherited(klass)
+          ensure
+            klass&.instance_variable_set(:@cs__defining_class, false)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/rails_extensions/assess/active_record.rb

@@ -0,0 +1,32 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+if defined?(ActiveRecord) &&
+      defined?(ActiveRecord::AttributeMethods) &&
+      defined?(ActiveRecord::AttributeMethods::Read) &&
+      defined?(ActiveRecord::AttributeMethods::Read::ClassMethods)
+
+  module ActiveRecord
+    module AttributeMethods
+      module Read
+        # Rails / ActiveRecord are sneaky a.f. They define attributes of a
+        # class in one method, then monkey patch allocate in another and
+        # finally invoke module_eval in this method... but of course they use a
+        # '_tmp_' header for the method name and then alias it in this module
+        # to name it what we expect
+        module ClassMethods
+          alias_method :cs__patched_define_method_attribute, :define_method_attribute
+
+          def define_method_attribute *args, &block
+            ret = cs__patched_define_method_attribute(*args, &block)
+            method_name = args[0]
+            Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
+            ret
+          end
+
+          protected :cs__patched_define_method_attribute, :define_method_attribute
+        end
+      end
+    end
+  end
+end

data/lib/contrast/rails_extensions/assess/active_record_named.rb

@@ -0,0 +1,61 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+if defined?(ActiveRecord) &&
+      defined?(ActiveRecord::Scoping) &&
+      defined?(ActiveRecord::Scoping::Named) &&
+      defined?(ActiveRecord::Scoping::Named::ClassMethods) &&
+      ActiveRecord::Scoping::Named::ClassMethods.
+            instance_methods(false).
+            include?(:scope)
+  module ActiveRecord
+    module Scoping
+      module Named
+        # Our patch into the ActiveRecord::Scoping::Named::ClassMethods Module,
+        # allowing for the runtime rewrite of interpolation calls defined in
+        # methods defined dynamically during application execution.
+        #
+        # TODO: RUBY-534
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :logging, :agent
+
+          def _cs__rewrite method_name, body
+            return body unless AGENT.rewrite_interpolation?
+            return body unless body.is_a?(Proc)
+
+            location = body.source_location
+            return body if location.nil?
+
+            # Good news, once we patch the body once, the source location
+            # becomes eval. We may need to fix this later though (so it may
+            # be bad news)
+            return body if location.empty? || location[0].empty? || location[0].include?('eval')
+
+            opener = Contrast::Agent::ClassReopener.new(Contrast::Agent::ModuleData.new(self))
+            original_source_code = opener.source_code(location, method_name)
+            return body unless original_source_code
+            return body if Contrast::Agent::Rewriter.send(:unrepeatable?, original_source_code)
+            return body unless Contrast::Agent::Rewriter.send(:interpolations?, original_source_code)
+
+            # the code looks like 'source :some_method_name, ->lambda_literal'
+            # we just need the lambda
+            body_start = original_source_code.index(',') + 1
+            original_source_code = original_source_code[body_start..-1]
+
+            new_method_source = Contrast::Agent::Rewriter.send(:rewrite_method, original_source_code)
+            return body unless Contrast::Agent::Rewriter.send(:valid_code?, new_method_source)
+
+            unbound_eval(cs__name, new_method_source)
+          rescue SyntaxError, StandardError => e
+            logger.debug(e, "Can't parse method source in scoped method #{ method_name }: #{ e.message }")
+            body
+          end
+        end
+      end
+    end
+  end
+  cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
+end

data/lib/contrast/rails_extensions/assess/configuration.rb

@@ -0,0 +1,26 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: false
+
+if defined?(Rails) && defined?(Rails::Application) && defined?(Rails::Application::Configuration)
+  module Rails
+    class Application
+      # Our patch into the Rails::Application::Configuration Class, allowing
+      # for the runtime detection of insecure configurations on individual
+      # ActionDispatch::Session::AbstractStore instances within the
+      # application.
+      class Configuration
+        include Contrast::Utils::InvalidConfigurationUtil
+        include Contrast::Components::Interface
+
+        access_component :analysis, :scope
+
+        alias_method :cs__patched_session_store, :session_store
+        def session_store *args
+          ret = cs__patched_session_store(*args)
+          Contrast::Utils::RailsAssessConfiguration.analyze_session_store(*args)
+          ret
+        end
+      end
+    end
+  end
+end

data/lib/contrast/rails_extensions/buffer.rb

@@ -0,0 +1,30 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+if defined?(ActionController) && defined?(ActionController::Live) && defined?(ActionController::Live::Buffer)
+  module ActionController
+    module Live
+      # This class acts as our patch into the ActionController::Live::Buffer
+      # class, allowing us to track the close event on streamed responses.
+      class Buffer
+        include Contrast::Components::Interface
+        access_component :contrast_service
+
+        # normally pre->in->post filters are applied however, in a streamed response
+        # we can run into a case where it's pre -> in -> post -> more infilters
+        # in order to submit anything found during the infilters after the response has been written we need to explicity send them
+        alias_method :cs__close, :close
+        def close
+          if (context = Contrast::Agent::REQUEST_TRACKER.current)
+            [context.server_activity, context.activity, context.observed_route].each do |msg|
+              CONTRAST_SERVICE.send_message msg
+            end
+          end
+          cs__close
+        end
+      end
+    end
+  end
+end

data/lib/contrast/rails_extensions/rack.rb

@@ -0,0 +1,45 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+if defined?(Rack)
+  # In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
+  # not have get_header or set_header methods. This is our way of working
+  # around that.
+  module Rack
+    if defined?(Rack::Request)
+      # Our patch into the Rack::Request class, allowing us to call set_header
+      # and get_header in our code without worrying about older versions of
+      # Rack not implementing these methods.
+      class Request
+        unless Rack::Request.instance_methods(true).include?(:set_header)
+          def set_header name, value
+            @env[name] = value
+          end
+        end
+        unless Rack::Request.instance_methods(true).include?(:get_header)
+          def get_header name
+            @env[name]
+          end
+        end
+      end
+    end
+
+    if defined?(Rack::Response)
+      # Our patch into the Rack::Response Class, allowing us to call set_header
+      # and get_header in our code without worrying about older versions of
+      # Rack not implementing these methods.
+      class Response
+        unless Rack::Response.instance_methods(true).include?(:set_header)
+          def set_header key, value
+            headers[key] = value
+          end
+        end
+        unless Rack::Response.instance_methods(true).include?(:get_header)
+          def get_header key
+            headers[key]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/security_exception.rb

@@ -0,0 +1,14 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  # A custom exception raised by our Protect rules in order to prevent
+  # malicious user input from completing an attack. This Exception purposefully
+  # extends StandardError and not SecurityError as StandardError is more likely
+  # to be handled by our customer's applications.
+  class SecurityException < StandardError
+    def initialize rule, message = nil
+      super(message || "Rule #{ rule.name } threw a security exception")
+    end
+  end
+end

data/lib/contrast/sinatra_extensions/assess/cookie.rb

@@ -0,0 +1,26 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+if defined?(Rack) && defined?(Rack::Session) && defined?(Rack::Session::Cookie)
+  module Rack
+    module Session
+      # Our patch into the Rack::Session::Cookie Class, allowing for the
+      # runtime detection of insecure configurations on individual cookies
+      # within the application
+      class Cookie
+        include Contrast::Utils::InvalidConfigurationUtil
+        include Contrast::Components::Interface
+
+        access_component :scope
+
+        alias_method :cs__patched_initialize, :initialize
+        def initialize app, options = {}
+          Contrast::Utils::RackAssessSessionCookie.analyze_cookie_initialization(options)
+          cs__patched_initialize(app, options)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/sinatra_extensions/inventory/sinatra_base.rb

@@ -0,0 +1,59 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+if defined?(Sinatra) && defined?(Sinatra::Base)
+  module Sinatra
+    # Our patch into the Sinatra::Base Class, allowing for the inventory of the
+    # routes called by the application
+    class Base
+      alias_method :cs__patched_call!, :call!
+
+      # publicly available method for Sinatra::Base things -- unfortunately,
+      # getting the routes appear to require a lookup every time
+      def call! *args
+        cs__patched_map_route(*args)
+        cs__patched_call!(*args)
+      end
+
+      private
+
+      # Use logic copied from Sinatra::Base#process_route to determine which
+      # pattern matches the request being invoked by Sinatra::Base#call!
+      #
+      # @param args [Array<Object>] we rely on the @settings object in
+      #   Sinatra::Base and the env variable passed in as args[0]
+      def cs__patched_map_route *args
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context
+
+        env = args[0]
+        return unless env
+
+        # There isn't a Request object in the Sinatra::Base yet - it's made
+        # during the #call! method, which we're patching - so we need to
+        # access the env
+        method = env[Rack::REQUEST_METHOD]
+        route = env[Rack::PATH_INFO]
+        route = route.to_s
+
+        # get all potential routes for this request type
+        routes = settings.routes[method]
+        return unless routes
+
+        # Do some cleanup that matches Sinatra::Base#process_route
+        route = '/' if route.empty? && !settings.empty_path_info?
+        route = route[0..-2] if !settings.strict_paths? && route != '/' && route.end_with?('/')
+
+        # Find the route that matches this request. Since we're using
+        # settings, we should resolve in the same precedence as Sinatra
+        routes.each do |pattern, _, _| # Mustermann::Sinatra
+          next unless pattern.params(route)
+
+          dtm = Contrast::Utils::PathUtil.get_sinatra_route(cs__class, method, pattern)
+          context.append_route_coverage(dtm)
+          break
+        end
+      end
+    end
+  end
+end

data/lib/contrast/tasks/service.rb

@@ -0,0 +1,95 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/os'
+
+module Contrast
+  # A Rake task designed to allow control of the Contrast Service as a stand
+  # alone executable rather than one managed by the Agent running in a process
+  # forked from the application
+  module Service
+    extend Rake::DSL
+    include Contrast::Components::Interface
+
+    access_component :contrast_service
+
+    # Start the service if it is not already running
+    def self.start_service
+      puts 'Starting Contrast Service'
+      service_log = CONTRAST_SERVICE.logger_path
+      if File.writable?(service_log)
+        spawn('contrast_service', out: File::NULL, err: service_log)
+      else
+        spawn('contrast_service', %i[out err] => File::NULL)
+      end
+
+      watcher = Contrast::Agent::Thread.new do
+        sleep(0.05) until Contrast::Utils::OS.running?
+      end
+      watcher.join(1)
+      puts Contrast::Utils::OS.running? ? 'Contrast Service started successfully.' : 'Contrast Service did not start.'
+    end
+
+    # Stop the service if it is running
+    def self.stop_service
+      if Contrast::Utils::OS.windows?
+        # https://stackoverflow.com/questions/13507902/how-to-extract-a-specific-field-from-output-of-tasklist-on-the-windows-command-l
+        pid = `for /f "tokens=2 delims=," %a in ('tasklist /nh /fi "imagename eq Contrast_Service.exe" /fo csv') do @echo %a`
+        `Taskkill /PID #{ pid } /F` if pid
+      else
+        pid = `ps aux | grep contrast-servic[e] | awk '{print $2}'`
+        `kill #{ pid }` if pid
+      end
+    end
+
+    namespace :contrast do
+      namespace :service do
+        desc 'Starts the Contrast Service'
+        task :start do
+          if Contrast::Utils::OS.running?
+            puts 'Contrast Service already running. No need to start'
+          elsif !CONTRAST_SERVICE.enabled?
+            puts 'Contrast Service disabled by configuration. Not starting.'
+          else
+            start_service
+          end
+        end
+      end
+    end
+
+    namespace :contrast do
+      namespace :service do
+        desc 'Prints the status of the Contrast Service'
+        task :status do
+          if Contrast::Utils::OS.running?
+            puts 'online'
+          elsif CONTRAST_SERVICE.enabled?
+            puts 'offline'
+          else
+            puts 'disabled'
+          end
+        end
+      end
+    end
+
+    namespace :contrast do
+      namespace :service do
+        desc 'Stops the Contrast Service'
+        task :stop do
+          if Contrast::Utils::OS.running?
+            puts 'Stopping Contrast Service'
+            stop_service
+            watcher = Contrast::Agent::Thread.new do
+              sleep(0.05) while Contrast::Utils::OS.running?
+            end
+            watcher.join(1)
+            puts Contrast::Utils::OS.running? ? 'Contrast Service did not stop.' : 'Contrast Service stopped successfully.'
+          else
+            puts 'Contrast Service is not already running. No need to stop.'
+          end
+        end
+      end
+    end
+  end
+end