contrast-agent 3.8.4

data/lib/contrast/utils/assess/sampling_util.rb

@@ -0,0 +1,96 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'singleton'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Utils
+    module Assess
+      # SamplingUtil has methods for tracking the number of requests per time window
+      class SamplingUtil
+        include Singleton
+
+        include Contrast::Components::Interface
+        access_component :sampling
+
+        def initialize
+          @requests = {}
+        end
+
+        def update
+          @enabled            = self.class.sampling_control[:enabled]
+          @baseline           = self.class.sampling_control[:baseline]
+          @request_frequency  = self.class.sampling_control[:request_frequency]
+          @response_frequency = self.class.sampling_control[:response_frequency]
+          @window_ms          = self.class.sampling_control[:window]
+
+          true
+        end
+
+        def reset
+          @requests.clear
+        end
+
+        def sample? request
+          history = request_history(request)
+          history.hit
+
+          # if sampling isn't enabled, we record all requests and take a
+          # default amount of responses
+          return [true, true] unless @enabled
+
+          # if we've exceeded this sample window, reset it
+          if history.elapsed >= @window_ms
+            history.reset_window
+            return [true, true]
+          end
+
+          # we have to take a baseline of this request/ response combo. we only
+          # baseline the first response, but we'll do full request analysis up
+          # to the baseline amount
+          return [true, history.window_hit == 1] if history.window_hit < @baseline
+
+          # Once the window_hit exceeds the baseline, we limit the analysis
+          # based on @request_frequency and @response_frequency.
+          non_baseline = history.window_hit - @baseline
+          analyze_request = (non_baseline % @request_frequency).zero?
+          analyze_response = (non_baseline % @response_frequency).zero?
+
+          [analyze_request, analyze_response]
+        end
+
+        private
+
+        # RequestHistory tracks one requests history per time window
+        class RequestHistory
+          attr_accessor :window_start, :total_hit, :window_hit
+
+          def initialize
+            @window_start = Contrast::Utils::Timer.now_ms
+            @total_hit = 0
+            @window_hit = 0
+          end
+
+          def elapsed
+            Contrast::Utils::Timer.now_ms - @window_start
+          end
+
+          def hit cnt = 1
+            @total_hit += cnt
+            @window_hit += cnt
+          end
+
+          def reset_window
+            @window_start = Contrast::Utils::Timer.now_ms
+            @window_hit = 0
+          end
+        end
+
+        def request_history request
+          @requests[request.hash_id] ||= RequestHistory.new
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/tracking_util.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/core_extensions/object'
+
+module Contrast
+  module Utils
+    module Assess
+      # TrackingUtil has methods for determining if a object is being tracked
+      class TrackingUtil
+        def self.tracked? obj
+          return false if obj.nil?
+
+          if Contrast::Utils::DuckUtils.quacks_like_tracked_hash?(obj)
+            obj.each_pair do |k, v|
+              return true if tracked?(k)
+              return true if tracked?(v)
+            end
+            false
+          elsif Contrast::Utils::DuckUtils.quacks_like_tracked_enumerable?(obj)
+            obj.any? do |ele|
+              tracked?(ele) unless obj == ele
+            end
+          elsif Contrast::Utils::DuckUtils.quacks_to?(obj, :cs__tracked?)
+            obj.cs__tracked?
+          else
+            false
+          end
+        rescue StandardError => e
+          # This is used to ask if a ton of objects are tracked. They may not
+          # all be iterable. Bad things could happen in some cases, like when
+          # checking a closed statement for SQL injection trigger events
+          logger.warn("#{ e } trying to TrackingUtil.tracked? on object of class #{ obj.cs__class }.")
+          false
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/boolean_util.rb

@@ -0,0 +1,33 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+
+module Contrast
+  module Utils
+    # Utility methods for asserting truthy or falsy state of a value expected
+    # to equate to a boolean
+    class BooleanUtil
+      class << self
+        # Ruby 2.4 does not nicely compare to nil, so we have to include
+        # these wrapper methods. RUBY-179 has the task to update this on
+        # EOL of 2.4 support
+        def false? config
+          return false unless config
+          return false if config == true
+          return true if config == false
+
+          Contrast::Utils::ObjectShare::FALSE.casecmp?(config)
+        end
+
+        def true? config
+          return false unless config
+          return false if config == false
+          return true if config == true
+
+          Contrast::Utils::ObjectShare::TRUE.casecmp?(config)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/cache.rb

@@ -0,0 +1,69 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Implementation taken from http://stackoverflow.com/questions/1933866/efficient-ruby-lru-cache
+    class Cache
+      def initialize max_size = 1000
+        @max_size = max_size
+        @data = {}
+      end
+
+      def max_size= size
+        return if size < 1
+
+        @max_size = size
+        return if @max_size >= @data.length
+
+        @data.keys[0..(@max_size - @data.length)].each do |k|
+          @data.delete(k)
+        end
+      end
+
+      def [] key
+        found = true
+        value = @data.delete(key) { found = false }
+        @data[key] = value if found
+      end
+
+      def []= key, value
+        @data.delete(key)
+        @data[key] = value
+        @data.delete(@data.first[0]) if @data.length > @max_size
+
+        value # rubocop:disable Lint/Void
+      end
+
+      def each
+        @data.reverse_each do |pair|
+          yield pair
+        end
+      end
+
+      # used further up the chain, non thread safe each
+      alias_method :each_unsafe, :each
+
+      def to_a
+        @data.to_a.reverse
+      end
+
+      def delete key
+        @data.delete(key)
+      end
+
+      def clear
+        @data.clear
+      end
+
+      def count
+        @data.count
+      end
+
+      # for cache validation only, ensures all is sound
+      def valid?
+        true
+      end
+    end
+  end
+end

data/lib/contrast/utils/class_util.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/core_extensions/object'
+
+module Contrast
+  module Utils
+    # Utility methods for exploring the complete space of objects
+    class ClassUtil
+      def self.ancestors_of clazz
+        arr = []
+        ObjectSpace.each_object(Module) do |obj|
+          next unless obj <= clazz
+
+          arr << obj
+        end
+        arr
+      end
+
+      # some classes have had things prepended to them, like Marshal in Rails
+      # 5 and higher. Their ActiveSupport::MarshalWithAutoloading will break
+      # our alias patching approach, as will any other prepend on something
+      # that we touch. Prepend and Alias are inherently incompatible monkey
+      # patching approaches. As such, we need to know if something has been
+      # prepended to.
+      #
+      # return true if the given module is not its first ancestor
+      def self.prepended? mod, ancestors = nil
+        ancestors ||= mod.ancestors
+        ancestors[0] != mod
+      end
+
+      def self.determine_target_class mod, is_instance
+        return mod if mod.singleton_class?
+
+        return mod.cs__singleton_class unless is_instance
+
+        mod
+      end
+
+      # return true if the given method is overwritten by one of the ancestors
+      # in the ancestor change that comes before the given module
+      def self.prepended_method? mod, method_policy
+        target_module = determine_target_class mod, method_policy.instance_method
+        ancestors = target_module.ancestors
+        return false unless prepended?(target_module, ancestors)
+
+        ancestors.each do |ancestor|
+          break if ancestor == target_module
+
+          methods = ancestor.instance_methods(false)
+          return true if methods.include?(method_policy.method_name)
+        end
+        false
+      end
+    end
+  end
+end

data/lib/contrast/utils/comment_range.rb

@@ -0,0 +1,19 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Stores the range of a comment
+    class CommentRange
+      COMMENT_START = /<!--/.cs__freeze
+      COMMENT_END = '-->'
+
+      attr_reader :open, :close
+
+      def initialize open_idx, close_idx
+        @open = open_idx
+        @close = close_idx
+      end
+    end
+  end
+end

data/lib/contrast/utils/data_store_util.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Utility class used to determine information about the current data store
+    # on which a query was executed or to which the application is connected.
+    module DataStoreUtil
+      def self.report_data_store data_store
+        return unless data_store
+
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context&.activity
+
+        context.activity.technologies[data_store] = true
+        context.activity.query_count += 1
+        return unless context.activity.query_count == 1
+
+        Contrast::Utils::InventoryUtil.append_db_config(context.activity)
+      end
+    end
+  end
+end

data/lib/contrast/utils/duck_utils.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Utility methods for identifying instances that can be used interchangably
+    class DuckUtils
+      def self.quacks_like_tracked_hash? obj
+        return false unless obj
+        return false if quacks_like_cs_patched?(obj)
+
+        obj.is_a?(Hash)
+      end
+
+      def self.quacks_like_tracked_enumerable? obj
+        return false unless obj
+        return false if obj.is_a?(IO)
+        # TODO: RUBY-606: temporary work around to avoid the agent treating OpenSSL::Buffering as a source,
+        # see https://contrast.atlassian.net/browse/RUBY-588
+        return false if defined?(OpenSSL::Buffering) && obj.is_a?(OpenSSL::Buffering)
+        return false if quacks_like_cs_patched?(obj)
+
+        obj.is_a?(Enumerable)
+      end
+
+      # This method will return true if the object being checked has been patched
+      # to have the cs__properties field. We check the cs__tracked? method since it
+      # is side effect free (ie doesn't cause the properties object to be created).
+      def self.quacks_like_cs_patched? obj
+        obj && quacks_to?(obj, :cs__tracked?)
+      end
+
+      # All Objects respond to dup. Not all Objects respond nicely. Nil, True,
+      # False and Number types respond with TypeError. This check should handle
+      # those cases.
+      # https://stackoverflow.com/questions/20954789/how-do-i-check-if-a-variable-really-responds-to-dup
+      def self.quacks_like_duplicable? obj
+        obj.cs__class.methods.include? :new
+      end
+
+      # Most things that are closable IO's will in fact be of the IO type. That
+      # being said, some will also be extensions of DelegateClass with IO type,
+      # like Tempfile. We need to handle both cases.
+      def self.quacks_like_closable_io object
+        return false unless Contrast::Utils::IOUtil.io?(object)
+
+        quacks_to?(object, :closed?)
+      end
+
+      def self.quacks_to? object, method
+        return true if object.cs__respond_to?(method)
+        return false unless object.is_a?(Delegator)
+
+        object.cs__delegator_respond_to?(method)
+      end
+    end
+  end
+end

data/lib/contrast/utils/env_configuration_item.rb

@@ -0,0 +1,52 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Stores key and value of a environmnt variable and can normalize the
+    # path for comparison to common config
+    class EnvConfigurationItem
+      START_UNDERSCORE = /^(_+)/.cs__freeze
+      END_UNDERSCORE   = /(_+)$/.cs__freeze
+      REPEATING_UNDERSCORE = /_{3,}/.cs__freeze
+
+      attr_reader :value, :dot_path_array
+
+      def initialize key, value
+        key = EnvConfigurationItem.resolve_corrected_path(key)
+        @dot_path_array = key.downcase.split(Contrast::Utils::ObjectShare::DOUBLE_UNDERSCORE)
+        @value = value
+
+        correct_dot_path
+      end
+
+      def correct_dot_path
+        return unless @dot_path_array
+
+        # we need to shift by one to access the appropriate level of the config
+        @dot_path_array.shift
+        # and then we need to fix any rules
+        idx = @dot_path_array.find_index('rules')
+        return unless idx
+
+        next_idx = idx + 1
+        return if next_idx == @dot_path_array.length
+
+        @dot_path_array[next_idx] = @dot_path_array[next_idx].to_s.tr('_', '-')
+      end
+
+      def self.resolve_corrected_path path
+        tmp_path = path.dup
+        start_match = START_UNDERSCORE.match(tmp_path)
+        tmp_path = tmp_path[start_match.offset(0).last..-1] if start_match
+
+        tmp_path.gsub!(REPEATING_UNDERSCORE, '__')
+
+        end_match = END_UNDERSCORE.match(tmp_path)
+        tmp_path = tmp_path[0...end_match.offset(0).first] if end_match
+
+        tmp_path
+      end
+    end
+  end
+end