contrast-agent 3.8.4

data/lib/contrast/utils/environment_util.rb

@@ -0,0 +1,152 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'socket'
+cs__scoped_require 'contrast/core_extensions/module'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Utils
+    # Gather information about the application and server environment
+    # that the agent is running in.
+    class EnvironmentUtil
+      include Contrast::Components::Interface
+
+      access_component :analysis
+
+      DEFAULT_APP_NAME = 'rack'
+      DEFAULT_SERVER_NAME = 'localhost'
+
+      CS_VERSION = 'VERSION'
+
+      # Possible names of constants that would hold version info
+      VERSION_CONSTANT_CANDIDATES = %w[
+        VERSION
+        ::VERSION
+        Version::VERSION
+        ::Version::VERSION
+        ::Application::VERSION
+      ].cs__freeze
+
+      # Common places where view-layer files can be found in a Rails application
+      RAILS_VIEWS = [
+        ['app/assets', '*.coffee', %w[CoffeeScript]],
+        ['app/assets', '*.scss', %w[SASS]],
+        ['app/views', '*.html', %w[HTML5]],
+        ['app/views', '*.html.erb', %w[HTML5 ERB]],
+        ['app/views', '*.html.haml', %w[HTML5 HAML]],
+        ['public', '*.html', %w[HTML5]]
+      ].cs__freeze
+
+      class << self
+        ######### These are helpers ####################
+
+        def present? str
+          !str.nil? && !str.to_s.empty?
+        end
+
+        ######### Actually env/framework dependent ####################
+
+        # See CONTRAST-16380 for more details
+        def determine_application_version
+          @_determine_application_version ||= begin
+            candidates = VERSION_CONSTANT_CANDIDATES.map do |name|
+              # If there's a constant named 'name' (VERSION, etc.), get its value.
+              begin
+                name.split('::').inject(Object) do |mod, class_name|
+                  mod.cs__const_get(class_name)
+                end
+              rescue LoadError, StandardError
+                nil
+              end
+            end
+            candidates.compact!
+            candidate = candidates.first || ENV[CS_VERSION]
+
+            case candidate
+            when Hash
+              candidate.values.join(Contrast::Utils::ObjectShare::PERIOD)
+            when Array
+              candidate.join(Contrast::Utils::ObjectShare::PERIOD)
+            when String
+              candidate
+            when NilClass
+              return nil
+            else
+              candidate.inspect
+            end
+          end
+        end
+
+        def platform
+          version = Rails.version rescue Sinatra::VERSION rescue Rack.version rescue '' # rubocop:disable Style/RescueModifier
+          major, minor, patch = *version.split(Contrast::Utils::ObjectShare::PERIOD)
+          major ||= ''
+          minor ||= ''
+          patch ||= ''
+
+          [major, minor, patch]
+        rescue StandardError
+          Contrast::Utils::ObjectShare::EMPTY_TRIPLE
+        end
+
+        # Read libraries from the gemfile and append to the given ApplicationUpdate message
+        # or other class that has a libraries map association
+        def add_library_to_app_update app_update_pb, library_tags = ''
+          libraries = Contrast::Utils::GemfileReader.instance.library_pb_list
+          libraries.each do |n|
+            n.tags = library_tags
+            app_update_pb.libraries[n.hash_code] = n
+          end
+        end
+
+        # Iterate through known locations, looking for files
+        # that represent view or template files. If found, for each file in the directory
+        # append the technology and the view object to the application update instance
+        def scan_views app_update_msg
+          return unless INVENTORY.enabled?
+
+          scan_rails_views(app_update_msg)
+          scan_sinatra_views(app_update_msg)
+        end
+
+        # Find all the predefined routes for this application and append them to the
+        # provided inventory message
+        # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg
+        # that has a routes array consisting of Contrast::Api::Dtm::RouteCoverage
+        def scan_routes msg
+          return unless INVENTORY.enabled?
+
+          Contrast::Utils::PathUtil.find_routes.each do |route|
+            msg.routes << route
+          end
+        end
+
+        private
+
+        def scan_view_directories app_update_msg, view_location_data
+          view_location_data.each do |path, extension, tech_names|
+            next if Dir["#{ path }/**/*#{ extension }"].empty?
+
+            tech_names.each do |tech|
+              app_update_msg.technologies[tech] = true
+            end
+          end
+        end
+
+        def scan_rails_views app_update_msg
+          scan_view_directories(app_update_msg, RAILS_VIEWS)
+        end
+
+        def scan_sinatra_views app_update_msg
+          sinatra_app = Contrast::Utils::SinatraHelper.app_class
+          return unless sinatra_app
+
+          scan_view_directories(app_update_msg, Contrast::Utils::SinatraHelper.scannable_view_dirs)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/freeze_util.rb

@@ -0,0 +1,36 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/core_extensions/object'
+cs__scoped_require 'contrast/utils/duck_utils'
+
+module Contrast
+  module Utils
+    # This utility allows us to act on frozen objects, creating an unfrozen
+    # duplicate in those cases where that is possible.
+    class FreezeUtil
+      class << self
+        # Make every attempt to duplicate the frozen object so that it can
+        # be tracked. Some things, like Nil, True, and False, respond to dup
+        # but throw a TypeError. This catches that case and returns the
+        # original. We luck out as these three cases do not get propagated to
+        #
+        # @param original [Object] something frozen, usually a String
+        # @return [Object] the original or an unfrozen copy
+        def unfreeze_dup original
+          return original unless original.cs__frozen?
+          return original unless Contrast::Utils::DuckUtils.quacks_like_duplicable?(original)
+
+          copy = original.dup
+          if Contrast::Utils::DuckUtils.quacks_like_tracked_hash?(copy)
+            copy.each_key do |key|
+              value = original[key]
+              copy[key] = Contrast::Utils::DuckUtils.quacks_like_duplicable?(original) ? value.dup : value
+            end
+          end
+          copy
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/gemfile_reader.rb

@@ -0,0 +1,191 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'set'
+cs__scoped_require 'contrast/utils/sha256_builder'
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/api'
+
+module Contrast
+  module Utils
+    # GemfileReader has methods for extracting information from gem specs
+    # it also has a cache of library file digests to the lines of code found.
+    class GemfileReader
+      include Singleton
+      include Contrast::Components::Interface
+
+      access_component :logging
+
+      CONTRAST_AGENT = 'contrast-agent'
+
+      def initialize
+        # Map of a Gem's Spec Digest to all loaded files from that Gem
+        @spec_to_files = {}
+      end
+
+      # the #clone is necessary here, as a require in another thread could
+      # potentially result in adding a key to the loaded_specs hash during
+      # iteration.  (as in RUBY-330)
+      def loaded_specs
+        Gem.loaded_specs.clone
+      end
+
+      # indicates if there's been an update to library information, allowing us
+      # to only serialize this information on change.
+      def updated?
+        @updated
+      end
+
+      def updated!
+        @updated = true
+      end
+
+      # Once we're Contrasted, we intercept require calls to do inventory.
+      # In order to catch up, we do a one-time manual catchup, & inventory
+      # all the already-loaded gems.
+      def map_loaded_classes
+        loaded_specs.each do |name, spec|
+          # Don't count Contrast gems
+          next if contrast_gems.include? name
+
+          # Get a digest of the Gem file itself
+          next unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
+
+          paths = get_by_digest(digest)
+          path = spec.full_gem_path
+          $LOADED_FEATURES.each do |line|
+            next unless line.to_s.start_with?(path)
+
+            # logger.debug("Recording loaded gem at '#{ line }' for inventory analysis") if logger.trace? # TODO: RUBY-547
+            updated!
+            paths << adjust_lib(line)
+          end
+        end
+      end
+
+      def map_class path
+        path = adjust_lib(path)
+
+        return unless (spec   = Gem::Specification.find_by_path(path))
+        return unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
+
+        updated!
+        get_by_digest(digest) << path
+      end
+
+      def library_pb_list
+        loaded_specs.each_with_object([]) do |(name, spec), arr|
+          next if contrast_gems.include? name
+          next unless spec
+          next unless (digest = Contrast::Utils::Sha256Builder.build_from_spec(spec))
+
+          arr << build_library_pb(digest, spec)
+        end
+      end
+
+      def generate_library_usage activity = nil
+        return unless updated?
+
+        @spec_to_files.each_pair do |digest, files|
+          usage = Contrast::Api::Dtm::LibraryUsageUpdate.new
+          usage.hash_code = Contrast::Utils::StringUtils.force_utf8(digest)
+          activity.library_usages[usage.hash_code] = usage if activity
+          # TODO: PROD-35 once TS switches to take filenames, remove the count setter and
+          #   send the class names in usage.class_names
+          usage.count = files.size
+        end
+        # TODO: PROD-35 once TS switches to take filenames, clear this and remove the
+        #   @updated variable
+
+        # @spec_to_files.clear
+        @updated = false
+      end
+
+      private
+
+      # marker for the lib dir in an absolute file path. purposefully includes
+      # the trailing '/'
+      LIB = '/lib/'
+
+      # Kernel#load uses the absolute path, but Gems / Specs use the path after
+      # `/lib`. This method accounts for that and trims out the `/lib/` section
+      # and starts with the first `/` after and the trailing file extension, if
+      # present.
+      #
+      # @param path [String] the path to parse
+      # @return [String] the relative path of the file, after the lib directory
+      def adjust_lib path
+        idx = path.index(LIB)
+        path = path[(idx + 4)..-1] if idx
+        idx = path.rindex(Contrast::Utils::ObjectShare::PERIOD)
+        path = path[0..idx] if idx
+        path
+      end
+
+      def get_by_digest digest
+        @spec_to_files[digest] = Set.new unless @spec_to_files.key?(digest)
+        @spec_to_files[digest]
+      end
+
+      def build_library_pb digest, spec
+        lib             = Contrast::Api::Dtm::Library.new
+        lib.file_path   = Contrast::Utils::StringUtils.force_utf8(spec.name)
+        lib.hash_code   = Contrast::Utils::StringUtils.force_utf8(digest)
+        lib.version     = Contrast::Utils::StringUtils.force_utf8(spec.version)
+        lib.manifest    = Contrast::Utils::StringUtils.force_utf8(build_manifest(spec))
+        lib.external_ms = date_to_ms(spec.date)
+        lib.internal_ms = lib.external_ms
+        lib.url         = Contrast::Utils::StringUtils.force_utf8(spec.homepage)
+        update_class_counts(lib, digest, spec)
+        lib
+      end
+
+      def date_to_ms date
+        (date.to_f * 1000.0).to_i
+      end
+
+      def update_class_counts lib, digest, spec
+        # Updating the class counts
+        path = spec.full_gem_path.to_s
+        lib.class_count = all_files(path).length
+        lib.used_class_count = @spec_to_files.key?(digest) ? get_by_digest(digest).size : 0
+        lib
+      end
+
+      def build_manifest spec
+        Contrast::Utils::StringUtils.force_utf8(spec.to_yaml.to_s) if defined?(YAML)
+      rescue StandardError
+        nil
+      end
+
+      # These are all the code files that are located in the Gem directory loaded
+      # by the current environment; this includes more than Ruby files
+      def all_files path
+        Contrast::Utils::Sha256Builder.instance.files(path)
+      end
+
+      # Go through all dependents, given as a pair from the DependencyList: `dependency`
+      # is the dependency itself, filled with all its specs. `dependents` is the array of reverse
+      # dependencies for the aforementioned dependency. If the dependency is also in contrast_dep_set,
+      # then contrast depends on it. If its array of dependents is 1, then contrast is the
+      # only dependency in that list. Since only contrast depends on it, we should ignore it.
+      def contrast_gems
+        @_contrast_gems ||= find_contrast_gems
+      end
+
+      def find_contrast_gems
+        ignore = Set.new([CONTRAST_AGENT])
+        contrast_specs = Gem::DependencyList.from_specs.specs.find do |dependency|
+          dependency.name == CONTRAST_AGENT
+        end
+        contrast_dep_set = contrast_specs.dependencies.map(&:name).to_set
+
+        Gem::DependencyList.from_specs.spec_predecessors.each_pair do |dependency, dependents|
+          ignore.add(dependency.name) if contrast_dep_set.include?(dependency.name) && dependents.length == 1
+        end
+        ignore
+      end
+    end
+  end
+end

data/lib/contrast/utils/hash_digest.rb

@@ -0,0 +1,148 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'digest'
+
+module Contrast
+  module Utils
+    # We use this class to provide hashes for our Request and Finding objects
+    # based upon our definitions of uniqueness.
+    # While the uniqueness of the request object is something internal to the
+    # Ruby agent, the uniqueness of the Finding hash is defined by a
+    # specification shared across all agent teams. The spec can be found here:
+    # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/vulnerability/preflight.md
+    class HashDigest < Digest::Class
+      include Digest::Instance
+
+      CONTENT_LENGTH_HEADER = 'Content-Length'
+      CRYPTO_RULES = %w[
+        crypto-bad-ciphers
+        crypto-bad-mac
+      ].cs__freeze
+      CONFIG_PATH_KEY = 'path'
+      CONFIG_SESSION_ID_KEY = 'sessionId'
+      CLASS_SOURCE_KEY = 'source'
+      CLASS_CONSTANT_NAME_KEY = 'name'
+      CLASS_LINE_NO_KEY = 'lineNo'
+      class << self
+        def generate_request_hash request
+          hash = new
+          hash.update(request.request_method)
+          hash.update(request.normalized_uri)
+          request.parameters.each_key do |name|
+            hash.update(name)
+          end
+          cl = request.normalized_request_headers[CONTENT_LENGTH_HEADER]
+          hash.update(request.normalized_length_header(cl)) if cl
+          hash.finish
+        end
+
+        def generate_event_hash finding, source
+          return generate_dataflow_hash(finding) if finding.events.length.to_i > 1
+
+          id = finding.rule_id
+          return generate_crypto_hash(finding, source) if CRYPTO_RULES.include?(id)
+
+          generate_trigger_hash(finding)
+        end
+
+        def generate_config_hash finding
+          hash = new
+          hash.update(finding.rule_id)
+          path = finding.properties[CONFIG_PATH_KEY]
+          hash.update(path)
+          method = finding.properties[CONFIG_SESSION_ID_KEY]
+          hash.update(method)
+          hash.finish
+        end
+
+        def generate_class_scanning_hash finding
+          hash = new
+          hash.update(finding.rule_id)
+          module_name = finding.properties[CLASS_SOURCE_KEY]
+          hash.update(module_name)
+          # We're not currently collecting this. 30/7/19 HM
+          line_no = finding.properties[CLASS_LINE_NO_KEY]
+          hash.update(line_no)
+          field = finding.properties[CLASS_CONSTANT_NAME_KEY]
+          hash.update(field)
+          hash.finish
+        end
+
+        def generate_crypto_hash finding, algorithm
+          hash = new
+          hash.update(finding.rule_id)
+          hash.update(algorithm)
+          hash.update_on_request
+          hash.finish
+        end
+
+        def generate_dataflow_hash finding
+          hash = new
+          hash.update(finding.rule_id)
+          hash.update_on_sources(finding.events)
+          hash.update_on_request
+          hash.finish
+        end
+
+        def generate_response_hash finding
+          hash = new
+          hash.update(finding.rule_id)
+          hash.update_on_request
+          hash.finish
+        end
+
+        def generate_trigger_hash finding
+          hash = new
+          hash.update(finding.rule_id)
+          hash.update_on_request
+          hash.finish
+        end
+      end
+
+      def update_on_request
+        context = Contrast::Agent::REQUEST_TRACKER.current
+        return unless context
+
+        route = context.route
+        request = context.request
+        if route
+          update(route.route)
+          update(route.verb)
+        elsif request
+          update(request.normalized_uri)
+          update(request.request_method)
+        end
+      end
+
+      def update_on_sources events
+        return unless events&.any?
+
+        events.each do |event|
+          event.event_sources.each do |source|
+            update(source.type)
+            update(source.name)
+          end
+        end
+      end
+
+      def initialize
+        @crc32 = 0
+      end
+
+      def update str
+        return unless str
+
+        @crc32 = Zlib.crc32(str, @crc32)
+      end
+
+      def reset
+        @crc32 = 0
+      end
+
+      def finish
+        @crc32.to_s
+      end
+    end
+  end
+end