contrast-agent 3.8.4

data/lib/contrast/utils/rack_assess_session_cookie.rb

@@ -0,0 +1,104 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Utils
+    # This module is used to analyze non-rails session storage configuration for assess vulnerabilities
+    module RackAssessSessionCookie
+      include Contrast::Components::Interface
+
+      access_component :analysis, :logging, :scope
+
+      CS__SECURE_RULE_NAME = 'secure-flag-missing'
+      CS__HTTPONLY_NAME = 'rails-http-only-disabled'
+      CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+      SAFE_SESSION_TIMEOUT = (30 * 60 * 60)
+      class << self
+        include Contrast::Utils::InvalidConfigurationUtil
+
+        def analyze_cookie_initialization options
+          return if PROTECT.enabled?
+
+          apply_session_timeout(options)
+          apply_httponly(options)
+          apply_secure_session(options)
+        end
+
+        def vulnerable_setting?(setting_key,
+                                safe_settings_value,
+                                options, safe_default: true,
+                                comparison_type: nil)
+          # In most cases, Rack is pretty nice and the default value is safe
+          return !safe_default unless options&.key?(setting_key)
+
+          value = options[setting_key]
+
+          return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+          value != safe_settings_value
+        end
+
+        def apply_secure_session options
+          return unless vulnerable_setting?(
+              :secure,
+              true,
+              options,
+              safe_default: false)
+
+          with_contrast_scope do
+            cs__report_finding(
+                CS__SECURE_RULE_NAME,
+                options,
+                caller_locations(10, 9)[0])
+          end
+        rescue StandardError => e
+          begin
+            logger.log_error('Unable to track call to secure session', e)
+          rescue StandardError
+            nil
+          end
+        end
+
+        def apply_session_timeout options
+          return unless vulnerable_setting?(:expire_after,
+                                            SAFE_SESSION_TIMEOUT,
+                                            options,
+                                            safe_default: false,
+                                            comparison_type: :greater_than)
+
+          with_contrast_scope do
+            cs__report_finding(
+                CS__SESSION_TIMEOUT_NAME,
+                options,
+                caller_locations(10, 9)[0])
+          end
+        rescue StandardError => e
+          begin
+            logger.log_error('Unable to track call to set session timeout', e)
+          rescue StandardError
+            nil
+          end
+        end
+
+        def apply_httponly options
+          return unless vulnerable_setting?(:httponly, true, options)
+
+          with_contrast_scope do
+            cs__report_finding(
+                CS__HTTPONLY_NAME,
+                options,
+                caller_locations(10, 9)[0])
+          end
+        rescue StandardError => e
+          begin
+            logger.log_error('Unable to track call to httponly', e)
+          rescue StandardError
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/rails_assess_configuration.rb

@@ -0,0 +1,95 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Utils
+    # This module is used to analyze rails session storage configuration for assess vulnerabilities
+    module RailsAssessConfiguration
+      include Contrast::Components::Interface
+
+      access_component :analysis, :logging, :scope
+
+      CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+      SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
+      CS__SECURE_RULE_NAME = 'secure-flag-missing'
+      CS__HTTPONLY_RULE_NAME = 'rails-http-only-disabled'
+
+      class << self
+        include Contrast::Utils::InvalidConfigurationUtil
+
+        def analyze_session_store *args
+          return if PROTECT.enabled?
+
+          apply_httponly_disabled(*args)
+          apply_secure_cookie_disabled(*args)
+          apply_session_timeout(*args)
+        end
+
+        def vulnerable_setting? setting_key, safe_settings_value, original_args, safe_default: true, comparison_type: nil
+          # In most cases, Rails is pretty nice and the default value is safe
+          return !safe_default unless original_args && original_args.length > 1
+
+          # If the user overrode some args, but not ours, fall back on the default
+          rails_session_settings = original_args[1]
+          return !safe_default unless rails_session_settings&.key?(setting_key)
+
+          value = rails_session_settings[setting_key]
+
+          return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+          value != safe_settings_value
+        end
+
+        def apply_session_timeout *args
+          return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
+          return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
+
+          rails_session_settings = args[1]
+          with_contrast_scope do
+            cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
+          end
+        rescue StandardError => e
+          begin
+            logger.log_error('Unable to track call to set session timeout', e)
+          rescue StandardError
+            nil
+          end
+        end
+
+        def apply_secure_cookie_disabled *args
+          return if ASSESS.rule_disabled? CS__SECURE_RULE_NAME
+          return unless vulnerable_setting?(:secure, true, args)
+
+          rails_session_settings = args[1]
+          with_contrast_scope do
+            cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+          end
+        rescue StandardError => e
+          begin
+            logger.log_error('Unable to track call to disable secure cookies', e)
+          rescue StandardError
+            nil
+          end
+        end
+
+        def apply_httponly_disabled *args
+          return if ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
+          return unless vulnerable_setting?(:httponly, true, args)
+
+          rails_session_settings = args[1]
+          with_contrast_scope do
+            cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+          end
+        rescue StandardError => e
+          begin
+            logger.log_error('Unable to track call to disable httponly in session cookie', e)
+          rescue StandardError
+            nil
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/random_util.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'securerandom'
+
+module Contrast
+  module Utils
+    # Utilites for generating random strings
+    class RandomUtil
+      RANDOM_CHARS = (('0'..'9').to_a + ('A'..'Z').to_a).cs__freeze
+      RANDOM_LENGTH = RANDOM_CHARS.length
+
+      def self.secure_random_string len
+        arr = []
+        len.to_i.times do
+          arr << RANDOM_CHARS[SecureRandom.random_number(RANDOM_LENGTH)]
+        end
+        arr.join
+      end
+    end
+  end
+end

data/lib/contrast/utils/resource_loader.rb

@@ -0,0 +1,23 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # ResourceLoader can attempt to read a file from a predefined resource directory
+    class ResourceLoader
+      RESOURCES = 'resources'
+
+      # __FILE__/../../../resources
+      RESOURCE_ROOT = File.join(
+          File.dirname(__FILE__),
+          Contrast::Utils::ObjectShare::PARENT_PATH,
+          Contrast::Utils::ObjectShare::PARENT_PATH,
+          Contrast::Utils::ObjectShare::PARENT_PATH,
+          RESOURCES).cs__freeze
+
+      def self.load resource
+        File.read(File.join(RESOURCE_ROOT, resource))
+      end
+    end
+  end
+end

data/lib/contrast/utils/ruby_ast_rewriter.rb

@@ -0,0 +1,74 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: false
+
+cs__scoped_require 'parser/current'
+
+module Contrast
+  module Utils
+    # This utility allows us to parse and rewrite the AST in Ruby 2.4 & 2.5,
+    # allowing us to track String interpolation propagation by replacing those
+    # events with String#+ events instead.
+    class RubyAstRewriter < Parser::TreeRewriter
+      VARIABLES = %i[ivar cvar gvar].cs__freeze
+
+      # Rewrite the given source_string, converting the interpolation action
+      # therein to a concatenation action
+      #
+      # @param source_string [String] the String to rewrite
+      # @return [String] either the rewritten string or the original on error.
+      def rewrite source_string
+        ast = Parser::CurrentRuby.parse(source_string)
+        buffer = Parser::Source::Buffer.new('rewrite')
+        buffer.source = source_string
+        begin
+          super(buffer, ast)
+        rescue StandardError => _e
+          source_string
+        end
+      end
+
+      # This overloads the on_dstr method in Parser::AST::Processor to handle
+      # the replace within the given node.
+      def on_dstr node
+        return if node.children.all? { |child_node| child_node.type == :str }
+
+        new_content = '('
+        node.children.each_with_index do |child_node, index|
+          # A begin node looks like #{some_code} in ruby, we do a substring
+          # from [2...-1] to get rid of the #{ & trailing }.
+          if child_node.type == :begin
+            code = child_node.
+                location.
+                expression.
+                source_buffer.
+                source[child_node.location.begin.begin_pos...child_node.location.end.end_pos]
+            code = code[2...-1]
+            new_content += "((#{ code }).to_s)"
+
+          # For interpolations that use class, instance, or global variables,
+          # those are NOT within a begin block, but instead are a ivar, cvar,
+          # or gvar node, not stripping of interpolation markers required.
+          elsif VARIABLES.include?(child_node.type)
+            variable = child_node.children.first
+            new_content << "((#{ variable }).to_s)"
+
+          # When interpolation includes strings before or after an
+          # interpolation they are simple :str nodes, in order to preserve
+          # escaping we need to do a dump of the string value.
+          elsif child_node.type == :str
+            literal_value = child_node.children.first
+            literal_value = literal_value.dump[1...-1]
+            new_content <<  "\"#{ literal_value }\""
+          end
+          new_content << ' + ' unless index == node.children.length - 1
+        end
+        new_content << ')'
+        if node.location.cs__respond_to?(:heredoc_body)
+          replace(node.location.heredoc_body, new_content)
+        else
+          replace(node.location.expression, new_content)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/scope_util.rb

@@ -0,0 +1,99 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Kernel # :nodoc:
+  include Contrast::Components::Interface
+
+  access_component :scope
+
+  alias_method :cs__catch, :catch
+
+  # In the event of a `throw`, we need to override `catch`
+  # to save & restore scope state:
+  #
+  #   scope_level == 0
+  #
+  #   catch(:abc) do
+  #     with_contrast_scope do
+  #       throw :abc # will leak
+  #     end
+  #   end
+  #
+  #   scope_level == 1
+  #
+  # While this will fix /all/ scope leaks, not just ones caused by `throw`,
+  # it shouldn't be relied upon as a catch-all (lmao) solution.
+
+  private
+
+  def catch *args, &block
+    # Save current scope level
+    scope_level = SCOPE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
+
+    # Run original catch with block.
+    retval = cs__catch(*args, &block)
+
+    # Restore scope.
+    SCOPE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
+
+    retval
+  end
+end
+
+# ScopeUtil should probably be merged into Scope component.
+module Contrast
+  module Utils
+    module ScopeUtil # :nodoc:
+      include Contrast::Components::Interface
+
+      access_component :analysis, :scope
+
+      # @return [Boolean]
+      def skip_contrast_analysis?
+        return true if in_contrast_scope?
+        return true unless Contrast::Agent::REQUEST_TRACKER.current&.analyze_request?
+
+        false
+      end
+
+      # Skip if we should skip_contrast_analysis?, sampling says to ignore this
+      # request, or assess has been disabled.
+      #
+      # @return [Boolean]
+      def skip_assess_analysis?
+        return true if skip_contrast_analysis?
+
+        current_context = Contrast::Agent::REQUEST_TRACKER.current
+        return true unless current_context.analyze_request?
+
+        !ASSESS.enabled?
+      end
+
+      def cs__enter_scope
+        enter_contrast_scope!
+      end
+
+      def cs__leave_scope
+        exit_contrast_scope!
+      end
+
+      def cs__enter_assess_scope
+        # If we shouldn't be doing assess things, don't propagate or whatever
+        disable_contrast = skip_assess_analysis?
+        return nil if disable_contrast
+
+        enter_contrast_scope!
+      end
+
+      def cs__enter_scope_contrast_patch
+        # If we're already in Contrast scope, don't propagate or whatever
+        disable_contrast = skip_contrast_analysis?
+        return nil if disable_contrast
+
+        enter_contrast_scope!
+      end
+    end
+  end
+end

data/lib/contrast/utils/service_response_util.rb

@@ -0,0 +1,116 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    # Utility class for processing responses from the Contrast Service. Specifically, this class
+    # processes Server and Application settings and updates the Settings component.
+    module ServiceResponseUtil
+      include Contrast::Components::Interface
+      access_component :contrast_service, :logging, :settings, :analysis
+
+      class << self
+        # TODO: RUBY-119
+        def process_response response
+          fs = Contrast::Agent::FeatureState.instance
+          fs.last_update = response&.sent_ms
+          server_features = process_server_response(response)
+          app_settings = process_application_response(response)
+
+          # ReactionProcessor is a design pattern from TeamServer.
+          # Right now, there's one potential reaction, which is disabling the agent
+          Contrast::Agent::ReactionProcessor.process(response&.application_settings)
+          # Determine new accumulator state
+          if (new_accum = response&.accumulator_settings)
+            SETTINGS.accumulator_settings.replace(new_accum)
+          end
+
+          fs.logger_manager.update(server_features&.log_file, server_features&.log_level)
+          update_features(server_features, app_settings)
+          logger.debug("Agent modes: P-#{ fs.protect_enabled? ? 'ENABLED' : 'DISABLED' }, A-#{ fs.assess_enabled? ? 'ENABLED' : 'DISABLED' }")
+        end
+
+        private
+
+        # Given some protobuf messages, update settings.
+        # This is the bridge between Contrast Service <-> Settings.
+        LOG_SERVER_SETTINGS_UPDATE = 'Agent: Received updated server features'
+        LOG_UPDATE_PROTECT         = 'Updating Protect state'
+        LOG_UPDATE_ASSESS          = 'Updating Assess state'
+        def process_server_response response
+          server_features = response&.server_features
+          return unless server_features
+
+          logger.debug(LOG_SERVER_SETTINGS_UPDATE)
+          # 'defend' is legacy for 'protect' in the dtm.
+          protect = server_features.defend
+          assess = server_features.assess
+
+          protect_enable = !!protect.enabled
+          assess_enable =  !!assess.enabled
+
+          # protect
+          begin
+            logger.debug(LOG_UPDATE_PROTECT)
+            SETTINGS.protect_state[:enabled] = protect_enable
+          end
+
+          # assess
+          begin
+            logger.debug(LOG_UPDATE_ASSESS)
+            SETTINGS.assess_state[:enabled] = assess_enable
+            SETTINGS.assess_state[:sampling_settings] = assess.sampling
+          end
+
+          server_features
+        end
+
+        MODE_WHITELIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
+        LOG_APP_SETTINGS_UPDATE = 'Agent: Received updated application settings'
+        def process_application_response response
+          app_settings = response&.application_settings
+          return unless app_settings
+
+          logger.debug(LOG_APP_SETTINGS_UPDATE)
+          exclusion_matchers = app_settings.exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
+          protection_rules = app_settings.protection_rules.map { |pr, _hash| [pr.id, pr.mode] }
+          protection_rules.select! { |(_id, mode)| MODE_WHITELIST.include? mode }
+          modes_by_id = protection_rules.to_h
+          SETTINGS.application_state.merge!(
+              modes_by_id: modes_by_id,
+              exclusion_matchers: exclusion_matchers,
+              disabled_assess_rules: app_settings.disabled_assess_rules,
+              session_id: app_settings.session_id)
+
+          app_settings
+        end
+
+        # This is can also go into settings/c.service, but it
+        # requires protobuf decorators to be pretty and decomposed.
+        LOG_INFO_RULE_SETTINGS = 'Current rule settings:'
+        def update_features server_features, app_settings
+          if !!(server_features || app_settings)
+            logger.debug_with_time('Rebuilding rule modes') do
+              SETTINGS.build_protect_rules if PROTECT.enabled?
+              SETTINGS.build_assess_rules  if ASSESS.enabled?
+
+              logger.info(LOG_INFO_RULE_SETTINGS)
+              PROTECT.rules.each { |k, v| logger.info(".. protect: #{ k } (#{ v.mode })") }
+              ASSESS.rules.each { |k, v| logger.info(".. assess:  #{ k } (#{ v.enabled? })") }
+            end
+          end
+
+          if (dynamic_sources_map_pb = server_features&.assess&.dynamic_sources_map)
+            dynamic_sources_map = dynamic_sources_map_pb.keys.inject({}) do |hsh, key|
+              hsh[key] = dynamic_sources_map_pb[key]
+            end
+            Contrast::Agent::Assess::Policy::Policy.instance.update_dynamic_sources dynamic_sources_map
+          end
+          # This is for assess
+          # PERF, we could avoid here with dirty-tracking.
+          Contrast::Utils::Assess::SamplingUtil.instance.update
+        end
+      end
+    end
+  end
+end