contrast-agent 3.10.0 → 3.12.1

data/lib/contrast/utils/string_utils.rb

@@ -1,10 +1,15 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/components/interface'
+
 module Contrast
   module Utils
     # Utilities for encoding and normalizing strings
     class StringUtils
+      include Contrast::Components::Interface
+      access_component :logging
+
       UTF8 = 'utf-8'
       HTTP_PREFIX = 'HTTP-'
 
@@ -17,6 +22,17 @@ module Contrast
         string.nil? ? 0 : string.to_s.length
       end
 
+      def self.present? str
+        !str.nil? && !str.to_s.empty?
+      end
+
+      def self.protobuf_format data, truncate: true
+        data = data&.to_s
+        data = Contrast::Utils::StringUtils.force_utf8(data)
+        data = Contrast::Utils::StringUtils.truncate(data) if truncate
+        data
+      end
+
       # Protobuf has a very strict typing. Nil is not a String and will throw
       # an exception if you try to set it. Use this to be safe.
       # Uses the object share to avoid creating several new strings per request
@@ -31,7 +47,7 @@ module Contrast
         str.to_s[0..255]
       end
 
-      def self.force_utf8 str, logger = nil
+      def self.force_utf8 str
         return Contrast::Utils::ObjectShare::EMPTY_STRING unless str
 
         str = str.to_s
@@ -45,7 +61,7 @@ module Contrast
         # We were unable to switch the String to a UTF-8 format.
         # Return non-nil so as not to throw an exception later when trying
         # to do regexp or other compares on the String
-        logger&.debug "Unable to change '#{ str }' to valid UTF-8: #{ e.message }"
+        logger.trace('Unable to cast String to UTF-8 format', e, value: str)
 
         Contrast::Utils::ObjectShare::EMPTY_STRING
       end

data/lib/contrast/utils/tag_util.rb

@@ -37,7 +37,9 @@ module Contrast
               tag.update_end(0)
             when Contrast::Agent::Assess::Tag::HIGH_SPAN
               tag.update_start(range.end_idx)
-            when Contrast::Agent::Assess::Tag::ABOVE # rubocop:disable Lint/EmptyWhen
+            when Contrast::Agent::Assess::Tag::ABOVE
+              # The tag's above where we are, it doesn't cover us but a later
+              # one may
             end
           end
           return false unless tag.length <= 0
@@ -89,6 +91,14 @@ module Contrast
           end
         end
 
+        def size_aware_merge target_object, tags
+          max_size = target_object.to_s.length
+          tags = merge_tags(tags)
+          tags.each do |tag|
+            tag.update_end(max_size) if tag.extends_beyond_string_size?(max_size)
+          end
+        end
+
         private
 
         # Add one new element to the given array

data/lib/contrast/utils/thread_tracker.rb

@@ -41,11 +41,11 @@ module Contrast
       end
 
       # logger may be nil so use this utility method instead
-      def log key, msg = nil
+      def log key
         return unless @logger
         return unless @logger.debug?
 
-        @logger.debug("Thread Tracker[#{ key }] :: #{ Process.pid }.#{ Thread.current.object_id } => #{ msg }")
+        @logger.debug('Accessing object in Thread Tracker', name: key, p_id: Process.pid, thread_id: Thread.current.object_id)
       rescue StandardError
         false # NOOP
       end

data/lib/contrast/utils/timer.rb

@@ -21,23 +21,11 @@ module Contrast
         result
       end
 
-      def ms key
-        events[key.to_s] || 0
-      end
-
-      def abs key
-        start_ms + (events[key.to_s] || 0)
-      end
-
       def to_s
         pairs = events.to_a.map { |pair| "#{ pair[0] }=#{ pair[1] }ms" }
         start_at.strftime('%Y-%m-%d %H:%M:%S.%L') + pairs.join(Contrast::Utils::ObjectShare::SPACE)
       end
 
-      def diff_s start_ms
-        (now_ms - start_ms) / 1000
-      end
-
       def now_ms
         (Time.now.to_f * 1000).to_i
       end
@@ -45,34 +33,6 @@ module Contrast
       def self.now_ms
         (Time.now.to_f * 1000).to_i
       end
-
-      def self.earliest lhs, rhs
-        if lhs && rhs
-          [lhs, rhs].min
-        elsif lhs
-          lhs
-        else
-          rhs
-        end
-      end
-
-      def self.latest lhs, rhs
-        if lhs && rhs
-          [lhs, rhs].max
-        elsif lhs
-          lhs
-        else
-          rhs
-        end
-      end
-
-      def now_sec
-        now_ms / 1000
-      end
-
-      def elapsed_ms
-        now_ms - start_ms
-      end
     end
   end
 end

data/resources/assess/policy.json

@@ -1,6 +1,7 @@
 {
   "tracked_classes": [
     "ActionDispatch::Http::UploadedFile",
+    "Fiber",
     "Symbol",
     "Pathname",
     "File",
@@ -149,7 +150,25 @@
       "source":"O",
       "target":"R",
       "action":"KEEP"
-    }, {
+    },     {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "to_s",
+      "source": "O",
+      "target": "R",
+      "action": "KEEP"
+    },
+    {
+      "class_name": "String",
+      "instance_method": true,
+      "method_visibility": "public",
+      "method_name": "to_str",
+      "source": "O",
+      "target": "R",
+      "action": "KEEP"
+    },
+    {
       "class_name": "String",
       "instance_method": true,
       "method_visibility": "public",
@@ -245,22 +264,6 @@
       "source":"O",
       "target":"R",
       "action":"KEEP"
-    }, {
-      "class_name":"String",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"to_s",
-      "source":"O",
-      "target":"R",
-      "action":"KEEP"
-    }, {
-      "class_name":"String",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"to_str",
-      "source":"O",
-      "target":"R",
-      "action":"KEEP"
     }, {
       "class_name":"String",
       "instance_method": true,
@@ -598,7 +601,9 @@
       "method_name":"to_a",
       "source":"O",
       "target":"R",
-      "action":"SPLAT"
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "to_a_tagger"
     }, {
       "class_name":"MatchData",
       "instance_method": true,
@@ -606,7 +611,9 @@
       "method_name":"[]",
       "source":"O",
       "target":"R",
-      "action":"SPLAT"
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "square_bracket_tagger"
     }, {
       "class_name":"MatchData",
       "instance_method": true,
@@ -614,7 +621,10 @@
       "method_name":"captures",
       "source":"O",
       "target":"R",
-      "action":"SPLAT"
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "captures_tagger"
+
     }, {
       "class_name":"MatchData",
       "instance_method": true,
@@ -622,7 +632,9 @@
       "method_name":"values_at",
       "source":"O",
       "target":"R",
-      "action":"SPLAT"
+      "action":"CUSTOM",
+      "patch_class": "Contrast::Agent::Assess::Policy::Propagator::MatchData",
+      "patch_method": "values_at_tagger"
     }, {
       "class_name":"String",
       "instance_method": true,
@@ -963,49 +975,8 @@
       "method_visibility": "private",
       "method_name": "sprintf",
       "action": "CUSTOM",
-      "patch_class": "KernelPropagator",
+      "patch_class": "Contrast::Extension::Assess::KernelPropagator",
       "patch_method": "sprintf_tagger"
-    }, {
-      "class_name":"SQLite3::Statement",
-      "instance_method": true,
-      "method_visibility": "private",
-      "method_name":"initialize",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger",
-      "source": "P1"
-    }, {
-      "class_name":"PG::Connection",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"sync_exec",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger"
-    }, {
-      "class_name":"PG::Connection",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"sync_exec_params",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger"
-    }, {
-      "class_name":"PG::Connection",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"async_exec",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger"
-    }, {
-      "class_name":"PG::Connection",
-      "instance_method": true,
-      "method_visibility": "public",
-      "method_name":"async_exec_params",
-      "action": "CUSTOM",
-      "patch_class": "Contrast::Agent::Assess::Rule::Csrf::CsrfApplicator",
-      "patch_method": "csrf_tagger"
     }, {
       "class_name":"ActiveRecord::ConnectionAdapters::Quoting",
       "instance_method": true,
@@ -1226,9 +1197,9 @@
           "method_name": "evaluate",
           "instance_method": true,
           "method_visibility": "public",
-          "source":"O",
-          "trigger_class": "TiltTemplateTrigger",
-          "trigger_method": "render_trigger_check"
+          "source": "O",
+          "trigger_class": "Contrast::Agent::Assess::Policy::Trigger::ReflectedXss",
+          "trigger_method": "xss_tilt_trigger"
         },
         {
           "class_name":"String",
@@ -1683,16 +1654,16 @@
           "method_visibility": "private",
           "method_name": "initialize",
           "source": "P1",
-          "trigger_class": "XPathLibraryTrigger",
-          "trigger_method": "xpath_trigger_check"
+          "trigger_class": "Contrast::Agent::Assess::Policy::Trigger::Xpath",
+          "trigger_method": "xpath_expression_trigger"
         }, {
           "class_name": "Oga::XML::CharacterNode",
           "instance_method": true,
-          "method_visibility": "public",
+          "method_visibility": "private",
           "method_name": "initialize",
           "source": "P0",
-          "trigger_class": "XPathLibraryTrigger",
-          "trigger_method": "xpath_trigger_check"
+          "trigger_class": "Contrast::Agent::Assess::Policy::Trigger::Xpath",
+          "trigger_method": "xpath_oga_trigger"
         }, {
           "class_name": "XPather",
           "instance_method": true,

data/resources/inventory/policy.json

@@ -2,8 +2,8 @@
   "rules":[
     {
       "name":"data_store",
-      "applicator": "Contrast::CoreExtensions::Inventory::DataStores",
-      "applicator_method": "patched_report_data_store",
+      "applicator": "Contrast::Agent::Inventory::Policy::DataStores",
+      "applicator_method": "report_data_store",
       "required_properties": ["data_store"],
       "optional_properties": [],
       "triggers":[

data/resources/protect/policy.json

@@ -2,8 +2,8 @@
   "rules":[
     {
       "name": "cmd-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesCommandInjectionRule",
-      "applicator_method": "apply_command_injection_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesCommandInjectionRule",
+      "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],
       "triggers": [
@@ -114,8 +114,8 @@
     },
     {
       "name": "nosql-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesNoSqliRule",
-      "applicator_method": "apply_nosql_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesNoSqliRule",
+      "applicator_method": "apply_rule",
       "required_properties": ["database"],
       "optional_properties": [],
       "triggers": [
@@ -156,8 +156,8 @@
     },
     {
       "name":"path-traversal",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesPathTraversalRule",
-      "applicator_method": "apply_path_traversal_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesPathTraversalRule",
+      "applicator_method": "apply_rule",
       "required_properties": ["action"],
       "optional_properties": [],
       "triggers":[
@@ -254,8 +254,8 @@
     },
     {
       "name": "sql-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesSqliRule",
-      "applicator_method": "apply_sql_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesSqliRule",
+      "applicator_method": "apply_rule",
       "required_properties": ["index", "database"],
       "optional_properties": [],
       "triggers": [
@@ -336,8 +336,8 @@
     },
     {
       "name": "untrusted-deserialization",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesDeserializationRule",
-      "applicator_method": "apply_deserialization_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesDeserializationRule",
+      "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],
       "triggers": [
@@ -361,8 +361,8 @@
     },
     {
       "name": "xxe",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesXxeRule",
-      "applicator_method": "apply_xxe_rule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesXxeRule",
+      "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],
       "triggers": [
@@ -377,7 +377,7 @@
           "method_name": "read_io",
           "instance_method": false,
           "method_visibility": "public",
-          "applicator_method": "apply_xxe_rule__io",
+          "applicator_method": "apply_rule__io",
           "properties": {}
         },{
           "class_name": "Nokogiri::XML::SAX::Parser",
@@ -390,7 +390,7 @@
           "method_name": "parse_io",
           "instance_method": true,
           "method_visibility": "public",
-          "applicator_method": "apply_xxe_rule__io",
+          "applicator_method": "apply_rule__io",
           "properties": {}
         },{
           "class_name": "Ox",
@@ -409,7 +409,7 @@
           "method_name": "read_data",
           "instance_method": true,
           "method_visibility": "public",
-          "applicator_method": "apply_xxe_rule__lexer",
+          "applicator_method": "apply_rule__lexer",
           "properties": {}
         }
 

data/ruby-agent.gemspec

@@ -33,8 +33,10 @@ end
 
 # Add those dependencies required to develop or test the Agent
 def self.add_dev_dependencies spec
+  spec.add_development_dependency 'amazing_print'
   spec.add_development_dependency 'bundler'
   spec.add_development_dependency 'climate_control' # mock ENV
+  spec.add_development_dependency 'debride'
   spec.add_development_dependency 'execjs'
   spec.add_development_dependency 'factory_bot'
   spec.add_development_dependency 'fake_ftp'
@@ -48,9 +50,9 @@ def self.add_dev_dependencies spec
   spec.add_development_dependency 'rspec', '~> 3.0'
   spec.add_development_dependency 'rspec-benchmark'
   spec.add_development_dependency 'rspec_junit_formatter', '0.3.0'
-  spec.add_development_dependency 'rubocop', '0.80.0'
+  spec.add_development_dependency 'rubocop', '0.83.0'
   spec.add_development_dependency 'rubocop-performance', '1.5.2'
-  spec.add_development_dependency 'rubocop-rspec', '1.38.1'
+  spec.add_development_dependency 'rubocop-rspec', '1.39.0'
   spec.add_development_dependency 'simplecov', '~> 0.18'
   spec.add_development_dependency 'sinatra', '>= 2'
   spec.add_development_dependency 'sqlite3', '1.3.9'
@@ -67,8 +69,9 @@ end
 # corresponding update to the fake gem server data in TeamServer.
 def self.add_dependencies spec
   spec.add_dependency 'google-protobuf', '~> 3.9.0'
+  spec.add_dependency 'ougai', '~> 1.8'
   spec.add_dependency 'parser', '~> 2.6'
-  spec.add_dependency 'rack', '>= 1.0', '< 3.0'
+  spec.add_dependency 'rack', '>= 2.0', '< 3.0'
 end
 
 # Enumerate the files required to build the Agent.
@@ -77,7 +80,7 @@ def self.add_files spec
     # Directories used for testing:
     f.match(%r{^(spec|test)/}) ||
         # Directories used in pipelines
-        f.match(%r{^(bin|bitbucket_scripts|vendor)/}) ||
+        f.match(%r{^(bin|bitbucket_scripts|internal_resources|vendor)/}) ||
         # Configuration and other files that don't belong to one directory
         f.match(/(Dockerfile)/)  ||
         f.match(/(.*\.csv)/)     ||
@@ -123,6 +126,10 @@ Gem::Specification.new do |spec|
   spec.extensions = Dir['ext/cs__common/extconf.rb', 'ext/**/extconf.rb']
   spec.require_paths = ['lib']
 
+  unless File.exist?(File.join(Dir.pwd, 'contrast_security.yaml'))
+    spec.post_install_message = 'To generate the required contrast_security.yaml file you can run: bundle exec rake contrast:config:create'
+  end
+
   add_authors(spec)
   add_files(spec)
   add_dev_dependencies(spec)