contrast-agent 3.10.0 → 3.12.1

data/ext/cs__assess_regexp_track/cs__assess_regexp_track.h

@@ -1,29 +0,0 @@
-#include <funchook.h>
-#include <ruby.h>
-
-static VALUE regexp_class;
-static VALUE track_rb_n_match;
-static VALUE track_rb_pre_match;
-static VALUE track_rb_post_match;
-static VALUE track_rb_reg_match_last;
-
-VALUE rb_reg_match_pre(VALUE match);
-static VALUE *(*rb_reg_match_pre_original)(VALUE match);
-
-VALUE rb_reg_match_post(VALUE match);
-static VALUE *(*rb_reg_match_post_original)(VALUE match);
-
-VALUE rb_reg_match_last(VALUE match);
-static VALUE *(*rb_reg_match_last_original)(VALUE match);
-
-VALUE rb_reg_nth_match(int nth, VALUE match);
-static VALUE *(*rb_reg_nth_match_original)(int nth, VALUE match);
-
-static VALUE rb_reg_match_pre_hook(VALUE match);
-static VALUE rb_reg_match_post_hook(VALUE match);
-static VALUE rb_reg_match_last_hook(VALUE match);
-static VALUE rb_reg_nth_match_hook(int nth, VALUE match);
-
-static int install_regexp_hooks();
-
-void Init_cs__assess_regexp_track(void);

data/ext/cs__assess_regexp_track/extconf.rb

@@ -1,2 +0,0 @@
-$TO_MAKE = File.basename(__dir__)
-require_relative '../extconf_common'

data/lib/contrast/agent/assess/frozen_properties.rb

@@ -1,41 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'set'
-cs__scoped_require 'base64'
-cs__scoped_require 'contrast/utils/tag_util'
-cs__scoped_require 'contrast/utils/prevent_serialization'
-
-module Contrast
-  module Agent
-    module Assess
-      # This class is used as an NoOP version of Properties. We'll pass this to
-      # any attempt to access Properties on a frozen object including
-      # AssessExtension iff that object did not have Properties before it was
-      # placed in a frozen state.
-      class FrozenProperties
-        include Contrast::Utils::PreventSerialization
-
-        def events
-          Contrast::Utils::ObjectShare::EMPTY_ARRAY
-        end
-
-        def properties
-          Contrast::Utils::ObjectShare::EMPTY_HASH
-        end
-
-        def tracked?
-          false
-        end
-
-        def tagged? _label
-          false
-        end
-
-        def any_tags_between? _start, _finish
-          false
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/csrf.rb

@@ -1,66 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # The Ruby implementation of the CSRF Assess Rule.
-        class Csrf < Contrast::Agent::Assess::Rule::ResponseScanningRule
-          NAME = 'csrf'
-          def name
-            NAME
-          end
-
-          DB_STATE_CHANGE = 'db'
-          ACTION_LIMIT = 3
-          QUERY_SIZE_LIMIT = 50
-          STATE_CHANGING_ACTIONS_KEY = 'csrf.statechange.actions'
-          def record_db_state_change context, query
-            return unless context
-
-            changes = context.get_property(STATE_CHANGING_ACTIONS_KEY)
-            changes ||= []
-            return unless changes.length < ACTION_LIMIT
-
-            return unless state_change?(query)
-
-            action = Contrast::Agent::Assess::Rule::Csrf::CsrfAction.new
-            action.type = DB_STATE_CHANGE
-            action.evidence = query[0..QUERY_SIZE_LIMIT]
-
-            changes << action
-
-            context.add_property(STATE_CHANGING_ACTIONS_KEY, changes)
-          end
-
-          STATE_CHANGE_QUERY_ACTIONS = %w[
-            insert
-            update
-            delete
-            drop
-            create
-            alter
-            upsert
-          ].cs__freeze
-          # Returns true if the given query starts with any
-          # of the STATE_CHANGE_QUERY_ACTIONS listed above
-          def state_change? query
-            return false unless query.is_a?(String) && !query.empty?
-
-            query.downcase.start_with?(*STATE_CHANGE_QUERY_ACTIONS)
-          end
-
-          # some watchers keep state and need to be reset in each request.
-          # this one is not one of those.
-          def watcher
-            @_watcher ||= Contrast::Agent::Assess::Rule::Csrf::Watcher.new
-          end
-
-          # Indicates if this request has been checked for a CSRF token
-          CHECKED = 'csrf.token.checked'
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/csrf/csrf_action.rb

@@ -1,28 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        class Csrf
-          # CSRF is only reported on those Requests which also result in a
-          # state changing action (database call). This class servers as a
-          # record of that action.
-          class CsrfAction
-            attr_accessor :type, :evidence
-
-            TYPE = 'type'
-            EVIDENCE = 'evidence'
-            def to_h
-              {
-                  TYPE => type,
-                  EVIDENCE => evidence
-              }
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb

@@ -1,73 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        class Csrf
-          # This class is called by our patches to determine if a CSRF
-          # vulnerability exists within an application. It is used through a
-          # CUSTOM propagation in order to capture that a Database call was
-          # made in response to a request that did not have the Contrast CSRF
-          # token.
-          class CsrfApplicator
-            include Contrast::Components::Interface
-            access_component :logging, :analysis, :scope
-
-            CS__CSRF_LOG_MSG = 'applying CSRF assess rule'
-
-            class << self
-              def csrf_tagger patcher, preshift, _ret, _block
-                return unless rule&.enabled?
-
-                idx = patcher.sources[0].to_i
-                args = preshift.args
-                return unless args&.length.to_i > idx
-
-                sql = args[idx]
-                return unless sql
-
-                with_contrast_scope do
-                  logger.debug(nil, CS__CSRF_LOG_MSG)
-                  rule.record_db_state_change(
-                      Contrast::Agent::REQUEST_TRACKER.current,
-                      sql)
-                end
-              end
-
-              def apply_csrf_rule sql
-                context = Contrast::Agent::REQUEST_TRACKER.current
-
-                return unless context&.app_loaded?
-                return unless ASSESS.enabled?
-                return unless sql
-
-                rule = Contrast::Agent::FeatureState.instance.assess_rule(
-                    Contrast::Agent::Assess::Rule::Csrf::NAME)
-                return unless rule&.enabled?
-
-                with_contrast_scope do
-                  logger.debug(CS__CSRF_LOG_MSG)
-                  rule.record_db_state_change(context, sql)
-                end
-              rescue StandardError => e
-                logger.warn(e, 'Error running CSRF assess rule')
-              end
-
-              private
-
-              def rule
-                @_rule ||= Contrast::Agent::FeatureState.instance.assess_rule(
-                    Contrast::Agent::Assess::Rule::Csrf::NAME)
-              end
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb

@@ -1,132 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/assess/rule/response_watcher'
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        class Csrf
-          # Watchers are how those Rules which do not act on dataflow function.
-          # This one is used by the CSRF rule to determine if a request was
-          # made in a way that is susceptible to a CSRF attack.
-          class Watcher < Contrast::Agent::Assess::Rule::ResponseWatcher
-            def supports? context
-              return false unless super(context)
-              return false unless user_agent?(context)
-              return false unless form_content_type?(context)
-              return false unless form_method?(context)
-              return false if empty_get?(context)
-
-              true
-            end
-
-            X_REQUESTED_WITH = 'X-REQUESTED-WITH'
-            # ignore this request if X-Requested-With is set
-            def x_requested_with? context
-              !context.request.normalized_request_headers[X_REQUESTED_WITH].nil?
-            end
-
-            USER_AGENT = 'USER-AGENT'
-            # ignore this request if User-Agent is NOT set
-            # since that indicates this isn't a browser interaction
-            def user_agent? context
-              !context.request.normalized_request_headers[USER_AGENT].nil?
-            end
-
-            CONTENT_TYPE = 'CONTENT-TYPE'
-            FORM_TYPES = %w[
-              text/plain
-              multipart/form-data
-              application/x-www-form-urlencoded
-            ].cs__freeze
-            # ignore this request if the Content-Type is NOT set
-            # to a form content type
-            def form_content_type? context
-              type = context.request.content_type
-              # We need to account for the charset being part of the header. It doesn't
-              # affect how we determine CSRF-ability or not
-              type = type.split(Contrast::Utils::ObjectShare::SEMICOLON)[0] if type
-              FORM_TYPES.include?(type)
-            end
-
-            FORM_METHODS = %w[GET POST].cs__freeze
-            # ignore this request if the request method
-            # is not one that can be set with forms
-            def form_method? context
-              FORM_METHODS.include?(context.request.request_method)
-            end
-
-            GET = 'GET'
-            # ignore this request if the method is get
-            # and the query string is empty
-            def empty_get? context
-              request = context.request
-              request.request_method ==
-                  GET &&
-                  (request.query_string.nil? || request.query_string.empty?)
-            end
-
-            # If a parameter contains 'csrf' or 'token', we consider
-            # it to be a guard against CSRF and therefore determine
-            # that this request is not vulnerable.
-            CSRF_PATTERN = /csrf/i.cs__freeze
-            TOKEN_PATTERN = /token/i.cs__freeze
-            def vulnerable? context
-              # having the property 'csrf.token.checked' indicates
-              # that a CSRF check was preformed at some point during
-              # this request, so we consider it to not be vulnerable
-              return false if context.get_property(CHECKED)
-
-              params = context.request.parameters
-              params.each_key do |key|
-                return false if key.match?(CSRF_PATTERN)
-                return false if key.match?(TOKEN_PATTERN) && looks_like_token?(params[key])
-              end
-              # having no actions means there's no vulnerability
-              return false unless context.get_property(STATE_CHANGING_ACTIONS_KEY)&.any?
-
-              true
-            end
-
-            MINIMUM_CSRF_TOKEN_SIZE = 8
-            MAXIMUM_CSRF_TOKEN_SIZE = 24
-            TOKEN_REGEXP = /^[A-Za-z0-9]*$/.cs__freeze
-            def looks_like_token? value
-              return false unless value
-
-              values = [value]
-              values.each do |parameter|
-                next unless parameter
-
-                length = parameter.length
-                next if length < MINIMUM_CSRF_TOKEN_SIZE
-                next if length > MAXIMUM_CSRF_TOKEN_SIZE
-                return true if parameter.match?(TOKEN_REGEXP)
-              end
-              false
-            end
-
-            DATA_KEY = 'actions'
-            def build_finding context
-              actions = context.get_property(STATE_CHANGING_ACTIONS_KEY)
-              return if actions.nil? || actions.empty?
-
-              string = actions.map(&:to_h).to_json
-              finding = Contrast::Api::Dtm::Finding.new
-              finding.rule_id = Contrast::Agent::Assess::Rule::Csrf::NAME
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
-              hash_code = Contrast::Utils::HashDigest.generate_response_hash(finding)
-              finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash_code)
-              finding.properties[DATA_KEY] = Contrast::Utils::StringUtils.force_utf8(string)
-              finding
-            rescue StandardError => e
-              logger.error(e, 'Unable to build a finding for CSRF')
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/response_scanning_rule.rb

@@ -1,47 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # Those rules which function by scanning the Response body in order to
-        # detect vulnerabilities. These rules should each have their own
-        # Contrast::Agent::Assess::RuleResponseWatcher.
-        #
-        # Note: Most have been moved to the Service, as they typically watch
-        #   the Request or Response bodies, parsing out vulnerabilities
-        #   therein. CSRF is an exception to this as the rule requires a change
-        #   to the Response body to function.
-        class ResponseScanningRule < Contrast::Agent::Assess::Rule::Base
-          def watcher
-            # raise(
-            #     NotImplementedError,
-            #     'A child rule should have overridden the watcher method')
-          end
-
-          def stream_safe?
-            false
-          end
-
-          def generate_hash finding
-            Contrast::Utils::HashDigest.generate_response_hash(finding)
-          end
-
-          def postfilter context
-            findings = watcher.postfilter(context) if watcher && context
-            return unless findings
-
-            if findings.is_a?(Array)
-              findings.each do |finding|
-                send_report(finding) if finding
-              end
-            else
-              send_report(findings)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/response_watcher.rb

@@ -1,36 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # A watcher focused on the Response body, parsing out vulnerabilities
-        # therein.
-        #
-        # Note: Most have been moved to the Service, as they typically watch
-        #   the Request or Response bodies, parsing out vulnerabilities
-        #   therein. CSRF is an exception to this as the rule requires a change
-        #   to the Response body to function.
-        class ResponseWatcher < Contrast::Agent::Assess::Rule::Watcher
-          def postfilter context
-            return unless supports?(context)
-            return unless vulnerable?(context)
-
-            build_finding(context)
-          end
-
-          def vulnerable? _context
-            raise(
-                NotImplementedError,
-                'A child rule should have overridden the vulnerable? method')
-          end
-
-          def build_finding _context
-            Contrast::Api::Dtm::Finding.new
-          end
-        end
-      end
-    end
-  end
-end