contrast-agent 3.10.0 → 3.12.1

data/lib/contrast/agent/patching/policy/patcher.rb

@@ -44,18 +44,16 @@ module Contrast
           extend Contrast::Agent::Patching::Policy::AfterLoadPatcher
 
           include Contrast::Components::Interface
-          access_component :logging, :analysis, :agent, :scope
+          access_component :agent, :analysis, :logging, :scope
 
           class << self
             # Hook to install the Contrast changes needed to allow for the
             # instrumentation of the application - this only occurs once, during
             # startup to catchup on everything we didn't see get loaded
             def patch
-              logger.debug_with_time("\tPatching") do
-                catchup_after_load_patches
-                patch_methods
-                Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations
-              end
+              catchup_after_load_patches
+              patch_methods
+              Contrast::Agent::Assess::Policy::RewriterPatch.rewrite_interpolations
             end
 
             # Hook to only monkeypatch Contrast. This will not trigger any
@@ -91,7 +89,7 @@ module Contrast
               patch_into_module(module_data)
               all_module_names.delete(mod_name) if status_type.get_status(mod).patched?
             rescue StandardError => e
-              logger.error("Unable to patch into #{ mod_name }", e)
+              logger.error('Unable to patch module', e, module: mod_name)
             end
 
             # We did it, team. We found a patcher(s) that applies to the given
@@ -150,20 +148,20 @@ module Contrast
             # only be invoked by the patch_methods method above in order to
             # ensure it is wrapped in a synchronize call
             def synchronized_patch_methods
-              # logger.trace_with_time("\t\tRunning patching") do # TODO: RUBY-547
-              patched = []
-              all_module_names.each do |patchable_name|
-                next if AGENT.skip_instrumentation?(patchable_name)
+              logger.trace_with_time('Running patching') do
+                patched = []
+                all_module_names.each do |patchable_name|
+                  next if AGENT.skip_instrumentation?(patchable_name)
 
-                patchable_mod = patchable(patchable_name)
-                next unless patchable_mod
+                  patchable_mod = patchable(patchable_name)
+                  next unless patchable_mod
 
-                module_data = Contrast::Agent::ModuleData.new(patchable_mod, patchable_name)
-                patch_into_module(module_data)
-                patched << patchable_name if status_type.get_status(patchable_mod).patched?
+                  module_data = Contrast::Agent::ModuleData.new(patchable_mod, patchable_name)
+                  patch_into_module(module_data)
+                  patched << patchable_name if status_type.get_status(patchable_mod).patched?
+                end
+                all_module_names.subtract(patched)
               end
-              all_module_names.subtract(patched)
-              # end
             end
 
             # Given the patchers that apply to this class that may apply, patch
@@ -187,9 +185,6 @@ module Contrast
 
               clazz = module_data.mod
 
-              status = status_type.get_status(clazz)
-              return if (status.patched? || status.patching?) && !redo_patch
-
               status.patching!
               patched = include_module(module_data)
 
@@ -216,19 +211,22 @@ module Contrast
             rescue StandardError => e
               status ||= status_type.get_status(module_data.mod)
               status.failed_patch!
-              logger.warn(e, "Unable to patch into #{ module_data.name }")
+              logger.warn('Patching failed', e, module: module_data.name)
             ensure
-              logger.debug(nil, "Patching #{ module_data.name } resulted in #{ status_type.get_status(module_data.mod).patch_status }")
+              logger.trace('Patching complete',
+                           module: module_data.name,
+                           result: Contrast::Agent::Patching::Policy::PatchStatus.get_status(
+                               module_data.mod).patch_status)
             end
 
             # Includes the given module with the
-            # Contrast::CoreExtensions::Assess::AssessExtension
+            # Contrast::Extension::Assess::AssessExtension
             # @param module_data [Contrast::Agent::ModuleData] the module, and
             #   its name, that's being patched into
             def include_module module_data
               return false unless Contrast::Agent::Assess::Policy::Policy.instance.tracked_classes.include?(module_data.name)
 
-              module_data.mod.send(:include, Contrast::CoreExtensions::Assess::AssessExtension)
+              module_data.mod.send(:include, Contrast::Extension::Assess::AssessExtension)
               true
             end
 
@@ -300,10 +298,10 @@ module Contrast
 end
 
 # core extensions
-cs__scoped_require 'contrast/extensions/ruby_core/module'
-cs__scoped_require 'contrast/extensions/ruby_core/assess'
-cs__scoped_require 'contrast/extensions/ruby_core/inventory'
-cs__scoped_require 'contrast/extensions/ruby_core/protect'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/kernel'
+cs__scoped_require 'contrast/extension/module'
+cs__scoped_require 'contrast/extension/assess'
+cs__scoped_require 'contrast/extension/inventory'
+cs__scoped_require 'contrast/extension/protect'
+cs__scoped_require 'contrast/extension/protect/kernel'
 
 cs__scoped_require 'cs__contrast_patch/cs__contrast_patch'

data/lib/contrast/agent/patching/policy/policy.rb

@@ -2,6 +2,8 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'json'
+cs__scoped_require 'singleton'
+
 cs__scoped_require 'contrast'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/agent/patching/policy/module_policy'
@@ -33,10 +35,9 @@ module Contrast
             raise(NotImplementedError, 'specify the concrete node type for this poilcy')
           end
 
-          access_component :logging, :analysis
+          access_component :analysis, :logging
 
-          attr_accessor :providers, :tracked_classes
-          attr_reader :sources, :propagators, :triggers, :patched_names
+          attr_reader :sources, :propagators, :triggers, :providers, :tracked_classes
 
           SOURCES_KEY =          'sources'
           PROPAGATION_KEY =      'propagators'
@@ -54,7 +55,6 @@ module Contrast
             @triggers = []
             @providers = {}
             @tracked_classes = []
-            @patched_names = Set.new
 
             json = Contrast::Utils::ResourceLoader.load(cs__class.policy_json)
             from_hash_string(json)
@@ -85,14 +85,14 @@ module Contrast
 
           def add_node node, node_type = :trigger
             unless node
-              logger.error(nil, 'Node was nil when adding node to policy')
+              logger.error('Node was nil when adding node to policy')
               return
             end
 
             begin
               node.validate
             rescue ArgumentError => e
-              logger.error(e, e.message)
+              logger.error('Node failed validation', e)
               return
             end
 
@@ -107,7 +107,7 @@ module Contrast
               module_names << node.class_name
               @sources << node
             else
-              logger.error(nil, "Invalid node_type: #{ node_type } provided when adding node to policy")
+              logger.error('Invalid node_type provided when adding node to policy', node_type: node_type)
             end
           end
 

data/lib/contrast/agent/patching/policy/policy_node.rb

@@ -13,10 +13,10 @@ module Contrast
         # @abstract
         class PolicyNode
           include Contrast::Components::Interface
-          access_component :scope
+          access_component :analysis, :scope
 
-          attr_accessor :class_name, :instance_method, :method_name, :method_scope, :method_visibility
-          attr_reader :properties
+          attr_accessor :class_name, :instance_method, :method_name, :method_visibility
+          attr_reader :properties, :method_scope
 
           def node_class
             raise NotImplementedError, 'specify the type of the feature for which this node patches'
@@ -60,14 +60,6 @@ module Contrast
             instance_method
           end
 
-          def private?
-            @method_visibility == :private
-          end
-
-          def public?
-            @method_visibility == :public
-          end
-
           private
 
           # Convert strings to symbols here, once, to avoid doing so on every

data/lib/contrast/agent/patching/policy/trigger_node.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/agent/patching/policy/policy_node'
 
 module Contrast
@@ -15,16 +15,13 @@ module Contrast
         # input attempted to or did do damage).
         class TriggerNode < PolicyNode
           JSON_NAME = 'name'
-          JSON_NODES = 'nodes'
           JSON_APPLICATOR = 'applicator'
           JSON_APPLICATOR_METHOD = 'applicator_method'
           JSON_REQUIRED_PROPS = 'required_properties'
           JSON_OPTIONAL_PROPS = 'optional_properties'
-          JSON_SCOPE = 'scope'
           JSON_ON_EXCEPTION = 'on_exception'
 
-          attr_reader :rule_id
-          attr_accessor :applicator_method, :applicator, :on_exception, :required_properties, :optional_properties
+          attr_reader :applicator, :applicator_method, :on_exception, :optional_properties, :required_properties, :rule_id
 
           def initialize trigger_hash = {}, rule_hash = {}
             super(trigger_hash)

data/lib/contrast/agent/protect/policy/applies_command_injection_rule.rb

@@ -0,0 +1,63 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
+cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
+cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+
+module Contrast
+  module Agent
+    module Protect
+      module Policy
+        # This Module is how we apply the Command Injection rule. It is called
+        # from our patches of the targeted methods in which command execution
+        # occurs. It is responsible for deciding if the infilter methods of the
+        # rule should be invoked.
+        # In addition, b/c of the nature of Deserialization's sand boxing
+        # function, this Module's apply methods call through to the
+        # {#apply_deserialization_command_check} method of the
+        # Deserialization applicator.
+        module AppliesCommandInjectionRule
+          extend Contrast::Agent::Protect::Policy::RuleApplicator
+
+          CS__SEMICOLON = '; '
+
+          class << self
+            def invoke method, _exception, _properties, object, args
+              return unless valid_command?(args)
+
+              command = build_command(args)
+              Contrast::Agent::Protect::Policy::AppliesDeserializationRule.apply_deserialization_command_check(command)
+              return if skip_analysis?
+
+              begin
+                clazz = object.is_a?(Module) ? object : object.cs__class
+                class_name = clazz.cs__name
+                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
+              end
+            end
+
+            protected
+
+            def name
+              Contrast::Agent::Protect::Rule::CmdInjection::NAME
+            end
+
+            private
+
+            def valid_command? command
+              command && (command.is_a?(String) || command.is_a?(Array))
+            end
+
+            def build_command command
+              return command if command.is_a?(String)
+
+              command = command.drop(1) if command.length > 1
+              command.join(CS__SEMICOLON)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/policy/applies_deserialization_rule.rb

@@ -0,0 +1,52 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/protect/rule/deserialization'
+cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+
+module Contrast
+  module Agent
+    module Protect
+      module Policy
+        # This Module is how we apply the Deserialization rule. It is called from
+        # our patches of the targeted methods in which deserialization occurs.
+        # It is responsible for deciding if the infilter methods of the rule
+        # should be invoked.
+        module AppliesDeserializationRule
+          extend Contrast::Agent::Protect::Policy::RuleApplicator
+
+          class << self
+            def invoke _method, _exception, _properties, _object, args
+              return unless valid_input?(args)
+              return if skip_analysis?
+
+              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, args[0])
+            end
+
+            def apply_deserialization_command_check command
+              return unless command
+              return if skip_analysis?
+
+              rule.check_command_scope(command)
+            end
+
+            protected
+
+            def name
+              Contrast::Agent::Protect::Rule::Deserialization::NAME
+            end
+
+            private
+
+            def valid_input? args
+              return false unless args&.any?
+
+              input = args[0]
+              input.is_a?(String)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb

@@ -0,0 +1,68 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/protect/rule/no_sqli'
+cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+
+module Contrast
+  module Agent
+    module Protect
+      module Policy
+        # This Module is how we apply the NoSQL Injection rule. It is called from
+        # our patches of the targeted methods in which the execution of String
+        # based NoSQL queries occur. It is responsible for deciding if the
+        # infilter methods of the rule should be invoked.
+        module AppliesNoSqliRule
+          extend Contrast::Agent::Protect::Policy::RuleApplicator
+
+          class << self
+            def invoke method, _exception, properties, _object, args
+              return unless valid_input?(args)
+              return if skip_analysis?
+
+              database = properties['database']
+              operations = args[0]
+              context = Contrast::Agent::REQUEST_TRACKER.current
+              if operations.is_a?(Array)
+                operations.each do |m|
+                  handle_operation(context, database, method, m)
+                end
+              else
+                handle_operation(context, database, method, operations)
+              end
+            end
+
+            protected
+
+            def name
+              Contrast::Agent::Protect::Rule::NoSqli::NAME
+            end
+
+            private
+
+            def valid_input? args
+              return false unless args&.any?
+
+              args[0]
+            end
+
+            def handle_operation context, database, _action, operation
+              data = extract_mongo_data(operation)
+              return unless data && !data.empty?
+
+              rule.infilter(context, database, data)
+            end
+
+            def extract_mongo_data operation
+              if operation.cs__respond_to? :selector
+                operation.selector
+              elsif operation.cs__respond_to? :documents
+                operation.documents
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb

@@ -0,0 +1,117 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/protect/rule/path_traversal'
+cs__scoped_require 'contrast/agent/protect/policy/rule_applicator'
+cs__scoped_require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Protect
+      module Policy
+        # This Module is how we apply the Path Traversal rule. It is called from
+        # our patches of the targeted methods in which File or IO access occur.
+        # It is responsible for deciding if the infilter methods of the rule
+        # should be invoked.
+        module AppliesPathTraversalRule
+          extend Contrast::Agent::Protect::Policy::RuleApplicator
+
+          class << self
+            def invoke method, _exception, properties, object, args
+              return unless args&.any?
+
+              path = args[0]
+              return unless path.is_a?(String)
+              return if skip_analysis?
+
+              action = properties['action']
+              write_marker = write?(action, *args)
+              possible_write = write_marker && possible_write(write_marker)
+              path_traversal_rule(path, possible_write, object, method)
+
+              # If the action was copy, we need to handle the write half of it.
+              # We handled read in line above.
+              return unless action == COPY
+              return unless args.length > 1
+
+              dst = args[1]
+              return unless dst.is_a?(String)
+
+              path_traversal_rule(dst, true, object, method)
+            end
+
+            protected
+
+            def name
+              Contrast::Agent::Protect::Rule::PathTraversal::NAME
+            end
+
+            private
+
+            def possible_write input
+              input.cs__respond_to?(:to_s) &&
+                  input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
+            end
+
+            READ = 'read'
+            WRITE = 'write'
+            COPY = 'copy'
+            def write? action, *args
+              return false if action == READ
+              return false if action == COPY
+              return true if action == WRITE
+
+              write_marker = args.length > 1 ? args[1] : nil
+              write_marker && possible_write(write_marker)
+            end
+
+            def path_traversal_rule path, possible_write, object, method
+              return unless applies_to?(path, possible_write)
+
+              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, method, path)
+            rescue Contrast::SecurityException => e
+              raise e
+            rescue StandardError => e
+              logger.error('Error applying path traversal', e, module: object.cs__class.cs__name, method: method)
+            end
+
+            CS__SAFER_REL_PATHS = %w[public app log tmp].cs__freeze
+            def safer_abs_paths
+              @_safer_abs_paths ||= begin
+                pwd = ENV['PWD']
+                if pwd
+                  tmp = CS__SAFER_REL_PATHS.map { |r| "#{ pwd }/#{ r }" }
+                  gems = ENV['GEM_PATH']
+                  tmp += gems.split(Contrast::Utils::ObjectShare::COLON) if gems
+                  tmp
+                else
+                  []
+                end
+              end
+            end
+
+            def applies_to? path, possible_write = false
+              # any possible write is a potential risk
+              return true if possible_write
+
+              # any path that moves 'up' is a potential risk
+              return true if path.index(Contrast::Utils::ObjectShare::PARENT_PATH)
+
+              path = path.downcase
+              if path.start_with?(Contrast::Utils::ObjectShare::SLASH)
+                safer_abs_paths.each do |prefix|
+                  return false if path.start_with?(prefix)
+                end
+              else
+                CS__SAFER_REL_PATHS.each do |prefix|
+                  return false if path.start_with?(prefix)
+                end
+              end
+              true
+            end
+          end
+        end
+      end
+    end
+  end
+end