contrast-agent 3.10.1 → 3.12.2

data/lib/contrast/agent/protect/rule/csrf.rb

@@ -1,118 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'rack'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/agent/request'
-cs__scoped_require 'contrast/agent/response'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/utils/timer'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect Cross-Site Request Forgery
-        # rule.
-        class Csrf < Contrast::Agent::Protect::Rule::Base
-          NAME = 'csrf'
-
-          def name
-            NAME
-          end
-
-          def stream_safe?
-            false
-          end
-
-          def request_evaluator
-            @_request_evaluator ||= Contrast::Agent::Protect::Rule::Csrf::CsrfEvaluator.new
-          end
-
-          def token_injector
-            @_token_injector ||= Contrast::Agent::Protect::Rule::Csrf::CsrfTokenInjector.new
-          end
-
-          BLOCK_MESSAGE = 'CSRF rule triggered. Request blocked.'
-
-          def prefilter context
-            return unless enabled? && mode != :NO_ACTION
-
-            request = context.request
-            return if request_evaluator.can_ignore_check?(request)
-
-            parameters = request.parameters
-            return unless parameters&.any?
-
-            tokens = parameters[token_injector.token_name]
-            expected_token = token_injector.get_expected_token(context)
-            return if valid_token?(expected_token, tokens)
-
-            # unexpected token is interpreted as an attack with a match
-            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
-            ia_result.input_type = :BODY
-            ia_result.value = build_attack_string(context.request)
-
-            result = build_attack_with_match(
-                context,
-                ia_result,
-                nil,
-                expected_token,
-                details: build_details(expected_token, tokens))
-
-            append_to_activity(context, result)
-
-            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
-          end
-
-          def valid_token? expected, actual_tokens
-            actual_tokens&.include?(expected)
-          end
-
-          def postfilter context
-            return unless enabled? && POSTFILTER_MODES.include?(mode)
-
-            token_injector.do_injection(context)
-          end
-
-          def build_sample context, evaluation, _url, **kwargs
-            sample = build_base_sample(context, evaluation)
-            sample.csrf = kwargs[:details]
-            sample
-          end
-
-          # Build a subclass of the RaspRuleSample using the query string and the
-          # evaluation
-          def build_details expected, actual_tokens
-            details = Contrast::Api::Dtm::CsrfDetails.new
-            details.name = Contrast::Utils::StringUtils.protobuf_safe_string(token_injector.token_name)
-            details.expected = Contrast::Utils::StringUtils.protobuf_safe_string(expected)
-            presented = build_presented_token(actual_tokens)
-            details.presented = Contrast::Utils::StringUtils.protobuf_safe_string(presented)
-            details
-          end
-
-          def build_presented_token actual_tokens
-            return Contrast::Utils::ObjectShare::EMPTY_STRING unless actual_tokens&.any?
-
-            actual_tokens.first
-          end
-
-          # Convert the request parameters into an attack string
-          def build_attack_string request
-            arr = []
-            request.dtm.normalized_request_params.each_with_index do |(name, value), index|
-              arr << Contrast::Utils::ObjectShare::AND unless index.zero?
-              arr += [name.to_s, Contrast::Utils::ObjectShare::EQUALS, value.values.to_s]
-            end
-            if arr.empty?
-              request.query_string
-            else
-              arr.join
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb

@@ -1,103 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'uri'
-
-# This class is used by the CSRF rule to determine if the given Request is
-# susceptible to CSRF / if the rule applies to it.
-class Contrast::Agent::Protect::Rule::Csrf::CsrfEvaluator # rubocop:disable Style/ClassAndModuleChildren
-  include Contrast::Components::Interface
-  access_component :logging
-
-  def can_ignore_check? request
-    if !form_submittable_method?(request)
-      logger.debug("Ignoring method #{ request.request_method } for URI #{ request.uri }")
-      true
-    elsif ajax_request?(request)
-      logger.debug("Ignoring Ajax request for URI #{ request.uri }")
-      true
-    elsif empty_post?(request)
-      logger.debug("Ignoring empty POST request for URI #{ request.uri }")
-      true
-    elsif !form_content_type?(request)
-      logger.debug("Ignoring POST request with Content-Type #{ request.content_type } for URI #{ request.uri }")
-      true
-    elsif request.static_request?
-      logger.debug("Ignoring static request for URI #{ request.uri }")
-      true
-    elsif origin_is_referer?(request)
-      logger.debug("Ignoring equivalent origin-referer for URI #{ request.uri }")
-      true
-    elsif login_page?(request)
-      logger.debug("Ignoring possible login page for URI #{ request.uri }")
-      true
-    else
-      false
-    end
-  rescue StandardError => e
-    logger.warn(e, 'Unable to determine if CSRF can be ignored')
-  end
-
-  POST_METHOD = 'POST'
-  def form_submittable_method? request
-    POST_METHOD == request.request_method
-  end
-
-  REQUESTED_WITH = 'X-REQUESTED-WITH'
-  def ajax_request? request
-    requested_with = request.header_value(REQUESTED_WITH)
-    !requested_with.nil? && !requested_with.empty?
-  end
-
-  USER_AGENT = 'USER-AGENT'
-  def empty_user_agent? request
-    agent = request.header_value(USER_AGENT)
-    agent.nil? || agent.empty?
-  end
-
-  def empty_post? request
-    request.request_body_str.empty? && (request.query_string.nil? || request.query_string.empty?)
-  end
-
-  FORM_CONTENT_TYPES = %w[text/plain multipart/form-data application/x-www-form-urlencoded].cs__freeze
-
-  def form_content_type? request
-    content_type = request.content_type
-    return true if content_type.nil? || content_type.empty?
-
-    content_type.start_with?(*FORM_CONTENT_TYPES)
-  end
-
-  ORIGIN = 'ORIGIN'
-  REFERER = 'REFERER'
-  def origin_is_referer? request
-    origin = request.header_value(ORIGIN)
-    referer = request.header_value(REFERER)
-    return false unless origin && referer
-    return false if origin.empty? || referer.empty?
-
-    origin = trim_origin(origin)
-    referer = URI(referer).host
-    origin == referer
-  end
-
-  HTTP = 'http://'
-  HTTPS = 'https://'
-  def trim_origin origin_header
-    origin_header = if origin_header.to_s.start_with?(HTTP, HTTPS)
-                      URI(origin_header).host
-                    else
-                      idx = origin_header.index(Contrast::Utils::ObjectShare::COLON)
-                      idx.nil? ? origin_header : origin_header[0, idx]
-                    end
-    origin_header
-  end
-
-  LOGIN_MARKERS = %w[login auth j_security verify validate sessions].cs__freeze
-  def login_page? request
-    url = request.url.downcase
-    LOGIN_MARKERS.any? { |marker| url.index(marker) }
-  end
-end

data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb

@@ -1,85 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/random_util'
-
-# This class is used by the CSRF rule to inject the Contrast CSRF token into
-# the Response's body, allowing for the detection of CSRF attacks.
-class Contrast::Agent::Protect::Rule::Csrf::CsrfTokenInjector # rubocop:disable Style/ClassAndModuleChildren
-  TKN_NAME = 'cs_csrf_tkn'
-  def token_name
-    TKN_NAME
-  end
-
-  SESSION_TOKEN_PREFIX = '__CONTRAST__'
-  def token_key
-    @_token_key ||= SESSION_TOKEN_PREFIX + token_name
-  end
-
-  def javascript
-    @_javascript ||= build_javascript
-  end
-
-  SCRIPT_LOC = File.join('csrf', 'inject.js').cs__freeze
-  NAME_MARKER = '!TOKEN_NAME!'
-  VALUE_MARKER = '!TOKEN_VALUE!'
-  def build_javascript
-    script = Contrast::Utils::ResourceLoader.load(SCRIPT_LOC)
-    script&.sub!(NAME_MARKER, TKN_NAME)
-    script
-  end
-
-  CSRF_TOKEN_LENGTH = 8
-  def get_expected_token context
-    cookies = context.request.request_cookies
-    token = cookies[token_key]
-    return token if token
-    return unless context.response
-
-    build_token(context)
-  end
-
-  def build_token context
-    token = Contrast::Utils::RandomUtil.secure_random_string(CSRF_TOKEN_LENGTH)
-    context&.response&.set_header(token_key, token)
-    token
-  end
-
-  CONTENT_TYPE = 'CONTENT-TYPE'
-
-  def wedge_token? response
-    return true unless response
-
-    content_type = response.header(CONTENT_TYPE)
-    return true unless content_type
-
-    content_type = content_type.to_s
-    !content_type.start_with?(*DATA_CONTENT_TYPES)
-  end
-
-  END_BODY_TAG = %r{</body>}i.cs__freeze
-  def do_injection context
-    return unless wedge_token?(context&.response)
-
-    body_string = context&.response&.body
-    return unless body_string
-
-    index = body_string.index(END_BODY_TAG)
-    return unless index
-
-    injection = get_expected_token(context)
-    return unless injection
-
-    injection = javascript.sub(VALUE_MARKER, injection)
-    body_string.insert(index, injection)
-    context&.response&.update_body(body_string)
-  end
-
-  DATA_CONTENT_TYPES = [
-    'image/', 'audio/', 'video/',
-    'application/json', 'application/xml',
-    'application/octet', 'application/force',
-    'text/json', 'text/xml'
-  ].cs__freeze
-end

data/lib/contrast/agent/settings_state.rb

@@ -1,152 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'securerandom'
-cs__scoped_require 'set'
-
-cs__scoped_require 'contrast/utils/assess/sampling_util'
-cs__scoped_require 'contrast/utils/assess/tracking_util'
-cs__scoped_require 'contrast/utils/environment_util'
-cs__scoped_require 'contrast/utils/env_configuration_item'
-cs__scoped_require 'contrast/utils/gemfile_reader'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/performs_logging'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/agent/reaction_processor'
-cs__scoped_require 'contrast/agent/require_state'
-cs__scoped_require 'contrast/agent/assess/policy/patcher'
-cs__scoped_require 'contrast/agent/patching/policy/patcher'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    # This class functions as a way to query the Agent for its current
-    # configuration without having to expose other sections of code to the
-    # decision tree needed to make that determination.
-    # It should not be accessed directly, but should instead be inherited from
-    #
-    # @abstract Use the methods in FeatureState to access this data
-    class SettingsState
-      include Contrast::Utils::PerformsLogging
-      include Contrast::Components::Interface
-
-      INVALID_CONFIG = '!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!'
-
-      access_component :agent, :analysis, :settings, :config, :contrast_service
-
-      MODE_WHITELIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
-
-      # These are components.
-      attr_accessor :last_update,
-                    :log_file,
-                    :log_level
-
-      # These represent process-level attributes,
-      # not directly related to Contrast function itself.
-      attr_reader :pid,
-                  :ppid
-
-      def initialize
-        @instrumentation_mutex = Mutex.new
-        @instrumented_packages = {}
-
-        # Last we heard from the Contrast Service
-        @last_update = nil
-
-        # keep track of which process instantiated this instance
-        @pid  = Process.pid.to_i
-        @ppid = Process.ppid.to_i
-
-        init_log_queueing
-
-        check_config
-
-        flush_log_queues
-      end
-
-      def check_config
-        SETTINGS.reset_state
-
-        if CONFIG.invalid?
-          AGENT.disable!
-          self.class.log_error(INVALID_CONFIG)
-          abort_log_queues
-          elseif CONFIG.disabled?
-          AGENT.disable!
-          self.class.log_warn(LOG_CONFIGURATION_DISABLED)
-        else
-          AGENT.enable!
-        end
-      end
-
-      # workaround to mixed use of class/instance
-      def self.logger
-        instance.logger
-      end
-
-      def logger
-        logger_manager.current
-      end
-
-      def logger_manager
-        (@_logger_manager ||= Contrast::Agent::LoggerManager.new.tap(&:update))
-      end
-
-      def assess_rule name
-        ASSESS.rule name
-      end
-
-      def instrument package
-        return if @instrumented_packages[package] # double check is intentional
-
-        @instrumentation_mutex.synchronize do
-          return if @instrumented_packages[package]
-
-          @instrumented_packages[package] = true
-        end
-
-        self.class.debug_with_time("instrumenting #{ package }") do
-          cs__scoped_require(package)
-        end
-      rescue LoadError, StandardError => e
-        @instrumented_packages[package] = false
-        self.class.log_error("[e.class: #{ e.class }] unable to instrument: #{ package }", e)
-      end
-
-      def protect_rule name
-        PROTECT.rule name
-      end
-
-      def send_inventory_message
-        return unless INVENTORY.enabled?
-
-        app_update_msg = Contrast::Api::Dtm::ApplicationUpdate.new
-
-        # TODO: RUBY-770
-        Contrast::Utils::EnvironmentUtil.add_library_to_app_update(app_update_msg, protobuf_format(CONFIG.root.inventory.tags))
-
-        Contrast::Delegators::ApplicationUpdate.new(app_update_msg).instance_eval do
-          append_view_technology_descriptor_data(Contrast::Agent.framework_manager.find_applicable_view_technologies) if INVENTORY.enabled?
-          append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data) if INVENTORY.enabled?
-          append_platform_version(Contrast::Agent.framework_manager.platform_version)
-        end
-
-        Contrast::Utils::InventoryUtil.append_db_config(app_update_msg)
-
-        CONTRAST_SERVICE.queue_message app_update_msg
-      end
-
-      def present? str
-        Contrast::Utils::EnvironmentUtil.present?(str)
-      end
-
-      # CONTRAST-35326, move this responsibility toward the protobuf object
-      def protobuf_format param, truncate: true
-        param = param&.to_s
-        param = Contrast::Utils::StringUtils.force_utf8(param)
-        param = Contrast::Utils::StringUtils.truncate(param) if truncate
-        param
-      end
-    end
-  end
-end