contrast-agent 3.10.1 → 3.12.2

data/lib/contrast/extensions/ruby_core/eval_trigger.rb

@@ -1,52 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module CoreExtensions
-    module Assess
-      # This Module allows us to track calls to the BasicObject#eval method,
-      # which violates the design of most methods we track in that we have to
-      # apply the trigger in a custom patch over one of the generic triggers in
-      # TriggerMethod.
-      module EvalTrigger
-        def instance_eval_trigger_check source, ret
-          apply_trigger(source, ret, 'BasicObject', :instance_eval)
-        end
-
-        def eval_trigger_check source, ret, method
-          apply_trigger(source, ret, 'Module', method)
-        end
-
-        def apply_trigger source, ret, clazz, method
-          current_context = Contrast::Agent::REQUEST_TRACKER.current
-          return unless current_context
-
-          # Since we know this is the source of the trigger, we can do some
-          # optimization here and return when it is not tracked
-          return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
-
-          # source might not be all the args passed in, but it is the one we care
-          # about. we could pass in all the args in the last param here if it
-          # becomes an issue in rendering on TS
-          Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(
-              current_context,
-              trigger_node(clazz, method),
-              source,
-              self,
-              ret,
-              1,
-              source)
-        end
-
-        private
-
-        def trigger_node clazz, method
-          triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
-          return unless triggers
-
-          triggers.find { |node| node.class_name == clazz && node.method_name == method }
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/inventory/datastores.rb

@@ -1,37 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/data_store_util'
-
-module Contrast
-  module CoreExtensions
-    module Inventory
-      # This Module is how we apply the Data Store detection required for the
-      # FlowMap feature. It is called from our patches of the targeted methods
-      # in which database operations occur. It is responsible for deciding if
-      # the given invocation is worth reporting or not.
-      module DataStores
-        class << self
-          include Contrast::Components::Interface
-
-          access_component :logging, :analysis
-          # The key used in policy.json to indicate the database type to
-          # report.
-          DATA_STORE_MARKER = 'data_store'
-
-          def patched_report_data_store _method, _exception, properties, object, _args
-            return unless INVENTORY.enabled?
-
-            marker = properties[DATA_STORE_MARKER]
-            return unless marker
-
-            Contrast::Utils::DataStoreUtil.report_data_store(marker)
-          rescue StandardError => e
-            logger.error(e, "Error reporting database call in #{ object }")
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_command_injection_rule.rb

@@ -1,72 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/applies_deserialization_rule'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the Command Injection rule. It is called
-      # from our patches of the targeted methods in which command execution
-      # occurs. It is responsible for deciding if the infilter methods of the
-      # rule should be invoked.
-      # In addition, b/c of the nature of Deserialization's sand boxing
-      # function, this Module's apply methods call through to the
-      # {#apply_deserialization_command_check} method of the
-      # Deserialization applicator.
-      module AppliesCommandInjectionRule
-        CS__SEMICOLON = '; '
-
-        class << self
-          include Contrast::Components::Interface
-          access_component :logging, :analysis
-
-          def apply_command_injection_rule method, _exception, _properties, object, args
-            return unless valid_command?(args)
-
-            command = build_command(args)
-            Contrast::CoreExtensions::Protect::AppliesDeserializationRule.apply_deserialization_command_check(command)
-            return if skip_analysis?
-
-            begin
-              clazz = object.is_a?(Module) ? object : object.cs__class
-              class_name = clazz.cs__name
-              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
-            end
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            msg = "command injection: class=#{ object }.#{ method }"
-            logger.error(e, msg)
-          end
-
-          private
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::CmdInjection::NAME
-          end
-
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-
-          def valid_command? command
-            command && (command.is_a?(String) || command.is_a?(Array))
-          end
-
-          def build_command command
-            return command if command.is_a?(String)
-
-            command = command.drop(1) if command.length > 1
-            command.join(CS__SEMICOLON)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_deserialization_rule.rb

@@ -1,60 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the Deserialization rule. It is called from
-      # our patches of the targeted methods in which deserialization occurs.
-      # It is responsible for deciding if the infilter methods of the rule
-      # should be invoked.
-      module AppliesDeserializationRule
-        include Contrast::Components::Interface
-        access_component :logging, :analysis
-
-        class << self
-          def apply_deserialization_rule method, _exception, _properties, object, args
-            return unless valid_input?(args)
-            return if skip_analysis?
-
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, args[0])
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, "Error running untrusted-deserialization rule in #{ object }.#{ method }")
-          end
-
-          def apply_deserialization_command_check command
-            return unless command
-            return if skip_analysis?
-
-            rule.check_command_scope(command)
-          end
-
-          private
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::Deserialization::NAME
-          end
-
-          def valid_input? args
-            return false unless args&.any?
-
-            input = args[0]
-            input.is_a?(String)
-          end
-
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_no_sqli_rule.rb

@@ -1,83 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the NoSQL Injection rule. It is called from
-      # our patches of the targeted methods in which the execution of String
-      # based NoSQL queries occur. It is responsible for deciding if the
-      # infilter methods of the rule should be invoked.
-      module AppliesNoSqliRule
-        DATABASE_MONGO = 'MongoDB'
-        ACTION_DISPATCH = 'dispatch'
-        ACTION_READ = 'read'
-        ACTION_WRITE = 'write'
-        ACTION_PROCESS = 'process'
-
-        class << self
-          include Contrast::Components::Interface
-          access_component :logging, :analysis
-
-          def apply_nosql_rule method, _exception, properties, _object, args
-            return unless valid_input?(args)
-            return if skip_analysis?
-
-            database = properties['database']
-            operations = args[0]
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            if operations.is_a?(Array)
-              operations.each do |m|
-                handle_operation(context, database, method, m)
-              end
-            else
-              handle_operation(context, database, method, operations)
-            end
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, "Error running NoSQLi rule in #{ properties['database'] }")
-          end
-
-          private
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::NoSqli::NAME
-          end
-
-          def valid_input? args
-            return false unless args&.any?
-
-            args[0]
-          end
-
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-
-          def handle_operation context, database, action, operation
-            data = extract_mongo_data(operation)
-            return unless data && !data.empty?
-
-            logger.debug(nil, "applying nosqli rule #{ database }##{ action }")
-            rule.infilter(context, database, data)
-          end
-
-          def extract_mongo_data operation
-            if operation.cs__respond_to? :selector
-              operation.selector
-            elsif operation.cs__respond_to? :documents
-              operation.documents
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_path_traversal_rule.rb

@@ -1,123 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the Path Traversal rule. It is called from
-      # our patches of the targeted methods in which File or IO access occur.
-      # It is responsible for deciding if the infilter methods of the rule
-      # should be invoked.
-      module AppliesPathTraversalRule
-        include Contrast::Components::Interface
-
-        access_component :logging, :analysis
-
-        class << self
-          def apply_path_traversal_rule method, _exception, properties, _object, args
-            return unless args&.any?
-
-            path = args[0]
-            return unless path.is_a?(String)
-            return if skip_analysis?
-
-            action = properties['action']
-            write_marker = write?(action, *args)
-            possible_write = write_marker && possible_write(write_marker)
-            path_traversal_rule(path, possible_write, method)
-
-            # If the action was copy, we need to handle the write half of it.
-            # We handled read in line above.
-            return unless action == COPY
-            return unless args.length > 1
-
-            dst = args[1]
-            return unless dst.is_a?(String)
-
-            path_traversal_rule(dst, true, method)
-          end
-
-          private
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::PathTraversal::NAME
-          end
-
-          def possible_write input
-            input.cs__respond_to?(:to_s) &&
-                input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
-          end
-
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-
-          READ = 'read'
-          WRITE = 'write'
-          COPY = 'copy'
-          def write? action, *args
-            return false if action == READ
-            return false if action == COPY
-            return true if action == WRITE
-
-            write_marker = args.length > 1 ? args[1] : nil
-            write_marker && possible_write(write_marker)
-          end
-
-          def path_traversal_rule path, possible_write, method
-            return unless applies_to?(path, possible_write)
-
-            logger.debug(nil, "checking path traversal: write=true path=#{ path }")
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, method, path)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, 'path traversal')
-          end
-
-          CS__SAFER_REL_PATHS = %w[public app log tmp].cs__freeze
-          def safer_abs_paths
-            @_safer_abs_paths ||= begin
-              pwd = ENV['PWD']
-              if pwd
-                tmp = CS__SAFER_REL_PATHS.map { |r| "#{ pwd }/#{ r }" }
-                gems = ENV['GEM_PATH']
-                tmp += gems.split(Contrast::Utils::ObjectShare::COLON) if gems
-                tmp
-              else
-                []
-              end
-            end
-          end
-
-          def applies_to? path, possible_write = false
-            # any possible write is a potential risk
-            return true if possible_write
-
-            # any path that moves 'up' is a potential risk
-            return true if path.index(Contrast::Utils::ObjectShare::PARENT_PATH)
-
-            path = path.downcase
-            if path.start_with?(Contrast::Utils::ObjectShare::SLASH)
-              safer_abs_paths.each do |prefix|
-                return false if path.start_with?(prefix)
-              end
-            else
-              CS__SAFER_REL_PATHS.each do |prefix|
-                return false if path.start_with?(prefix)
-              end
-            end
-            true
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_sqli_rule.rb

@@ -1,65 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/data_store_util'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the SQL Injection rule. It is called from
-      # our patches of the targeted methods in which the execution of String
-      # based SQL queries occur. It is responsible for deciding if the infilter
-      # methods of the rule should be invoked.
-      module AppliesSqliRule
-        DATABASE_MYSQL =    'MySQL'
-        DATABASE_SQLITE =   'SQLite3'
-        DATABASE_PG =       'PostgreSQL'
-
-        class << self
-          include Contrast::Components::Interface
-
-          access_component :logging, :analysis
-
-          def apply_sql_rule method, _exception, properties, object, args
-            database = properties['database']
-            return unless database
-
-            index = properties[Contrast::Utils::ObjectShare::INDEX]
-            return unless valid_input?(index, args)
-            return if skip_analysis?
-
-            sql = args[index]
-            logger.debug(nil, "applying sqli rule on #{ object } for #{ method }")
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, database, sql)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, "Error running SQLi rule in #{ object }")
-          end
-
-          private
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::Sqli::NAME
-          end
-
-          def valid_input? index, args
-            return false unless args && args.length > index
-
-            sql = args[index]
-            sql && !sql.empty?
-          end
-
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-        end
-      end
-    end
-  end
-end