contrast-agent 3.10.2 → 3.11.0

data/lib/contrast/extensions/ruby_core/assess/string.rb

@@ -1,10 +1,12 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
 cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
 
 # This patch installs our extension as early as possible. The alternative is to
-# litter our code with responds_to? checks.
+# litter our code with Contrast::Utils::DuckUtils.trackable? checks.
 class String
   include Contrast::CoreExtensions::Assess::AssessExtension
 end
@@ -19,7 +21,7 @@ module Contrast
       class StringPropagator
         include Contrast::Components::Interface
 
-        access_component :analysis, :agent, :logging, :scope
+        access_component :agent, :analysis, :logging, :scope
 
         NODE_HASH = {
             'class_name' => 'String',
@@ -50,6 +52,16 @@ module Contrast
             end
           end
 
+          def instrument_string
+            @_instrument_string ||= begin
+                                      cs__scoped_require 'cs__assess_string/cs__assess_string'
+                                      true
+                                    end
+          rescue StandardError => e
+            logger.error('Error loading hash track patch', e)
+            false
+          end
+
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
@@ -58,7 +70,7 @@ module Contrast
                                                     end
                                                     true
                                                   rescue StandardError => e
-                                                    logger.error(e, 'Error loading interpolation patch')
+                                                    logger.error('Error loading interpolation patch', e)
                                                     false
                                                   end
             end
@@ -69,7 +81,3 @@ module Contrast
     end
   end
 end
-
-cs__scoped_require 'cs__assess_string/cs__assess_string'
-
-Contrast::CoreExtensions::Assess::StringPropagator.instrument_string_interpolation

data/lib/contrast/extensions/ruby_core/assess/tilt_template_trigger.rb

@@ -1,11 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
 # This module acts a trigger & propagator for Tilt::Template evaluation
 module TiltTemplateTrigger
-  include Contrast::Components::Interface
-  access_component :logging
   class << self
     NODE_HASH = {
         'class_name' => 'Tilt::Template',
@@ -20,13 +17,36 @@ module TiltTemplateTrigger
     }.cs__freeze
     TEMPLATE_PROPAGATION_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(NODE_HASH)
 
-    def render_trigger_check context, trigger_node, _source, object, ret, invoked, *args
-      logger.debug { 'Tilt::Template Trigger - running propagation' }
-
+    def render_trigger_check context, trigger_node, _source, object, ret, *args
       scope = args[0]
-      binding_variables = scope.instance_variables
+
       erb_template_prerender = object.instance_variable_get(:@data)
       interpolated_inputs = []
+      handle_binding_variables(scope, erb_template_prerender, ret, interpolated_inputs)
+
+      handle_local_variables(args, erb_template_prerender, ret, interpolated_inputs)
+
+      unless interpolated_inputs.empty?
+        interpolated_inputs.each do |input|
+          input.cs__properties.events.each do |event|
+            ret.cs__properties.events << event
+          end
+        end
+        ret.cs__properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs)
+      end
+
+      if ret.cs__tracked?
+        Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, ret, erb_template_prerender, ret, interpolated_inputs)
+      end
+
+      ret
+    end
+
+    private
+
+    def handle_binding_variables scope, erb_template_prerender, ret, interpolated_inputs
+      binding_variables = scope.instance_variables
+
       binding_variables.each do |bound_variable_sym|
         bound_variable_value = scope.instance_variable_get(bound_variable_sym)
 
@@ -36,11 +56,12 @@ module TiltTemplateTrigger
         start_index = ret.index(bound_variable_value)
         next if start_index.nil?
 
-        logger.debug('Tilt::Template Trigger - found bound_variable in erb template result')
         ret.cs__copy_from(bound_variable_value, start_index)
         interpolated_inputs << bound_variable_sym
       end
+    end
 
+    def handle_local_variables args, erb_template_prerender, ret, interpolated_inputs
       locals = args[1]
       locals.each do |local_name, local_value|
         next unless local_value.cs__respond_to?(:cs__tracked?) && local_value.cs__tracked?
@@ -49,25 +70,9 @@ module TiltTemplateTrigger
         start_index = ret.index(local_value)
         next if start_index.nil?
 
-        logger.debug('Tilt:Template Trigger - found local_value in erb template result')
         ret.cs__copy_from(local_value, start_index)
         interpolated_inputs << local_name
       end
-
-      unless interpolated_inputs.empty?
-        interpolated_inputs.each do |input|
-          input.cs__properties.events.each do |event|
-            ret.cs__properties.events << event
-          end
-        end
-        ret.cs__properties.build_event(TEMPLATE_PROPAGATION_NODE, ret, erb_template_prerender, ret, interpolated_inputs, invoked + 1)
-      end
-
-      if ret.cs__tracked?
-        Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, ret, erb_template_prerender, ret, invoked + 1, interpolated_inputs)
-      end
-
-      ret
     end
   end
 end

data/lib/contrast/extensions/ruby_core/assess/xpath_library_trigger.rb

@@ -12,7 +12,7 @@ module XPathLibraryTrigger
   include Contrast::Components::Interface
 
   class << self
-    def xpath_trigger_check context, trigger_node, _source, object, ret, invoked, *args
+    def xpath_trigger_check context, trigger_node, _source, object, ret, *args
       return ret unless args
 
       # convert the options arg in Oga::XML::CharacterNode#initialize into an
@@ -25,7 +25,7 @@ module XPathLibraryTrigger
         next unless trigger_node.violated?(arg)
 
         Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
-            context, trigger_node, arg, object, ret, invoked + 1, args)
+            context, trigger_node, arg, object, ret, args)
       end
 
       ret

data/lib/contrast/extensions/ruby_core/eval_trigger.rb

@@ -34,7 +34,6 @@ module Contrast
               source,
               self,
               ret,
-              1,
               source)
         end
 

data/lib/contrast/extensions/ruby_core/inventory/datastores.rb

@@ -15,7 +15,7 @@ module Contrast
         class << self
           include Contrast::Components::Interface
 
-          access_component :logging, :analysis
+          access_component :analysis, :logging
           # The key used in policy.json to indicate the database type to
           # report.
           DATA_STORE_MARKER = 'data_store'
@@ -28,7 +28,7 @@ module Contrast
 
             Contrast::Utils::DataStoreUtil.report_data_store(marker)
           rescue StandardError => e
-            logger.error(e, "Error reporting database call in #{ object }")
+            logger.error('Error reporting database call', e, object: object)
           end
         end
       end

data/lib/contrast/extensions/ruby_core/protect/applies_command_injection_rule.rb

@@ -1,8 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
 cs__scoped_require 'contrast/extensions/ruby_core/protect/applies_deserialization_rule'
+cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
 
 module Contrast
   module CoreExtensions
@@ -16,13 +17,12 @@ module Contrast
       # {#apply_deserialization_command_check} method of the
       # Deserialization applicator.
       module AppliesCommandInjectionRule
+        extend Contrast::CoreExtensions::Protect::RuleApplicator
+
         CS__SEMICOLON = '; '
 
         class << self
-          include Contrast::Components::Interface
-          access_component :logging, :analysis
-
-          def apply_command_injection_rule method, _exception, _properties, object, args
+          def invoke method, _exception, _properties, object, args
             return unless valid_command?(args)
 
             command = build_command(args)
@@ -34,26 +34,15 @@ module Contrast
               class_name = clazz.cs__name
               rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
             end
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            msg = "command injection: class=#{ object }.#{ method }"
-            logger.error(e, msg)
           end
 
-          private
+          protected
 
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::CmdInjection::NAME
+          def name
+            Contrast::Agent::Protect::Rule::CmdInjection::NAME
           end
 
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
+          private
 
           def valid_command? command
             command && (command.is_a?(String) || command.is_a?(Array))

data/lib/contrast/extensions/ruby_core/protect/applies_deserialization_rule.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/protect/rule/deserialization'
+cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
 
 module Contrast
   module CoreExtensions
@@ -11,19 +12,14 @@ module Contrast
       # It is responsible for deciding if the infilter methods of the rule
       # should be invoked.
       module AppliesDeserializationRule
-        include Contrast::Components::Interface
-        access_component :logging, :analysis
+        extend Contrast::CoreExtensions::Protect::RuleApplicator
 
         class << self
-          def apply_deserialization_rule method, _exception, _properties, object, args
+          def invoke _method, _exception, _properties, _object, args
             return unless valid_input?(args)
             return if skip_analysis?
 
             rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, args[0])
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, "Error running untrusted-deserialization rule in #{ object }.#{ method }")
           end
 
           def apply_deserialization_command_check command
@@ -33,26 +29,20 @@ module Contrast
             rule.check_command_scope(command)
           end
 
-          private
+          protected
 
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::Deserialization::NAME
+          def name
+            Contrast::Agent::Protect::Rule::Deserialization::NAME
           end
 
+          private
+
           def valid_input? args
             return false unless args&.any?
 
             input = args[0]
             input.is_a?(String)
           end
-
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
         end
       end
     end

data/lib/contrast/extensions/ruby_core/protect/applies_no_sqli_rule.rb

@@ -1,7 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/agent/protect/rule/no_sqli'
+cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
 
 module Contrast
   module CoreExtensions
@@ -11,17 +12,10 @@ module Contrast
       # based NoSQL queries occur. It is responsible for deciding if the
       # infilter methods of the rule should be invoked.
       module AppliesNoSqliRule
-        DATABASE_MONGO = 'MongoDB'
-        ACTION_DISPATCH = 'dispatch'
-        ACTION_READ = 'read'
-        ACTION_WRITE = 'write'
-        ACTION_PROCESS = 'process'
+        extend Contrast::CoreExtensions::Protect::RuleApplicator
 
         class << self
-          include Contrast::Components::Interface
-          access_component :logging, :analysis
-
-          def apply_nosql_rule method, _exception, properties, _object, args
+          def invoke method, _exception, properties, _object, args
             return unless valid_input?(args)
             return if skip_analysis?
 
@@ -35,37 +29,26 @@ module Contrast
             else
               handle_operation(context, database, method, operations)
             end
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, "Error running NoSQLi rule in #{ properties['database'] }")
           end
 
-          private
+          protected
 
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::NoSqli::NAME
+          def name
+            Contrast::Agent::Protect::Rule::NoSqli::NAME
           end
 
+          private
+
           def valid_input? args
             return false unless args&.any?
 
             args[0]
           end
 
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-
-          def handle_operation context, database, action, operation
+          def handle_operation context, database, _action, operation
             data = extract_mongo_data(operation)
             return unless data && !data.empty?
 
-            logger.debug(nil, "applying nosqli rule #{ database }##{ action }")
             rule.infilter(context, database, data)
           end
 

data/lib/contrast/extensions/ruby_core/protect/applies_path_traversal_rule.rb

@@ -1,8 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+cs__scoped_require 'contrast/agent/protect/rule/path_traversal'
+cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
 cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
 
 module Contrast
   module CoreExtensions
@@ -12,12 +13,10 @@ module Contrast
       # It is responsible for deciding if the infilter methods of the rule
       # should be invoked.
       module AppliesPathTraversalRule
-        include Contrast::Components::Interface
-
-        access_component :logging, :analysis
+        extend Contrast::CoreExtensions::Protect::RuleApplicator
 
         class << self
-          def apply_path_traversal_rule method, _exception, properties, _object, args
+          def invoke method, _exception, properties, object, args
             return unless args&.any?
 
             path = args[0]
@@ -27,7 +26,7 @@ module Contrast
             action = properties['action']
             write_marker = write?(action, *args)
             possible_write = write_marker && possible_write(write_marker)
-            path_traversal_rule(path, possible_write, method)
+            path_traversal_rule(path, possible_write, object, method)
 
             # If the action was copy, we need to handle the write half of it.
             # We handled read in line above.
@@ -37,28 +36,22 @@ module Contrast
             dst = args[1]
             return unless dst.is_a?(String)
 
-            path_traversal_rule(dst, true, method)
+            path_traversal_rule(dst, true, object, method)
           end
 
-          private
+          protected
 
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::PathTraversal::NAME
+          def name
+            Contrast::Agent::Protect::Rule::PathTraversal::NAME
           end
 
+          private
+
           def possible_write input
             input.cs__respond_to?(:to_s) &&
                 input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
           end
 
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-
           READ = 'read'
           WRITE = 'write'
           COPY = 'copy'
@@ -71,15 +64,14 @@ module Contrast
             write_marker && possible_write(write_marker)
           end
 
-          def path_traversal_rule path, possible_write, method
+          def path_traversal_rule path, possible_write, object, method
             return unless applies_to?(path, possible_write)
 
-            logger.debug(nil, "checking path traversal: write=true path=#{ path }")
             rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, method, path)
           rescue Contrast::SecurityException => e
             raise e
           rescue StandardError => e
-            logger.error(e, 'path traversal')
+            logger.error('Error applying path traversal', e, module: object.cs__class.cs__name, method: method)
           end
 
           CS__SAFER_REL_PATHS = %w[public app log tmp].cs__freeze