contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/api/decorators/application_update.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ApplicationUpdate protobuf model so it can own some of the data massaging required for
+      # AppUpdate dtm
+      module ApplicationUpdate
+        include Contrast::Components::Interface
+        access_component :config
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        def append_library_update library_dtm_list, library_tags
+          lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
+          library_dtm_list.each do |library_dtm|
+            library_dtm.tags = lib_tags
+            libraries[library_dtm.hash_code] = library_dtm
+          end
+        end
+
+        # TS only allows you to report 500 routes per application
+        def append_route_coverage_data route_coverage_dtms
+          route_coverage_dtms.take(500).each do |route_coverage_dtm|
+            routes << route_coverage_dtm
+          end
+        end
+
+        def append_platform_version platform_version
+          self.platform = Contrast::Api::Dtm::Platform.new if platform.nil?
+          platform.major = platform_version.major
+          platform.minor = platform_version.minor
+          platform.build = platform_version.patch
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          def build
+            msg = new
+            msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
+            msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
+            msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::ApplicationUpdate.include(Contrast::Api::Decorators::ApplicationUpdate)

data/lib/contrast/api/decorators/http_request.rb

@@ -0,0 +1,139 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/dtm.pb'
+cs__scoped_require 'contrast/api/decorators/address'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/timer'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the HttpRequest protobuf model so it can own some of
+      # the data massaging required for Request dtm
+      module HttpRequest
+        include Contrast::Components::Interface
+        access_component :agent
+
+        OMITTED_BODY = '{{body-omitted-by-contrast}}'
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Append the sender and receiver to self.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_addresses request
+          self.sender = Contrast::Api::Dtm::Address.build_sender(request)
+          self.receiver = Contrast::Api::Dtm::Address.build_receiver
+        end
+
+        # Append the connection to self.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_connection request
+          self.protocol = Contrast::Utils::StringUtils.force_utf8(request.scheme)
+          self.version = '1.1' # currently not in rack request; hard-coding
+          self.method = Contrast::Utils::StringUtils.force_utf8(request.request_method)
+          self.raw = Contrast::Utils::StringUtils.force_utf8(request.rack_request.path_info)
+        end
+
+        # Append the parameters to self, using the preferred
+        # normalized_request_params field.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_params request
+          request.parameters.each do |k, v|
+            append_pair(normalized_request_params, k, v)
+          end
+        end
+
+        # Append the normalized headers to self, using the preferred
+        # request_headers field.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_headers request
+          request.headers.each do |k, v|
+            next unless k && v
+            next if v.is_a?(Hash)
+
+            key = Contrast::Utils::StringUtils.force_utf8(k)
+            val = Contrast::Utils::StringUtils.force_utf8(v)
+            request_headers[key] = val
+          end
+
+          request.cookies.each do |k, v|
+            append_pair(normalized_cookies, k, v)
+          end
+        end
+
+        # Append the body to self, using the preferred
+        # request_body_binary field.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_body request
+          self.document_type = Contrast::Utils::StringUtils.force_utf8(request.document_type)
+
+          self.request_body_binary = if omit_body?(request)
+                                       OMITTED_BODY
+                                     else
+                                       Contrast::Utils::StringUtils.force_utf8(request.body)
+                                     end
+          return if request.file_names.empty?
+
+          request.file_names.each do |name, filename|
+            pair = Contrast::Api::Dtm::SimplePair.new
+            pair.key = Contrast::Utils::StringUtils.force_utf8(name)
+            pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
+            multipart_headers << pair
+          end
+        end
+
+        def omit_body? request
+          return true if AGENT.omit_body?
+          return false if request.document_type != :NORMAL
+
+          request.content_type&.include?('multipart/form-data')
+        end
+
+        def append_pair map, key, value
+          return unless key && value
+          return if value.is_a?(Hash)
+
+          safe_key = Contrast::Utils::StringUtils.force_utf8(key)
+          map[safe_key] ||= Contrast::Api::Dtm::Pair.new
+          map[safe_key].key = safe_key
+          map[safe_key].values << Contrast::Utils::StringUtils.force_utf8(value)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :scope
+
+          # Convert our Request into a DTM
+          # @param request [Contrast::Agent::Request]
+          # @return [Contrast::Api::Dtm::HttpRequest]
+          def build request
+            with_contrast_scope do
+              msg = new
+              msg.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
+              msg.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
+
+              msg.append_addresses(request)
+              msg.append_connection(request)
+              msg.append_params(request)
+              msg.append_headers(request)
+              msg.append_body(request)
+              msg
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::HttpRequest.include(Contrast::Api::Decorators::HttpRequest)

data/lib/contrast/api/decorators/input_analysis.rb

@@ -0,0 +1,17 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the InputAnalysis protobuf model so it can own the request which its data is for
+      module InputAnalysis
+        attr_accessor :request
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::InputAnalysis.include(Contrast::Api::Decorators::InputAnalysis)

data/lib/contrast/api/decorators/message.rb

@@ -0,0 +1,75 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the Message protobuf model so it can handle instance data massaging
+      module Message
+        include Contrast::Components::Interface
+        access_component :app_context, :logging
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        def append_event event
+          case event
+          when Contrast::Api::Dtm::ServerActivity
+            self.server_activity = event
+          when Contrast::Api::Dtm::AgentStartup
+            self.agent_startup = event
+          when Contrast::Api::Dtm::ApplicationCreate
+            self.application_create = event
+          when Contrast::Api::Dtm::ApplicationUpdate
+            self.application_update = event
+          when Contrast::Api::Dtm::Activity
+            self.activity = event
+          when Contrast::Api::Dtm::HttpRequest
+            self.prefilter = event
+          when Contrast::Api::Dtm::HttpResponse
+            self.postfilter = event
+          when Contrast::Api::Dtm::Poll
+            self.poll = event
+          when Contrast::Api::Dtm::ObservedRoute
+            self.observed_route = event
+          else
+            logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.name)
+            return
+          end
+          logger.debug('Wrapping event in message',
+                       msg_id: __id__,
+                       p_id: pid,
+                       msg_count: message_count,
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          @@message_total = 0 # rubocop:disable Style/ClassVars
+          def message_count
+            @@message_total += 1 # rubocop:disable Style/ClassVars
+          end
+
+          def build event
+            msg = new
+            msg.app_name      = APP_CONTEXT.name
+            msg.app_path      = APP_CONTEXT.path
+            msg.app_language  = Contrast::Utils::ObjectShare::RUBY
+            msg.client_id     = APP_CONTEXT.client_id
+            msg.message_count = message_count
+            msg.pid           = APP_CONTEXT.pid
+            msg.ppid          = APP_CONTEXT.ppid
+            msg.append_event(event)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Message.include(Contrast::Api::Decorators::Message)

data/lib/contrast/api/decorators/rasp_rule_sample.rb

@@ -0,0 +1,28 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the RaspRuleSample protobuf model
+      module RaspRuleSample
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to RaspRuleSample
+        module ClassMethods
+          def build context, ia_result
+            sample = new
+            sample.timestamp_ms = context.timer.start_ms
+            sample.user_input = Contrast::Api::Dtm::UserInput.build_from_ia_result(ia_result)
+            sample.user_input.document_type = Contrast::Utils::StringUtils.force_utf8(context.request.document_type)
+            sample
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::RaspRuleSample.include(Contrast::Api::Decorators::RaspRuleSample)

data/lib/contrast/api/decorators/route_coverage.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the RouteCoverage protobuf model to handle conversion between framework route classes
+      module RouteCoverage
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for RouteCoverage
+        module ClassMethods
+          def source_or_string obj
+            if obj.cs__is_a?(Regexp)
+              obj.source
+            elsif obj.cs__respond_to?(:safe_string)
+              obj.safe_string
+            else
+              obj.to_s
+            end
+          end
+
+          # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
+          # @param journey_obj [ActionDispatch::Journey::Route] a rails route
+          # @return [Contrast::Api::Dtm::RouteCoverage]
+          def from_action_dispatch_journey journey_obj
+            msg = new
+            msg.route = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
+
+            verb = source_or_string(journey_obj.verb)
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
+
+            url = source_or_string(journey_obj.path.spec)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(url)
+            msg
+          end
+
+          def from_sinatra_route clazz, method, pattern
+            safe_pattern = source_or_string(pattern)
+
+            msg = new
+            msg.route = "#{ clazz }##{ method } #{ safe_pattern }"
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::RouteCoverage.include(Contrast::Api::Decorators::RouteCoverage)

data/lib/contrast/api/decorators/server_features.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the ServerFeatures protobuf model to handle setting translation
+      module ServerFeatures
+        # 'defend' is legacy for 'protect' in the dtm.
+        def protect_enabled?
+          !!defend.enabled
+        end
+
+        def assess_enabled?
+          !!assess.enabled
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Settings::ServerFeatures.include(Contrast::Api::Decorators::ServerFeatures)

data/lib/contrast/api/decorators/trace_event.rb

@@ -0,0 +1,99 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the TraceEvent protobuf model
+      module TraceEvent
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Wrapper around build_event_object for the args array. Handles
+        # tainting the correct argument.
+        def build_event_args contrast_event, taint_target
+          contrast_event.args.each_index do |idx|
+            truncate_arg = taint_target != idx
+            event_arg = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.args[idx], truncate_arg)
+            args << event_arg
+          end
+        end
+
+        # TeamServer only supports one object's taint ranges at a time.
+        # We'll find the taint ranges for the target and return those
+        def build_taint_ranges contrast_event, taint_target
+          # If there's no taint_target, this isn't a dataflow trace, but a
+          # trigger one
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless taint_target
+
+          properties = case taint_target
+                       when Contrast::Utils::ObjectShare::OBJECT_KEY
+                         contrast_event.object.cs__properties
+                       when Contrast::Utils::ObjectShare::RETURN_KEY
+                         contrast_event.ret.cs__properties
+                       else
+                         target = contrast_event.args[taint_target]
+                         if target.is_a?(Hash)
+                           if contrast_event.policy_node&.targets&.any?
+                             target[contrast_event.policy_node.targets[0]].cs__properties
+                           else
+                             target[contrast_event.policy_node.sources[0]].cs__properties
+                           end
+                         else
+                           target.cs__properties
+                         end
+                       end
+
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
+
+          properties.tags_to_dtm
+        end
+
+        # Class methods for TraceEvent
+        module ClassMethods
+          def build contrast_event
+            event_dtm = new
+            # Figure out what the target of this event was. It's a little
+            # annoying for us since P can be named (thanks, Ruby) where
+            # as for everyone else it is idx based.
+            taint_target = contrast_event.determine_taint_target(event_dtm) # This can't be pulled into the decorator because SourceEvent has a custom impl :/
+
+            event_dtm.type = contrast_event.policy_node.node_type
+            event_dtm.action = contrast_event.policy_node.build_action
+            event_dtm.timestamp_ms = contrast_event.time.to_i
+            event_dtm.thread = Contrast::Utils::StringUtils.force_utf8(contrast_event.thread)
+            truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
+            event_dtm.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
+            truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
+            event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
+            event_dtm.build_event_args(contrast_event, taint_target)
+
+            taint_ranges = event_dtm.build_taint_ranges(contrast_event, taint_target)
+            taint_ranges.each do |range|
+              event_dtm.taint_ranges << range
+            end
+
+            # We delayed doing this as long as possible b/c it's expensive
+            stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
+            event_dtm.stack += stack
+
+            event_dtm.object_id = contrast_event.event_id.to_i
+            contrast_event.parent_ids&.each do |id|
+              parent = Contrast::Api::Dtm::ParentObjectId.new
+              parent.id = id.to_i
+              event_dtm.parent_object_ids << parent
+            end
+
+            event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
+            event_dtm
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceEvent.include(Contrast::Api::Decorators::TraceEvent)