contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/assess/tracking_util'
+cs__scoped_require 'base64'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the TraceEventObject protobuf model
+      module TraceEventObject
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for TraceEventObject
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :scope
+          # Build the event object. We were originally going to include taint on
+          # each one, but TS doesn't accept / use that, so it is a waste of time.
+          #
+          # We'll truncate any object that isn't important to the taint ranges of
+          # this event, so that we don't murder TeamServer by, for instance,
+          # hypothetically sending the entire rendered HTML page >_>  <_<  >_>
+          ELLIPSIS = '...'
+          UNTRUNCATED_PORTION_LENGTH = 25
+          TRUNCATION_LENGTH = (UNTRUNCATED_PORTION_LENGTH * 2) + ELLIPSIS.length
+          def build object, truncate
+            event_object = new
+            with_contrast_scope do
+              obj_string = Contrast::Utils::StringUtils.force_utf8(object)
+              obj_string = truncate(obj_string) if truncate && obj_string.length > TRUNCATION_LENGTH
+              event_object.value = Base64.encode64(obj_string)
+              event_object.tracked = Contrast::Utils::Assess::TrackingUtil.tracked?(object)
+            end
+            event_object
+          end
+
+          def truncate obj_string
+            tmp = []
+            tmp << obj_string[0, UNTRUNCATED_PORTION_LENGTH]
+            tmp << ELLIPSIS
+            tmp << obj_string[
+                obj_string.length - UNTRUNCATED_PORTION_LENGTH,
+                UNTRUNCATED_PORTION_LENGTH]
+            tmp.join
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceEventObject.include(Contrast::Api::Decorators::TraceEventObject)

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -0,0 +1,46 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/assess/tracking_util'
+cs__scoped_require 'base64'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the TraceEventSignature protobuf model
+      module TraceEventSignature
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for TraceEventSignature
+        module ClassMethods
+          def build ret_obj, policy_node, args
+            signature = new
+            return_type = ret_obj ? ret_obj.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
+            signature.return_type = Contrast::Utils::StringUtils.force_utf8(return_type)
+            signature.class_name = Contrast::Utils::StringUtils.force_utf8(policy_node.class_name)
+            signature.method_name = Contrast::Utils::StringUtils.force_utf8(policy_node.method_name)
+            if args
+              args&.each do |arg|
+                arg_type = arg ? arg.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
+                signature.arg_types << Contrast::Utils::StringUtils.force_utf8(arg_type)
+              end
+            end
+            signature.constructor = policy_node.method_name == :new
+            # if there's a ret, then this method isn't nil. not 100% full proof since you can
+            # return nil, but this is the best we've got currently.
+            signature.void_method = ret_obj.nil?
+            # 8 is STATIC in Java... we have to placate them for now
+            # it has been requested that flags be removed since it isn't used
+            signature.flags = 8 unless policy_node.instance_method?
+            signature
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceEventSignature.include(Contrast::Api::Decorators::TraceEventSignature)

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the TraceTaintRange protobuf model
+      module TraceTaintRange
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for TraceEventObject
+        module ClassMethods
+          # Convert the tags from Contrast::Agent::Assess::Property::Tagged to
+          # the form required for their Event's DTM.
+          #
+          # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}]
+          # @return [Array<Contrast::Api::Dtm::TraceTaintRange>]
+          def build_for_event tags
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags&.any?
+
+            ranges = []
+            tags.each_value do |value|
+              next if value.empty?
+
+              value.each { |tag| ranges << build(tag) }
+            end
+            ranges
+          end
+
+          # Convert our Tags to their DTM equivalent
+          #
+          # @param tag [Contrast::Agent::Assess::Tag]
+          # @return [Contrast::Api::Dtm::TraceTaintRange]
+          def build tag
+            range = Contrast::Api::Dtm::TraceTaintRange.new
+            range.tag = Contrast::Utils::StringUtils.protobuf_safe_string(tag.label)
+            range.range = tag.start_idx.to_s + Contrast::Utils::ObjectShare::COLON + tag.end_idx.to_s
+            range
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceTaintRange.include(Contrast::Api::Decorators::TraceTaintRange)

data/lib/contrast/api/decorators/trace_taint_range_tags.rb

@@ -0,0 +1,109 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Decorators
+      # A holder for the valid tags that can be sent to the Service, and
+      # ultimately TS, that we have to honor. Placed here so as not to clutter
+      # other code.
+      module TraceTaintRangeTags
+        # EventTagTypeDTM
+        VALID_TAGS = %w[
+          XML_ENCODED
+          XML_DECODED
+          HTML_ENCODED
+          HTML_DECODED
+          URL_ENCODED
+          URL_DECODED
+          CSS_ENCODED
+          CSS_DECODED
+          BASE64_ENCODED
+          BASE64_DECODED
+          JAVASCRIPT_ENCODED
+          JAVASCRIPT_DECODED
+          JAVA_ENCODED
+          JAVA_DECODED
+          CSV_ENCODED
+          CSV_DECODED
+          SQL_ENCODED
+          SQL_DECODED
+          LDAP_ENCODED
+          LDAP_DECODED
+          XPATH_ENCODED
+          XPATH_DECODED
+          OS_ENCODED
+          OS_DECODED
+          VBSCRIPT_ENCODED
+          VBSCRIPT_DECODED
+          POTENTIAL_SANITIZED
+          POTENTIAL_VALIDATED
+          NO_CONTROL_CHARS
+          CUSTOM
+
+          CUSTOM_ENCODED
+          CUSTOM_ENCODED_CMD_INJECTION
+          CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION
+          CUSTOM_ENCODED_HEADER_INJECTION
+          CUSTOM_ENCODED_HQL_INJECTION
+          CUSTOM_ENCODED_LDAP_INJECTION
+          CUSTOM_ENCODED_LOG_INJECTION
+          CUSTOM_ENCODED_NOSQL_INJECTION
+          CUSTOM_ENCODED_PATH_TRAVERSAL
+          CUSTOM_ENCODED_REDOS
+          CUSTOM_ENCODED_REFLECTED_XSS
+          CUSTOM_ENCODED_REFLECTION_INJECTION
+          CUSTOM_ENCODED_SMTP_INJECTION
+          CUSTOM_ENCODED_SQL_INJECTION
+          CUSTOM_ENCODED_SSRF
+          CUSTOM_ENCODED_STORED_XSS
+          CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION
+          CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION
+          CUSTOM_ENCODED_UNSAFE_READLINE
+          CUSTOM_ENCODED_UNSAFE_XML_DECODE
+          CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION
+          CUSTOM_ENCODED_UNVALIDATED_FORWARD
+          CUSTOM_ENCODED_UNVALIDATED_REDIRECT
+          CUSTOM_ENCODED_XPATH_INJECTION
+          CUSTOM_ENCODED_XXE
+          CUSTOM_SECURITY_CONTROL_APPLIED
+
+          CUSTOM_VALIDATED
+          CUSTOM_VALIDATED_CMD_INJECTION
+          CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION
+          CUSTOM_VALIDATED_HEADER_INJECTION
+          CUSTOM_VALIDATED_HQL_INJECTION
+          CUSTOM_VALIDATED_LDAP_INJECTION
+          CUSTOM_VALIDATED_LOG_INJECTION
+          CUSTOM_VALIDATED_NOSQL_INJECTION
+          CUSTOM_VALIDATED_PATH_TRAVERSAL
+          CUSTOM_VALIDATED_REDOS
+          CUSTOM_VALIDATED_REFLECTED_XSS
+          CUSTOM_VALIDATED_REFLECTION_INJECTION
+          CUSTOM_VALIDATED_SMTP_INJECTION
+          CUSTOM_VALIDATED_SQL_INJECTION
+          CUSTOM_VALIDATED_SSRF
+          CUSTOM_VALIDATED_STORED_XSS
+          CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION
+          CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION
+          CUSTOM_VALIDATED_UNSAFE_READLINE
+          CUSTOM_VALIDATED_UNSAFE_XML_DECODE
+          CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION
+          CUSTOM_VALIDATED_UNVALIDATED_FORWARD
+          CUSTOM_VALIDATED_UNVALIDATED_REDIRECT
+          CUSTOM_VALIDATED_XPATH_INJECTION
+          CUSTOM_VALIDATED_XXE
+
+          DATABASE_WRITE
+        ].cs__freeze
+
+        VALID_SOURCE_TAGS = %w[
+          NO_NEWLINES
+          UNTRUSTED
+          CROSS_SITE
+          LIMITED_CHARS
+        ].cs__freeze
+      end
+    end
+  end
+end

data/lib/contrast/api/decorators/user_input.rb

@@ -0,0 +1,40 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/assess/tracking_util'
+cs__scoped_require 'base64'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the TraceEventObject protobuf model
+      module UserInput
+        UNKNOWN_USER_INPUT = Contrast::Api::Dtm::UserInput.new.tap do |user_input|
+          user_input.input_type = :UNKNOWN
+        end.cs__freeze
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to UserInput
+        module ClassMethods
+          def build_from_ia_result ia_result
+            return UNKNOWN_USER_INPUT.dup unless ia_result
+
+            user_input = new
+            user_input.input_type = ia_result.input_type.to_i
+            user_input.matcher_ids = ia_result.ids
+            user_input.path = ia_result.path.to_s
+            user_input.key = ia_result.key.to_s
+            user_input.value = ia_result.value.to_s
+            user_input
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::UserInput.include(Contrast::Api::Decorators::UserInput)

data/lib/contrast/components/agent.rb

@@ -2,19 +2,19 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'rubygems/version'
+cs__scoped_require 'contrast/agent/rule_set'
 
 module Contrast
   module Components
     module Agent
       # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
+      # for access of the values contained in its parent_configuration_spec.yaml.
       # Specifically, this allows for querying the state of the Agent.
       class Interface
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :analysis, :config, :settings
 
         def enabled?
           !!@enabled
@@ -32,12 +32,12 @@ module Contrast
           @enabled = false
         end
 
-        def unavailable?
-          !enabled?
+        def ruleset
+          @_ruleset ||= Contrast::Agent::RuleSet.new(retrieve_ruleset&.values)
         end
 
-        def ready?
-          state.agent_ready?
+        def reset_ruleset
+          @_ruleset = nil
         end
 
         def patch_interpolation?
@@ -49,15 +49,26 @@ module Contrast
         end
 
         def patch_yield?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield)
+          @_patch_yield = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.propagate_yield) if @_patch_yield.nil?
+          @_patch_yield
         end
 
         def interpolation_enabled?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate)
+          @_interpolation_enabled = !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate) if @_interpolation_enabled.nil?
+          @_interpolation_enabled
+        end
+
+        def omit_body?
+          @_omit_body = true?(CONFIG.root.agent.omit_body) if @_omit_body.nil?
+          @_omit_body
         end
 
-        def report_custom_code_sysfile_access?
-          Contrast::Agent::FeatureState.instance.report_custom_code_sysfile_access?
+        def exception_control
+          @_exception_control ||= {
+              enable: true?(CONFIG.root.agent.ruby.exceptions.capture),
+              status: CONFIG.root.agent.ruby.exceptions.override_status || 403,
+              message: CONFIG.root.agent.ruby.exceptions.override_message || Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
+          }
         end
 
         def skip_instrumentation? loaded_module_name
@@ -66,19 +77,6 @@ module Contrast
           loaded_module_name.start_with?(*CONFIG.root.agent.ruby.uninstrument_namespace)
         end
 
-        # All this method chain does anymore is load the Thread patch that
-        # propagates request contexts.  That can go away RUBY-700.
-        SHARED_LIBRARIES = %w[contrast/extensions/ruby_core/thread].cs__freeze
-        def run_instrumentation
-          Contrast::Agent::FeatureState.instance.tap do |settings|
-            SHARED_LIBRARIES.each { |lib| settings.instrument lib }
-          end
-          Contrast::Agent::Patching::Policy::Patcher.patch # This acts as a catch up for everything we didn't see get loaded
-          enable_tracepoint # This handles all class loads & required instrumentation going forward
-        end
-
-        # TODO: RUBY-564: This responsibility should be extracted out of this agent component and moved to
-        # the new component that handles one-time-whole-app initialization procedures.
         def insert_middleware app
           app.middleware.insert_before 0, Contrast::Agent::Middleware # Keep our middleware at the outermost layer of the onion
         end
@@ -96,6 +94,18 @@ module Contrast
           @_interpolation_patch_possible = Gem::Version.new(RUBY_VERSION) >= INTERPOLATION_HOOKABLE_VERSION if @_interpolation_patch_possible.nil?
           @_interpolation_patch_possible
         end
+
+        def retrieve_ruleset
+          return {} unless enabled?
+
+          if ASSESS.enabled? && PROTECT.enabled?
+            ASSESS.rules.merge(PROTECT.rules)
+          elsif ASSESS.enabled?
+            ASSESS.rules
+          else
+            PROTECT.rules
+          end
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/app_context.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/sinatra_helper'
 cs__scoped_require 'rubygems/version'
 
 module Contrast
@@ -16,32 +15,30 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :agent, :config
 
         DEFAULT_APP_NAME    = 'rails'
         DEFAULT_APP_PATH    = '/'
         DEFAULT_SERVER_NAME = 'localhost'
         DEFAULT_SERVER_PATH = '/'
 
-        def present? str
-          Contrast::Utils::EnvironmentUtil.present?(str)
+        def initialize
+          original_pid
         end
 
         def server_type
           @_server_type ||= begin
                               tmp = CONFIG.root.server.type
-                              tmp = Contrast::Agent.framework_manager.server_type unless present?(tmp)
+                              tmp = Contrast::Agent.framework_manager.server_type unless Contrast::Utils::StringUtils.present?(tmp)
                               tmp
-                            rescue StandardError
-                              RACK_TYPE
                             end
         end
 
         def name
           @_name ||= begin
                        tmp = CONFIG.root.application.name
-                       tmp = Contrast::Agent.framework_manager.app_name unless present?(tmp)
-                       tmp = File.basename(Dir.pwd) unless present?(tmp)
+                       tmp = Contrast::Agent.framework_manager.app_name unless Contrast::Utils::StringUtils.present?(tmp)
+                       tmp = File.basename(Dir.pwd) unless Contrast::Utils::StringUtils.present?(tmp)
                        Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_APP_NAME)
                      rescue StandardError
                        DEFAULT_APP_NAME
@@ -60,7 +57,7 @@ module Contrast
         def server_name
           @_server_name ||= begin
                               tmp = CONFIG.root.server.name
-                              tmp = Socket.gethostname unless present?(tmp)
+                              tmp = Socket.gethostname unless Contrast::Utils::StringUtils.present?(tmp)
                               tmp = Contrast::Utils::StringUtils.force_utf8(tmp)
                               Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_NAME)
                             rescue StandardError
@@ -71,7 +68,7 @@ module Contrast
         def server_path
           @_server_path ||= begin
                               tmp = CONFIG.root.server.path
-                              tmp = Dir.pwd unless present?(tmp)
+                              tmp = Dir.pwd unless Contrast::Utils::StringUtils.present?(tmp)
                               Contrast::Utils::StringUtils.truncate(tmp, DEFAULT_SERVER_PATH)
                             rescue StandardError
                               DEFAULT_SERVER_PATH
@@ -81,34 +78,27 @@ module Contrast
         def build_app_startup_message
           msg = Contrast::Api::Dtm::ApplicationCreate.new
 
-          app_ver = if CONFIG.root.application.version.to_s.empty?
-                      Contrast::Utils::EnvironmentUtil.determine_application_version
-                    else
-                      CONFIG.root.application.version
-                    end
-
-          msg.group            = protobuf_format CONFIG.root.application.group
-          msg.tags             = protobuf_format CONFIG.root.application.tags
-          msg.app_version      = protobuf_format app_ver
-          msg.code             = protobuf_format CONFIG.root.application.code
-          msg.metadata         = protobuf_format CONFIG.root.application.metadata
+          msg.group            = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.group
+          msg.tags             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.tags
+          msg.app_version      = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.version.to_s
+          msg.code             = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.code
+          msg.metadata         = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.metadata
           # Other fields have limits in TeamServer, the rest don't.
-          msg.session_id       = protobuf_format CONFIG.root.application.session_id,        truncate: false
-          msg.session_metadata = protobuf_format CONFIG.root.application.session_metadata,  truncate: false
+          msg.session_id       = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_id,        truncate: false
+          msg.session_metadata = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.application.session_metadata,  truncate: false
 
           msg
         end
 
-        LOG_BUILD_STARTUP = 'build startup message'
         def build_agent_startup_message
           msg = Contrast::Api::Dtm::AgentStartup.new
-          msg.server_name    = protobuf_format server_name
-          msg.server_path    = protobuf_format server_path
-          msg.server_type    = protobuf_format server_type
+          msg.server_name    = Contrast::Utils::StringUtils.protobuf_format server_name
+          msg.server_path    = Contrast::Utils::StringUtils.protobuf_format server_path
+          msg.server_type    = Contrast::Utils::StringUtils.protobuf_format server_type
           msg.server_version = Contrast::Agent::VERSION
-          msg.version        = protobuf_format CONFIG.root.server.version
-          msg.environment    = protobuf_format CONFIG.root.server.environment
-          msg.tags           = protobuf_format CONFIG.root.server.tags
+          msg.version        = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.version
+          msg.environment    = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.environment
+          msg.tags           = Contrast::Utils::StringUtils.protobuf_format CONFIG.root.server.tags
           msg
         end
 
@@ -128,20 +118,30 @@ module Contrast
           @_client_id ||= [name, pgid].join('-')
         end
 
-        # TODO: RUBY-564: This responsibility should be extracted out of app_context and moved to
-        # the new component that handles one-time-whole-app initialization procedures.
         def instrument_middleware_stack?
           !Contrast::Utils::JobServersRunning.job_servers_running?
         end
 
+        def disabled_agent_rake_tasks
+          CONFIG.root.agent.ruby.disabled_agent_rake_tasks
+        end
+
+        # Determines if the Process we're currently in matches that of the
+        # Process in which the App Context instance was created.
+        # If it doesn't, that indicates the running context is in a new
+        # Process.
+        # @return [Boolean] if we're in the original Process in which the
+        #   App Context instance was initialized.
+        def in_new_process?
+          current_pid = Process.pid
+          original_pid = pid
+          current_pid != original_pid
+        end
+
         private
 
-        # TODO: RUBY-120, move this responsibility toward the protobuf object
-        def protobuf_format param, truncate: true
-          param = param&.to_s
-          param = Contrast::Utils::StringUtils.force_utf8(param)
-          param = Contrast::Utils::StringUtils.truncate(param) if truncate
-          param
+        def original_pid
+          @_original_pid ||= Process.pid
         end
       end