contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/components/protect.rb

@@ -13,23 +13,59 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :settings
+        access_component :config, :settings
 
         def enabled?
-          state.protect_enabled?
+          # config overrides if forcibly set
+          return false if forcibly_disabled?
+          return true  if forcibly_enabled?
+
+          SETTINGS.protect_enabled?
         end
 
-        def forcibly_disabled?
-          state.protect_forcibly_disabled?
+        def rule_config
+          CONFIG.root.protect.rules
         end
 
         def rules
           SETTINGS.protect_rules
         end
 
+        def rule_mode rule_id
+          CONFIG.root.protect.rules[rule_id]&.mode || SETTINGS.modes_by_id[rule_id] || :NO_ACTION
+        end
+
         def rule name
           SETTINGS.protect_rules[name]
         end
+
+        def report_any_command_execution?
+          if @_report_any_command_execution.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::CmdInjection::NAME]
+            @_report_any_command_execution = true?(ctrl.disable_system_commands)
+          end
+          @_report_any_command_execution
+        end
+
+        def report_custom_code_sysfile_access?
+          if @_report_custom_code_sysfile_access.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::PathTraversal::NAME]
+            @_report_custom_code_sysfile_access = true?(ctrl.detect_custom_code_accessing_system_files)
+          end
+          @_report_custom_code_sysfile_access
+        end
+
+        def forcibly_disabled?
+          @_forcibly_disabled = false?(CONFIG.root.protect.enable) if @_forcibly_disabled.nil?
+          @_forcibly_disabled
+        end
+
+        private
+
+        def forcibly_enabled?
+          @_forcibly_enabled = true?(CONFIG.root.protect.enable) if @_forcibly_enabled.nil?
+          @_forcibly_enabled
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/sampling.rb

@@ -9,7 +9,7 @@ module Contrast
         DEFAULT_SAMPLING_BASELINE           = 5
         DEFAULT_SAMPLING_REQUEST_FREQUENCY  = 5
         DEFAULT_SAMPLING_RESPONSE_FREQUENCY = 25
-        DEFAULT_SAMPLING_WINDOW_MS          = 180_000 # 3 minutes, arbitrary value from Java agent
+        DEFAULT_SAMPLING_WINDOW_MS          = 180_000
       end
 
       module ClassMethods #:nodoc:
@@ -17,18 +17,29 @@ module Contrast
         include Constants
         include Contrast::Components::Interface
 
-        access_component :config
+        access_component :config, :settings
 
-        def sampling_control settings = @sampling_features
-          cas = CONFIG.root.assess&.sampling
+        def sampling_enabled?
+          sampling_control[:enabled]
+        end
+
+        def sampling_control
+          @_sampling_control ||= begin
+            cas = CONFIG.root.assess&.sampling
+            settings = SETTINGS&.assess_state&.[](:sampling_settings)
+            {
+                enabled: true?([cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED].reject(&:nil?)[0]),
+                baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE].map(&:to_i).find(&:positive?),
+                request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY].map(&:to_i).find(&:positive?),
+                response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
+                window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS].map(&:to_i).find(&:positive?)
+            }
+          end
+        end
 
-          {
-              enabled: true?([cas&.enable, settings&.enabled, DEFAULT_SAMPLING_ENABLED] .reject(&:nil?).first),
-              baseline: [cas&.baseline, settings&.baseline, DEFAULT_SAMPLING_BASELINE] .map(&:to_i).find(&:positive?),
-              request_frequency: [cas&.request_frequency, settings&.request_frequency, DEFAULT_SAMPLING_REQUEST_FREQUENCY] .map(&:to_i).find(&:positive?),
-              response_frequency: [cas&.response_frequency, settings&.response_frequency, DEFAULT_SAMPLING_RESPONSE_FREQUENCY].map(&:to_i).find(&:positive?),
-              window: [cas&.window_ms, settings&.window_ms, DEFAULT_SAMPLING_WINDOW_MS] .map(&:to_i).find(&:positive?)
-          }
+        # Used to reset sampling when settings from TeamServer change
+        def reset_sampling_control
+          @_sampling_control = nil
         end
       end
 

data/lib/contrast/components/scope.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
 cs__scoped_require 'fiber'
+cs__scoped_require 'monitor'
 cs__scoped_require 'contrast/agent/scope'
 
 # This is the Scope component.
@@ -54,7 +54,7 @@ module Contrast
           end
         end
 
-        # TODO: https://contrast.atlassian.net/browse/RUBY-290
+        # TODO: RUBY-572
         #
         # Current behavior is to no-op if we're not "in a request context".
         # Our C functions were previously checking to see if we had a scope, because
@@ -84,53 +84,3 @@ module Contrast
     end
   end
 end
-
-# This is a reasonable place for the Kernel#catch hook to live.
-# No current plans for component re-design, but if we had some kind of
-# "do this when a component is hooked in" thing, this would live there.
-# For now, it's over-engineering to live anywhere else.  -ajm
-module Kernel # :nodoc:
-  alias_method :cs__catch, :catch
-
-  # In the event of a `throw`, we need to override `catch`
-  # to save & restore scope state:
-  #
-  #   scope_level == 0
-  #
-  #   catch(:abc) do
-  #     with_contrast_scope do
-  #       throw :abc # will leak
-  #     end
-  #   end
-  #
-  #   scope_level == 1
-  #
-  # Frankly, this isn't how scope should be used.  This is in place of
-  # proper `ensure` blocks within the instrumentation call stack.
-  # This will actually /create/ scope leaks if you're doing something like:
-  #
-  #   catch(:ohno) do
-  #     enter scope
-  #   end
-  #
-  #   abc()
-  #
-  #   exit scope
-  #
-  # i.e. if you intend to change net scope across a catch block boundary.
-
-  private
-
-  def catch *args, &block
-    # Save current scope level
-    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
-
-    # Run original catch with block.
-    retval = cs__catch(*args, &block)
-
-    # Restore scope.
-    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
-
-    retval
-  end
-end

data/lib/contrast/components/settings.rb

@@ -23,11 +23,6 @@ module Contrast
         # this statefulness
         attr_reader :tainted_columns # This can probably go into assess_state?
 
-        # a vulnerability like padding oracle is exploited across
-        # multiple requests, as a timing attack.  these attempts must be
-        # accumulated, in order to recognize the pattern and block the attack.
-        attr_reader :accumulator_settings
-
         # These three 'state' variables represent atomic config/setting state,
         # outside of things like rule defs.
 
@@ -40,8 +35,7 @@ module Contrast
 
         def protect_state
           @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              accumulator_settings: Contrast::Api::Settings::AccumulatorSettings.new
+              enabled: false
           }
         end
 
@@ -58,8 +52,7 @@ module Contrast
         # So, between this block and rules, that's setting state.
         PROTECT_STATE_ATTRS       = %i[].cs__freeze
         ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
-        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules session_id].cs__freeze
-        STATE_ATTRS               = PROTECT_STATE_ATTRS | ASSESS_STATE_ATTRS | APPLICATION_STATE_ATTRS
+        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules].cs__freeze
 
         # Meta-define an accessor for each state attribute.
         begin
@@ -86,6 +79,40 @@ module Contrast
           reset_state
         end
 
+        def protect_enabled?
+          @_protect_enabled = !!protect_state[:enabled] if @_protect_enabled.nil?
+          @_protect_enabled
+        end
+
+        def assess_enabled?
+          @_assess_enabled = !!assess_state[:enabled] if @_assess_enabled.nil?
+          @_assess_enabled
+        end
+
+        def code_exclusions
+          exclusion_matchers.select(&:code?)
+        end
+
+        def update_from_server_features server_features
+          # protect
+          begin
+            @_protect_enabled = nil
+            protect_state[:enabled] = server_features.protect_enabled?
+          end
+
+          # assess
+          begin
+            @_assess_enabled = nil
+            assess_state[:enabled] = server_features.assess_enabled?
+            assess_state[:sampling_settings] = server_features.assess.sampling
+            Contrast::Utils::Assess::SamplingUtil.instance.update
+          end
+        end
+
+        def update_from_application_settings application_settings
+          application_state.merge!(application_settings.application_state_translation)
+        end
+
         # Wipe state to zero.
         def reset_state
           @assess_rules = {}
@@ -101,7 +128,6 @@ module Contrast
         def build_assess_rules
           @assess_rules = {}
 
-          Contrast::Agent::Assess::Rule::Csrf.new
           Contrast::Agent::Assess::Rule::Redos.new
         end
 
@@ -118,19 +144,6 @@ module Contrast
           Contrast::Agent::Protect::Rule::UnsafeFileUpload.new
           Contrast::Agent::Protect::Rule::Xss.new
           Contrast::Agent::Protect::Rule::Xxe.new
-
-          # Beta Rules
-          Contrast::Agent::Protect::Rule::Csrf.new
-        end
-
-        def protect_rule name
-          @protect_rules[name]
-        end
-
-        # these are less 'settings' and more 'how do I behave.'
-        # relocate to Agent or Assess/Protect.
-        def protect_rule_mode rule_id
-          CONFIG.root.protect.rules[rule_id]&.mode || modes_by_id[rule_id] || :NO_ACTION
         end
       end
 

data/lib/contrast/config/base_configuration.rb

@@ -15,6 +15,7 @@ module Contrast
       BOOLEANS = [true, false].cs__freeze
 
       attr_reader :map
+
       alias_method :to_hash, :map
       def_delegators :@map, :empty?, :key?,
                      :delete,

data/lib/contrast/config/default_value.rb

@@ -8,6 +8,7 @@ module Contrast
     # explicitly to false.
     class DefaultValue
       attr_reader :value
+
       def initialize value
         @value = value
       end

data/lib/contrast/config/protect_rule_configuration.rb

@@ -8,12 +8,6 @@ module Contrast
     # Common Configuration settings. Those in this section pertain to the
     # rule mode of a single protect rule in the Agent.
     class ProtectRuleConfiguration < BaseConfiguration
-      # rubocop:disable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-      BLOCKING_RULES   = ::Set.new([:BLOCK , :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      PREFILTER_RULES  = ::Set.new([         :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      POSTFILTER_RULES = ::Set.new([:BLOCK , :PERMIT, :MONITOR]).cs__freeze
-      # rubocop:enable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-
       KEYS = {
           enable: EMPTY_VALUE,
           mode: EMPTY_VALUE,
@@ -24,14 +18,6 @@ module Contrast
       def initialize hsh
         super(hsh, KEYS)
       end
-
-      def off?
-        mode == 'off'
-      end
-
-      def on?
-        !off?
-      end
     end
   end
 end

data/lib/contrast/config/protect_rules_configuration.rb

@@ -14,7 +14,6 @@ module Contrast
           'nosql-injection' => Contrast::Config::ProtectRuleConfiguration,
           'untrusted-deserialization' => Contrast::Config::ProtectRuleConfiguration,
           'method-tampering' => Contrast::Config::ProtectRuleConfiguration,
-          csrf: Contrast::Config::ProtectRuleConfiguration,
           xxe: Contrast::Config::ProtectRuleConfiguration,
           'path-traversal' => Contrast::Config::ProtectRuleConfiguration,
           'reflected-xss' => Contrast::Config::ProtectRuleConfiguration,

data/lib/contrast/configuration.rb

@@ -88,13 +88,13 @@ module Contrast
           puts "!!! Contrast - Configuration file at #{ path } is not readable by current user"
           next
         end
-        config = yaml_to_hash(path)
+        config = yaml_to_hash(path) || {}
         break
       end
 
       if config.empty?
         puts "!!! Contrast - working directory: #{ Dir.pwd }"
-        puts '!!! Contrast - configuration file could not be found at any of the search paths'
+        puts '!!! Contrast - valid configuration file could not be found at any of the search paths'
         puts 'Valid configuration paths are: '
         configuration_paths.each do |path|
           puts(path)

data/lib/contrast/{extensions/ruby_core → extension}/assess.rb

@@ -2,14 +2,15 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Protect namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Assess namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #
     # @deprecated This is one of our earliest designs and is not nearly as
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
+    #   Removing it requires a C refactor to handle the namespace.
     module Assess
       cs__scoped_require 'contrast/agent/patching/policy/patcher'
 
@@ -19,7 +20,6 @@ module Contrast
       cs__scoped_require 'contrast/agent/assess/rule/provider'
 
       # tagging / dataflow
-      cs__scoped_require 'contrast/agent/assess/adjusted_span'
       cs__scoped_require 'contrast/agent/assess/policy/policy_node'
       cs__scoped_require 'contrast/agent/assess/policy/source_node'
       cs__scoped_require 'contrast/agent/assess/policy/source_method'
@@ -31,22 +31,18 @@ module Contrast
       cs__scoped_require 'contrast/agent/assess/policy/patcher'
 
       # classes that don't play nice w/ our standard propagation
-      cs__scoped_require 'contrast/agent/assess/frozen_properties'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+      cs__scoped_require 'contrast/extension/assess/assess_extension'
       # this needs to come first b/c array and others work on strings and
       # expect them to be trackable
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/string'
+      cs__scoped_require 'contrast/extension/assess/string'
 
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/array'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/erb'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/fiber'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/hash'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/kernel'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/regexp'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/module'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/basic_object'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/tilt_template_trigger'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/xpath_library_trigger'
+      cs__scoped_require 'contrast/extension/assess/array'
+      cs__scoped_require 'contrast/extension/assess/erb'
+      cs__scoped_require 'contrast/extension/assess/eval_trigger'
+      cs__scoped_require 'contrast/extension/assess/fiber'
+      cs__scoped_require 'contrast/extension/assess/hash'
+      cs__scoped_require 'contrast/extension/assess/kernel'
+      cs__scoped_require 'contrast/extension/assess/regexp'
     end
   end
 end

data/lib/contrast/extension/assess/array.rb

@@ -0,0 +1,77 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/patch'
+cs__scoped_require 'contrast/agent/patching/policy/patcher'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      class ArrayPropagator
+        include Contrast::Components::Interface
+
+        access_component :scope
+
+        ARRAY_JOIN_HASH = {
+            'class_name' => 'Array',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'join',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'NOOP',
+            'patch_method' => 'cs__track_join'
+        }.cs__freeze
+        ARRAY_JOIN_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(ARRAY_JOIN_HASH)
+
+        class << self
+          # When you call join, they use an internal thing, so there's no good way to get at the thing being returned.
+          # Multiple Strings are appended with the #join method. Because that
+          # operation happens in C, we have to do it here rather than rely on the
+          # patch of our String append or concat methods.
+          def cs__track_join ary, separator, ret
+            return unless ary
+            return ret if Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis?
+
+            with_contrast_scope do
+              shift = 0
+              separator_length = separator.nil? ? 0 : separator.to_s.length
+              ary.each do |obj|
+                if obj # skip nil here
+                  ret.cs__copy_from(obj, shift)
+                  shift += obj.to_s.length
+                end
+                shift += separator_length
+              end
+              return ret unless ret.cs__tracked?
+
+              ret.cs__properties.cleanup_tags
+              ret.cs__properties.build_event(
+                  ARRAY_JOIN_NODE,
+                  ret,
+                  ary,
+                  ret,
+                  [separator])
+              ret
+            end
+          end
+
+          def instrument_array_track
+            @_instrument_array_track ||= begin
+                                           cs__scoped_require 'cs__assess_array/cs__assess_array'
+                                           true
+                                         end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading assess track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end