contrast-agent 3.10.2 → 3.13.0

data/lib/contrast/extensions/ruby_core/protect/applies_xxe_rule.rb

@@ -1,143 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/object_share'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the XXE rule. It is called from our patches
-      # of the targeted methods in which XML parsing and entity resolution
-      # occurs. It is responsible for deciding if the infilter methods of the
-      # rule should be invoked.
-      module AppliesXxeRule
-        include Contrast::Components::Interface
-        access_component :logging, :analysis
-
-        class << self
-          def apply_xxe_rule _method, _exception, _properties, object, args
-            return unless valid_input?(args)
-            return if skip_analysis?
-
-            xml = args.first
-            parser = determine_parser(object)
-            return unless parser
-
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, xml)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
-            logger.error(e, "Error running XXE rule in #{ parser }")
-          end
-
-          # IO is tricky. If we can't rewind it, we can't fix it back to the
-          # original state. To be safe, we'll skip non-rewindable IO objects.
-          def apply_xxe_rule__io _method, _exception, _properties, object, args
-            need_rewind = false
-            return unless valid_io_input?(args)
-            return if skip_analysis?
-
-            need_rewind = true
-            xml = args.first.read
-            parser = determine_parser(object)
-            return unless parser
-
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, xml)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
-            logger.error(e, "Error running XXE rule in #{ parser }")
-          ensure
-            args.first.rewind if need_rewind
-          end
-
-          # Oga's Lexer is a special case b/c the information we need is on the
-          # object itself -- specifically in the @data instance variable
-          def apply_xxe_rule__lexer _method, _exception, _properties, object, _args
-            return unless valid_data_input?(object)
-            return if skip_analysis?
-
-            parser = determine_parser(object)
-            return unless parser
-
-            data = object.instance_variable_get(DATA_KEY)
-
-            if data.cs__is_a?(String)
-              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, data)
-            elsif data.cs__respond_to?(:each_line)
-              data.each_line do |line|
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, line)
-              end
-              data.rewind if data.cs__respond_to?(:rewind)
-            elsif data.cs__respond_to?(:each)
-              data.each do |chunk|
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, chunk)
-              end
-              data.rewind if data.cs__respond_to?(:rewind)
-            end
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
-            logger.error(e, "Error running XXE rule in #{ parser }")
-          end
-
-          private
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::Xxe::NAME
-          end
-
-          def valid_input? args
-            return false unless args&.any?
-
-            args.first
-          end
-
-          def valid_io_input? args
-            return false unless valid_input?(args)
-
-            io = args.first
-            io&.respond_to?(:rewind)
-          end
-
-          DATA_KEY = '@data'.to_sym
-          def valid_data_input? object
-            object.instance_variable_defined?(DATA_KEY) &&
-                object.instance_variable_get(DATA_KEY)
-          end
-
-          def skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-
-          NOKOGIRI_MARKER = 'Nokogiri::'
-          PARSER_NOKOGIRI = 'Nokogiri'
-          OX_MARKER = 'Ox' # breaks marker pattern b/c Ox is entire classname
-          PARSER_OX = 'Ox'
-          OGA_MARKER = 'Oga::'
-          PARSER_OGA = 'Oga'
-          def determine_parser object
-            clazz = object.is_a?(Module) ? object : object.cs__class
-            name = clazz.cs__name
-
-            if name.start_with?(NOKOGIRI_MARKER)
-              PARSER_NOKOGIRI
-            elsif name.start_with?(OX_MARKER)
-              PARSER_OX
-            elsif name.start_with?(OGA_MARKER)
-              PARSER_OGA
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/kernel.rb

@@ -1,30 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-# This Module functions as our patch into the Kernel class for Protect,
-# allowing us to track activity as it crosses spawned processes.
-module Kernel
-  class << self
-    include Contrast::Components::Interface
-    access_component :contrast_service
-
-    def cs__protect_build_wrapper
-      lambda {
-        Kernel.cs__protect_proc_start
-        yield
-        # AtExitHook handles sending any messages generated in the new forked process
-      }
-    end
-
-    def cs__protect_proc_start
-      context = Contrast::Agent::REQUEST_TRACKER.current
-      return unless context
-
-      context.reset_activity
-    end
-  end
-end
-
-cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'

data/lib/contrast/framework/rails_support.rb

@@ -1,88 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Framework
-    # Used when Rails is present to define framework specific behavior
-    class RailsSupport < BaseSupport
-      class << self
-        RAILS_VIEWS = [
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'coffee', %w[CoffeeScript]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'scss', %w[SASS]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html', %w[HTML5]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.erb', %w[HTML5 ERB]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.haml', %w[HTML5 HAML]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
-        ].cs__freeze
-
-        RAILS_MODULE_NAME_VERSION = Gem::Version.new('6.0.0')
-
-        def detection_class
-          'Rails'
-        end
-
-        def version
-          Rails.version
-        end
-
-        def application_name
-          # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed entirely
-          # and instead we need to use parent_module_name
-          return Rails.application.cs__class.parent_module_name if Gem::Version.new(Rails.version) >= RAILS_MODULE_NAME_VERSION
-
-          Rails.application.cs__class.parent_name
-        end
-
-        def server_type
-          'rails'
-        end
-
-        def scan_views
-          scan_view_directories(RAILS_VIEWS)
-        end
-
-        def collect_routes
-          routes = Rails.application.routes.routes.map do |route|
-            route_to_coverage(route)
-          end
-          routes
-        end
-
-        def current_route request
-          return unless Rails.cs__respond_to?(:application)
-
-          # returns array of arrays [[match_data, path_parameters, route]], sorted by
-          # precedence
-          # match_data: ActionDispatch::Journey::Path::Pattern::MatchData
-          # path_parameters: hash of various things
-          # route: ActionDispatch::Journey::Route
-          full_routes = Rails.application.routes.router.send(:find_routes, request.rack_request)
-          return if full_routes.empty?
-
-          full_route = full_routes[0] # [match_data, path_parameters, route]
-          return unless full_route
-
-          route = full_route[2] # route w/ highest precedence
-          return unless route
-
-          route_to_coverage(route)
-        end
-
-        private
-
-        # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
-        def route_to_coverage route
-          route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-          route_coverage.route = "#{ route.defaults[:controller] }##{ route.defaults[:action] }"
-
-          verb = source_or_string(route.verb)
-          route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(verb)
-
-          url = source_or_string(route.path.spec)
-          route_coverage.url = Contrast::Utils::StringUtils.force_utf8(url)
-          route_coverage
-        end
-      end
-    end
-  end
-end

data/lib/contrast/framework/sinatra_application_helper.rb

@@ -1,49 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Framework
-    # This module is to help perform sometimes necessary tasks specific to Sinatra
-    module SinatraApplicationHelper
-      SINATRA_VIEWS = [
-        Contrast::Framework::ViewTechnologiesDescriptor.new('public/stylesheets', 'scss', %w[SASS]),
-        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html', %w[HTML5]),
-        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.erb', %w[HTML5 ERB]),
-        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.haml', %w[HTML5 HAML]),
-        Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
-      ].cs__freeze
-
-      def app_class
-        @_app_class ||= begin
-                          return nil unless defined?(Sinatra) && defined?(Sinatra::Base)
-
-                          sinatra_layers = ObjectSpace.each_object(Sinatra::Base).to_a
-                          result_layer = sinatra_layers.find { |layer| layer.app.nil? }
-                          result_layer
-                        end
-      end
-
-      def scannable_view_dirs
-        @_scannable_view_dirs ||= begin
-                                    views = SINATRA_VIEWS.dup
-                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'erb', %w[HTML5 ERB]) if view_directory
-                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'haml', %w[HTML5 HAML]) if view_directory
-                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(public_directory, 'html', %w[HTML5]) if public_directory
-                                    views
-                                  end
-      end
-
-      def view_directory
-        @_view_directory ||= begin
-                               app_class&.settings&.views
-                             end
-      end
-
-      def public_directory
-        @_public_directory ||= begin
-                                 app_class&.settings&.public_dir
-                               end
-      end
-    end
-  end
-end

data/lib/contrast/framework/sinatra_support.rb

@@ -1,94 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/framework/sinatra_application_helper'
-
-module Contrast
-  module Framework
-    # Used when Sinatra is present to define framework specific behavior
-    class SinatraSupport < BaseSupport
-      extend Contrast::Framework::SinatraApplicationHelper
-      class << self
-        def detection_class
-          'Sinatra'
-        end
-
-        def version
-          Sinatra::VERSION
-        end
-
-        def application_name
-          return unless app_class
-
-          app_class.cs__class.cs__name
-        end
-
-        def server_type
-          'sinatra'
-        end
-
-        def scan_views
-          return unless app_class
-
-          scan_view_directories(scannable_view_dirs)
-        end
-
-        # Iterate over every class that extends Sinatra::Base, pull out its routes
-        # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
-        # Contrast::Api::Dtm::RouteCoverage
-        def collect_routes
-          routes = []
-          controllers = sinatra_controllers
-          controllers.each do |clazz|
-            class_routes = sinatra_class_routes(clazz)
-            next unless class_routes
-
-            class_routes.each_pair do |method, list|
-              # item: [ Mustermann::Sinatra, [], Proc]
-              list.each do |item|
-                routes << route_to_coverage(clazz, method, item[0])
-              end
-            end
-          end
-          routes
-        end
-
-        # TODO: RUBY-763
-        def current_route _request
-          nil
-        end
-
-        private
-
-        # Iterate over every class that extends Sinatra::Base, pull out its routes
-        # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
-        # Contrast::Api::Dtm::RouteCoverage
-        def sinatra_controllers
-          return [] unless defined?(Sinatra) && defined?(Sinatra::Base)
-
-          Contrast::Utils::ClassUtil.descendants(Sinatra::Base)
-        end
-
-        def sinatra_class_routes controller
-          controller.instance_variable_get(:@routes)
-        rescue StandardError
-          logger.debug(nil, "#{ controller } has no route instances")
-          nil
-        end
-
-        # TODO: RUBY-763
-        # given clazz, method, and Mustermann::Sinatra, build a
-        # Contrast::Api::Dtm::RouteCoverage
-        def route_to_coverage clazz, method, pattern
-          safe_pattern = source_or_string(pattern)
-
-          route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-          route_coverage.route = "#{ clazz }##{ method } #{ safe_pattern }"
-          route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(method)
-          route_coverage.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
-          route_coverage
-        end
-      end
-    end
-  end
-end

data/lib/contrast/framework/view_technologies_descriptor.rb

@@ -1,20 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Framework
-    # Used to define common locations and extensions for specific technologies
-    class ViewTechnologiesDescriptor
-      attr_reader :path, :extension, :technology_names
-      def initialize path, extension, technology_names
-        @path = path
-        @extension = extension
-        @technology_names = technology_names
-      end
-
-      def empty?
-        Dir["#{ path }/**/*#{ extension }"].empty?
-      end
-    end
-  end
-end

data/lib/contrast/internal_exception.rb

@@ -1,8 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  # Used to type a StandardError raised by Contrast code.
-  class InternalException < StandardError
-  end
-end

data/lib/contrast/utils/cache.rb

@@ -1,69 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Implementation taken from http://stackoverflow.com/questions/1933866/efficient-ruby-lru-cache
-    class Cache
-      def initialize max_size = 1000
-        @max_size = max_size
-        @data = {}
-      end
-
-      def max_size= size
-        return if size < 1
-
-        @max_size = size
-        return if @max_size >= @data.length
-
-        @data.keys[0..(@max_size - @data.length)].each do |k|
-          @data.delete(k)
-        end
-      end
-
-      def [] key
-        found = true
-        value = @data.delete(key) { found = false }
-        @data[key] = value if found
-      end
-
-      def []= key, value
-        @data.delete(key)
-        @data[key] = value
-        @data.delete(@data.first[0]) if @data.length > @max_size
-
-        value # rubocop:disable Lint/Void
-      end
-
-      def each
-        @data.reverse_each do |pair|
-          yield pair
-        end
-      end
-
-      # used further up the chain, non thread safe each
-      alias_method :each_unsafe, :each
-
-      def to_a
-        @data.to_a.reverse
-      end
-
-      def delete key
-        @data.delete(key)
-      end
-
-      def clear
-        @data.clear
-      end
-
-      def count
-        @data.count
-      end
-
-      # for cache validation only, ensures all is sound
-      def valid?
-        true
-      end
-    end
-  end
-end