contrast-agent 3.11.0 → 3.12.0

data/resources/inventory/policy.json

@@ -2,8 +2,8 @@
   "rules":[
     {
       "name":"data_store",
-      "applicator": "Contrast::CoreExtensions::Inventory::DataStores",
-      "applicator_method": "patched_report_data_store",
+      "applicator": "Contrast::Agent::Inventory::Policy::DataStores",
+      "applicator_method": "report_data_store",
       "required_properties": ["data_store"],
       "optional_properties": [],
       "triggers":[

data/resources/protect/policy.json

@@ -2,7 +2,7 @@
   "rules":[
     {
       "name": "cmd-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesCommandInjectionRule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesCommandInjectionRule",
       "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],
@@ -114,7 +114,7 @@
     },
     {
       "name": "nosql-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesNoSqliRule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesNoSqliRule",
       "applicator_method": "apply_rule",
       "required_properties": ["database"],
       "optional_properties": [],
@@ -156,7 +156,7 @@
     },
     {
       "name":"path-traversal",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesPathTraversalRule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesPathTraversalRule",
       "applicator_method": "apply_rule",
       "required_properties": ["action"],
       "optional_properties": [],
@@ -254,7 +254,7 @@
     },
     {
       "name": "sql-injection",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesSqliRule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesSqliRule",
       "applicator_method": "apply_rule",
       "required_properties": ["index", "database"],
       "optional_properties": [],
@@ -336,7 +336,7 @@
     },
     {
       "name": "untrusted-deserialization",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesDeserializationRule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesDeserializationRule",
       "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],
@@ -361,7 +361,7 @@
     },
     {
       "name": "xxe",
-      "applicator": "Contrast::CoreExtensions::Protect::AppliesXxeRule",
+      "applicator": "Contrast::Agent::Protect::Policy::AppliesXxeRule",
       "applicator_method": "apply_rule",
       "required_properties": [],
       "optional_properties": [],

data/ruby-agent.gemspec

@@ -71,7 +71,7 @@ def self.add_dependencies spec
   spec.add_dependency 'google-protobuf', '~> 3.9.0'
   spec.add_dependency 'ougai', '~> 1.8'
   spec.add_dependency 'parser', '~> 2.6'
-  spec.add_dependency 'rack', '>= 1.0', '< 3.0'
+  spec.add_dependency 'rack', '>= 2.0', '< 3.0'
 end
 
 # Enumerate the files required to build the Agent.
@@ -126,6 +126,10 @@ Gem::Specification.new do |spec|
   spec.extensions = Dir['ext/cs__common/extconf.rb', 'ext/**/extconf.rb']
   spec.require_paths = ['lib']
 
+  unless File.exist?(File.join(Dir.pwd, 'contrast_security.yaml'))
+    spec.post_install_message = 'To generate the required contrast_security.yaml file you can run: bundle exec rake contrast:config:create'
+  end
+
   add_authors(spec)
   add_files(spec)
   add_dev_dependencies(spec)

data/service_executables/VERSION

@@ -1 +1 @@
-2.6.4
+2.8.1

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: contrast-agent
 version: !ruby/object:Gem::Version
-  version: 3.11.0
+  version: 3.12.0
 platform: ruby
 authors:
 - galen.palmer@contrastsecurity.com
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-05-26 00:00:00.000000000 Z
+date: 2020-06-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: amazing_print
@@ -440,7 +440,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '3.0'
@@ -450,7 +450,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.0'
+        version: '2.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '3.0'
@@ -462,24 +462,25 @@ executables:
 - contrast_service
 extensions:
 - ext/cs__common/extconf.rb
-- ext/cs__assess_module/extconf.rb
-- ext/cs__assess_yield_track/extconf.rb
-- ext/cs__assess_hash/extconf.rb
-- ext/cs__protect_kernel/extconf.rb
-- ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_marshal_module/extconf.rb
+- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__assess_fiber_track/extconf.rb
 - ext/cs__assess_string_interpolation26/extconf.rb
-- ext/cs__assess_kernel/extconf.rb
+- ext/cs__contrast_patch/extconf.rb
 - ext/cs__assess_array/extconf.rb
-- ext/cs__assess_fiber_track/extconf.rb
-- ext/cs__assess_marshal_module/extconf.rb
+- ext/cs__assess_kernel/extconf.rb
 - ext/cs__assess_string/extconf.rb
-- ext/cs__contrast_patch/extconf.rb
-- ext/cs__assess_basic_object/extconf.rb
+- ext/cs__assess_hash/extconf.rb
+- ext/cs__assess_module/extconf.rb
+- ext/cs__assess_regexp/extconf.rb
+- ext/cs__assess_yield_track/extconf.rb
 - ext/cs__assess_active_record_named/extconf.rb
+- ext/cs__protect_kernel/extconf.rb
 extra_rdoc_files: []
 files:
 - ".clang-format"
 - ".dockerignore"
+- ".flayignore"
 - ".gitignore"
 - ".gitmodules"
 - ".rspec"
@@ -663,7 +664,7 @@ files:
 - funchook/src/funchook_x86.o
 - funchook/src/instructions.o
 - funchook/src/insts.o
-- funchook/src/libfunchook.dylib
+- funchook/src/libfunchook.so
 - funchook/src/mnemonics.o
 - funchook/src/operands.o
 - funchook/src/os_func.c
@@ -683,8 +684,6 @@ files:
 - funchook/test/funchook_test
 - funchook/test/libfunchook_test.c
 - funchook/test/libfunchook_test.so
-- funchook/test/libfunchook_test.so.dSYM/Contents/Info.plist
-- funchook/test/libfunchook_test.so.dSYM/Contents/Resources/DWARF/libfunchook_test.so
 - funchook/test/libfunchook_test2.c
 - funchook/test/suffix.list
 - funchook/test/test_main.c
@@ -742,6 +741,8 @@ files:
 - lib/contrast/agent/assess/policy/source_node.rb
 - lib/contrast/agent/assess/policy/source_validation/cross_site_validator.rb
 - lib/contrast/agent/assess/policy/source_validation/source_validation.rb
+- lib/contrast/agent/assess/policy/trigger/reflected_xss.rb
+- lib/contrast/agent/assess/policy/trigger/xpath.rb
 - lib/contrast/agent/assess/policy/trigger_method.rb
 - lib/contrast/agent/assess/policy/trigger_node.rb
 - lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb
@@ -750,18 +751,11 @@ files:
 - lib/contrast/agent/assess/properties.rb
 - lib/contrast/agent/assess/rule.rb
 - lib/contrast/agent/assess/rule/base.rb
-- lib/contrast/agent/assess/rule/csrf.rb
-- lib/contrast/agent/assess/rule/csrf/csrf_action.rb
-- lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb
-- lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb
 - lib/contrast/agent/assess/rule/provider.rb
 - lib/contrast/agent/assess/rule/provider/hardcoded_key.rb
 - lib/contrast/agent/assess/rule/provider/hardcoded_password.rb
 - lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb
 - lib/contrast/agent/assess/rule/redos.rb
-- lib/contrast/agent/assess/rule/response_scanning_rule.rb
-- lib/contrast/agent/assess/rule/response_watcher.rb
-- lib/contrast/agent/assess/rule/watcher.rb
 - lib/contrast/agent/assess/tag.rb
 - lib/contrast/agent/at_exit_hook.rb
 - lib/contrast/agent/class_reopener.rb
@@ -769,10 +763,9 @@ files:
 - lib/contrast/agent/deadzone/policy/policy.rb
 - lib/contrast/agent/disable_reaction.rb
 - lib/contrast/agent/exclusion_matcher.rb
-- lib/contrast/agent/feature_state.rb
+- lib/contrast/agent/inventory/policy/datastores.rb
 - lib/contrast/agent/inventory/policy/policy.rb
 - lib/contrast/agent/inventory/policy/trigger_node.rb
-- lib/contrast/agent/logger.rb
 - lib/contrast/agent/middleware.rb
 - lib/contrast/agent/module_data.rb
 - lib/contrast/agent/patching/policy/after_load_patch.rb
@@ -785,15 +778,19 @@ files:
 - lib/contrast/agent/patching/policy/policy.rb
 - lib/contrast/agent/patching/policy/policy_node.rb
 - lib/contrast/agent/patching/policy/trigger_node.rb
+- lib/contrast/agent/protect/policy/applies_command_injection_rule.rb
+- lib/contrast/agent/protect/policy/applies_deserialization_rule.rb
+- lib/contrast/agent/protect/policy/applies_no_sqli_rule.rb
+- lib/contrast/agent/protect/policy/applies_path_traversal_rule.rb
+- lib/contrast/agent/protect/policy/applies_sqli_rule.rb
+- lib/contrast/agent/protect/policy/applies_xxe_rule.rb
 - lib/contrast/agent/protect/policy/policy.rb
+- lib/contrast/agent/protect/policy/rule_applicator.rb
 - lib/contrast/agent/protect/policy/trigger_node.rb
 - lib/contrast/agent/protect/rule.rb
 - lib/contrast/agent/protect/rule/base.rb
 - lib/contrast/agent/protect/rule/base_service.rb
 - lib/contrast/agent/protect/rule/cmd_injection.rb
-- lib/contrast/agent/protect/rule/csrf.rb
-- lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb
-- lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb
 - lib/contrast/agent/protect/rule/default_scanner.rb
 - lib/contrast/agent/protect/rule/deserialization.rb
 - lib/contrast/agent/protect/rule/http_method_tampering.rb
@@ -820,7 +817,6 @@ files:
 - lib/contrast/agent/rule_set.rb
 - lib/contrast/agent/scope.rb
 - lib/contrast/agent/service_heartbeat.rb
-- lib/contrast/agent/settings_state.rb
 - lib/contrast/agent/socket_client.rb
 - lib/contrast/agent/static_analysis.rb
 - lib/contrast/agent/thread.rb
@@ -832,7 +828,6 @@ files:
 - lib/contrast/api/decorators.rb
 - lib/contrast/api/decorators/application_settings.rb
 - lib/contrast/api/decorators/application_update.rb
-- lib/contrast/api/decorators/exclusion.rb
 - lib/contrast/api/decorators/input_analysis.rb
 - lib/contrast/api/decorators/server_features.rb
 - lib/contrast/api/dtm_pb.rb
@@ -875,63 +870,57 @@ files:
 - lib/contrast/config/server_configuration.rb
 - lib/contrast/config/service_configuration.rb
 - lib/contrast/configuration.rb
-- lib/contrast/extensions/framework/rack/cookie.rb
-- lib/contrast/extensions/framework/rack/request.rb
-- lib/contrast/extensions/framework/rack/response.rb
-- lib/contrast/extensions/framework/rails/action_controller_inheritance.rb
-- lib/contrast/extensions/framework/rails/action_controller_railties_helper_inherited.rb
-- lib/contrast/extensions/framework/rails/active_record.rb
-- lib/contrast/extensions/framework/rails/active_record_named.rb
-- lib/contrast/extensions/framework/rails/active_record_time_zone_inherited.rb
-- lib/contrast/extensions/framework/rails/buffer.rb
-- lib/contrast/extensions/framework/rails/configuration.rb
-- lib/contrast/extensions/framework/sinatra/base.rb
-- lib/contrast/extensions/ruby_core/assess.rb
-- lib/contrast/extensions/ruby_core/assess/array.rb
-- lib/contrast/extensions/ruby_core/assess/assess_extension.rb
-- lib/contrast/extensions/ruby_core/assess/basic_object.rb
-- lib/contrast/extensions/ruby_core/assess/erb.rb
-- lib/contrast/extensions/ruby_core/assess/exec_trigger.rb
-- lib/contrast/extensions/ruby_core/assess/fiber.rb
-- lib/contrast/extensions/ruby_core/assess/hash.rb
-- lib/contrast/extensions/ruby_core/assess/kernel.rb
-- lib/contrast/extensions/ruby_core/assess/module.rb
-- lib/contrast/extensions/ruby_core/assess/regexp.rb
-- lib/contrast/extensions/ruby_core/assess/string.rb
-- lib/contrast/extensions/ruby_core/assess/tilt_template_trigger.rb
-- lib/contrast/extensions/ruby_core/assess/xpath_library_trigger.rb
-- lib/contrast/extensions/ruby_core/delegator.rb
-- lib/contrast/extensions/ruby_core/eval_trigger.rb
-- lib/contrast/extensions/ruby_core/inventory.rb
-- lib/contrast/extensions/ruby_core/inventory/datastores.rb
-- lib/contrast/extensions/ruby_core/module.rb
-- lib/contrast/extensions/ruby_core/protect.rb
-- lib/contrast/extensions/ruby_core/protect/applies_command_injection_rule.rb
-- lib/contrast/extensions/ruby_core/protect/applies_deserialization_rule.rb
-- lib/contrast/extensions/ruby_core/protect/applies_no_sqli_rule.rb
-- lib/contrast/extensions/ruby_core/protect/applies_path_traversal_rule.rb
-- lib/contrast/extensions/ruby_core/protect/applies_sqli_rule.rb
-- lib/contrast/extensions/ruby_core/protect/applies_xxe_rule.rb
-- lib/contrast/extensions/ruby_core/protect/kernel.rb
-- lib/contrast/extensions/ruby_core/protect/psych.rb
-- lib/contrast/extensions/ruby_core/protect/rule_applicator.rb
-- lib/contrast/extensions/ruby_core/thread.rb
+- lib/contrast/extension/assess.rb
+- lib/contrast/extension/assess/array.rb
+- lib/contrast/extension/assess/assess_extension.rb
+- lib/contrast/extension/assess/erb.rb
+- lib/contrast/extension/assess/eval_trigger.rb
+- lib/contrast/extension/assess/exec_trigger.rb
+- lib/contrast/extension/assess/fiber.rb
+- lib/contrast/extension/assess/hash.rb
+- lib/contrast/extension/assess/kernel.rb
+- lib/contrast/extension/assess/regexp.rb
+- lib/contrast/extension/assess/string.rb
+- lib/contrast/extension/delegator.rb
+- lib/contrast/extension/inventory.rb
+- lib/contrast/extension/kernel.rb
+- lib/contrast/extension/module.rb
+- lib/contrast/extension/protect.rb
+- lib/contrast/extension/protect/kernel.rb
+- lib/contrast/extension/protect/psych.rb
+- lib/contrast/extension/thread.rb
 - lib/contrast/framework/base_support.rb
 - lib/contrast/framework/manager.rb
 - lib/contrast/framework/platform_version.rb
-- lib/contrast/framework/rails_support.rb
-- lib/contrast/framework/sinatra_application_helper.rb
-- lib/contrast/framework/sinatra_support.rb
+- lib/contrast/framework/rack/patch/session_cookie.rb
+- lib/contrast/framework/rack/patch/support.rb
+- lib/contrast/framework/rack/support.rb
+- lib/contrast/framework/rails/patch/action_controller_live_buffer.rb
+- lib/contrast/framework/rails/patch/assess_configuration.rb
+- lib/contrast/framework/rails/patch/rails_application_configuration.rb
+- lib/contrast/framework/rails/patch/support.rb
+- lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb
+- lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb
+- lib/contrast/framework/rails/rewrite/active_record_named.rb
+- lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb
+- lib/contrast/framework/rails/support.rb
+- lib/contrast/framework/sinatra/application_helper.rb
+- lib/contrast/framework/sinatra/patch/base.rb
+- lib/contrast/framework/sinatra/patch/support.rb
+- lib/contrast/framework/sinatra/support.rb
 - lib/contrast/framework/view_technologies_descriptor.rb
 - lib/contrast/internal_exception.rb
+- lib/contrast/logger/application.rb
+- lib/contrast/logger/log.rb
+- lib/contrast/logger/time.rb
 - lib/contrast/security_exception.rb
+- lib/contrast/tasks/config.rb
 - lib/contrast/tasks/service.rb
 - lib/contrast/utils/assess/sampling_util.rb
 - lib/contrast/utils/assess/tracking_util.rb
 - lib/contrast/utils/boolean_util.rb
 - lib/contrast/utils/cache.rb
 - lib/contrast/utils/class_util.rb
-- lib/contrast/utils/data_store_util.rb
 - lib/contrast/utils/duck_utils.rb
 - lib/contrast/utils/env_configuration_item.rb
 - lib/contrast/utils/freeze_util.rb
@@ -946,9 +935,6 @@ files:
 - lib/contrast/utils/os.rb
 - lib/contrast/utils/preflight_util.rb
 - lib/contrast/utils/prevent_serialization.rb
-- lib/contrast/utils/rack_assess_session_cookie.rb
-- lib/contrast/utils/rails_assess_configuration.rb
-- lib/contrast/utils/random_util.rb
 - lib/contrast/utils/resource_loader.rb
 - lib/contrast/utils/ruby_ast_rewriter.rb
 - lib/contrast/utils/service_response_util.rb
@@ -961,7 +947,6 @@ files:
 - lib/contrast/utils/thread_tracker.rb
 - lib/contrast/utils/timer.rb
 - resources/assess/policy.json
-- resources/csrf/inject.js
 - resources/deadzone/policy.json
 - resources/inventory/policy.json
 - resources/protect/policy.json
@@ -973,7 +958,7 @@ files:
 - service_executables/mac/contrast-service
 - shared_libraries/.gitkeep
 - shared_libraries/funchook.h
-- shared_libraries/libfunchook.dylib
+- shared_libraries/libfunchook.so
 homepage: https://www.contrastsecurity.com
 licenses:
 - CONTRAST SECURITY (see license file)
@@ -982,7 +967,8 @@ metadata:
   support_uri: https://support.contrastsecurity.com
   trouble_shooting_uri: https://support.contrastsecurity.com/hc/en-us/search?utf8=%E2%9C%93&query=Ruby
   wiki_uri: https://docs.contrastsecurity.com/
-post_install_message: 
+post_install_message: 'To generate the required contrast_security.yaml file you can
+  run: bundle exec rake contrast:config:create'
 rdoc_options: []
 require_paths:
 - lib
@@ -1000,7 +986,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Contrast Security's agent for rack-based applications.

data/funchook/test/libfunchook_test.so.dSYM/Contents/Info.plist

@@ -1,20 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-	<dict>
-		<key>CFBundleDevelopmentRegion</key>
-		<string>English</string>
-		<key>CFBundleIdentifier</key>
-		<string>com.apple.xcode.dsym.libfunchook_test.so</string>
-		<key>CFBundleInfoDictionaryVersion</key>
-		<string>6.0</string>
-		<key>CFBundlePackageType</key>
-		<string>dSYM</string>
-		<key>CFBundleSignature</key>
-		<string>????</string>
-		<key>CFBundleShortVersionString</key>
-		<string>1.0</string>
-		<key>CFBundleVersion</key>
-		<string>1</string>
-	</dict>
-</plist>

data/lib/contrast/agent/assess/rule/csrf.rb

@@ -1,66 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # The Ruby implementation of the CSRF Assess Rule.
-        class Csrf < Contrast::Agent::Assess::Rule::ResponseScanningRule
-          NAME = 'csrf'
-          def name
-            NAME
-          end
-
-          DB_STATE_CHANGE = 'db'
-          ACTION_LIMIT = 3
-          QUERY_SIZE_LIMIT = 50
-          STATE_CHANGING_ACTIONS_KEY = 'csrf.statechange.actions'
-          def record_db_state_change context, query
-            return unless context
-
-            changes = context.get_property(STATE_CHANGING_ACTIONS_KEY)
-            changes ||= []
-            return unless changes.length < ACTION_LIMIT
-
-            return unless state_change?(query)
-
-            action = Contrast::Agent::Assess::Rule::Csrf::CsrfAction.new
-            action.type = DB_STATE_CHANGE
-            action.evidence = query[0..QUERY_SIZE_LIMIT]
-
-            changes << action
-
-            context.add_property(STATE_CHANGING_ACTIONS_KEY, changes)
-          end
-
-          STATE_CHANGE_QUERY_ACTIONS = %w[
-            insert
-            update
-            delete
-            drop
-            create
-            alter
-            upsert
-          ].cs__freeze
-          # Returns true if the given query starts with any
-          # of the STATE_CHANGE_QUERY_ACTIONS listed above
-          def state_change? query
-            return false unless query.is_a?(String) && !query.empty?
-
-            query.downcase.start_with?(*STATE_CHANGE_QUERY_ACTIONS)
-          end
-
-          # some watchers keep state and need to be reset in each request.
-          # this one is not one of those.
-          def watcher
-            @_watcher ||= Contrast::Agent::Assess::Rule::Csrf::Watcher.new
-          end
-
-          # Indicates if this request has been checked for a CSRF token
-          CHECKED = 'csrf.token.checked'
-        end
-      end
-    end
-  end
-end