contrast-agent 3.11.0 → 3.12.0

data/lib/contrast/agent/protect/rule/csrf.rb

@@ -1,119 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'rack'
-cs__scoped_require 'contrast/agent/protect/rule/base'
-cs__scoped_require 'contrast/agent/request'
-cs__scoped_require 'contrast/agent/response'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/utils/timer'
-
-module Contrast
-  module Agent
-    module Protect
-      module Rule
-        # The Ruby implementation of the Protect Cross-Site Request Forgery
-        # rule.
-        class Csrf < Contrast::Agent::Protect::Rule::Base
-          NAME = 'csrf'
-
-          def name
-            NAME
-          end
-
-          def stream_safe?
-            false
-          end
-
-          def request_evaluator
-            @_request_evaluator ||= Contrast::Agent::Protect::Rule::Csrf::CsrfEvaluator.new
-          end
-
-          def token_injector
-            @_token_injector ||= Contrast::Agent::Protect::Rule::Csrf::CsrfTokenInjector.new
-          end
-
-          BLOCK_MESSAGE = 'CSRF rule triggered. Request blocked.'
-
-          def prefilter context
-            return unless enabled? && mode != :NO_ACTION
-
-            request = context.request
-            return if request_evaluator.can_ignore_check?(request)
-
-            parameters = request.parameters
-            return unless parameters&.any?
-
-            tokens = parameters[token_injector.token_name]
-            expected_token = token_injector.get_expected_token(context)
-            return if valid_token?(expected_token, tokens)
-
-            # unexpected token is interpreted as an attack with a match
-            ia_result = Contrast::Api::Settings::InputAnalysisResult.new
-            ia_result.input_type = :BODY
-            ia_result.value = build_attack_string(context.request)
-
-            result = build_attack_with_match(
-                context,
-                ia_result,
-                nil,
-                expected_token,
-                details: build_details(expected_token, tokens))
-
-            append_to_activity(context, result)
-
-            raise Contrast::SecurityException.new(self, BLOCK_MESSAGE) if blocked?
-          end
-
-          def valid_token? expected, actual_tokens
-            actual_tokens&.include?(expected)
-          end
-
-          def postfilter context
-            return unless enabled? && POSTFILTER_MODES.include?(mode)
-
-            token_injector.do_injection(context)
-          end
-
-          def build_sample context, evaluation, _url, **kwargs
-            sample = build_base_sample(context, evaluation)
-            sample.csrf = kwargs[:details]
-            sample
-          end
-
-          # Build a subclass of the RaspRuleSample using the query string and the
-          # evaluation
-          def build_details expected, actual_tokens
-            details = Contrast::Api::Dtm::CsrfDetails.new
-            details.name = Contrast::Utils::StringUtils.protobuf_safe_string(token_injector.token_name)
-            details.expected = Contrast::Utils::StringUtils.protobuf_safe_string(expected)
-            presented = build_presented_token(actual_tokens)
-            details.presented = Contrast::Utils::StringUtils.protobuf_safe_string(presented)
-            details
-          end
-
-          def build_presented_token actual_tokens
-            return Contrast::Utils::ObjectShare::EMPTY_STRING unless actual_tokens&.any?
-
-            actual_tokens.first
-          end
-
-          # Convert the request parameters into an attack string
-          def build_attack_string request
-            arr = []
-            request.dtm.normalized_request_params.each_with_index do |(name, value), index|
-              arr << Contrast::Utils::ObjectShare::AND unless index.zero?
-              arr += [name.to_s, Contrast::Utils::ObjectShare::EQUALS, value.values.to_s]
-            end
-            if arr.empty?
-              request.query_string
-            else
-              arr.join
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/protect/rule/csrf/csrf_evaluator.rb

@@ -1,100 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'uri'
-
-# This class is used by the CSRF rule to determine if the given Request is
-# susceptible to CSRF / if the rule applies to it.
-class Contrast::Agent::Protect::Rule::Csrf::CsrfEvaluator # rubocop:disable Style/ClassAndModuleChildren
-  include Contrast::Components::Interface
-  access_component :logging
-
-  def can_ignore_check? request
-    if !form_submittable_method?(request)
-      logger.trace('Ignoring method', method: request.request_method, uri: request.uri)
-      true
-    elsif ajax_request?(request)
-      logger.trace('Ignoring Ajax request', uri: request.uri)
-      true
-    elsif empty_post?(request)
-      logger.trace('Ignoring empty POST', uri: request.uri)
-      true
-    elsif !form_content_type?(request)
-      logger.trace(
-          'Ignoring POST request because of Content-Type',
-          content_type: request.content_type,
-          uri: request.uri)
-      true
-    elsif request.static_request?
-      logger.trace('Ignoring static request', uri: request.uri)
-      true
-    elsif origin_is_referer?(request)
-      logger.trace('Ignoring equivalent origin-referer', uri: request.uri)
-      true
-    elsif login_page?(request)
-      logger.trace('Ignoring possible login page', uri: request.uri)
-      true
-    else
-      false
-    end
-  rescue StandardError => e
-    logger.debug('Unable to determine if CSRF can be ignored', e)
-  end
-
-  POST_METHOD = 'POST'
-  def form_submittable_method? request
-    POST_METHOD == request.request_method
-  end
-
-  REQUESTED_WITH = 'X-REQUESTED-WITH'
-  def ajax_request? request
-    requested_with = request.header_value(REQUESTED_WITH)
-    !requested_with.nil? && !requested_with.empty?
-  end
-
-  def empty_post? request
-    request.request_body_str.empty? && (request.query_string.nil? || request.query_string.empty?)
-  end
-
-  FORM_CONTENT_TYPES = %w[text/plain multipart/form-data application/x-www-form-urlencoded].cs__freeze
-
-  def form_content_type? request
-    content_type = request.content_type
-    return true if content_type.nil? || content_type.empty?
-
-    content_type.start_with?(*FORM_CONTENT_TYPES)
-  end
-
-  ORIGIN = 'ORIGIN'
-  REFERER = 'REFERER'
-  def origin_is_referer? request
-    origin = request.header_value(ORIGIN)
-    referer = request.header_value(REFERER)
-    return false unless origin && referer
-    return false if origin.empty? || referer.empty?
-
-    origin = trim_origin(origin)
-    referer = URI(referer).host
-    origin == referer
-  end
-
-  HTTP = 'http://'
-  HTTPS = 'https://'
-  def trim_origin origin_header
-    origin_header = if origin_header.to_s.start_with?(HTTP, HTTPS)
-                      URI(origin_header).host
-                    else
-                      idx = origin_header.index(Contrast::Utils::ObjectShare::COLON)
-                      idx.nil? ? origin_header : origin_header[0, idx]
-                    end
-    origin_header
-  end
-
-  LOGIN_MARKERS = %w[login auth j_security verify validate sessions].cs__freeze
-  def login_page? request
-    url = request.url.downcase
-    LOGIN_MARKERS.any? { |marker| url.index(marker) }
-  end
-end

data/lib/contrast/agent/protect/rule/csrf/csrf_token_injector.rb

@@ -1,85 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/random_util'
-
-# This class is used by the CSRF rule to inject the Contrast CSRF token into
-# the Response's body, allowing for the detection of CSRF attacks.
-class Contrast::Agent::Protect::Rule::Csrf::CsrfTokenInjector # rubocop:disable Style/ClassAndModuleChildren
-  TKN_NAME = 'cs_csrf_tkn'
-  def token_name
-    TKN_NAME
-  end
-
-  SESSION_TOKEN_PREFIX = '__CONTRAST__'
-  def token_key
-    @_token_key ||= SESSION_TOKEN_PREFIX + token_name
-  end
-
-  def javascript
-    @_javascript ||= build_javascript
-  end
-
-  SCRIPT_LOC = File.join('csrf', 'inject.js').cs__freeze
-  NAME_MARKER = '!TOKEN_NAME!'
-  VALUE_MARKER = '!TOKEN_VALUE!'
-  def build_javascript
-    script = Contrast::Utils::ResourceLoader.load(SCRIPT_LOC)
-    script&.sub!(NAME_MARKER, TKN_NAME)
-    script
-  end
-
-  CSRF_TOKEN_LENGTH = 8
-  def get_expected_token context
-    cookies = context.request.request_cookies
-    token = cookies[token_key]
-    return token if token
-    return unless context.response
-
-    build_token(context)
-  end
-
-  def build_token context
-    token = Contrast::Utils::RandomUtil.secure_random_string(CSRF_TOKEN_LENGTH)
-    context&.response&.set_header(token_key, token)
-    token
-  end
-
-  CONTENT_TYPE = 'CONTENT-TYPE'
-
-  def wedge_token? response
-    return true unless response
-
-    content_type = response.header(CONTENT_TYPE)
-    return true unless content_type
-
-    content_type = content_type.to_s
-    !content_type.start_with?(*DATA_CONTENT_TYPES)
-  end
-
-  END_BODY_TAG = %r{</body>}i.cs__freeze
-  def do_injection context
-    return unless wedge_token?(context&.response)
-
-    body_string = context&.response&.body
-    return unless body_string
-
-    index = body_string.index(END_BODY_TAG)
-    return unless index
-
-    injection = get_expected_token(context)
-    return unless injection
-
-    injection = javascript.sub(VALUE_MARKER, injection)
-    body_string.insert(index, injection)
-    context&.response&.update_body(body_string)
-  end
-
-  DATA_CONTENT_TYPES = [
-    'image/', 'audio/', 'video/',
-    'application/json', 'application/xml',
-    'application/octet', 'application/force',
-    'text/json', 'text/xml'
-  ].cs__freeze
-end

data/lib/contrast/agent/settings_state.rb

@@ -1,88 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'securerandom'
-cs__scoped_require 'set'
-cs__scoped_require 'singleton'
-
-cs__scoped_require 'contrast/components/interface'
-
-cs__scoped_require 'contrast/agent/reaction_processor'
-
-module Contrast
-  module Agent
-    # This class functions as a way to query the Agent for its current
-    # configuration without having to expose other sections of code to the
-    # decision tree needed to make that determination.
-    # It should not be accessed directly, but should instead be inherited from
-    #
-    # @abstract Use the methods in FeatureState to access this data
-    class SettingsState
-      include Contrast::Components::Interface
-
-      access_component :agent, :analysis, :settings, :config, :contrast_service
-
-      # These are components.
-      attr_accessor :last_update
-
-      # These represent process-level attributes,
-      # not directly related to Contrast function itself.
-      attr_reader :pid,
-                  :ppid
-
-      def initialize
-        @instrumentation_mutex = Mutex.new
-        @instrumented_packages = {}
-
-        # Last we heard from the Contrast Service
-        @last_update = nil
-
-        # keep track of which process instantiated this instance
-        @pid  = Process.pid.to_i
-        @ppid = Process.ppid.to_i
-
-        check_config
-      end
-
-      def check_config
-        SETTINGS.reset_state
-
-        if CONFIG.invalid?
-          AGENT.disable!
-          logger.error('!!! CONFIG FILE IS INVALID - DISABLING CONTRAST AGENT !!!')
-        elsif CONFIG.disabled?
-          AGENT.disable!
-          logger.warn('Contrast disabled by configuration. Continuing without instrumentation.')
-        else
-          AGENT.enable!
-        end
-      end
-
-      def assess_rule name
-        ASSESS.rule name
-      end
-
-      def instrument package
-        return if @instrumented_packages[package] # double check is intentional
-
-        @instrumentation_mutex.synchronize do
-          return if @instrumented_packages[package]
-
-          @instrumented_packages[package] = true
-        end
-
-        logger.trace_with_time("instrumenting #{ package } ") do
-          cs__scoped_require(package)
-        end
-      rescue LoadError, StandardError => e
-        @instrumented_packages[package] = false
-        logger.error("failed instrumenting #{ package } ", e)
-      end
-
-      # Test only
-      def protect_rule name
-        PROTECT.rule name
-      end
-    end
-  end
-end

data/lib/contrast/api/decorators/exclusion.rb

@@ -1,20 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/api/settings_pb'
-
-module Contrast
-  module Api
-    module Decorators
-      # Used to decorate the Contrast::Api::Settings::Exclusion protobuf model
-      # to allow for renaming of fields.
-      module Exclusion
-        def denylist
-          blacklist
-        end
-      end
-    end
-  end
-end
-
-Contrast::Api::Settings::Exclusion.include(Contrast::Api::Decorators::Exclusion)

data/lib/contrast/extensions/framework/rack/cookie.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Rack
-  module Session
-    # Our patch into the Rack::Session::Cookie Class, allowing for the
-    # runtime detection of insecure configurations on individual cookies
-    # within the application
-    class Cookie
-      include Contrast::Utils::InvalidConfigurationUtil
-      include Contrast::Components::Interface
-
-      access_component :scope
-
-      alias_method :cs__patched_initialize, :initialize
-      def initialize app, options = {}
-        Contrast::Utils::RackAssessSessionCookie.analyze_cookie_initialization(options)
-        cs__patched_initialize(app, options)
-      end
-    end
-  end
-end

data/lib/contrast/extensions/framework/rack/request.rb

@@ -1,24 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# In earlier versions of rack < 2.0.0 the Rack::Response and Rack::Request do
-# not have get_header or set_header methods. This is our way of working
-# around that.
-module Rack
-  # Our patch into the Rack::Request class, allowing us to call set_header
-  # and get_header in our code without worrying about older versions of
-  # Rack not implementing these methods.
-  class Request
-    unless Rack::Request.instance_methods(true).include?(:set_header)
-      def set_header name, value
-        @env[name] = value
-      end
-    end
-
-    unless Rack::Request.instance_methods(true).include?(:get_header)
-      def get_header name
-        @env[name]
-      end
-    end
-  end
-end