contrast-agent 3.11.0 → 3.12.0

data/lib/contrast/utils/data_store_util.rb

@@ -1,23 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Utils
-    # Utility class used to determine information about the current data store
-    # on which a query was executed or to which the application is connected.
-    module DataStoreUtil
-      def self.report_data_store data_store
-        return unless data_store
-
-        context = Contrast::Agent::REQUEST_TRACKER.current
-        return unless context&.activity
-
-        context.activity.technologies[data_store] = true
-        context.activity.query_count += 1
-        return unless context.activity.query_count == 1
-
-        Contrast::Utils::InventoryUtil.append_db_config(context.activity)
-      end
-    end
-  end
-end

data/lib/contrast/utils/rack_assess_session_cookie.rb

@@ -1,104 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This module is used to analyze non-rails session storage configuration for assess vulnerabilities
-    module RackAssessSessionCookie
-      include Contrast::Components::Interface
-
-      access_component :analysis, :logging, :scope
-
-      CS__SECURE_RULE_NAME = 'secure-flag-missing'
-      CS__HTTPONLY_NAME = 'rails-http-only-disabled'
-      CS__SESSION_TIMEOUT_NAME = 'session-timeout'
-      SAFE_SESSION_TIMEOUT = (30 * 60 * 60)
-      class << self
-        include Contrast::Utils::InvalidConfigurationUtil
-
-        def analyze_cookie_initialization options
-          return if PROTECT.enabled?
-
-          apply_session_timeout(options)
-          apply_httponly(options)
-          apply_secure_session(options)
-        end
-
-        def vulnerable_setting?(setting_key,
-                                safe_settings_value,
-                                options, safe_default: true,
-                                comparison_type: nil)
-          # In most cases, Rack is pretty nice and the default value is safe
-          return !safe_default unless options&.key?(setting_key)
-
-          value = options[setting_key]
-
-          return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
-
-          value != safe_settings_value
-        end
-
-        def apply_secure_session options
-          return unless vulnerable_setting?(
-              :secure,
-              true,
-              options,
-              safe_default: false)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__SECURE_RULE_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.error('Unable to track call to secure session', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_session_timeout options
-          return unless vulnerable_setting?(:expire_after,
-                                            SAFE_SESSION_TIMEOUT,
-                                            options,
-                                            safe_default: false,
-                                            comparison_type: :greater_than)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__SESSION_TIMEOUT_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.error('Unable to track call to set session timeout', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_httponly options
-          return unless vulnerable_setting?(:httponly, true, options)
-
-          with_contrast_scope do
-            cs__report_finding(
-                CS__HTTPONLY_NAME,
-                options,
-                caller_locations(10, 9)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.error('Unable to track call to httponly', e)
-          rescue StandardError
-            nil
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/rails_assess_configuration.rb

@@ -1,95 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Utils
-    # This module is used to analyze rails session storage configuration for assess vulnerabilities
-    module RailsAssessConfiguration
-      include Contrast::Components::Interface
-
-      access_component :analysis, :logging, :scope
-
-      CS__SESSION_TIMEOUT_NAME = 'session-timeout'
-      SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
-      CS__SECURE_RULE_NAME = 'secure-flag-missing'
-      CS__HTTPONLY_RULE_NAME = 'rails-http-only-disabled'
-
-      class << self
-        include Contrast::Utils::InvalidConfigurationUtil
-
-        def analyze_session_store *args
-          return if PROTECT.enabled?
-
-          apply_httponly_disabled(*args)
-          apply_secure_cookie_disabled(*args)
-          apply_session_timeout(*args)
-        end
-
-        def vulnerable_setting? setting_key, safe_settings_value, original_args, safe_default: true, comparison_type: nil
-          # In most cases, Rails is pretty nice and the default value is safe
-          return !safe_default unless original_args && original_args.length > 1
-
-          # If the user overrode some args, but not ours, fall back on the default
-          rails_session_settings = original_args[1]
-          return !safe_default unless rails_session_settings&.key?(setting_key)
-
-          value = rails_session_settings[setting_key]
-
-          return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
-
-          value != safe_settings_value
-        end
-
-        def apply_session_timeout *args
-          return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
-          return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.error('Unable to track call to set session timeout', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_secure_cookie_disabled *args
-          return if ASSESS.rule_disabled? CS__SECURE_RULE_NAME
-          return unless vulnerable_setting?(:secure, true, args)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.error('Unable to track call to disable secure cookies', e)
-          rescue StandardError
-            nil
-          end
-        end
-
-        def apply_httponly_disabled *args
-          return if ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
-          return unless vulnerable_setting?(:httponly, true, args)
-
-          rails_session_settings = args[1]
-          with_contrast_scope do
-            cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
-          end
-        rescue StandardError => e
-          begin
-            logger.error('Unable to track call to disable httponly in session cookie', e)
-          rescue StandardError
-            nil
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/utils/random_util.rb

@@ -1,22 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'securerandom'
-
-module Contrast
-  module Utils
-    # Utilites for generating random strings
-    class RandomUtil
-      RANDOM_CHARS = (('0'..'9').to_a + ('A'..'Z').to_a).cs__freeze
-      RANDOM_LENGTH = RANDOM_CHARS.length
-
-      def self.secure_random_string len
-        arr = []
-        len.to_i.times do
-          arr << RANDOM_CHARS[SecureRandom.random_number(RANDOM_LENGTH)]
-        end
-        arr.join
-      end
-    end
-  end
-end

data/resources/csrf/inject.js

@@ -1,44 +0,0 @@
-<script>
-  function _contrast_isSameOrigin(action) {
-    var thisDomain = document.domain;
-    var parser = document.createElement('a');
-    parser.href = action;
-    return parser.hostname == thisDomain;
-  }
-
-  function _contrast_addTokenToForms() {
-    for(var i=0;i<document.forms.length;i++) {
-      var form = document.forms[i];
-      var action = form.action;
-      if(!!action || _contrast_isSameOrigin(action)) {
-        if(!form._contrast_tokenized) {
-          var input = document.createElement("input");
-          input.setAttribute("type", "hidden");
-          input.setAttribute("name", "!TOKEN_NAME!");
-          input.setAttribute("value", "!TOKEN_VALUE!");
-          form.appendChild(input);
-          form._contrast_tokenized = true;
-        }
-      }
-    }
-  }
-
-  (function() {_contrast_addTokenToForms();})();
-
-  var _contrast_watchNewForms = (function() {
-    var MutationObserver = window.MutationObserver || window.WebKitMutationObserver, eventListenerSupported = window.addEventListener;
-    return function(obj, callback) {
-      if(MutationObserver) {
-        var obs = new MutationObserver(function(mutations, observer) {
-          if( mutations[0].addedNodes.length )
-            callback();
-        });
-        obs.observe(obj, { childList:true, subtree:true });
-      } else if(eventListenerSupported) {
-        obj.addEventListener('DOMNodeInserted', callback, false);
-      }
-    }
-  })();
-
-  _contrast_watchNewForms(document.body, function() { _contrast_addTokenToForms(); });
-</script>