contrast-agent 3.11.0 → 3.12.0

data/lib/contrast/components/contrast_service.rb

@@ -15,18 +15,24 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :config, :agent
+        DEFAULT_SERVICE_LOG = 'contrast_service.log'
+        # The Rails ActionDispatch regexp for localhost IP + literal localhost
+        # https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/http/request.rb#L32
+        LOCALHOST = Regexp.union [/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/, /^::1$/, /^0:0:0:0:0:0:0:1(%.*)?$/, /^localhost$/]
 
-        def update_received?
-          state.update_received?
-        end
-
-        def enabled?
-          state.service_enabled?
-        end
+        access_component :agent, :config
 
-        def disabled?
-          state.service_forcibly_disabled?
+        def use_bundled_service?
+          # Validates the config to decide if it's suitable for starting
+          # the bundled service
+          @_use_bundled_service ||= begin
+                                      # Requirement says "must be true" but that
+                                      # should be "must not be false" -- oops.
+                                      !false?(CONFIG.root.agent.start_bundled_service) &&
+                                          # Either a valid host or a valid socket
+                                          # Path validity is the service's problem
+                                          (LOCALHOST.match?(host) || !!socket_path)
+                                    end
         end
 
         def host
@@ -34,76 +40,26 @@ module Contrast
         end
 
         def port
-          @_port ||= (CONFIG.root.agent.service.port || Contrast::Configuration::DEFAULT_PORT).to_i
+          @_port ||= (CONFIG.root.agent.service.port || DEFAULT_PORT).to_i
         end
 
         def socket_path
           @_socket_path ||= CONFIG.root.agent.service.socket
         end
 
-        def logger_path
-          @_logger_path ||= CONFIG.root.agent.service.logger.path || DEFAULT_LOG_FILENAME
-        end
-
         def use_tcp?
           socket_path.nil?
         end
 
-        def last_update
-          state.last_update
-        end
-
-        def use_bundled_service?
-          # Validates the config to decide if it's suitable for starting
-          # the bundled service
-          @_use_bundled_service ||= begin
-                                      # Requirement says "must be true" but that
-                                      # should be "must not be false" -- oops.
-                                      !false?(CONFIG.root.agent.start_bundled_service) &&
-                                          # Either a valid host or a valid socket
-                                          ((CONFIG.root.agent.service.host.nil? ||
-                                          CONFIG.root.agent.service.host == 'localhost' ||
-                                          CONFIG.root.agent.service.host == '127.0.0.1') ||
-                                          # Path validity is the service's problem
-                                          !!CONFIG.root.agent.service.socket)
-                                    end
-        end
-
-        # TODO: As part of RUBY-356. Add new handling for SQL analysis via RPC (SPEED-211)
-
-        # The API for Agent to Service communication. These methods abstract away implementation
-        # details, responsibilities of sending messages to the service, and requirements mandated
-        # within the Agent<>SpeedRacer contract.
-
-        # Pushes a message onto a queue to later be consumed when the service sender thread is ready to
-        # handle it. The service response is not returned; rather, it is processed by the service sender
-        # thread. All messages sent to SpeedRacer should be queued rather than sent unless the calling method
-        # explicitly needs to act on the response object with custom logic (i.e. RequestContext#service_extract_response)
-        #
-        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event
-        #  field of Contrast::Api::Dtm::Message
-        # TODO: rename method to queue_event
-        def queue_message event
-          return unless event
-
-          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(event)
+        def logger_path
+          @_logger_path ||= CONFIG.root.agent.service.logger.path || DEFAULT_SERVICE_LOG
         end
 
-        # TODO: RUBY-662. Add additional check before we queue/send a message to see if we were unable
-        # to connect to the service.
+        private
 
-        # Bypass the queue and send the message directly to SpeedRacer. This is the only way
-        # to receive the response object back from SpeedRacer. An invoking method that needs
-        # to process the response object with custom logic should use this method.
-        #
-        # @param event [Contrast::Api::Dtm] One of the DTMs valid for the event
-        #   field of Contrast::Api::Dtm::Message
-        # @return [Array<Contrast::Api::Dtm::AttackResult>] the response from SpeedRacer
-        # TODO: rename method to send_event
-        def send_message event
-          return unless event
-
-          state.client.send_to_speedracer(event)
+        def disabled?
+          @_disabled = false?(CONFIG.root.agent.start_bundled_service) if @_disabled.nil?
+          @_disabled
         end
       end
 

data/lib/contrast/components/interface.rb

@@ -2,7 +2,7 @@
 # frozen_string_literal: true
 
 cs__scoped_require 'delegate'
-cs__scoped_require 'contrast/extensions/ruby_core/module'
+cs__scoped_require 'contrast/extension/module'
 cs__scoped_require 'contrast/utils/boolean_util'
 
 module Contrast
@@ -56,14 +56,6 @@ module Contrast
         def true? config_param
           Contrast::Utils::BooleanUtil.true?(config_param)
         end
-
-        # TODO: RUBY-536
-        private
-
-        def _state_shim
-          Contrast::Agent::FeatureState.instance
-        end
-        alias_method :state, :_state_shim
       end
     end
 
@@ -164,12 +156,12 @@ Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:logging] =
 cs__scoped_require 'contrast/components/agent'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:agent] = [Contrast::Components::Agent]
 
-cs__scoped_require 'contrast/components/app_context'
-Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:app_context] = [Contrast::Components::AppContext]
-
 cs__scoped_require 'contrast/components/contrast_service'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:contrast_service] = [Contrast::Components::ContrastService]
 
+cs__scoped_require 'contrast/components/app_context'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:app_context] = [Contrast::Components::AppContext]
+
 cs__scoped_require 'contrast/components/heap_dump'
 Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:heap_dump] = [Contrast::Components::HeapDump]
 

data/lib/contrast/components/inventory.rb

@@ -11,9 +11,13 @@ module Contrast
       # product.
       class Interface
         include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+
+        access_component :config
 
         def enabled?
-          state.inventory_enabled?
+          @_enabled = !false?(CONFIG.root.inventory.enable) if @_enabled.nil?
+          @_enabled
         end
       end
 

data/lib/contrast/components/logger.rb

@@ -1,14 +1,14 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/logger'
+cs__scoped_require 'contrast/logger/log'
 
 module Contrast
   module Components
     module Logger
       module InstanceMethods #:nodoc:
         def logger
-          Contrast::Agent::Logger.instance.logger
+          Contrast::Logger::Log.instance.logger
         end
       end
       ClassMethods = InstanceMethods

data/lib/contrast/components/protect.rb

@@ -13,23 +13,59 @@ module Contrast
         include Contrast::Components::ComponentBase
         include Contrast::Components::Interface
 
-        access_component :settings
+        access_component :config, :settings
 
         def enabled?
-          state.protect_enabled?
+          # config overrides if forcibly set
+          return false if forcibly_disabled?
+          return true  if forcibly_enabled?
+
+          SETTINGS.protect_enabled?
         end
 
-        def forcibly_disabled?
-          state.protect_forcibly_disabled?
+        def rule_config
+          CONFIG.root.protect.rules
         end
 
         def rules
           SETTINGS.protect_rules
         end
 
+        def rule_mode rule_id
+          CONFIG.root.protect.rules[rule_id]&.mode || SETTINGS.modes_by_id[rule_id] || :NO_ACTION
+        end
+
         def rule name
           SETTINGS.protect_rules[name]
         end
+
+        def report_any_command_execution?
+          if @_report_any_command_execution.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::CmdInjection::NAME]
+            @_report_any_command_execution = true?(ctrl.disable_system_commands)
+          end
+          @_report_any_command_execution
+        end
+
+        def report_custom_code_sysfile_access?
+          if @_report_custom_code_sysfile_access.nil?
+            ctrl = rule_config[Contrast::Agent::Protect::Rule::PathTraversal::NAME]
+            @_report_custom_code_sysfile_access = true?(ctrl.detect_custom_code_accessing_system_files)
+          end
+          @_report_custom_code_sysfile_access
+        end
+
+        def forcibly_disabled?
+          @_forcibly_disabled = false?(CONFIG.root.protect.enable) if @_forcibly_disabled.nil?
+          @_forcibly_disabled
+        end
+
+        private
+
+        def forcibly_enabled?
+          @_forcibly_enabled = true?(CONFIG.root.protect.enable) if @_forcibly_enabled.nil?
+          @_forcibly_enabled
+        end
       end
 
       COMPONENT_INTERFACE = Interface.new

data/lib/contrast/components/scope.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
 cs__scoped_require 'fiber'
+cs__scoped_require 'monitor'
 cs__scoped_require 'contrast/agent/scope'
 
 # This is the Scope component.
@@ -54,7 +54,7 @@ module Contrast
           end
         end
 
-        # TODO: https://contrast.atlassian.net/browse/RUBY-290
+        # TODO: RUBY-572
         #
         # Current behavior is to no-op if we're not "in a request context".
         # Our C functions were previously checking to see if we had a scope, because
@@ -84,53 +84,3 @@ module Contrast
     end
   end
 end
-
-# This is a reasonable place for the Kernel#catch hook to live.
-# No current plans for component re-design, but if we had some kind of
-# "do this when a component is hooked in" thing, this would live there.
-# For now, it's over-engineering to live anywhere else.  -ajm
-module Kernel # :nodoc:
-  alias_method :cs__catch, :catch
-
-  # In the event of a `throw`, we need to override `catch`
-  # to save & restore scope state:
-  #
-  #   scope_level == 0
-  #
-  #   catch(:abc) do
-  #     with_contrast_scope do
-  #       throw :abc # will leak
-  #     end
-  #   end
-  #
-  #   scope_level == 1
-  #
-  # Frankly, this isn't how scope should be used.  This is in place of
-  # proper `ensure` blocks within the instrumentation call stack.
-  # This will actually /create/ scope leaks if you're doing something like:
-  #
-  #   catch(:ohno) do
-  #     enter scope
-  #   end
-  #
-  #   abc()
-  #
-  #   exit scope
-  #
-  # i.e. if you intend to change net scope across a catch block boundary.
-
-  private
-
-  def catch *args, &block
-    # Save current scope level
-    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
-
-    # Run original catch with block.
-    retval = cs__catch(*args, &block)
-
-    # Restore scope.
-    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
-
-    retval
-  end
-end

data/lib/contrast/components/settings.rb

@@ -23,11 +23,6 @@ module Contrast
         # this statefulness
         attr_reader :tainted_columns # This can probably go into assess_state?
 
-        # a vulnerability like padding oracle is exploited across
-        # multiple requests, as a timing attack.  these attempts must be
-        # accumulated, in order to recognize the pattern and block the attack.
-        attr_reader :accumulator_settings
-
         # These three 'state' variables represent atomic config/setting state,
         # outside of things like rule defs.
 
@@ -40,8 +35,7 @@ module Contrast
 
         def protect_state
           @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              accumulator_settings: Contrast::Api::Settings::AccumulatorSettings.new
+              enabled: false
           }
         end
 
@@ -58,7 +52,7 @@ module Contrast
         # So, between this block and rules, that's setting state.
         PROTECT_STATE_ATTRS       = %i[].cs__freeze
         ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
-        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules session_id].cs__freeze
+        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules].cs__freeze
 
         # Meta-define an accessor for each state attribute.
         begin
@@ -81,18 +75,40 @@ module Contrast
           end
         end
 
+        def session_id
+          # TODO: RUBY-900 we shouldn't send things w/o having session id,
+          #   figure out how this happened and fix it.
+          application_state[:session_id] || Contrast::Utils::ObjectShare::EMPTY_STRING
+        end
+
         def initialize
           reset_state
         end
 
+        def protect_enabled?
+          @_protect_enabled = !!protect_state[:enabled] if @_protect_enabled.nil?
+          @_protect_enabled
+        end
+
+        def assess_enabled?
+          @_assess_enabled = !!assess_state[:enabled] if @_assess_enabled.nil?
+          @_assess_enabled
+        end
+
+        def code_exclusions
+          exclusion_matchers.select(&:code?)
+        end
+
         def update_from_server_features server_features
           # protect
           begin
+            @_protect_enabled = nil
             protect_state[:enabled] = server_features.protect_enabled?
           end
 
           # assess
           begin
+            @_assess_enabled = nil
             assess_state[:enabled] = server_features.assess_enabled?
             assess_state[:sampling_settings] = server_features.assess.sampling
             Contrast::Utils::Assess::SamplingUtil.instance.update
@@ -118,7 +134,6 @@ module Contrast
         def build_assess_rules
           @assess_rules = {}
 
-          Contrast::Agent::Assess::Rule::Csrf.new
           Contrast::Agent::Assess::Rule::Redos.new
         end
 
@@ -135,15 +150,6 @@ module Contrast
           Contrast::Agent::Protect::Rule::UnsafeFileUpload.new
           Contrast::Agent::Protect::Rule::Xss.new
           Contrast::Agent::Protect::Rule::Xxe.new
-
-          # Beta Rules
-          Contrast::Agent::Protect::Rule::Csrf.new
-        end
-
-        # these are less 'settings' and more 'how do I behave.'
-        # relocate to Agent or Assess/Protect.
-        def protect_rule_mode rule_id
-          CONFIG.root.protect.rules[rule_id]&.mode || modes_by_id[rule_id] || :NO_ACTION
         end
       end
 

data/lib/contrast/config/protect_rules_configuration.rb

@@ -14,7 +14,6 @@ module Contrast
           'nosql-injection' => Contrast::Config::ProtectRuleConfiguration,
           'untrusted-deserialization' => Contrast::Config::ProtectRuleConfiguration,
           'method-tampering' => Contrast::Config::ProtectRuleConfiguration,
-          csrf: Contrast::Config::ProtectRuleConfiguration,
           xxe: Contrast::Config::ProtectRuleConfiguration,
           'path-traversal' => Contrast::Config::ProtectRuleConfiguration,
           'reflected-xss' => Contrast::Config::ProtectRuleConfiguration,

data/lib/contrast/{extensions/ruby_core → extension}/assess.rb

@@ -2,14 +2,15 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Assess namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Assess namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #
     # @deprecated This is one of our earliest designs and is not nearly as
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
+    #   Removing it requires a C refactor to handle the namespace.
     module Assess
       cs__scoped_require 'contrast/agent/patching/policy/patcher'
 
@@ -31,21 +32,18 @@ module Contrast
       cs__scoped_require 'contrast/agent/assess/policy/patcher'
 
       # classes that don't play nice w/ our standard propagation
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+      cs__scoped_require 'contrast/extension/assess/assess_extension'
       # this needs to come first b/c array and others work on strings and
       # expect them to be trackable
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/string'
+      cs__scoped_require 'contrast/extension/assess/string'
 
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/array'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/erb'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/fiber'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/hash'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/kernel'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/regexp'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/module'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/basic_object'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/tilt_template_trigger'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/xpath_library_trigger'
+      cs__scoped_require 'contrast/extension/assess/array'
+      cs__scoped_require 'contrast/extension/assess/erb'
+      cs__scoped_require 'contrast/extension/assess/eval_trigger'
+      cs__scoped_require 'contrast/extension/assess/fiber'
+      cs__scoped_require 'contrast/extension/assess/hash'
+      cs__scoped_require 'contrast/extension/assess/kernel'
+      cs__scoped_require 'contrast/extension/assess/regexp'
     end
   end
 end