contrast-agent 3.11.0 → 3.12.0

data/lib/contrast/{extensions/ruby_core → extension}/protect.rb

@@ -2,8 +2,8 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Protect namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Protect namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #

data/lib/contrast/extension/protect/kernel.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Protect
+      # This Module functions as our patch into the Kernel class for Protect,
+      # allowing us to track activity as it crosses spawned processes.
+      module Kernel
+        class << self
+          include Contrast::Components::Interface
+          access_component :contrast_service
+
+          def build_wrapper
+            lambda {
+              proc_start
+              yield
+              # AtExitHook handles sending any messages generated in the new forked process
+            }
+          end
+
+          def proc_start
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless context
+
+            context.reset_activity
+          end
+
+          def instrument
+            @_instrument ||= begin
+                                               cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading kernel protect patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/protect/psych.rb

@@ -2,6 +2,6 @@
 # frozen_string_literal: true
 
 if defined?(Psych)
-  cs__scoped_require 'contrast/extensions/ruby_core/protect/applies_deserialization_rule'
+  cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
   cs__scoped_require 'cs__patched_psych/cs__patched_psych'
 end

data/lib/contrast/framework/base_support.rb

@@ -46,6 +46,28 @@ module Contrast
           raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
         end
 
+        # Some Frameworks require specific patching for their classes to handle
+        # functionality like configuration scanning. To accommodate this, this
+        # method provides a place to register those patches for invocation on
+        # Agent load.
+        #
+        # By default, and hopefully in all cases, we won't need these patches,
+        # so we're allowing nil here rather than raising an exception.
+        def before_load_patches; end
+
+        # Some Frameworks require specific patching for their classes to handle
+        # functionality like routing. To accommodate this, this method provides
+        # a place to register those patches for invocation in our
+        # AfterLoadPatcher flow.
+        #
+        # By default, and hopefully in all cases, we won't need these patches,
+        # so we're allowing nil here rather than raising an exception.
+        #
+        # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>,nil]
+        #   those patches required for a Framework which can only be installed
+        #   once a specific module has been loaded.
+        def after_load_patches; end
+
         # We only support websockets in rails right now, so we won't detect streaming in
         # any other framework
         def streaming? _env

data/lib/contrast/framework/manager.rb

@@ -3,9 +3,9 @@
 
 cs__scoped_require 'contrast/framework/view_technologies_descriptor'
 cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rails_support'
-cs__scoped_require 'contrast/framework/sinatra_support'
+cs__scoped_require 'contrast/framework/rack/support'
+cs__scoped_require 'contrast/framework/rails/support'
+cs__scoped_require 'contrast/framework/sinatra/support'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/utils/class_util'
 
@@ -20,8 +20,9 @@ module Contrast
       # Rack will be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra
       # do not exist
       SUPPORTED_FRAMEWORKS = [
-        Contrast::Framework::RailsSupport,
-        Contrast::Framework::SinatraSupport
+        Contrast::Framework::Rails::Support,
+        Contrast::Framework::Sinatra::Support,
+        Contrast::Framework::Rack::Support
       ].cs__freeze
 
       def initialize
@@ -34,6 +35,30 @@ module Contrast
         @_frameworks.compact!
       end
 
+      # Patches that have to be applied as early as possible to catch calls
+      # that happen prior to the first Request, typically those around
+      # configuration.
+      def before_load_patches!
+        @_before_load_patches ||= begin
+                                    SUPPORTED_FRAMEWORKS.each(&:before_load_patches)
+                                    true
+                                  end
+      end
+
+      # Return all the After Load Patches for all the Frameworks we know, even
+      # if that Framework hasn't been detected.
+      #
+      # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>] the
+      #   AfterLoadPatches of each framework
+      def find_after_load_patches
+        patches = Set.new
+        SUPPORTED_FRAMEWORKS.each do |framework|
+          framework_patches = framework.after_load_patches
+          patches.merge(framework_patches) if framework_patches && !framework_patches.empty?
+        end
+        patches
+      end
+
       def find_applicable_view_technologies
         scan_views_for_all_frameworks
       end
@@ -58,7 +83,7 @@ module Contrast
 
       def app_root
         found = first_framework_result :application_root, nil
-        found || Rack::Directory.new('').root
+        found || ::Rack::Directory.new('').root
       end
 
       # If we have 0 or n > 1 frameworks, we need to use the default rack request
@@ -67,7 +92,7 @@ module Contrast
       def retrieve_request env
         return @_frameworks[0].retrieve_request(env) if @_frameworks.length == 1
 
-        Rack::Request.new(env)
+        ::Rack::Request.new(env)
       end
 
       # @param env [Hash] the various variables stored by this and other Middlewares to know the state
@@ -86,7 +111,7 @@ module Contrast
         result = nil
         @_frameworks.find do |framework_klass|
           # TODO: RUBY-763 Sinatra::Base#call patch adds the Route report
-          next if framework_klass == Contrast::Framework::SinatraSupport
+          next if framework_klass == Contrast::Framework::Sinatra::Support
 
           result = framework_klass.current_route(request)
         end

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -0,0 +1,126 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Framework
+    module Rack
+      module Patch
+        # Our patch into the Rack::Session::Cookie Class, allowing for the
+        # runtime detection of insecure configurations on individual cookies
+        # within the application
+        class SessionCookie
+          include Contrast::Components::Interface
+
+          access_component :agent, :analysis, :logging, :scope
+
+          CS__SECURE_RULE_NAME = 'secure-flag-missing'
+          CS__HTTPONLY_NAME = 'rails-http-only-disabled'
+          CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+          SAFE_SESSION_TIMEOUT = (30 * 60 * 60)
+          class << self
+            include Contrast::Utils::InvalidConfigurationUtil
+
+            def instrument
+              @_instrument ||= begin
+                                 ::Rack::Session::Cookie.class_eval do
+                                   alias_method :cs__patched_initialize, :initialize
+                                   def initialize app, options = {}
+                                     Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
+                                     cs__patched_initialize(app, options)
+                                   end
+                                 end
+                                 true
+                               end
+            end
+
+            def analyze options
+              return unless AGENT.enabled?
+              return if PROTECT.enabled?
+
+              apply_session_timeout(options)
+              apply_httponly(options)
+              apply_secure_session(options)
+            end
+
+            private
+
+            def vulnerable_setting?(setting_key,
+                                    safe_settings_value,
+                                    options, safe_default: true,
+                                    comparison_type: nil)
+              # In most cases, Rack is pretty nice and the default value is safe
+              return !safe_default unless options&.key?(setting_key)
+
+              value = options[setting_key]
+
+              return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+              value != safe_settings_value
+            end
+
+            def apply_secure_session options
+              return unless vulnerable_setting?(
+                  :secure,
+                  true,
+                  options,
+                  safe_default: false)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__SECURE_RULE_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to secure session', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_session_timeout options
+              return unless vulnerable_setting?(:expire_after,
+                                                SAFE_SESSION_TIMEOUT,
+                                                options,
+                                                safe_default: false,
+                                                comparison_type: :greater_than)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__SESSION_TIMEOUT_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to set session timeout', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_httponly options
+              return unless vulnerable_setting?(:httponly, true, options)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__HTTPONLY_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to httponly', e)
+              rescue StandardError
+                nil
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rack/patch/support.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+
+module Contrast
+  module Framework
+    module Rack
+      module Patch
+        # Extension point allowing for the registration of Patches required to
+        # support the Rack framework.
+        module Support
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            Set.new([Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                'Rack::Session::Cookie',
+                'contrast/framework/rack/patch/session_cookie',
+                instrumenting_module: 'Contrast::Framework::Rack::Patch::SessionCookie')])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rack/support.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/base_support'
+cs__scoped_require 'contrast/framework/rack/patch/support'
+
+module Contrast
+  module Framework
+    module Rack
+      # Used when Rack is present to define framework specific behavior. For
+      # now, the only part of this implemented is the Patch Support.
+      class Support < BaseSupport
+        extend Contrast::Framework::Rack::Patch::Support
+        class << self
+          def detection_class
+            'don\'t let me be detected'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -0,0 +1,43 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/service_sender_util'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # This class acts as our patch into the ActionController::Live::Buffer
+        # class, allowing us to track the close event on streamed responses.
+        class ActionControllerLiveBuffer
+          class << self
+            def send_messages
+              return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
+
+              [context.server_activity, context.activity, context.observed_route].each do |msg|
+                Contrast::Utils::ServiceSenderUtil.send_event_immediately(msg)
+              end
+            end
+
+            def instrument
+              @_instrument ||= begin
+                                 ::ActionController::Live::Buffer.class_eval do
+                                   # normally pre->in->post filters are applied however, in a streamed response
+                                   # we can run into a case where it's pre -> in -> post -> more infilters
+                                   # in order to submit anything found during the infilters after the response has
+                                   # been written we need to explicitly send them
+                                   alias_method :cs__close, :close
+                                   def close
+                                     Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
+                                     cs__close
+                                   end
+                                 end
+                                 true
+                               end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -0,0 +1,103 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/invalid_configuration_util'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # This module is used to analyze rails session storage configuration for assess vulnerabilities
+        module AssessConfiguration
+          include Contrast::Components::Interface
+
+          access_component :agent, :analysis, :logging, :scope
+
+          CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+          SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
+          CS__SECURE_RULE_NAME = 'secure-flag-missing'
+          CS__HTTPONLY_RULE_NAME = 'rails-http-only-disabled'
+
+          class << self
+            include Contrast::Utils::InvalidConfigurationUtil
+
+            def analyze_session_store *args
+              return unless AGENT.enabled?
+              return if PROTECT.enabled?
+
+              apply_httponly_disabled(*args)
+              apply_secure_cookie_disabled(*args)
+              apply_session_timeout(*args)
+            end
+
+            private
+
+            def vulnerable_setting? setting_key, safe_settings_value, original_args, safe_default: true, comparison_type: nil
+              # In most cases, Rails is pretty nice and the default value is safe
+              return !safe_default unless original_args && original_args.length > 1
+
+              # If the user overrode some args, but not ours, fall back on the default
+              rails_session_settings = original_args[1]
+              return !safe_default unless rails_session_settings&.key?(setting_key)
+
+              value = rails_session_settings[setting_key]
+
+              return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+              value != safe_settings_value
+            end
+
+            def apply_session_timeout *args
+              return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
+              return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(5, 4)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to set session timeout', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_secure_cookie_disabled *args
+              return if ASSESS.rule_disabled? CS__SECURE_RULE_NAME
+              return unless vulnerable_setting?(:secure, true, args)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to disable secure cookies', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_httponly_disabled *args
+              return if ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
+              return unless vulnerable_setting?(:httponly, true, args)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(5, 4)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to disable httponly in session cookie', e)
+              rescue StandardError
+                nil
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end