contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/api/communication/unix_socket.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/communication/socket'
+
+module Contrast
+  module Api
+    module Communication
+      # Implements a UNIX domain socket to connect to the Contrast Service.
+      class UnixSocket
+        include Contrast::Api::Communication::Socket
+
+        attr_reader :path
+
+        # Create the socket
+        # @param path [String] file path to a UNIX domain socket
+        def initialize path
+          @path = path
+        end
+
+        def new_socket
+          ::UNIXSocket.new(path)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/api/decorators.rb

@@ -8,7 +8,17 @@ module Contrast
     end
   end
 end
+cs__scoped_require 'contrast/api/decorators/message'
 cs__scoped_require 'contrast/api/decorators/application_update'
 cs__scoped_require 'contrast/api/decorators/input_analysis'
 cs__scoped_require 'contrast/api/decorators/application_settings'
 cs__scoped_require 'contrast/api/decorators/server_features'
+cs__scoped_require 'contrast/api/decorators/route_coverage'
+cs__scoped_require 'contrast/api/decorators/trace_event_object'
+cs__scoped_require 'contrast/api/decorators/trace_event_signature'
+cs__scoped_require 'contrast/api/decorators/trace_taint_range'
+cs__scoped_require 'contrast/api/decorators/trace_event'
+cs__scoped_require 'contrast/api/decorators/rasp_rule_sample'
+cs__scoped_require 'contrast/api/decorators/user_input'
+cs__scoped_require 'contrast/api/decorators/address'
+cs__scoped_require 'contrast/api/decorators/http_request'

data/lib/contrast/api/decorators/address.rb

@@ -0,0 +1,60 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/dtm.pb'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/timer'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the Address protobuf model so it can own some of the
+      # data massaging required for Request dtm
+      module Address
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :logging
+
+          # receiver is memoized because it is the address/host/port of the server, once we
+          # resolve this for the first time, it shouldn't change
+          #
+          # @return [Contrast::Api::Dtm::Address] the address of this server
+          def build_receiver
+            @_build_receiver ||= begin
+                             address = new
+                             address.host = 'localhost'
+                             address.ip = '127.0.0.1'
+                             begin
+                               Timeout.timeout(1) do
+                                 address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
+                                 address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
+                               end
+                             rescue StandardError => e
+                               logger.warn('Unable to resolve host or ip', e, address: address)
+                             end
+                             address
+                           end
+          end
+
+          # Parse out the sender of the Request and return it as an Address
+          #
+          # @return [Contrast::Api::Dtm::Address] the address from which the
+          #   request originated
+          def build_sender request
+            sender = new
+            sender.ip = Contrast::Utils::StringUtils.force_utf8(request.ip)
+            sender
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Address.include(Contrast::Api::Decorators::Address)

data/lib/contrast/api/decorators/application_settings.rb

@@ -8,7 +8,12 @@ module Contrast
     module Decorators
       # Used to decorate the ApplicationSettings protobuf model to handle setting translation
       module ApplicationSettings
-        MODE_ALLOWLIST = %i[NO_ACTION BLOCK_AT_PERIMETER MONITOR BLOCK].cs__freeze
+        MODE_ALLOWLIST = [
+          Contrast::Api::Settings::ProtectionRule::Mode::NO_ACTION,
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK,
+          Contrast::Api::Settings::ProtectionRule::Mode::MONITOR,
+          Contrast::Api::Settings::ProtectionRule::Mode::BLOCK_AT_PERIMETER
+        ].cs__freeze
         # Convert protobuf exlcusions into Agent exclusions
         def translated_exclusions
           exclusions.map { |exc| Contrast::Agent::ExclusionMatcher.new(exc) }
@@ -25,8 +30,7 @@ module Contrast
           {
               modes_by_id: translated_protection_mode_by_id,
               exclusion_matchers: translated_exclusions,
-              disabled_assess_rules: disabled_assess_rules,
-              session_id: session_id
+              disabled_assess_rules: disabled_assess_rules
           }
         end
       end

data/lib/contrast/api/decorators/application_update.rb

@@ -17,14 +17,6 @@ module Contrast
           klass.extend(ClassMethods)
         end
 
-        def append_view_technology_descriptor_data view_technology_descriptors
-          view_technology_descriptors.each do |vtd|
-            vtd.technology_names.each do |tech_name|
-              technologies[tech_name] = true
-            end
-          end
-        end
-
         def append_library_update library_dtm_list, library_tags
           lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
           library_dtm_list.each do |library_dtm|
@@ -51,7 +43,6 @@ module Contrast
         module ClassMethods
           def build
             msg = new
-            msg.append_view_technology_descriptor_data(Contrast::Agent.framework_manager.find_applicable_view_technologies)
             msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
             msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
             msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)

data/lib/contrast/api/decorators/http_request.rb

@@ -0,0 +1,139 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/api/dtm.pb'
+cs__scoped_require 'contrast/api/decorators/address'
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/timer'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the HttpRequest protobuf model so it can own some of
+      # the data massaging required for Request dtm
+      module HttpRequest
+        include Contrast::Components::Interface
+        access_component :agent
+
+        OMITTED_BODY = '{{body-omitted-by-contrast}}'
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Append the sender and receiver to self.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_addresses request
+          self.sender = Contrast::Api::Dtm::Address.build_sender(request)
+          self.receiver = Contrast::Api::Dtm::Address.build_receiver
+        end
+
+        # Append the connection to self.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_connection request
+          self.protocol = Contrast::Utils::StringUtils.force_utf8(request.scheme)
+          self.version = '1.1' # currently not in rack request; hard-coding
+          self.method = Contrast::Utils::StringUtils.force_utf8(request.request_method)
+          self.raw = Contrast::Utils::StringUtils.force_utf8(request.rack_request.path_info)
+        end
+
+        # Append the parameters to self, using the preferred
+        # normalized_request_params field.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_params request
+          request.parameters.each do |k, v|
+            append_pair(normalized_request_params, k, v)
+          end
+        end
+
+        # Append the normalized headers to self, using the preferred
+        # request_headers field.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_headers request
+          request.headers.each do |k, v|
+            next unless k && v
+            next if v.is_a?(Hash)
+
+            key = Contrast::Utils::StringUtils.force_utf8(k)
+            val = Contrast::Utils::StringUtils.force_utf8(v)
+            request_headers[key] = val
+          end
+
+          request.cookies.each do |k, v|
+            append_pair(normalized_cookies, k, v)
+          end
+        end
+
+        # Append the body to self, using the preferred
+        # request_body_binary field.
+        #
+        # @param request [Contrast::Api::Dtm::HttpRequest]
+        def append_body request
+          self.document_type = Contrast::Utils::StringUtils.force_utf8(request.document_type)
+
+          self.request_body_binary = if omit_body?(request)
+                                       OMITTED_BODY
+                                     else
+                                       Contrast::Utils::StringUtils.force_utf8(request.body)
+                                     end
+          return if request.file_names.empty?
+
+          request.file_names.each do |name, filename|
+            pair = Contrast::Api::Dtm::SimplePair.new
+            pair.key = Contrast::Utils::StringUtils.force_utf8(name)
+            pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
+            multipart_headers << pair
+          end
+        end
+
+        def omit_body? request
+          return true if AGENT.omit_body?
+          return false if request.document_type != :NORMAL
+
+          request.content_type&.include?('multipart/form-data')
+        end
+
+        def append_pair map, key, value
+          return unless key && value
+          return if value.is_a?(Hash)
+
+          safe_key = Contrast::Utils::StringUtils.force_utf8(key)
+          map[safe_key] ||= Contrast::Api::Dtm::Pair.new
+          map[safe_key].key = safe_key
+          map[safe_key].values << Contrast::Utils::StringUtils.force_utf8(value)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :scope
+
+          # Convert our Request into a DTM
+          # @param request [Contrast::Agent::Request]
+          # @return [Contrast::Api::Dtm::HttpRequest]
+          def build request
+            with_contrast_scope do
+              msg = new
+              msg.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
+              msg.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
+
+              msg.append_addresses(request)
+              msg.append_connection(request)
+              msg.append_params(request)
+              msg.append_headers(request)
+              msg.append_body(request)
+              msg
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::HttpRequest.include(Contrast::Api::Decorators::HttpRequest)

data/lib/contrast/api/decorators/message.rb

@@ -0,0 +1,75 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the Message protobuf model so it can handle instance data massaging
+      module Message
+        include Contrast::Components::Interface
+        access_component :app_context, :logging
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        def append_event event
+          case event
+          when Contrast::Api::Dtm::ServerActivity
+            self.server_activity = event
+          when Contrast::Api::Dtm::AgentStartup
+            self.agent_startup = event
+          when Contrast::Api::Dtm::ApplicationCreate
+            self.application_create = event
+          when Contrast::Api::Dtm::ApplicationUpdate
+            self.application_update = event
+          when Contrast::Api::Dtm::Activity
+            self.activity = event
+          when Contrast::Api::Dtm::HttpRequest
+            self.prefilter = event
+          when Contrast::Api::Dtm::HttpResponse
+            self.postfilter = event
+          when Contrast::Api::Dtm::Poll
+            self.poll = event
+          when Contrast::Api::Dtm::ObservedRoute
+            self.observed_route = event
+          else
+            logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.name)
+            return
+          end
+          logger.debug('Wrapping event in message',
+                       msg_id: __id__,
+                       p_id: pid,
+                       msg_count: message_count,
+                       event_id: event.__id__,
+                       event_type: event.cs__class.name)
+        end
+
+        # Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
+        module ClassMethods
+          @@message_total = 0 # rubocop:disable Style/ClassVars
+          def message_count
+            @@message_total += 1 # rubocop:disable Style/ClassVars
+          end
+
+          def build event
+            msg = new
+            msg.app_name      = APP_CONTEXT.name
+            msg.app_path      = APP_CONTEXT.path
+            msg.app_language  = Contrast::Utils::ObjectShare::RUBY
+            msg.client_id     = APP_CONTEXT.client_id
+            msg.message_count = message_count
+            msg.pid           = APP_CONTEXT.pid
+            msg.ppid          = APP_CONTEXT.ppid
+            msg.append_event(event)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::Message.include(Contrast::Api::Decorators::Message)

data/lib/contrast/api/decorators/rasp_rule_sample.rb

@@ -0,0 +1,28 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the RaspRuleSample protobuf model
+      module RaspRuleSample
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to RaspRuleSample
+        module ClassMethods
+          def build context, ia_result
+            sample = new
+            sample.timestamp_ms = context.timer.start_ms
+            sample.user_input = Contrast::Api::Dtm::UserInput.build_from_ia_result(ia_result)
+            sample.user_input.document_type = Contrast::Utils::StringUtils.force_utf8(context.request.document_type)
+            sample
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::RaspRuleSample.include(Contrast::Api::Decorators::RaspRuleSample)

data/lib/contrast/api/decorators/route_coverage.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the RouteCoverage protobuf model to handle conversion between framework route classes
+      module RouteCoverage
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for RouteCoverage
+        module ClassMethods
+          def source_or_string obj
+            if obj.cs__is_a?(Regexp)
+              obj.source
+            elsif obj.cs__respond_to?(:safe_string)
+              obj.safe_string
+            else
+              obj.to_s
+            end
+          end
+
+          # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
+          # @param journey_obj [ActionDispatch::Journey::Route] a rails route
+          # @return [Contrast::Api::Dtm::RouteCoverage]
+          def from_action_dispatch_journey journey_obj
+            msg = new
+            msg.route = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
+
+            verb = source_or_string(journey_obj.verb)
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
+
+            url = source_or_string(journey_obj.path.spec)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(url)
+            msg
+          end
+
+          def from_sinatra_route clazz, method, pattern
+            safe_pattern = source_or_string(pattern)
+
+            msg = new
+            msg.route = "#{ clazz }##{ method } #{ safe_pattern }"
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::RouteCoverage.include(Contrast::Api::Decorators::RouteCoverage)