contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/components/settings.rb

@@ -23,11 +23,6 @@ module Contrast
         # this statefulness
         attr_reader :tainted_columns # This can probably go into assess_state?
 
-        # a vulnerability like padding oracle is exploited across
-        # multiple requests, as a timing attack.  these attempts must be
-        # accumulated, in order to recognize the pattern and block the attack.
-        attr_reader :accumulator_settings
-
         # These three 'state' variables represent atomic config/setting state,
         # outside of things like rule defs.
 
@@ -40,8 +35,7 @@ module Contrast
 
         def protect_state
           @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              accumulator_settings: Contrast::Api::Settings::AccumulatorSettings.new
+              enabled: false
           }
         end
 
@@ -58,7 +52,7 @@ module Contrast
         # So, between this block and rules, that's setting state.
         PROTECT_STATE_ATTRS       = %i[].cs__freeze
         ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
-        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules session_id].cs__freeze
+        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules].cs__freeze
 
         # Meta-define an accessor for each state attribute.
         begin
@@ -85,14 +79,30 @@ module Contrast
           reset_state
         end
 
+        def protect_enabled?
+          @_protect_enabled = !!protect_state[:enabled] if @_protect_enabled.nil?
+          @_protect_enabled
+        end
+
+        def assess_enabled?
+          @_assess_enabled = !!assess_state[:enabled] if @_assess_enabled.nil?
+          @_assess_enabled
+        end
+
+        def code_exclusions
+          exclusion_matchers.select(&:code?)
+        end
+
         def update_from_server_features server_features
           # protect
           begin
+            @_protect_enabled = nil
             protect_state[:enabled] = server_features.protect_enabled?
           end
 
           # assess
           begin
+            @_assess_enabled = nil
             assess_state[:enabled] = server_features.assess_enabled?
             assess_state[:sampling_settings] = server_features.assess.sampling
             Contrast::Utils::Assess::SamplingUtil.instance.update
@@ -118,7 +128,6 @@ module Contrast
         def build_assess_rules
           @assess_rules = {}
 
-          Contrast::Agent::Assess::Rule::Csrf.new
           Contrast::Agent::Assess::Rule::Redos.new
         end
 
@@ -135,15 +144,6 @@ module Contrast
           Contrast::Agent::Protect::Rule::UnsafeFileUpload.new
           Contrast::Agent::Protect::Rule::Xss.new
           Contrast::Agent::Protect::Rule::Xxe.new
-
-          # Beta Rules
-          Contrast::Agent::Protect::Rule::Csrf.new
-        end
-
-        # these are less 'settings' and more 'how do I behave.'
-        # relocate to Agent or Assess/Protect.
-        def protect_rule_mode rule_id
-          CONFIG.root.protect.rules[rule_id]&.mode || modes_by_id[rule_id] || :NO_ACTION
         end
       end
 

data/lib/contrast/config/protect_rules_configuration.rb

@@ -14,7 +14,6 @@ module Contrast
           'nosql-injection' => Contrast::Config::ProtectRuleConfiguration,
           'untrusted-deserialization' => Contrast::Config::ProtectRuleConfiguration,
           'method-tampering' => Contrast::Config::ProtectRuleConfiguration,
-          csrf: Contrast::Config::ProtectRuleConfiguration,
           xxe: Contrast::Config::ProtectRuleConfiguration,
           'path-traversal' => Contrast::Config::ProtectRuleConfiguration,
           'reflected-xss' => Contrast::Config::ProtectRuleConfiguration,

data/lib/contrast/configuration.rb

@@ -88,13 +88,13 @@ module Contrast
           puts "!!! Contrast - Configuration file at #{ path } is not readable by current user"
           next
         end
-        config = yaml_to_hash(path)
+        config = yaml_to_hash(path) || {}
         break
       end
 
       if config.empty?
         puts "!!! Contrast - working directory: #{ Dir.pwd }"
-        puts '!!! Contrast - configuration file could not be found at any of the search paths'
+        puts '!!! Contrast - valid configuration file could not be found at any of the search paths'
         puts 'Valid configuration paths are: '
         configuration_paths.each do |path|
           puts(path)

data/lib/contrast/{extensions/ruby_core → extension}/assess.rb

@@ -2,14 +2,15 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Assess namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Assess namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #
     # @deprecated This is one of our earliest designs and is not nearly as
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
+    #   Removing it requires a C refactor to handle the namespace.
     module Assess
       cs__scoped_require 'contrast/agent/patching/policy/patcher'
 
@@ -19,7 +20,6 @@ module Contrast
       cs__scoped_require 'contrast/agent/assess/rule/provider'
 
       # tagging / dataflow
-      cs__scoped_require 'contrast/agent/assess/adjusted_span'
       cs__scoped_require 'contrast/agent/assess/policy/policy_node'
       cs__scoped_require 'contrast/agent/assess/policy/source_node'
       cs__scoped_require 'contrast/agent/assess/policy/source_method'
@@ -31,21 +31,18 @@ module Contrast
       cs__scoped_require 'contrast/agent/assess/policy/patcher'
 
       # classes that don't play nice w/ our standard propagation
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+      cs__scoped_require 'contrast/extension/assess/assess_extension'
       # this needs to come first b/c array and others work on strings and
       # expect them to be trackable
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/string'
+      cs__scoped_require 'contrast/extension/assess/string'
 
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/array'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/erb'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/fiber'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/hash'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/kernel'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/regexp'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/module'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/basic_object'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/tilt_template_trigger'
-      cs__scoped_require 'contrast/extensions/ruby_core/assess/xpath_library_trigger'
+      cs__scoped_require 'contrast/extension/assess/array'
+      cs__scoped_require 'contrast/extension/assess/erb'
+      cs__scoped_require 'contrast/extension/assess/eval_trigger'
+      cs__scoped_require 'contrast/extension/assess/fiber'
+      cs__scoped_require 'contrast/extension/assess/hash'
+      cs__scoped_require 'contrast/extension/assess/kernel'
+      cs__scoped_require 'contrast/extension/assess/regexp'
     end
   end
 end

data/lib/contrast/extension/assess/array.rb

@@ -0,0 +1,77 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/patch'
+cs__scoped_require 'contrast/agent/patching/policy/patcher'
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This is our patch of the Array class required to handle propagation
+      # Disclaimer: there may be a better way, but we're in a 'get it work' state.
+      # Hopefully, we'll be in a 'get it right' state soon.
+      class ArrayPropagator
+        include Contrast::Components::Interface
+
+        access_component :scope
+
+        ARRAY_JOIN_HASH = {
+            'class_name' => 'Array',
+            'instance_method' => true,
+            'method_visibility' => 'public',
+            'method_name' => 'join',
+            'action' => 'CUSTOM',
+            'source' => 'O',
+            'target' => 'R',
+            'patch_class' => 'NOOP',
+            'patch_method' => 'cs__track_join'
+        }.cs__freeze
+        ARRAY_JOIN_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(ARRAY_JOIN_HASH)
+
+        class << self
+          # When you call join, they use an internal thing, so there's no good way to get at the thing being returned.
+          # Multiple Strings are appended with the #join method. Because that
+          # operation happens in C, we have to do it here rather than rely on the
+          # patch of our String append or concat methods.
+          def cs__track_join ary, separator, ret
+            return unless ary
+            return ret if Contrast::Agent::Patching::Policy::Patch.skip_assess_analysis?
+
+            with_contrast_scope do
+              shift = 0
+              separator_length = separator.nil? ? 0 : separator.to_s.length
+              ary.each do |obj|
+                if obj # skip nil here
+                  ret.cs__copy_from(obj, shift)
+                  shift += obj.to_s.length
+                end
+                shift += separator_length
+              end
+              return ret unless ret.cs__tracked?
+
+              ret.cs__properties.cleanup_tags
+              ret.cs__properties.build_event(
+                  ARRAY_JOIN_NODE,
+                  ret,
+                  ary,
+                  ret,
+                  [separator])
+              ret
+            end
+          end
+
+          def instrument_array_track
+            @_instrument_array_track ||= begin
+                                           cs__scoped_require 'cs__assess_array/cs__assess_array'
+                                           true
+                                         end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading assess track patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/assess_extension.rb

@@ -5,13 +5,13 @@ cs__scoped_require 'contrast/agent/assess/properties'
 cs__scoped_require 'contrast/agent/assess/insulator'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This module is responsible for maintaining the data we need to
       # construct a trace event for the object in which it is included. Rather
       # than have this code all over the place, any class that wants to use
       # dataflow features should be sent
-      # 'include Contrast::CoreExtensions::Assess::AssessExtension'
+      # 'include Contrast::Extension::Assess::AssessExtension'
       module AssessExtension
         # Lazily build properties object. Only objects that have been tracked
         # will have the @_cs__properties, but all will respond to the
@@ -122,8 +122,7 @@ module Contrast
               range = existing[0]
               range.repurpose(0, ret_length)
             else
-              span = Contrast::Agent::Assess::AdjustedSpan.new(0, ret_length)
-              ret.cs__properties.add_tag(key, span)
+              ret.cs__properties.add_tag(key, 0...ret_length)
             end
           end
         end

data/lib/contrast/extension/assess/eval_trigger.rb

@@ -0,0 +1,78 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Assess
+      # This Module allows us to track calls to the BasicObject#eval method,
+      # which violates the design of most methods we track in that we have to
+      # apply the trigger in a custom patch over one of the generic triggers in
+      # TriggerMethod.
+      class EvalTrigger
+        include Contrast::Components::Interface
+        access_component :logging
+
+        class << self
+          def instance_eval_trigger_check obj, source, ret
+            apply_trigger(obj, source, ret, 'BasicObject', :instance_eval)
+          end
+
+          def eval_trigger_check obj, source, ret, method
+            apply_trigger(obj, source, ret, 'Module', method)
+          end
+
+          def apply_trigger obj, source, ret, clazz, method
+            current_context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless current_context
+
+            # Since we know this is the source of the trigger, we can do some
+            # optimization here and return when it is not tracked
+            return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
+
+            # source might not be all the args passed in, but it is the one we care
+            # about. we could pass in all the args in the last param here if it
+            # becomes an issue in rendering on TS
+            Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(
+                current_context,
+                trigger_node(clazz, method),
+                source,
+                obj,
+                ret,
+                source)
+          end
+
+          def instrument_basic_object_track
+            @_instrument_basic_object_track ||= begin
+                                               cs__scoped_require 'cs__assess_basic_object/cs__assess_basic_object'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading basic object track patch', e)
+            false
+          end
+
+          def instrument_module_track
+            @_instrument_module_track ||= begin
+                                               cs__scoped_require 'cs__assess_module/cs__assess_module'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading module track patch', e)
+            false
+          end
+
+          private
+
+          def trigger_node clazz, method
+            triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
+            return unless triggers
+
+            triggers.find { |node| node.class_name == clazz && node.method_name == method }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/assess/exec_trigger.rb

@@ -4,7 +4,7 @@
 cs__scoped_require 'contrast/agent/at_exit_hook'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Module allows us to track calls to the Kernel#exec method, which
       # violates the design of most methods we track in that we have to apply

data/lib/contrast/{extensions/ruby_core → extension}/assess/fiber.rb

@@ -9,7 +9,7 @@ cs__scoped_require 'contrast/components/interface'
 # Specifically, we instrument 'rb_fiber_yield' and 'rb_fiber_new' in
 # order to track what happens within Enumerator#next.
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke Regexp propagation for those
       # methods which are too complex to fit into one of the standard
@@ -20,15 +20,16 @@ module Contrast
 
         access_component :analysis, :logging, :scope
 
+        # we use funchook to patch rb_fiber_new the initialize method is not exposed by Ruby core
         FIBER_NEW_NODE_HASH = {
             'class_name' => 'Fiber',
             'instance_method' => true,
             'method_visibility' => 'public',
-            'method_name' => 'c_new', # TODO: Why do we patch new here and not initialize? Historically, new has been problematic.
+            'method_name' => 'c_new',
             'action' => 'CUSTOM',
             'source' => 'O',
             'target' => 'R',
-            'patch_class' => 'Contrast::CoreExtensions::Assess::FiberPropagator',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
             'patch_method' => 'track_rb_fiber_new'
         }.cs__freeze
         FIBER_NEW_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_NEW_NODE_HASH)
@@ -43,7 +44,7 @@ module Contrast
             'action' => 'CUSTOM',
             'source' => 'O',
             'target' => 'R',
-            'patch_class' => 'Contrast::CoreExtensions::Assess::FiberPropagator',
+            'patch_class' => 'Contrast::Extension::Assess::FiberPropagator',
             'patch_method' => 'track_rb_fiber_yield'
         }.cs__freeze
         FIBER_YIELD_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(FIBER_YIELD_NODE_HASH)
@@ -98,10 +99,10 @@ module Contrast
 
           def instrument_fiber_track
             @_instrument_fiber_variables ||= begin
-                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
+                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
                 true
               end
-          rescue StandardError => e
+          rescue StandardError, LoadError => e
             logger.error('Error loading fiber track patch', e)
             false
           end

data/lib/contrast/{extensions/ruby_core → extension}/assess/hash.rb

@@ -4,7 +4,7 @@
 cs__scoped_require 'contrast/components/interface'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke Hash propagation for those
       # methods which are too complex to fit into one of the standard
@@ -28,7 +28,7 @@ module Contrast
                                             cs__scoped_require 'cs__assess_hash/cs__assess_hash'
                                             true
                                           end
-          rescue StandardError => e
+          rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false
           end

data/lib/contrast/extension/assess/kernel.rb

@@ -0,0 +1,110 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/extension/assess/exec_trigger'
+
+module Contrast
+  module Extension
+    module Assess
+      # This module provides us with a way to invoke Kernel propagation for those
+      # methods which are too complex to fit into one of the standard
+      # Contrast::Agent::Assess::Policy::Propagator molds without cluttering up the
+      # Kernel Module or exposing our methods there.
+      module KernelPropagator
+        class << self
+          include Contrast::Components::Interface
+          include Contrast::Extension::Assess::ExecTrigger
+
+          access_component :logging
+
+          # We're 'tracking' sprintf now, meaning if anything is tracked on the way
+          # in, the entire result will be tracked out. We're going to take this
+          # approach for now b/c it's fast and easy. I don't super love it, and by
+          # that I mean I hate it.
+          #
+          # To actually track this, we'd have to find the index of the new things
+          # being added, then remove the tags at the range of the format marker,
+          # which is some arbitrary length thing, and add the new tags from the
+          # inserted string, shifted down by the length of the aforementioned
+          # marker.
+          #
+          # marker is in the format %[flags][width][.precision]type, type being a
+          # single character. We could regexp this with %.+[bBdiouxXeEfgGaAcps%]
+          #
+          # also, b/c Ruby hates us, there are things called absolute markers,
+          # (digit)$, that go in the flags section. These cannot be mixed w/ the
+          # order assumed type
+          #
+          # oh, and there's also %<name>type and %{name}... b/c of course there is
+          # -HM
+          def sprintf_tagger patcher, preshift, ret, _block
+            format_string = preshift.args[0]
+            args = preshift.args[1]
+
+            track_sprintf(ret, format_string, args)
+
+            ret.cs__properties.build_event(
+                patcher,
+                ret,
+                preshift.object,
+                ret,
+                preshift.args,
+                1)
+            ret
+          end
+
+          def track_sprintf result, format_string, args
+            handle_sprintf_value(format_string, result)
+            if args.is_a?(String)
+              handle_sprintf_value(args, result)
+            elsif args.is_a?(Hash)
+              handle_sprintf_hash(args, result)
+            elsif args.is_a?(Array)
+              handle_sprintf_array args, result
+            end
+
+            result
+          rescue StandardError => e
+            logger.error(
+                'Unable to track dataflow through sprintf', e)
+            result
+          end
+
+          def instrument_kernel_track
+            @_instrument_fiber_variables ||= begin
+                                               cs__scoped_require 'cs__assess_kernel/cs__assess_kernel'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading kernel track patch', e)
+            false
+          end
+
+          private
+
+          def handle_sprintf_value value, result
+            return unless Contrast::Utils::DuckUtils.trackable?(value) && value.cs__tracked?
+
+            value.cs__properties.events.each do |event|
+              result.cs__properties.events << event
+            end
+            value.cs__splat_tags(result)
+          end
+
+          def handle_sprintf_array args, result
+            args.each do |value|
+              handle_sprintf_value(value, result)
+            end
+          end
+
+          def handle_sprintf_hash args, result
+            args.each_value do |value|
+              handle_sprintf_value(value, result)
+            end
+          end
+        end
+      end
+    end
+  end
+end