contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/{extensions/ruby_core → extension}/assess/regexp.rb

@@ -5,7 +5,7 @@ cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
 cs__scoped_require 'contrast/components/interface'
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke Regexp propagation for those
       # methods which are too complex to fit into one of the standard
@@ -25,7 +25,7 @@ module Contrast
             'action' => 'CUSTOM',
             'source' => 'P0',
             'target' => 'R',
-            'patch_class' => 'Contrast::CoreExtensions::Assess::RegexpPropagator',
+            'patch_class' => 'Contrast::Extension::Assess::RegexpPropagator',
             'patch_method' => 'track_equal_squiggle'
         }.cs__freeze
         REGEXP_EQUAL_SQUIGGLE_NODE = Contrast::Agent::Assess::Policy::PropagationNode.new(REGEXP_EQUAL_SQUIGGLE_HASH)
@@ -43,7 +43,7 @@ module Contrast
             # As such, a scope of 1 here indicates that,
             # so we know that we're in the top level call for this method.
             # normal patch [-alias-]> special case patch [-alias-]> original method
-            # TODO:  RUBY-686
+            # TODO: RUBY-686
             return if scope_for_current_ec.instance_variable_get(:@contrast_scope) > 1
 
             target = info_hash[:back_ref]
@@ -73,7 +73,7 @@ module Contrast
                                                cs__scoped_require 'cs__assess_regexp/cs__assess_regexp'
                                                true
                                              end
-          rescue StandardError => e
+          rescue StandardError, LoadError => e
             logger.error('Error loading regexp track patch', e)
             false
           end

data/lib/contrast/{extensions/ruby_core → extension}/assess/string.rb

@@ -3,16 +3,16 @@
 
 cs__scoped_require 'contrast/agent/assess/policy/propagation_node'
 cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/extensions/ruby_core/assess/assess_extension'
+cs__scoped_require 'contrast/extension/assess/assess_extension'
 
 # This patch installs our extension as early as possible. The alternative is to
 # litter our code with Contrast::Utils::DuckUtils.trackable? checks.
 class String
-  include Contrast::CoreExtensions::Assess::AssessExtension
+  include Contrast::Extension::Assess::AssessExtension
 end
 
 module Contrast
-  module CoreExtensions
+  module Extension
     module Assess
       # This Class provides us with a way to invoke String propagation for those
       # methods which are too complex to fit into one of the standard
@@ -57,7 +57,7 @@ module Contrast
                                       cs__scoped_require 'cs__assess_string/cs__assess_string'
                                       true
                                     end
-          rescue StandardError => e
+          rescue StandardError, LoadError => e
             logger.error('Error loading hash track patch', e)
             false
           end
@@ -65,11 +65,11 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                                                    if AGENT.patch_interpolation?
+                                                    if AGENT.patch_interpolation? && Funchook.available?
                                                       cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
                                                     end
                                                     true
-                                                  rescue StandardError => e
+                                                  rescue StandardError, LoadError => e
                                                     logger.error('Error loading interpolation patch', e)
                                                     false
                                                   end

data/lib/contrast/{extensions/ruby_core → extension}/inventory.rb

@@ -2,8 +2,8 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Inventory namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Inventory namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #
@@ -11,7 +11,6 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Inventory
-      cs__scoped_require 'contrast/internal_exception'
       cs__scoped_require 'contrast/security_exception'
       # patching
       cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'

data/lib/contrast/extension/kernel.rb

@@ -0,0 +1,54 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/scope'
+
+# This is a reasonable place for the Kernel#catch hook to live.
+# No current plans for component re-design, but if we had some kind of
+# "do this when a component is hooked in" thing, this would live there.
+# For now, it's over-engineering to live anywhere else.  -ajm
+module Kernel # :nodoc:
+  alias_method :cs__catch, :catch
+
+  # In the event of a `throw`, we need to override `catch`
+  # to save & restore scope state:
+  #
+  #   scope_level == 0
+  #
+  #   catch(:abc) do
+  #     with_contrast_scope do
+  #       throw :abc # will leak
+  #     end
+  #   end
+  #
+  #   scope_level == 1
+  #
+  # Frankly, this isn't how scope should be used.  This is in place of
+  # proper `ensure` blocks within the instrumentation call stack.
+  # This will actually /create/ scope leaks if you're doing something like:
+  #
+  #   catch(:ohno) do
+  #     enter scope
+  #   end
+  #
+  #   abc()
+  #
+  #   exit scope
+  #
+  # i.e. if you intend to change net scope across a catch block boundary.
+
+  private
+
+  def catch *args, &block
+    # Save current scope level
+    scope_level = Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_get(:@contrast_scope)
+
+    # Run original catch with block.
+    retval = cs__catch(*args, &block)
+
+    # Restore scope.
+    Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.instance_variable_set(:@contrast_scope, scope_level)
+
+    retval
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/protect.rb

@@ -2,8 +2,8 @@
 # frozen_string_literal: true
 
 module Contrast
-  module CoreExtensions
-    # Our top level Protect namespace in the Core Extensions section of our
+  module Extension
+    # Our top level Protect namespace in the Core Extension section of our
     # code. These patches are those that are invoked directly from a patched
     # Class.
     #

data/lib/contrast/extension/protect/kernel.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Extension
+    module Protect
+      # This Module functions as our patch into the Kernel class for Protect,
+      # allowing us to track activity as it crosses spawned processes.
+      module Kernel
+        class << self
+          include Contrast::Components::Interface
+          access_component :contrast_service
+
+          def build_wrapper
+            lambda {
+              proc_start
+              yield
+              # AtExitHook handles sending any messages generated in the new forked process
+            }
+          end
+
+          def proc_start
+            context = Contrast::Agent::REQUEST_TRACKER.current
+            return unless context
+
+            context.reset_activity
+          end
+
+          def instrument
+            @_instrument ||= begin
+                                               cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'
+                                               true
+                                             end
+          rescue StandardError, LoadError => e
+            logger.error('Error loading kernel protect patch', e)
+            false
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/{extensions/ruby_core → extension}/protect/psych.rb

@@ -2,6 +2,6 @@
 # frozen_string_literal: true
 
 if defined?(Psych)
-  cs__scoped_require 'contrast/extensions/ruby_core/protect/applies_deserialization_rule'
+  cs__scoped_require 'contrast/agent/protect/policy/applies_deserialization_rule'
   cs__scoped_require 'cs__patched_psych/cs__patched_psych'
 end

data/lib/contrast/framework/base_support.rb

@@ -23,13 +23,6 @@ module Contrast
           raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
         end
 
-        # Iterate through known locations, looking for files
-        # that represent view or template files. If found, for each file in the directory
-        # append the technology and the view object to the application update instance
-        def scan_views
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
         # Find all the predefined routes for this application and append them to the
         # provided inventory message
         # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg
@@ -46,27 +39,33 @@ module Contrast
           raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
         end
 
+        # Some Frameworks require specific patching for their classes to handle
+        # functionality like configuration scanning. To accommodate this, this
+        # method provides a place to register those patches for invocation on
+        # Agent load.
+        #
+        # By default, and hopefully in all cases, we won't need these patches,
+        # so we're allowing nil here rather than raising an exception.
+        def before_load_patches; end
+
+        # Some Frameworks require specific patching for their classes to handle
+        # functionality like routing. To accommodate this, this method provides
+        # a place to register those patches for invocation in our
+        # AfterLoadPatcher flow.
+        #
+        # By default, and hopefully in all cases, we won't need these patches,
+        # so we're allowing nil here rather than raising an exception.
+        #
+        # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>,nil]
+        #   those patches required for a Framework which can only be installed
+        #   once a specific module has been loaded.
+        def after_load_patches; end
+
         # We only support websockets in rails right now, so we won't detect streaming in
         # any other framework
         def streaming? _env
           false
         end
-
-        protected
-
-        def source_or_string obj
-          if obj.cs__is_a?(Regexp)
-            obj.source
-          elsif obj.cs__respond_to?(:safe_string)
-            obj.safe_string
-          else
-            obj.to_s
-          end
-        end
-
-        def scan_view_directories view_technology_descriptors
-          view_technology_descriptors.reject(&:empty?)
-        end
       end
     end
   end

data/lib/contrast/framework/manager.rb

@@ -1,11 +1,10 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/view_technologies_descriptor'
 cs__scoped_require 'contrast/framework/platform_version'
-cs__scoped_require 'contrast/framework/base_support'
-cs__scoped_require 'contrast/framework/rails_support'
-cs__scoped_require 'contrast/framework/sinatra_support'
+cs__scoped_require 'contrast/framework/rack/support'
+cs__scoped_require 'contrast/framework/rails/support'
+cs__scoped_require 'contrast/framework/sinatra/support'
 cs__scoped_require 'contrast/components/interface'
 cs__scoped_require 'contrast/utils/class_util'
 
@@ -20,8 +19,9 @@ module Contrast
       # Rack will be a special case that may involve updating some logic to handle only applying Rack if Rails/Sinatra
       # do not exist
       SUPPORTED_FRAMEWORKS = [
-        Contrast::Framework::RailsSupport,
-        Contrast::Framework::SinatraSupport
+        Contrast::Framework::Rails::Support,
+        Contrast::Framework::Sinatra::Support,
+        Contrast::Framework::Rack::Support
       ].cs__freeze
 
       def initialize
@@ -34,8 +34,28 @@ module Contrast
         @_frameworks.compact!
       end
 
-      def find_applicable_view_technologies
-        scan_views_for_all_frameworks
+      # Patches that have to be applied as early as possible to catch calls
+      # that happen prior to the first Request, typically those around
+      # configuration.
+      def before_load_patches!
+        @_before_load_patches ||= begin
+                                    SUPPORTED_FRAMEWORKS.each(&:before_load_patches)
+                                    true
+                                  end
+      end
+
+      # Return all the After Load Patches for all the Frameworks we know, even
+      # if that Framework hasn't been detected.
+      #
+      # @return [Set<Contrast::Agent::Patching::Policy::AfterLoadPatch>] the
+      #   AfterLoadPatches of each framework
+      def find_after_load_patches
+        patches = Set.new
+        SUPPORTED_FRAMEWORKS.each do |framework|
+          framework_patches = framework.after_load_patches
+          patches.merge(framework_patches) if framework_patches && !framework_patches.empty?
+        end
+        patches
       end
 
       def find_route_discovery_data
@@ -58,7 +78,7 @@ module Contrast
 
       def app_root
         found = first_framework_result :application_root, nil
-        found || Rack::Directory.new('').root
+        found || ::Rack::Directory.new('').root
       end
 
       # If we have 0 or n > 1 frameworks, we need to use the default rack request
@@ -67,7 +87,7 @@ module Contrast
       def retrieve_request env
         return @_frameworks[0].retrieve_request(env) if @_frameworks.length == 1
 
-        Rack::Request.new(env)
+        ::Rack::Request.new(env)
       end
 
       # @param env [Hash] the various variables stored by this and other Middlewares to know the state
@@ -86,7 +106,7 @@ module Contrast
         result = nil
         @_frameworks.find do |framework_klass|
           # TODO: RUBY-763 Sinatra::Base#call patch adds the Route report
-          next if framework_klass == Contrast::Framework::SinatraSupport
+          next if framework_klass == Contrast::Framework::Sinatra::Support
 
           result = framework_klass.current_route(request)
         end
@@ -99,10 +119,6 @@ module Contrast
         Contrast::Utils::ClassUtil.truly_defined?(klass)
       end
 
-      def scan_views_for_all_frameworks
-        data_for_all_frameworks :scan_views
-      end
-
       def routes_for_all_frameworks
         data_for_all_frameworks :collect_routes
       end

data/lib/contrast/framework/rack/patch/session_cookie.rb

@@ -0,0 +1,126 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Framework
+    module Rack
+      module Patch
+        # Our patch into the Rack::Session::Cookie Class, allowing for the
+        # runtime detection of insecure configurations on individual cookies
+        # within the application
+        class SessionCookie
+          include Contrast::Components::Interface
+
+          access_component :agent, :analysis, :logging, :scope
+
+          CS__SECURE_RULE_NAME = 'secure-flag-missing'
+          CS__HTTPONLY_NAME = 'rails-http-only-disabled'
+          CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+          SAFE_SESSION_TIMEOUT = (30 * 60 * 60)
+          class << self
+            include Contrast::Utils::InvalidConfigurationUtil
+
+            def instrument
+              @_instrument ||= begin
+                                 ::Rack::Session::Cookie.class_eval do
+                                   alias_method :cs__patched_initialize, :initialize
+                                   def initialize app, options = {}
+                                     Contrast::Framework::Rack::Patch::SessionCookie.analyze(options)
+                                     cs__patched_initialize(app, options)
+                                   end
+                                 end
+                                 true
+                               end
+            end
+
+            def analyze options
+              return unless AGENT.enabled?
+              return if PROTECT.enabled?
+
+              apply_session_timeout(options)
+              apply_httponly(options)
+              apply_secure_session(options)
+            end
+
+            private
+
+            def vulnerable_setting?(setting_key,
+                                    safe_settings_value,
+                                    options, safe_default: true,
+                                    comparison_type: nil)
+              # In most cases, Rack is pretty nice and the default value is safe
+              return !safe_default unless options&.key?(setting_key)
+
+              value = options[setting_key]
+
+              return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+              value != safe_settings_value
+            end
+
+            def apply_secure_session options
+              return unless vulnerable_setting?(
+                  :secure,
+                  true,
+                  options,
+                  safe_default: false)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__SECURE_RULE_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to secure session', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_session_timeout options
+              return unless vulnerable_setting?(:expire_after,
+                                                SAFE_SESSION_TIMEOUT,
+                                                options,
+                                                safe_default: false,
+                                                comparison_type: :greater_than)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__SESSION_TIMEOUT_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to set session timeout', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_httponly options
+              return unless vulnerable_setting?(:httponly, true, options)
+
+              with_contrast_scope do
+                cs__report_finding(
+                    CS__HTTPONLY_NAME,
+                    options,
+                    caller_locations(10, 9)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to httponly', e)
+              rescue StandardError
+                nil
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end