contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/framework/rack/patch/support.rb

@@ -0,0 +1,24 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+
+module Contrast
+  module Framework
+    module Rack
+      module Patch
+        # Extension point allowing for the registration of Patches required to
+        # support the Rack framework.
+        module Support
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            Set.new([Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                'Rack::Session::Cookie',
+                'contrast/framework/rack/patch/session_cookie',
+                instrumenting_module: 'Contrast::Framework::Rack::Patch::SessionCookie')])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rack/support.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/base_support'
+cs__scoped_require 'contrast/framework/rack/patch/support'
+
+module Contrast
+  module Framework
+    module Rack
+      # Used when Rack is present to define framework specific behavior. For
+      # now, the only part of this implemented is the Patch Support.
+      class Support < BaseSupport
+        extend Contrast::Framework::Rack::Patch::Support
+        class << self
+          def detection_class
+            'don\'t let me be detected'
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb

@@ -0,0 +1,41 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # This class acts as our patch into the ActionController::Live::Buffer
+        # class, allowing us to track the close event on streamed responses.
+        class ActionControllerLiveBuffer
+          class << self
+            def send_messages
+              return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
+
+              [context.server_activity, context.activity, context.observed_route].each do |msg|
+                Contrast::Agent.messaging_queue.send_event_immediately(msg)
+              end
+            end
+
+            def instrument
+              @_instrument ||= begin
+                                 ::ActionController::Live::Buffer.class_eval do
+                                   # normally pre->in->post filters are applied however, in a streamed response
+                                   # we can run into a case where it's pre -> in -> post -> more infilters
+                                   # in order to submit anything found during the infilters after the response has
+                                   # been written we need to explicitly send them
+                                   alias_method :cs__close, :close
+                                   def close
+                                     Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer.send_messages
+                                     cs__close
+                                   end
+                                 end
+                                 true
+                               end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/assess_configuration.rb

@@ -0,0 +1,102 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+cs__scoped_require 'contrast/utils/invalid_configuration_util'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # This module is used to analyze rails session storage configuration for assess vulnerabilities
+        module AssessConfiguration
+          include Contrast::Components::Interface
+
+          access_component :agent, :analysis, :logging, :scope
+
+          CS__SESSION_TIMEOUT_NAME = 'session-timeout'
+          SAFE_SESSION_TIMEOUT = (30 * 60 * 1000)
+          CS__SECURE_RULE_NAME = 'secure-flag-missing'
+          CS__HTTPONLY_RULE_NAME = 'rails-http-only-disabled'
+
+          class << self
+            include Contrast::Utils::InvalidConfigurationUtil
+
+            def analyze_session_store *args
+              return if PROTECT.enabled?
+
+              apply_httponly_disabled(*args)
+              apply_secure_cookie_disabled(*args)
+              apply_session_timeout(*args)
+            end
+
+            private
+
+            def vulnerable_setting? setting_key, safe_settings_value, original_args, safe_default: true, comparison_type: nil
+              # In most cases, Rails is pretty nice and the default value is safe
+              return !safe_default unless original_args && original_args.length > 1
+
+              # If the user overrode some args, but not ours, fall back on the default
+              rails_session_settings = original_args[1]
+              return !safe_default unless rails_session_settings&.key?(setting_key)
+
+              value = rails_session_settings[setting_key]
+
+              return value.to_i > safe_settings_value.to_i if comparison_type&.to_sym == :greater_than
+
+              value != safe_settings_value
+            end
+
+            def apply_session_timeout *args
+              return if ASSESS.rule_disabled? CS__SESSION_TIMEOUT_NAME
+              return unless vulnerable_setting?(:expire_after, SAFE_SESSION_TIMEOUT, args, comparison_type: :greater_than, safe_default: false)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__SESSION_TIMEOUT_NAME, rails_session_settings, caller_locations(6, 5)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to set session timeout', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_secure_cookie_disabled *args
+              return if ASSESS.rule_disabled? CS__SECURE_RULE_NAME
+              return unless vulnerable_setting?(:secure, true, args)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__SECURE_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to disable secure cookies', e)
+              rescue StandardError
+                nil
+              end
+            end
+
+            def apply_httponly_disabled *args
+              return if ASSESS.rule_disabled? CS__HTTPONLY_RULE_NAME
+              return unless vulnerable_setting?(:httponly, true, args)
+
+              rails_session_settings = args[1]
+              with_contrast_scope do
+                cs__report_finding(CS__HTTPONLY_RULE_NAME, rails_session_settings, caller_locations(6, 5)[0])
+              end
+            rescue StandardError => e
+              begin
+                logger.error('Unable to track call to disable httponly in session cookie', e)
+              rescue StandardError
+                nil
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/rails_application_configuration.rb

@@ -0,0 +1,31 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/rails/patch/assess_configuration'
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # Our patch into the Rails::Application::Configuration Class, allowing
+        # for the runtime detection of insecure configurations on individual
+        # ActionDispatch::Session::AbstractStore instances within the
+        # application.
+        class RailsApplicationConfiguration
+          def self.instrument
+            @_instrument ||= begin
+                               ::Rails::Application::Configuration.class_eval do
+                                 alias_method :cs__patched_session_store, :session_store
+                                 def session_store *args
+                                   ret = cs__patched_session_store(*args)
+                                   Contrast::Framework::Rails::Patch::AssessConfiguration.analyze_session_store(*args)
+                                   ret
+                                 end
+                               end
+                               true
+                             end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/patch/support.rb

@@ -0,0 +1,67 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/framework/rails/patch/rails_application_configuration'
+cs__scoped_require 'contrast/agent/patching/policy/after_load_patch'
+
+module Contrast
+  module Framework
+    module Rails
+      module Patch
+        # Extension point allowing for the registration of Patches required to
+        # support the Rails framework.
+        module Support
+          # (See BaseSupport#before_load_patches)
+          def before_load_patches!
+            return unless defined?(::Rails)
+
+            # In Rails, session configuration occurs extremely early & only once.
+            # If we defer our patching of the rails session configuration too long
+            # (i.e., where we normally patch) we will miss the configuration
+            # and will never be able to report session misconfiguration rules.
+            Contrast::Framework::Rails::Patch::RailsApplicationConfiguration.instrument
+            cs__scoped_require 'contrast/agent/railtie' if ::Rails::VERSION::MAJOR.to_i >= 3
+          end
+
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            Set.new([
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActionController::Live::Buffer',
+                          'contrast/framework/rails/patch/action_controller_live_buffer',
+                          instrumenting_module: 'Contrast::Framework::Rails::Patch::ActionControllerLiveBuffer'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'Rails::Application::Configuration',
+                          'contrast/framework/rails/patch/rails_application_configuration',
+                          method_to_instrument: :session_store,
+                          instrumenting_module: 'Contrast::Framework::Rails::Patch::RailsApplicationConfiguration'),
+
+                      # TODO: RUBY-714 remove w/ EOL of 2.5
+                      #
+                      # @deprecated  Everything past here is used for Rewriting and can
+                      #   be removed once we no longer support 2.5.
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActionController::Railties::Helper::ClassMethods',
+                          'contrast/framework/rails/rewrite/action_controller_railties_helper_inherited',
+                          method_to_instrument: :inherited,
+                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActionControllerRailtiesHelperInherited'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActiveRecord::AttributeMethods::Read::ClassMethods',
+                          'contrast/framework/rails/rewrite/active_record_attribute_methods_read',
+                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordAttributeMethodsRead'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActiveRecord::Scoping::Named::ClassMethods',
+                          'contrast/framework/rails/rewrite/active_record_named',
+                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordNamed'),
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods',
+                          'contrast/framework/rails/rewrite/active_record_time_zone_inherited',
+                          method_to_instrument: :inherited,
+                          instrumenting_module: 'Contrast::Framework::Rails::Rewrite::ActiveRecordTimeZoneInherited')
+                    ])
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/action_controller_railties_helper_inherited.rb

@@ -0,0 +1,34 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    module Rails
+      module Rewrite
+        # Used to monkey patch all the inherited calls in action_pack
+        #
+        # This is the usual entry point for Rails inheritance work, so it should
+        # catch most of the calls to inherited.
+        # TODO: RUBY-714 remove w/ EOL of 2.5
+        # @deprecated Changes to this class are discouraged as this approach is
+        #   being phased out with support for those language versions.
+        class ActionControllerRailtiesHelperInherited
+          def self.instrument
+            @_instrument ||= begin
+                               ::ActionController::Railties::Helpers.class_eval do
+                                 alias_method :cs__patched_helper_inherited, :inherited
+                                 def inherited klass
+                                   klass&.instance_variable_set(:@cs__defining_class, true)
+                                   cs__patched_helper_inherited(klass)
+                                 ensure
+                                   klass&.instance_variable_set(:@cs__defining_class, false)
+                                 end
+                               end
+                               true
+                             end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/active_record_attribute_methods_read.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    module Rails
+      module Rewrite
+        # Rails / ActiveRecord are sneaky. They define attributes of a class in
+        # one method, then monkey patch allocate in another and finally invoke
+        # module_eval in this method... but of course they use a '_tmp_' header
+        # for the method name and then alias it in this module to name it what
+        # we expect
+        #
+        # TODO: RUBY-714 remove w/ EOL of 2.5
+        # @deprecated Changes to this class are discouraged as this approach is
+        #   being phased out with support for those language versions.
+        class ActiveRecordAttributeMethodsRead
+          def self.instrument
+            @_instrument ||= begin
+                           ::ActiveRecord::AttributeMethods::Read::ClassMethods.class_eval do
+                             alias_method :cs__patched_define_method_attribute, :define_method_attribute
+
+                             def define_method_attribute *args, &block
+                               ret = cs__patched_define_method_attribute(*args, &block)
+                               method_name = args[0]
+                               Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
+                               ret
+                             end
+
+                             protected :cs__patched_define_method_attribute, :define_method_attribute
+                           end
+                           true
+                         end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/active_record_named.rb

@@ -0,0 +1,73 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/components/interface'
+
+module Contrast
+  module Framework
+    module Rails
+      module Rewrite
+        # Our patch into the ActiveRecord::Scoping::Named::ClassMethods Module,
+        # allowing for the runtime rewrite of interpolation calls defined in
+        # methods defined dynamically during application execution.
+        #
+        # TODO: RUBY-714 remove w/ EOL of 2.5
+        # @deprecated Changes to this class are discouraged as this approach is
+        #   being phased out with support for those language versions.
+        class ActiveRecordNamed
+          include Contrast::Components::Interface
+          access_component :agent, :logging
+
+          class << self
+            def rewrite mod, method_name, body
+              return body unless AGENT.rewrite_interpolation?
+              return body unless body.is_a?(Proc)
+
+              location = body.source_location
+              return body unless location_available?(location)
+
+              opener = Contrast::Agent::ClassReopener.new(Contrast::Agent::ModuleData.new(mod))
+              original_source_code = opener.source_code(location, method_name)
+              return body unless original_source_code
+              return body if Contrast::Agent::Rewriter.send(:unrepeatable?, original_source_code)
+              return body unless Contrast::Agent::Rewriter.send(:interpolations?, original_source_code)
+
+              # the code looks like 'source :some_method_name, ->lambda_literal'
+              # we just need the lambda
+              body_start = original_source_code.index(',') + 1
+              original_source_code = original_source_code[body_start..-1]
+
+              new_method_source = Contrast::Agent::Rewriter.send(:rewrite_method, original_source_code)
+              return body unless Contrast::Agent::Rewriter.send(:valid_code?, new_method_source)
+
+              unbound_eval(cs__name, new_method_source)
+            rescue SyntaxError, StandardError => e
+              logger.debug('Can\'t parse method source in scoped method', e, method: method_name)
+              body
+            end
+
+            # Good news, once we patch the body once, the source location
+            # becomes eval. We may need to fix this later though (so it may
+            # be bad news)
+            def location_available? location
+              return false if location.nil?
+              return false if location.empty? || location[0].empty? || location[0].include?('eval')
+
+              true
+            end
+
+            def instrument
+              @_instrument_named_track ||= begin
+                                                 cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
+                                                 true
+                                               end
+            rescue StandardError, LoadError => e
+              logger.error('Error loading active record named track patch', e)
+              false
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/rails/rewrite/active_record_time_zone_inherited.rb

@@ -0,0 +1,33 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Framework
+    module Rails
+      module Rewrite
+        # Used to monkey patch all the inherited calls in action_pack
+        # TODO: RUBY-714 remove w/ EOL of 2.5
+        # @deprecated Changes to this class are discouraged as this approach is
+        #   being phased out with support for those language versions.
+        class ActiveRecordTimeZoneInherited
+          def self.instrument
+            @_instrument ||= begin
+                               ::ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods.class_eval do
+                                 private
+
+                                 alias_method :cs__patched_inherited, :inherited
+                                 def inherited klass
+                                   klass&.instance_variable_set(:@cs__defining_class, true)
+                                   cs__patched_inherited(klass)
+                                 ensure
+                                   klass&.instance_variable_set(:@cs__defining_class, false)
+                                 end
+                               end
+                               true
+                             end
+          end
+        end
+      end
+    end
+  end
+end