contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/extensions/ruby_core/assess/xpath_library_trigger.rb

@@ -1,40 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-# This module acts a trigger to handle the special cases of the XPath library gem
-# and the Oga gem. Untrusted data may come into either of the trigger methods from
-# these classes as an array or hash, respectively. Since untrusted user input comes
-# into these triggers as a splat argument or an options hash, we need to iterate
-# thorugh these objects to see if we were tracking on any of them and report a finding
-# if so.
-module XPathLibraryTrigger
-  include Contrast::Components::Interface
-
-  class << self
-    def xpath_trigger_check context, trigger_node, _source, object, ret, *args
-      return ret unless args
-
-      # convert the options arg in Oga::XML::CharacterNode#initialize into an
-      # array of its values so we can check if any are unsafe
-      args = args.first.values if oga_defined? && object.cs__is_a?(Oga::XML::CharacterNode) && args.first.cs__is_a?(Hash)
-
-      args.each do |arg|
-        next unless arg.cs__is_a?(String) || arg.cs__is_a?(Symbol)
-        next unless arg.cs__tracked?
-        next unless trigger_node.violated?(arg)
-
-        Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(
-            context, trigger_node, arg, object, ret, args)
-      end
-
-      ret
-    end
-
-    private
-
-    def oga_defined?
-      @_oga_defined ||= defined?(Oga::XML::CharacterNode)
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/eval_trigger.rb

@@ -1,51 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module CoreExtensions
-    module Assess
-      # This Module allows us to track calls to the BasicObject#eval method,
-      # which violates the design of most methods we track in that we have to
-      # apply the trigger in a custom patch over one of the generic triggers in
-      # TriggerMethod.
-      module EvalTrigger
-        def instance_eval_trigger_check source, ret
-          apply_trigger(source, ret, 'BasicObject', :instance_eval)
-        end
-
-        def eval_trigger_check source, ret, method
-          apply_trigger(source, ret, 'Module', method)
-        end
-
-        def apply_trigger source, ret, clazz, method
-          current_context = Contrast::Agent::REQUEST_TRACKER.current
-          return unless current_context
-
-          # Since we know this is the source of the trigger, we can do some
-          # optimization here and return when it is not tracked
-          return unless Contrast::Utils::Assess::TrackingUtil.tracked?(source)
-
-          # source might not be all the args passed in, but it is the one we care
-          # about. we could pass in all the args in the last param here if it
-          # becomes an issue in rendering on TS
-          Contrast::Agent::Assess::Policy::TriggerMethod.apply_eval_trigger(
-              current_context,
-              trigger_node(clazz, method),
-              source,
-              self,
-              ret,
-              source)
-        end
-
-        private
-
-        def trigger_node clazz, method
-          triggers = Contrast::Agent::Assess::Policy::Policy.instance.triggers
-          return unless triggers
-
-          triggers.find { |node| node.class_name == clazz && node.method_name == method }
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/inventory/datastores.rb

@@ -1,37 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/data_store_util'
-
-module Contrast
-  module CoreExtensions
-    module Inventory
-      # This Module is how we apply the Data Store detection required for the
-      # FlowMap feature. It is called from our patches of the targeted methods
-      # in which database operations occur. It is responsible for deciding if
-      # the given invocation is worth reporting or not.
-      module DataStores
-        class << self
-          include Contrast::Components::Interface
-
-          access_component :analysis, :logging
-          # The key used in policy.json to indicate the database type to
-          # report.
-          DATA_STORE_MARKER = 'data_store'
-
-          def patched_report_data_store _method, _exception, properties, object, _args
-            return unless INVENTORY.enabled?
-
-            marker = properties[DATA_STORE_MARKER]
-            return unless marker
-
-            Contrast::Utils::DataStoreUtil.report_data_store(marker)
-          rescue StandardError => e
-            logger.error('Error reporting database call', e, object: object)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_command_injection_rule.rb

@@ -1,61 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/protect/rule/cmd_injection'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/applies_deserialization_rule'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the Command Injection rule. It is called
-      # from our patches of the targeted methods in which command execution
-      # occurs. It is responsible for deciding if the infilter methods of the
-      # rule should be invoked.
-      # In addition, b/c of the nature of Deserialization's sand boxing
-      # function, this Module's apply methods call through to the
-      # {#apply_deserialization_command_check} method of the
-      # Deserialization applicator.
-      module AppliesCommandInjectionRule
-        extend Contrast::CoreExtensions::Protect::RuleApplicator
-
-        CS__SEMICOLON = '; '
-
-        class << self
-          def invoke method, _exception, _properties, object, args
-            return unless valid_command?(args)
-
-            command = build_command(args)
-            Contrast::CoreExtensions::Protect::AppliesDeserializationRule.apply_deserialization_command_check(command)
-            return if skip_analysis?
-
-            begin
-              clazz = object.is_a?(Module) ? object : object.cs__class
-              class_name = clazz.cs__name
-              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, class_name, method, command)
-            end
-          end
-
-          protected
-
-          def name
-            Contrast::Agent::Protect::Rule::CmdInjection::NAME
-          end
-
-          private
-
-          def valid_command? command
-            command && (command.is_a?(String) || command.is_a?(Array))
-          end
-
-          def build_command command
-            return command if command.is_a?(String)
-
-            command = command.drop(1) if command.length > 1
-            command.join(CS__SEMICOLON)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_deserialization_rule.rb

@@ -1,50 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/protect/rule/deserialization'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the Deserialization rule. It is called from
-      # our patches of the targeted methods in which deserialization occurs.
-      # It is responsible for deciding if the infilter methods of the rule
-      # should be invoked.
-      module AppliesDeserializationRule
-        extend Contrast::CoreExtensions::Protect::RuleApplicator
-
-        class << self
-          def invoke _method, _exception, _properties, _object, args
-            return unless valid_input?(args)
-            return if skip_analysis?
-
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, args[0])
-          end
-
-          def apply_deserialization_command_check command
-            return unless command
-            return if skip_analysis?
-
-            rule.check_command_scope(command)
-          end
-
-          protected
-
-          def name
-            Contrast::Agent::Protect::Rule::Deserialization::NAME
-          end
-
-          private
-
-          def valid_input? args
-            return false unless args&.any?
-
-            input = args[0]
-            input.is_a?(String)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_no_sqli_rule.rb

@@ -1,66 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/protect/rule/no_sqli'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the NoSQL Injection rule. It is called from
-      # our patches of the targeted methods in which the execution of String
-      # based NoSQL queries occur. It is responsible for deciding if the
-      # infilter methods of the rule should be invoked.
-      module AppliesNoSqliRule
-        extend Contrast::CoreExtensions::Protect::RuleApplicator
-
-        class << self
-          def invoke method, _exception, properties, _object, args
-            return unless valid_input?(args)
-            return if skip_analysis?
-
-            database = properties['database']
-            operations = args[0]
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            if operations.is_a?(Array)
-              operations.each do |m|
-                handle_operation(context, database, method, m)
-              end
-            else
-              handle_operation(context, database, method, operations)
-            end
-          end
-
-          protected
-
-          def name
-            Contrast::Agent::Protect::Rule::NoSqli::NAME
-          end
-
-          private
-
-          def valid_input? args
-            return false unless args&.any?
-
-            args[0]
-          end
-
-          def handle_operation context, database, _action, operation
-            data = extract_mongo_data(operation)
-            return unless data && !data.empty?
-
-            rule.infilter(context, database, data)
-          end
-
-          def extract_mongo_data operation
-            if operation.cs__respond_to? :selector
-              operation.selector
-            elsif operation.cs__respond_to? :documents
-              operation.documents
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_path_traversal_rule.rb

@@ -1,115 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/protect/rule/path_traversal'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
-cs__scoped_require 'contrast/utils/object_share'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the Path Traversal rule. It is called from
-      # our patches of the targeted methods in which File or IO access occur.
-      # It is responsible for deciding if the infilter methods of the rule
-      # should be invoked.
-      module AppliesPathTraversalRule
-        extend Contrast::CoreExtensions::Protect::RuleApplicator
-
-        class << self
-          def invoke method, _exception, properties, object, args
-            return unless args&.any?
-
-            path = args[0]
-            return unless path.is_a?(String)
-            return if skip_analysis?
-
-            action = properties['action']
-            write_marker = write?(action, *args)
-            possible_write = write_marker && possible_write(write_marker)
-            path_traversal_rule(path, possible_write, object, method)
-
-            # If the action was copy, we need to handle the write half of it.
-            # We handled read in line above.
-            return unless action == COPY
-            return unless args.length > 1
-
-            dst = args[1]
-            return unless dst.is_a?(String)
-
-            path_traversal_rule(dst, true, object, method)
-          end
-
-          protected
-
-          def name
-            Contrast::Agent::Protect::Rule::PathTraversal::NAME
-          end
-
-          private
-
-          def possible_write input
-            input.cs__respond_to?(:to_s) &&
-                input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
-          end
-
-          READ = 'read'
-          WRITE = 'write'
-          COPY = 'copy'
-          def write? action, *args
-            return false if action == READ
-            return false if action == COPY
-            return true if action == WRITE
-
-            write_marker = args.length > 1 ? args[1] : nil
-            write_marker && possible_write(write_marker)
-          end
-
-          def path_traversal_rule path, possible_write, object, method
-            return unless applies_to?(path, possible_write)
-
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, method, path)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error('Error applying path traversal', e, module: object.cs__class.cs__name, method: method)
-          end
-
-          CS__SAFER_REL_PATHS = %w[public app log tmp].cs__freeze
-          def safer_abs_paths
-            @_safer_abs_paths ||= begin
-              pwd = ENV['PWD']
-              if pwd
-                tmp = CS__SAFER_REL_PATHS.map { |r| "#{ pwd }/#{ r }" }
-                gems = ENV['GEM_PATH']
-                tmp += gems.split(Contrast::Utils::ObjectShare::COLON) if gems
-                tmp
-              else
-                []
-              end
-            end
-          end
-
-          def applies_to? path, possible_write = false
-            # any possible write is a potential risk
-            return true if possible_write
-
-            # any path that moves 'up' is a potential risk
-            return true if path.index(Contrast::Utils::ObjectShare::PARENT_PATH)
-
-            path = path.downcase
-            if path.start_with?(Contrast::Utils::ObjectShare::SLASH)
-              safer_abs_paths.each do |prefix|
-                return false if path.start_with?(prefix)
-              end
-            else
-              CS__SAFER_REL_PATHS.each do |prefix|
-                return false if path.start_with?(prefix)
-              end
-            end
-            true
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/applies_sqli_rule.rb

@@ -1,53 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/protect/rule/sqli'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
-cs__scoped_require 'contrast/utils/data_store_util'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the SQL Injection rule. It is called from
-      # our patches of the targeted methods in which the execution of String
-      # based SQL queries occur. It is responsible for deciding if the infilter
-      # methods of the rule should be invoked.
-      class AppliesSqliRule
-        extend Contrast::CoreExtensions::Protect::RuleApplicator
-
-        DATABASE_MYSQL =    'MySQL'
-        DATABASE_SQLITE =   'SQLite3'
-        DATABASE_PG =       'PostgreSQL'
-
-        class << self
-          def invoke _method, _exception, properties, _object, args
-            database = properties['database']
-            return unless database
-
-            index = properties[Contrast::Utils::ObjectShare::INDEX]
-            return unless valid_input?(index, args)
-            return if skip_analysis?
-
-            sql = args[index]
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, database, sql)
-          end
-
-          protected
-
-          def name
-            Contrast::Agent::Protect::Rule::Sqli::NAME
-          end
-
-          private
-
-          def valid_input? index, args
-            return false unless args && args.length > index
-
-            sql = args[index]
-            sql && !sql.empty?
-          end
-        end
-      end
-    end
-  end
-end