contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/extensions/ruby_core/protect/applies_xxe_rule.rb

@@ -1,127 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/protect/rule/xxe'
-cs__scoped_require 'contrast/extensions/ruby_core/protect/rule_applicator'
-cs__scoped_require 'contrast/utils/object_share'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the XXE rule. It is called from our patches
-      # of the targeted methods in which XML parsing and entity resolution
-      # occurs. It is responsible for deciding if the infilter methods of the
-      # rule should be invoked.
-      module AppliesXxeRule
-        extend Contrast::CoreExtensions::Protect::RuleApplicator
-
-        class << self
-          def apply_rule method, _exception, _properties, object, args
-            xml = args[0]
-            xxe_check(method, xml, object)
-          end
-
-          # IO is tricky. If we can't rewind it, we can't fix it back to the
-          # original state. To be safe, we'll skip non-rewindable IO objects.
-          def apply_rule__io method, _exception, _properties, object, args
-            need_rewind = false
-            potential_xml = args[0]
-            return unless potential_xml&.respond_to?(:rewind)
-
-            xml = potential_xml.read
-            need_rewind = true
-            xxe_check(method, xml, object)
-          ensure
-            potential_xml.rewind if need_rewind
-          end
-
-          # Oga's Lexer is a special case b/c the information we need is on the
-          # object itself -- specifically in the @data instance variable
-          def apply_rule__lexer method, _exception, _properties, object, _args
-            return unless valid_data_input?(object)
-
-            data = object.instance_variable_get(DATA_KEY)
-            xxe_check(method, data, object)
-          ensure
-            data.rewind if data&.cs__respond_to?(:rewind)
-          end
-
-          protected
-
-          def name
-            Contrast::Agent::Protect::Rule::Xxe::NAME
-          end
-
-          private
-
-          DATA_KEY = '@data'.to_sym
-          def valid_data_input? object
-            object.instance_variable_defined?(DATA_KEY) &&
-                object.instance_variable_get(DATA_KEY)
-          end
-
-          NOKOGIRI_MARKER = 'Nokogiri::'
-          PARSER_NOKOGIRI = 'Nokogiri'
-          OX_MARKER = 'Ox' # breaks marker pattern b/c Ox is entire classname
-          PARSER_OX = 'Ox'
-          OGA_MARKER = 'Oga::'
-          PARSER_OGA = 'Oga'
-          # Given an object, determine the XML parser type that it represents.
-          #
-          # @param object[Object] the parsing instance or Module
-          # @return [String] the name of the parser
-          def determine_parser object
-            clazz = object.is_a?(Module) ? object : object.cs__class
-            name = clazz.cs__name
-
-            if name.start_with?(NOKOGIRI_MARKER)
-              PARSER_NOKOGIRI
-            elsif name.start_with?(OX_MARKER)
-              PARSER_OX
-            elsif name.start_with?(OGA_MARKER)
-              PARSER_OGA
-            end
-          end
-
-          # Given an xml, convert it to a String and pass it to the rule for
-          # analysis.
-          #
-          # @param method [Symbol] the name of the method doing this work.
-          # @param xml [Object] the container of the XML to be checked.
-          # @param potential_parser [Object] the entity that may be an XML
-          #   parser.
-          # @raise [Contrast::SecurityException] Security exception if an XXE
-          #   attack is found and the rule is in block mode.
-          def xxe_check method, xml, potential_parser
-            return if skip_analysis?
-            return unless xml
-
-            parser = determine_parser(potential_parser)
-            return unless parser
-
-            if xml.cs__is_a?(String)
-              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, xml)
-            elsif xml.cs__respond_to?(:each_line)
-              xml.each_line do |line|
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, line)
-              end
-            elsif xml.cs__respond_to?(:each)
-              xml.each do |chunk|
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, chunk)
-              end
-            end
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
-            logger.error(
-                'Error applying xxe',
-                e,
-                module: potential_parser.cs__class.cs__name,
-                method: method, parser: parser)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/extensions/ruby_core/protect/kernel.rb

@@ -1,30 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-# This Module functions as our patch into the Kernel class for Protect,
-# allowing us to track activity as it crosses spawned processes.
-module Kernel
-  class << self
-    include Contrast::Components::Interface
-    access_component :contrast_service
-
-    def cs__protect_build_wrapper
-      lambda {
-        Kernel.cs__protect_proc_start
-        yield
-        # AtExitHook handles sending any messages generated in the new forked process
-      }
-    end
-
-    def cs__protect_proc_start
-      context = Contrast::Agent::REQUEST_TRACKER.current
-      return unless context
-
-      context.reset_activity
-    end
-  end
-end
-
-cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'

data/lib/contrast/extensions/ruby_core/protect/rule_applicator.rb

@@ -1,50 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/data_store_util'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is the base of our Protect Applicators. It lays out the
-      # form of the Applicator, which will override specific implementations
-      # in order to properly invoke its Rule.
-      module RuleApplicator
-        include Contrast::Components::Interface
-
-        access_component :analysis, :logging
-
-        def apply_rule method, exception, properties, object, args
-          invoke(method, exception, properties, object, args)
-        rescue Contrast::SecurityException => e
-          raise e
-        rescue StandardError => e
-          logger.error('Error applying protect rule', e, module: object.cs__class.cs__name, method: method, rule: name)
-        end
-
-        protected
-
-        def invoke _method, _exception, _properties, _object, _args
-          raise NotImplementedError, 'This is abstract, override it.'
-        end
-
-        def name
-          raise NotImplementedError, 'This is abstract, override it.'
-        end
-
-        def rule
-          PROTECT.rule name
-        end
-
-        def skip_analysis?
-          context = Contrast::Agent::REQUEST_TRACKER.current
-          return true unless context&.app_loaded?
-          return true unless rule&.enabled?
-
-          false
-        end
-      end
-    end
-  end
-end

data/lib/contrast/framework/rails_support.rb

@@ -1,104 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Framework
-    # Used when Rails is present to define framework specific behavior
-    class RailsSupport < BaseSupport
-      class << self
-        RAILS_VIEWS = [
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'coffee', %w[CoffeeScript]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/assets', 'scss', %w[SASS]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html', %w[HTML5]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.erb', %w[HTML5 ERB]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('app/views', 'html.haml', %w[HTML5 HAML]),
-          Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
-        ].cs__freeze
-
-        RAILS_MODULE_NAME_VERSION = Gem::Version.new('6.0.0')
-
-        def detection_class
-          'Rails'
-        end
-
-        def version
-          Rails.version
-        end
-
-        def application_name
-          # Rails version 6.0.0 deprecated Rails::Application#parent_name, in Rails 6.1.0 that method will be removed entirely
-          # and instead we need to use parent_module_name
-          return Rails.application.cs__class.parent_module_name if Gem::Version.new(Rails.version) >= RAILS_MODULE_NAME_VERSION
-
-          Rails.application.cs__class.parent_name
-        end
-
-        def application_root
-          Rails.root
-        end
-
-        def server_type
-          'rails'
-        end
-
-        def scan_views
-          scan_view_directories(RAILS_VIEWS)
-        end
-
-        def collect_routes
-          routes = Rails.application.routes.routes.map do |route|
-            route_to_coverage(route)
-          end
-          routes
-        end
-
-        def current_route request
-          return unless Rails.cs__respond_to?(:application)
-
-          # returns array of arrays [[match_data, path_parameters, route]], sorted by
-          # precedence
-          # match_data: ActionDispatch::Journey::Path::Pattern::MatchData
-          # path_parameters: hash of various things
-          # route: ActionDispatch::Journey::Route
-          full_routes = Rails.application.routes.router.send(:find_routes, request.rack_request)
-          return if full_routes.empty?
-
-          full_route = full_routes[0] # [match_data, path_parameters, route]
-          return unless full_route
-
-          route = full_route[2] # route w/ highest precedence
-          return unless route
-
-          route_to_coverage(route)
-        end
-
-        def retrieve_request env
-          rails_env = Rails.application.env_config.merge(env)
-          ActionDispatch::Request.new(rails_env || env)
-        end
-
-        AC_INSTANCE = 'action_controller.instance'
-        def streaming? env
-          return false unless defined?(ActionController::Live)
-
-          env[AC_INSTANCE].cs__class.included_modules.include?(ActionController::Live)
-        end
-
-        private
-
-        # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
-        def route_to_coverage route
-          route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-          route_coverage.route = "#{ route.defaults[:controller] }##{ route.defaults[:action] }"
-
-          verb = source_or_string(route.verb)
-          route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(verb)
-
-          url = source_or_string(route.path.spec)
-          route_coverage.url = Contrast::Utils::StringUtils.force_utf8(url)
-          route_coverage
-        end
-      end
-    end
-  end
-end

data/lib/contrast/framework/sinatra_application_helper.rb

@@ -1,49 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Framework
-    # This module is to help perform sometimes necessary tasks specific to Sinatra
-    module SinatraApplicationHelper
-      SINATRA_VIEWS = [
-        Contrast::Framework::ViewTechnologiesDescriptor.new('public/stylesheets', 'scss', %w[SASS]),
-        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html', %w[HTML5]),
-        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.erb', %w[HTML5 ERB]),
-        Contrast::Framework::ViewTechnologiesDescriptor.new('views', 'html.haml', %w[HTML5 HAML]),
-        Contrast::Framework::ViewTechnologiesDescriptor.new('public', 'html', %w[HTML5])
-      ].cs__freeze
-
-      def app_class
-        @_app_class ||= begin
-                          return nil unless defined?(Sinatra) && defined?(Sinatra::Base)
-
-                          sinatra_layers = ObjectSpace.each_object(Sinatra::Base).to_a
-                          result_layer = sinatra_layers.find { |layer| layer.app.nil? }
-                          result_layer
-                        end
-      end
-
-      def scannable_view_dirs
-        @_scannable_view_dirs ||= begin
-                                    views = SINATRA_VIEWS.dup
-                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'erb', %w[HTML5 ERB]) if view_directory
-                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(view_directory, 'haml', %w[HTML5 HAML]) if view_directory
-                                    views << Contrast::Framework::ViewTechnologiesDescriptor.new(public_directory, 'html', %w[HTML5]) if public_directory
-                                    views
-                                  end
-      end
-
-      def view_directory
-        @_view_directory ||= begin
-                               app_class&.settings&.views
-                             end
-      end
-
-      def public_directory
-        @_public_directory ||= begin
-                                 app_class&.settings&.public_dir
-                               end
-      end
-    end
-  end
-end

data/lib/contrast/framework/sinatra_support.rb

@@ -1,104 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/framework/sinatra_application_helper'
-
-module Contrast
-  module Framework
-    # Used when Sinatra is present to define framework specific behavior
-    class SinatraSupport < BaseSupport
-      extend Contrast::Framework::SinatraApplicationHelper
-      class << self
-        def detection_class
-          'Sinatra'
-        end
-
-        def version
-          Sinatra::VERSION
-        end
-
-        def application_name
-          return unless app_class
-
-          app_class.cs__class.cs__name
-        end
-
-        def application_root
-          return unless app_class
-
-          app_class.root
-        end
-
-        def server_type
-          'sinatra'
-        end
-
-        def scan_views
-          return unless app_class
-
-          scan_view_directories(scannable_view_dirs)
-        end
-
-        # Iterate over every class that extends Sinatra::Base, pull out its routes
-        # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
-        # Contrast::Api::Dtm::RouteCoverage
-        def collect_routes
-          routes = []
-          controllers = sinatra_controllers
-          controllers.each do |clazz|
-            class_routes = sinatra_class_routes(clazz)
-            next unless class_routes
-
-            class_routes.each_pair do |method, list|
-              # item: [ Mustermann::Sinatra, [], Proc]
-              list.each do |item|
-                routes << route_to_coverage(clazz, method, item[0])
-              end
-            end
-          end
-          routes
-        end
-
-        # TODO: RUBY-763
-        def current_route _request
-          nil
-        end
-
-        def retrieve_request env
-          Sinatra::Request.new(env)
-        end
-
-        private
-
-        # Iterate over every class that extends Sinatra::Base, pull out its routes
-        # (array of arrays with Mustermann::Sinatra as [][0]) and convert them into
-        # Contrast::Api::Dtm::RouteCoverage
-        def sinatra_controllers
-          return [] unless defined?(Sinatra) && defined?(Sinatra::Base)
-
-          Contrast::Utils::ClassUtil.descendants(Sinatra::Base)
-        end
-
-        def sinatra_class_routes controller
-          controller.instance_variable_get(:@routes) if controller.instance_variable_defined?(:@routes)
-        rescue StandardError
-          logger.trace('Sinatra controller found with no route instances', module: controller)
-          nil
-        end
-
-        # TODO: RUBY-763
-        # given clazz, method, and Mustermann::Sinatra, build a
-        # Contrast::Api::Dtm::RouteCoverage
-        def route_to_coverage clazz, method, pattern
-          safe_pattern = source_or_string(pattern)
-
-          route_coverage = Contrast::Api::Dtm::RouteCoverage.new
-          route_coverage.route = "#{ clazz }##{ method } #{ safe_pattern }"
-          route_coverage.verb = Contrast::Utils::StringUtils.force_utf8(method)
-          route_coverage.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
-          route_coverage
-        end
-      end
-    end
-  end
-end