contrast-agent 3.11.0 → 3.13.1

data/lib/contrast/agent/protect/rule/xxe.rb

@@ -77,6 +77,7 @@ module Contrast
 
           def build_sample context, ia_result, _url, **kwargs
             sample = build_base_sample(context, ia_result)
+            sample.user_input = build_user_input(ia_result)
             sample.xxe = kwargs[:details]
             sample
           end

data/lib/contrast/agent/railtie.rb

@@ -24,6 +24,7 @@ module Contrast
 
       rake_tasks do
         load 'contrast/tasks/service.rb'
+        load 'contrast/tasks/config.rb'
       end
     end
   end

data/lib/contrast/agent/reaction_processor.rb

@@ -26,14 +26,14 @@ module Contrast
 
         application_settings.reactions.each do |reaction|
           # the enums are all uppercase, we need to downcase them before attempting to log
-          level = reaction.log_level.nil? ? :error : reaction.log_level.downcase
+          level = reaction.log_level.nil? ? :error : reaction.log_level.name.downcase
 
           logger.with_level(level, reaction.message) if reaction.message
 
           case reaction.operation
-          when :DISABLE
+          when Contrast::Api::Settings::Reaction::Operation::DISABLE
             Contrast::Agent::DisableReaction.run reaction, level
-          when :NOOP
+          when Contrast::Api::Settings::Reaction::Operation::NOOP
             # NOOP
           else
             logger.warn(

data/lib/contrast/agent/request.rb

@@ -17,7 +17,7 @@ module Contrast
     # order to avoid repeatedly creating Strings & thrashing GC.
     class Request
       include Contrast::Components::Interface
-      access_component :logging, :scope
+      access_component :agent, :logging, :scope
 
       extend Forwardable
 
@@ -25,66 +25,16 @@ module Contrast
       LAST_REST_TOKEN = %r{/[\d]+$}.cs__freeze
       INNER_NUMBER_MARKER = '/{n}/'
       LAST_NUMBER_MARKER = '/{n}'
-      OMITTED_BODY = '{{body-omitted-by-contrast}}'
 
       attr_reader :rack_request
 
-      def_delegators :@rack_request,
-                     :env,
-                     :query_string,
-                     :user_agent,
-                     :path,
-                     :base_url
-
-      # receiver is memoized because it is the address/host/port of the server, once we
-      # resolve this for the first time, it shouldn't change
-      def self.receiver
-        @_receiver ||= build_receiver
-      end
+      # Delegate calls to the following methods to the attribute @rack_request
+      def_delegators :@rack_request, :base_url, :content_type, :cookies, :env, :ip, :path, :port, :query_string, :request_method, :scheme, :url, :user_agent
 
       def initialize rack_request
         @rack_request = rack_request
       end
 
-      ACCEPT = 'ACCEPT'
-      def accept_headers
-        accepts = Array(normalized_request_headers[ACCEPT])
-        accepts.any? ? accepts : nil
-      end
-
-      STATIC_SUFFIXES = /\.(?:js|css|jpeg|jpg|gif|png|ico|woff|svg|pdf|eot|ttf|jar)$/i.cs__freeze
-      WILDCARD = '*/*'
-      # Utility method for checking if a request is for a static resource.
-      # @return [Boolean] true, if the request is for a well-known static
-      #  type, like the following, and false otherwise: .js, .css, .jpg,
-      # .gif, .png, .ico
-      def static_request?
-        return true if trimmed_uri&.match?(STATIC_SUFFIXES)
-
-        accepts = accept_headers
-        if accepts
-          return false if accepts[0].to_s.start_with?(WILDCARD)
-          return true if media_content_type?(accepts[0])
-        end
-
-        false
-      end
-
-      MEDIA_TYPE_MARKERS = %w[image/ text/css text/javascript].cs__freeze
-      def media_content_type? str
-        str = str.to_s
-        str.start_with?(*MEDIA_TYPE_MARKERS)
-      end
-
-      def trimmed_uri
-        @_trimmed_uri ||= begin
-          raise ArgumentError, 'url was nil when attempting to trim' unless uri
-
-          trimmed = uri.split(Contrast::Utils::ObjectShare::SEMICOLON).first # remove ;jsessionid
-          trimmed.split(Contrast::Utils::ObjectShare::QUESTION_MARK).first # remove ?query_string=
-        end
-      end
-
       # Returns a normalized form of the URI. In "normal" URIs
       # this will return an unchanged String, but in REST-y
       # URIs this will normalize the digit path tokens, e.g.:
@@ -96,73 +46,111 @@ module Contrast
       # Should also handle the ;jsessionid.
       def normalized_uri
         @_normalized_uri ||= begin
-          uri = trimmed_uri
-          uri = uri.gsub(INNER_REST_TOKEN, INNER_NUMBER_MARKER) # replace interior tokens
-          uri.gsub(LAST_REST_TOKEN, LAST_NUMBER_MARKER) # replace last token
-        end
+                               path = rack_request.path
+                               uri = path.split(Contrast::Utils::ObjectShare::SEMICOLON)[0]    # remove ;jsessionid
+                               uri = uri.split(Contrast::Utils::ObjectShare::QUESTION_MARK)[0] # remove ?query_string=
+                               uri.gsub(INNER_REST_TOKEN, INNER_NUMBER_MARKER)                 # replace interior tokens
+                               uri.gsub(LAST_REST_TOKEN, LAST_NUMBER_MARKER)                   # replace last token
+                             end
       end
 
-      UNKNOWN_REQUEST_METHOD = 'UNKNOWN'
-
-      def request_method
-        rack_request.get_header(Rack::REQUEST_METHOD)
-      rescue StandardError => e
-        logger.warn('Unable to extract request method', e)
-        UNKNOWN_REQUEST_METHOD
+      def document_type
+        @_document_type ||= begin
+                              if /xml/i.match?(content_type) || body&.start_with?('<?xml')
+                                :XML
+                              elsif /json/i.match?(content_type) || body&.match?(/\s*[{\[]/)
+                                :JSON
+                              else
+                                :NORMAL
+                              end
+                            end
       end
 
-      def document_type_from_header
-        case content_type
-        when /xml/i
-          :XML
-        when /json/i
-          :JSON
-        when /html/i
-          :NORMAL
-        end
+      # Header keys upcased and any underscores replaced with dashes
+      def headers
+        @_headers ||= begin
+                        with_contrast_scope do
+                          hash = {}
+                          env.each do |key, value|
+                            next unless key
+
+                            name = key.to_s
+                            next unless name.start_with?(Contrast::Utils::ObjectShare::HTTP_SCORE)
+
+                            hash[Contrast::Utils::StringUtils.normalized_key(name)] = value
+                          end
+                          hash
+                        end
+                      end
       end
 
-      def document_type
-        @_document_type ||= begin
-          type = document_type_from_header
-          if type
-            type
-          elsif request_body_str.start_with?('<?xml')
-            :XML
-          elsif request_body_str.match?(/\s*[{\[]/)
-            :JSON
+      def body
+        # Memoize a flag indicating whether we've tried to read the body or not
+        # (can't use body because it might be nil)
+        @_body_read ||= begin
+          body = rack_request.body
+          if defined?(Rack::Multipart) && defined?(Rack::Multipart::UploadedFile) && body.is_a?(Rack::Multipart::UploadedFile)
+            logger.trace("not parsing uploaded file body :: #{ body.original_filename }::#{ body.content_type }")
+            @_body = nil
           else
-            :NORMAL
+            logger.trace("parsing body from request :: #{ body.cs__class.cs__name }")
+            @_body = Contrast::Utils::StringUtils.force_utf8(read_body(body))
           end
+
+          true
         end
+
+        # Return memoized body (which might be nil)
+        @_body
       end
 
-      def request_headers
-        @_request_headers ||= begin
-          with_contrast_scope do
-            headers = header_pairs(env).each_with_object({}) do |pair, h|
-              h[pair[0]] = pair[1]
-            end
-            headers
-          end
-        end
+      # Unlike most of our translation, which is called where needed for each
+      # message and forgotten, we'll leave this method to call the build as we
+      # don't want to pay to reconstruct the DTM for this Request multiple
+      # times.
+      #
+      # @return [Contrast::Api::Dtm::HttpRequest] the SpeedRacer compatible
+      #   form of this Request
+      def dtm
+        @_dtm ||= Contrast::Api::Dtm::HttpRequest.build(self)
       end
 
-      # Header keys upcased and any underscores replaced with dashes
-      def normalized_request_headers
-        @_normalized_request_headers ||= begin
-          hash = {}
-          request_headers.each_pair do |header_name, header_value|
-            hash[Contrast::Utils::StringUtils.normalized_key(header_name)] = header_value
-          end
-          hash
-        end
+      def parameters
+        @_parameters ||= with_contrast_scope { normalize_params(rack_request.params) }
+      end
+
+      def file_names
+        @_file_names ||= begin
+                           names = {}
+                           parsed_data = Rack::Multipart.parse_multipart(rack_request.env)
+                           traverse_parsed_multipart(parsed_data, names)
+                         rescue StandardError => _e
+                           logger.warn('Unable to parse multipart request!')
+                           {}
+                         end
+      end
+
+      def hash_id
+        @_hash_id ||= Contrast::Utils::HashDigest.generate_request_hash(self)
       end
 
-      def header_value key
-        normalized_request_headers[Contrast::Utils::StringUtils.normalized_key(key)]
+      STATIC_SUFFIXES = /\.(?:js|css|jpeg|jpg|gif|png|ico|woff|svg|pdf|eot|ttf|jar)$/i.cs__freeze
+      MEDIA_TYPE_MARKERS = %w[image/ text/css text/javascript].cs__freeze
+      # Utility method for checking if a request is for a static resource.
+      # @return [Boolean] true, if the request is for a well-known static
+      #  type as determined by the request suffix or the accept header.
+      def static?
+        return true if normalized_uri&.match?(STATIC_SUFFIXES)
+
+        accepts = Array(headers['ACCEPT'])&.first&.to_s
+        return false unless accepts
+        return false if accepts.start_with?('*/*')
+
+        accepts.start_with?(*MEDIA_TYPE_MARKERS)
       end
 
+      private
+
       # Return a flattened hash of params with realized paths for keys, in
       # addition to a separate, valueless, entry for each nest key.
       # See RUBY-621 for more details.
@@ -201,237 +189,6 @@ module Contrast
         end
       end
 
-      def request_body
-        # Memoize a flag indicating whether we've tried to read the body or not
-        # (can't use body because it might be nil)
-        @_request_body_read ||= begin
-          body = @rack_request.body
-          if defined?(Rack::Multipart)
-            if defined?(Rack::Multipart::UploadedFile) && body.is_a?(Rack::Multipart::UploadedFile)
-              logger.trace("not parsing uploaded file body :: #{ body.original_filename }::#{ body.content_type }")
-              @_request_body = nil
-            else
-              logger.trace("parsing body from request :: #{ body.cs__class.cs__name }")
-              @_request_body = Contrast::Utils::StringUtils.force_utf8(read_body(body))
-            end
-          else
-            logger.trace('Rack before 1.3.x does not support Rack::Multipart')
-            @_request_body = Contrast::Utils::StringUtils.force_utf8(read_body(body))
-          end
-
-          true
-        end
-
-        # Return memoized body (which might be nil)
-        @_request_body
-      end
-
-      def request_body_str
-        request_body.to_s || Contrast::Utils::ObjectShare::EMPTY_STRING
-      end
-
-      # This will become to_protobuf
-      # Expectation is that all data from a previous phase will be populated
-      # before the subsequent one begins
-      def dtm
-        @_dtm ||= begin
-          with_contrast_scope do
-            http_request = Contrast::Api::Dtm::HttpRequest.new
-            http_request.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
-            http_request.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
-
-            append_receiver(http_request)
-            append_connection(http_request)
-            append_params(http_request)
-            append_headers(http_request)
-            append_body(http_request)
-
-            http_request
-          end
-        end
-      end
-
-      def append_receiver http_request
-        r = cs__class.receiver
-        r.port = port.to_i if port
-        http_request.receiver = r unless r.nil?
-      end
-
-      def append_connection http_request
-        http_request.sender = Contrast::Api::Dtm::Address.new
-        http_request.sender.ip = Contrast::Utils::StringUtils.force_utf8(ip)
-        http_request.protocol = Contrast::Utils::StringUtils.force_utf8(scheme)
-        http_request.version = '1.1' # currently not in rack request; hard-coding
-        http_request.method = Contrast::Utils::StringUtils.force_utf8(request_method)
-        http_request.raw = Contrast::Utils::StringUtils.force_utf8(@rack_request.path_info)
-        http_request.parsed_connection = false
-      end
-
-      def append_params http_request
-        parameters.each do |k, v|
-          next unless k && v
-          next if v.is_a?(Hash)
-
-          key = Contrast::Utils::StringUtils.force_utf8(k)
-          val = Contrast::Utils::StringUtils.force_utf8(v)
-          params = http_request.normalized_request_params
-          params[key] = Contrast::Api::Dtm::Pair.new unless params[key].is_a?(Contrast::Api::Dtm::Pair)
-          params[key].key = key
-          params[key].values << val
-        end
-      end
-
-      def append_headers http_request
-        request_headers.each do |k, v|
-          next unless k && v
-          next if v.is_a?(Hash)
-
-          key = Contrast::Utils::StringUtils.force_utf8(k)
-          val = Contrast::Utils::StringUtils.force_utf8(v)
-          http_request.request_headers[key] = val
-        end
-
-        http_request.parsed_request_headers = true
-
-        normalized_request_headers.each do |k, v|
-          next unless k && v
-          next if v.is_a?(Hash)
-
-          key = Contrast::Utils::StringUtils.force_utf8(k)
-          val = Contrast::Utils::StringUtils.force_utf8(v)
-          http_request.normalized_request_headers[key] ||= Contrast::Api::Dtm::Pair.new
-          http_request.normalized_request_headers[key].key = key
-          http_request.normalized_request_headers[key].values << val
-        end
-
-        request_cookies.each do |k, v|
-          next unless k && v
-          next if v.is_a?(Hash)
-
-          key = Contrast::Utils::StringUtils.force_utf8(k)
-          val = Contrast::Utils::StringUtils.force_utf8(v)
-          http_request.normalized_cookies[key] ||= Contrast::Api::Dtm::Pair.new
-          http_request.normalized_cookies[key].key = key
-          http_request.normalized_cookies[key].values << val
-        end
-      end
-
-      def append_body http_request
-        http_request.document_type = Contrast::Utils::StringUtils.force_utf8(document_type)
-
-        http_request.request_body = if omit_body?
-                                      OMITTED_BODY
-                                    else
-                                      Contrast::Utils::StringUtils.force_utf8(request_body)
-                                    end
-        return if file_names.empty?
-
-        file_names.each do |name, filename|
-          pair = Contrast::Api::Dtm::SimplePair.new
-          pair.key = Contrast::Utils::StringUtils.force_utf8(name)
-          pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
-          http_request.multipart_headers << pair
-        end
-      end
-
-      def omit_body?
-        return true if Contrast::Agent::FeatureState.instance.omit_body?
-        return false if document_type == :XML
-        return false if document_type == :JSON
-
-        content_type&.include?('multipart/form-data')
-      end
-
-      def self.build_receiver
-        address = Contrast::Api::Dtm::Address.new
-        address.host = 'localhost'
-        address.ip = '127.0.0.1'
-        begin
-          Timeout.timeout(1) do
-            address.host = Contrast::Utils::StringUtils.force_utf8(Socket.gethostname)
-            address.ip = Contrast::Utils::StringUtils.force_utf8(Resolv.getaddress(address.host))
-          end
-        rescue StandardError => e
-          logger.warn('Unable to resolve host or ip', e, address: address)
-        end
-        address
-      end
-
-      # Memoized Rack Request Values
-      def ip
-        @_ip ||= @rack_request.ip
-      end
-
-      def scheme
-        @_scheme ||= @rack_request.scheme
-      end
-
-      def port
-        @_port ||= @rack_request.port
-      end
-
-      def uri
-        @_uri ||= @rack_request.path
-      end
-
-      def url
-        @_url ||= @rack_request.url
-      end
-
-      def content_type
-        @_content_type ||= @rack_request.content_type
-      end
-
-      def request_cookies
-        @_request_cookies ||= @rack_request.cookies
-      end
-
-      def parameters
-        @_parameters ||= with_contrast_scope { normalize_params(@rack_request.params) }
-      end
-
-      # End of Rack Request memoized values
-
-      def file_names
-        @_file_names ||= begin
-                           names = {}
-                           parsed_data = Rack::Multipart.parse_multipart(@rack_request.env)
-                           traverse_parsed_multipart(parsed_data, names)
-                         rescue StandardError => _e
-                           logger.warn('Unable to parse multipart request!')
-                           {}
-                         end
-      end
-
-      def hash_id
-        @_hash_id ||= Contrast::Utils::HashDigest.generate_request_hash(self)
-      end
-
-      # we just need to map length to a repeatable value
-      # unlike Java, we hash with strings, so we'll use single character
-      # strings for our purposes.
-      CHARS = %w[a b c d e f g].cs__freeze
-      def normalized_length_header chr
-        chr = chr.to_s
-        tmp = CHARS[Math.log10(chr.length).to_i] if chr
-        tmp ||= CHARS[6]
-        tmp
-      end
-
-      private
-
-      HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
-
-      def header_pairs env
-        selected = env.select do |k, _v|
-          k.to_s.start_with?(Contrast::Utils::ObjectShare::HTTP_SCORE)
-        end
-        selected.map do |k, v|
-          name = k.to_s.sub(HTTP_PREFIX, Contrast::Utils::ObjectShare::EMPTY_STRING)
-          [name, v]
-        end
-      end
-
       def read_body body
         return body if body.is_a?(String)