contrast-agent 3.12.0 → 3.13.2

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -0,0 +1,46 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/assess/tracking_util'
+cs__scoped_require 'base64'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the TraceEventSignature protobuf model
+      module TraceEventSignature
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for TraceEventSignature
+        module ClassMethods
+          def build ret_obj, policy_node, args
+            signature = new
+            return_type = ret_obj ? ret_obj.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
+            signature.return_type = Contrast::Utils::StringUtils.force_utf8(return_type)
+            signature.class_name = Contrast::Utils::StringUtils.force_utf8(policy_node.class_name)
+            signature.method_name = Contrast::Utils::StringUtils.force_utf8(policy_node.method_name)
+            if args
+              args&.each do |arg|
+                arg_type = arg ? arg.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
+                signature.arg_types << Contrast::Utils::StringUtils.force_utf8(arg_type)
+              end
+            end
+            signature.constructor = policy_node.method_name == :new
+            # if there's a ret, then this method isn't nil. not 100% full proof since you can
+            # return nil, but this is the best we've got currently.
+            signature.void_method = ret_obj.nil?
+            # 8 is STATIC in Java... we have to placate them for now
+            # it has been requested that flags be removed since it isn't used
+            signature.flags = 8 unless policy_node.instance_method?
+            signature
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceEventSignature.include(Contrast::Api::Decorators::TraceEventSignature)

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -0,0 +1,51 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/object_share'
+cs__scoped_require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the TraceTaintRange protobuf model
+      module TraceTaintRange
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for TraceEventObject
+        module ClassMethods
+          # Convert the tags from Contrast::Agent::Assess::Property::Tagged to
+          # the form required for their Event's DTM.
+          #
+          # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}]
+          # @return [Array<Contrast::Api::Dtm::TraceTaintRange>]
+          def build_for_event tags
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags&.any?
+
+            ranges = []
+            tags.each_value do |value|
+              next if value.empty?
+
+              value.each { |tag| ranges << build(tag) }
+            end
+            ranges
+          end
+
+          # Convert our Tags to their DTM equivalent
+          #
+          # @param tag [Contrast::Agent::Assess::Tag]
+          # @return [Contrast::Api::Dtm::TraceTaintRange]
+          def build tag
+            range = Contrast::Api::Dtm::TraceTaintRange.new
+            range.tag = Contrast::Utils::StringUtils.protobuf_safe_string(tag.label)
+            range.range = tag.start_idx.to_s + Contrast::Utils::ObjectShare::COLON + tag.end_idx.to_s
+            range
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceTaintRange.include(Contrast::Api::Decorators::TraceTaintRange)

data/lib/contrast/api/decorators/trace_taint_range_tags.rb

@@ -0,0 +1,109 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Decorators
+      # A holder for the valid tags that can be sent to the Service, and
+      # ultimately TS, that we have to honor. Placed here so as not to clutter
+      # other code.
+      module TraceTaintRangeTags
+        # EventTagTypeDTM
+        VALID_TAGS = %w[
+          XML_ENCODED
+          XML_DECODED
+          HTML_ENCODED
+          HTML_DECODED
+          URL_ENCODED
+          URL_DECODED
+          CSS_ENCODED
+          CSS_DECODED
+          BASE64_ENCODED
+          BASE64_DECODED
+          JAVASCRIPT_ENCODED
+          JAVASCRIPT_DECODED
+          JAVA_ENCODED
+          JAVA_DECODED
+          CSV_ENCODED
+          CSV_DECODED
+          SQL_ENCODED
+          SQL_DECODED
+          LDAP_ENCODED
+          LDAP_DECODED
+          XPATH_ENCODED
+          XPATH_DECODED
+          OS_ENCODED
+          OS_DECODED
+          VBSCRIPT_ENCODED
+          VBSCRIPT_DECODED
+          POTENTIAL_SANITIZED
+          POTENTIAL_VALIDATED
+          NO_CONTROL_CHARS
+          CUSTOM
+
+          CUSTOM_ENCODED
+          CUSTOM_ENCODED_CMD_INJECTION
+          CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION
+          CUSTOM_ENCODED_HEADER_INJECTION
+          CUSTOM_ENCODED_HQL_INJECTION
+          CUSTOM_ENCODED_LDAP_INJECTION
+          CUSTOM_ENCODED_LOG_INJECTION
+          CUSTOM_ENCODED_NOSQL_INJECTION
+          CUSTOM_ENCODED_PATH_TRAVERSAL
+          CUSTOM_ENCODED_REDOS
+          CUSTOM_ENCODED_REFLECTED_XSS
+          CUSTOM_ENCODED_REFLECTION_INJECTION
+          CUSTOM_ENCODED_SMTP_INJECTION
+          CUSTOM_ENCODED_SQL_INJECTION
+          CUSTOM_ENCODED_SSRF
+          CUSTOM_ENCODED_STORED_XSS
+          CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION
+          CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION
+          CUSTOM_ENCODED_UNSAFE_READLINE
+          CUSTOM_ENCODED_UNSAFE_XML_DECODE
+          CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION
+          CUSTOM_ENCODED_UNVALIDATED_FORWARD
+          CUSTOM_ENCODED_UNVALIDATED_REDIRECT
+          CUSTOM_ENCODED_XPATH_INJECTION
+          CUSTOM_ENCODED_XXE
+          CUSTOM_SECURITY_CONTROL_APPLIED
+
+          CUSTOM_VALIDATED
+          CUSTOM_VALIDATED_CMD_INJECTION
+          CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION
+          CUSTOM_VALIDATED_HEADER_INJECTION
+          CUSTOM_VALIDATED_HQL_INJECTION
+          CUSTOM_VALIDATED_LDAP_INJECTION
+          CUSTOM_VALIDATED_LOG_INJECTION
+          CUSTOM_VALIDATED_NOSQL_INJECTION
+          CUSTOM_VALIDATED_PATH_TRAVERSAL
+          CUSTOM_VALIDATED_REDOS
+          CUSTOM_VALIDATED_REFLECTED_XSS
+          CUSTOM_VALIDATED_REFLECTION_INJECTION
+          CUSTOM_VALIDATED_SMTP_INJECTION
+          CUSTOM_VALIDATED_SQL_INJECTION
+          CUSTOM_VALIDATED_SSRF
+          CUSTOM_VALIDATED_STORED_XSS
+          CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION
+          CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION
+          CUSTOM_VALIDATED_UNSAFE_READLINE
+          CUSTOM_VALIDATED_UNSAFE_XML_DECODE
+          CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION
+          CUSTOM_VALIDATED_UNVALIDATED_FORWARD
+          CUSTOM_VALIDATED_UNVALIDATED_REDIRECT
+          CUSTOM_VALIDATED_XPATH_INJECTION
+          CUSTOM_VALIDATED_XXE
+
+          DATABASE_WRITE
+        ].cs__freeze
+
+        VALID_SOURCE_TAGS = %w[
+          NO_NEWLINES
+          UNTRUSTED
+          CROSS_SITE
+          LIMITED_CHARS
+        ].cs__freeze
+      end
+    end
+  end
+end

data/lib/contrast/api/decorators/user_input.rb

@@ -0,0 +1,40 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/string_utils'
+cs__scoped_require 'contrast/utils/assess/tracking_util'
+cs__scoped_require 'base64'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the TraceEventObject protobuf model
+      module UserInput
+        UNKNOWN_USER_INPUT = Contrast::Api::Dtm::UserInput.new.tap do |user_input|
+          user_input.input_type = :UNKNOWN
+        end.cs__freeze
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to UserInput
+        module ClassMethods
+          def build_from_ia_result ia_result
+            return UNKNOWN_USER_INPUT.dup unless ia_result
+
+            user_input = new
+            user_input.input_type = ia_result.input_type.to_i
+            user_input.matcher_ids = ia_result.ids
+            user_input.path = ia_result.path.to_s
+            user_input.key = ia_result.key.to_s
+            user_input.value = ia_result.value.to_s
+            user_input
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::UserInput.include(Contrast::Api::Decorators::UserInput)

data/lib/contrast/components/app_context.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/sinatra_helper'
 cs__scoped_require 'rubygems/version'
 
 module Contrast
@@ -23,12 +22,6 @@ module Contrast
         DEFAULT_SERVER_NAME = 'localhost'
         DEFAULT_SERVER_PATH = '/'
 
-        def ready?
-          @_ready ||= AGENT.enabled? &&
-              Contrast::Utils::ServiceSenderUtil.connection_established? &&
-              Contrast::Utils::ServiceResponseUtil.update_received?
-        end
-
         def initialize
           original_pid
         end

data/lib/contrast/components/config.rb

@@ -3,6 +3,7 @@
 
 cs__scoped_require 'contrast/utils/boolean_util'
 cs__scoped_require 'contrast/utils/env_configuration_item'
+cs__scoped_require 'contrast/utils/object_share'
 cs__scoped_require 'contrast/configuration'
 
 module Contrast
@@ -69,17 +70,11 @@ module Contrast
         end
 
         def session_id
-          @_session_id ||= begin
-                             s = raw.application.session_id || ''
-                             s.empty? ? nil : s
-                           end
+          @_session_id ||= raw.application.session_id || Contrast::Utils::ObjectShare::EMPTY_STRING
         end
 
         def session_metadata
-          @_session_metadata ||= begin
-                                   s = raw.application.session_metadata || ''
-                                   s.empty? ? nil : s
-                                 end
+          @_session_metadata ||= raw.application.session_metadata || Contrast::Utils::ObjectShare::EMPTY_STRING
         end
 
         def valid?
@@ -98,7 +93,7 @@ module Contrast
           # If the config is invalid, and you want to know about it, then
           # you have a circular dependency if you try to log it,
           # hence `log: false`.
-          if session_id && session_metadata
+          if !session_id.empty? && !session_metadata.empty?
             if log
               cs__class.log_error(SESSION_VARIABLES)
             else

data/lib/contrast/components/interface.rb

@@ -120,7 +120,7 @@ module Contrast
 
             @_access_component[sym] = true
           else
-            raise NotImplementedError, "#{ self } asked to access undefined component '#{ sym }'."
+            raise NoMethodError, "#{ self } asked to access undefined component '#{ sym }'."
           end
         end
       end

data/lib/contrast/components/settings.rb

@@ -75,12 +75,6 @@ module Contrast
           end
         end
 
-        def session_id
-          # TODO: RUBY-900 we shouldn't send things w/o having session id,
-          #   figure out how this happened and fix it.
-          application_state[:session_id] || Contrast::Utils::ObjectShare::EMPTY_STRING
-        end
-
         def initialize
           reset_state
         end

data/lib/contrast/configuration.rb

@@ -88,13 +88,13 @@ module Contrast
           puts "!!! Contrast - Configuration file at #{ path } is not readable by current user"
           next
         end
-        config = yaml_to_hash(path)
+        config = yaml_to_hash(path) || {}
         break
       end
 
       if config.empty?
         puts "!!! Contrast - working directory: #{ Dir.pwd }"
-        puts '!!! Contrast - configuration file could not be found at any of the search paths'
+        puts '!!! Contrast - valid configuration file could not be found at any of the search paths'
         puts 'Valid configuration paths are: '
         configuration_paths.each do |path|
           puts(path)

data/lib/contrast/extension/assess.rb

@@ -20,7 +20,6 @@ module Contrast
       cs__scoped_require 'contrast/agent/assess/rule/provider'
 
       # tagging / dataflow
-      cs__scoped_require 'contrast/agent/assess/adjusted_span'
       cs__scoped_require 'contrast/agent/assess/policy/policy_node'
       cs__scoped_require 'contrast/agent/assess/policy/source_node'
       cs__scoped_require 'contrast/agent/assess/policy/source_method'

data/lib/contrast/extension/assess/assess_extension.rb

@@ -122,8 +122,7 @@ module Contrast
               range = existing[0]
               range.repurpose(0, ret_length)
             else
-              span = Contrast::Agent::Assess::AdjustedSpan.new(0, ret_length)
-              ret.cs__properties.add_tag(key, span)
+              ret.cs__properties.add_tag(key, 0...ret_length)
             end
           end
         end

data/lib/contrast/extension/assess/fiber.rb

@@ -99,7 +99,7 @@ module Contrast
 
           def instrument_fiber_track
             @_instrument_fiber_variables ||= begin
-                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track'
+                cs__scoped_require 'cs__assess_fiber_track/cs__assess_fiber_track' if Funchook.available?
                 true
               end
           rescue StandardError, LoadError => e

data/lib/contrast/extension/assess/string.rb

@@ -65,7 +65,7 @@ module Contrast
           def instrument_string_interpolation
             if @_instrument_string_interpolation.nil?
               @_instrument_string_interpolation = begin
-                                                    if AGENT.patch_interpolation?
+                                                    if AGENT.patch_interpolation? && Funchook.available?
                                                       cs__scoped_require 'cs__assess_string_interpolation26/cs__assess_string_interpolation26'
                                                     end
                                                     true

data/lib/contrast/extension/inventory.rb

@@ -11,7 +11,6 @@ module Contrast
     #   relevant given the move to C based patching and the lessons learned
     #   therein.
     module Inventory
-      cs__scoped_require 'contrast/internal_exception'
       cs__scoped_require 'contrast/security_exception'
       # patching
       cs__scoped_require 'contrast/agent/inventory/policy/trigger_node'

data/lib/contrast/framework/base_support.rb

@@ -23,13 +23,6 @@ module Contrast
           raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
         end
 
-        # Iterate through known locations, looking for files
-        # that represent view or template files. If found, for each file in the directory
-        # append the technology and the view object to the application update instance
-        def scan_views
-          raise NoMethodError, 'Subclasses of BaseSupport should implement this method'
-        end
-
         # Find all the predefined routes for this application and append them to the
         # provided inventory message
         # msg should be a Contrast::Api::Dtm::ApplicationUpdate or some other msg
@@ -73,22 +66,6 @@ module Contrast
         def streaming? _env
           false
         end
-
-        protected
-
-        def source_or_string obj
-          if obj.cs__is_a?(Regexp)
-            obj.source
-          elsif obj.cs__respond_to?(:safe_string)
-            obj.safe_string
-          else
-            obj.to_s
-          end
-        end
-
-        def scan_view_directories view_technology_descriptors
-          view_technology_descriptors.reject(&:empty?)
-        end
       end
     end
   end

data/lib/contrast/framework/manager.rb

@@ -1,7 +1,6 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/framework/view_technologies_descriptor'
 cs__scoped_require 'contrast/framework/platform_version'
 cs__scoped_require 'contrast/framework/rack/support'
 cs__scoped_require 'contrast/framework/rails/support'
@@ -59,10 +58,6 @@ module Contrast
         patches
       end
 
-      def find_applicable_view_technologies
-        scan_views_for_all_frameworks
-      end
-
       def find_route_discovery_data
         routes_for_all_frameworks
       end
@@ -124,10 +119,6 @@ module Contrast
         Contrast::Utils::ClassUtil.truly_defined?(klass)
       end
 
-      def scan_views_for_all_frameworks
-        data_for_all_frameworks :scan_views
-      end
-
       def routes_for_all_frameworks
         data_for_all_frameworks :collect_routes
       end