contrast-agent 3.12.1 → 3.14.0

data/lib/contrast/api/decorators/route_coverage.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::RouteCoverage} protobuf model
+      # to handle conversion between framework route classes and the dtm.
+      module RouteCoverage
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for RouteCoverage
+        module ClassMethods
+          def source_or_string obj
+            if obj.cs__is_a?(Regexp)
+              obj.source
+            elsif obj.cs__respond_to?(:safe_string)
+              obj.safe_string
+            else
+              obj.to_s
+            end
+          end
+
+          # Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
+          # @param journey_obj [ActionDispatch::Journey::Route] a rails route
+          # @return [Contrast::Api::Dtm::RouteCoverage]
+          def from_action_dispatch_journey journey_obj
+            msg = new
+            msg.route = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
+
+            verb = source_or_string(journey_obj.verb)
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
+
+            url = source_or_string(journey_obj.path.spec)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(url)
+            msg
+          end
+
+          def from_sinatra_route clazz, method, pattern
+            safe_pattern = source_or_string(pattern)
+
+            msg = new
+            msg.route = "#{ clazz }##{ method } #{ safe_pattern }"
+            msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
+            msg.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
+            msg
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::RouteCoverage.include(Contrast::Api::Decorators::RouteCoverage)

data/lib/contrast/api/decorators/server_features.rb

@@ -1,12 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/string_utils'
+require 'contrast/utils/string_utils'
 
 module Contrast
   module Api
     module Decorators
-      # Used to decorate the ServerFeatures protobuf model to handle setting translation
+      # Used to decorate the {Contrast::Api::Settings::ServerFeatures} protobuf
+      # model to handle setting translation to boolean values.
       module ServerFeatures
         # 'defend' is legacy for 'protect' in the dtm.
         def protect_enabled?

data/lib/contrast/api/decorators/trace_event.rb

@@ -0,0 +1,100 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::TraceEvent} protobuf model to
+      # convert our {Contrast::Agent::AssessContrastEvent} to the dtm.
+      module TraceEvent
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Wrapper around build_event_object for the args array. Handles
+        # tainting the correct argument.
+        def build_event_args contrast_event, taint_target
+          contrast_event.args.each_index do |idx|
+            truncate_arg = taint_target != idx
+            event_arg = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.args[idx], truncate_arg)
+            args << event_arg
+          end
+        end
+
+        # TeamServer only supports one object's taint ranges at a time.
+        # We'll find the taint ranges for the target and return those
+        def build_taint_ranges contrast_event, taint_target
+          # If there's no taint_target, this isn't a dataflow trace, but a
+          # trigger one
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless taint_target
+
+          properties = case taint_target
+                       when Contrast::Utils::ObjectShare::OBJECT_KEY
+                         contrast_event.object.cs__properties
+                       when Contrast::Utils::ObjectShare::RETURN_KEY
+                         contrast_event.ret.cs__properties
+                       else
+                         target = contrast_event.args[taint_target]
+                         if target.is_a?(Hash)
+                           if contrast_event.policy_node&.targets&.any?
+                             target[contrast_event.policy_node.targets[0]].cs__properties
+                           else
+                             target[contrast_event.policy_node.sources[0]].cs__properties
+                           end
+                         else
+                           target.cs__properties
+                         end
+                       end
+
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
+
+          properties.tags_to_dtm
+        end
+
+        # Class methods for TraceEvent
+        module ClassMethods
+          def build contrast_event
+            event_dtm = new
+            # Figure out what the target of this event was. It's a little
+            # annoying for us since P can be named (thanks, Ruby) where
+            # as for everyone else it is idx based.
+            taint_target = contrast_event.determine_taint_target(event_dtm) # This can't be pulled into the decorator because SourceEvent has a custom impl :/
+
+            event_dtm.type = contrast_event.policy_node.node_type
+            event_dtm.action = contrast_event.policy_node.build_action
+            event_dtm.timestamp_ms = contrast_event.time.to_i
+            event_dtm.thread = Contrast::Utils::StringUtils.force_utf8(contrast_event.thread)
+            truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
+            event_dtm.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
+            truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
+            event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
+            event_dtm.build_event_args(contrast_event, taint_target)
+
+            taint_ranges = event_dtm.build_taint_ranges(contrast_event, taint_target)
+            taint_ranges.each do |range|
+              event_dtm.taint_ranges << range
+            end
+
+            # We delayed doing this as long as possible b/c it's expensive
+            stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
+            event_dtm.stack += stack
+
+            event_dtm.object_id = contrast_event.event_id.to_i
+            contrast_event.parent_ids&.each do |id|
+              parent = Contrast::Api::Dtm::ParentObjectId.new
+              parent.id = id.to_i
+              event_dtm.parent_object_ids << parent
+            end
+
+            event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
+            event_dtm
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceEvent.include(Contrast::Api::Decorators::TraceEvent)

data/lib/contrast/api/decorators/trace_event_object.rb

@@ -0,0 +1,58 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
+require 'contrast/components/interface'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::TraceEventObject} protobuf
+      # model.
+      module TraceEventObject
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for TraceEventObject
+        module ClassMethods
+          include Contrast::Components::Interface
+          access_component :scope
+          # Build the event object. We were originally going to include taint on
+          # each one, but TS doesn't accept / use that, so it is a waste of time.
+          #
+          # We'll truncate any object that isn't important to the taint ranges of
+          # this event, so that we don't murder TeamServer by, for instance,
+          # hypothetically sending the entire rendered HTML page >_>  <_<  >_>
+          ELLIPSIS = '...'
+          UNTRUNCATED_PORTION_LENGTH = 25
+          TRUNCATION_LENGTH = (UNTRUNCATED_PORTION_LENGTH * 2) + ELLIPSIS.length
+          def build object, truncate
+            event_object = new
+            with_contrast_scope do
+              obj_string = Contrast::Utils::StringUtils.force_utf8(object)
+              obj_string = truncate(obj_string) if truncate && obj_string.length > TRUNCATION_LENGTH
+              event_object.value = Base64.encode64(obj_string)
+              event_object.tracked = Contrast::Utils::Assess::TrackingUtil.tracked?(object)
+            end
+            event_object
+          end
+
+          def truncate obj_string
+            tmp = []
+            tmp << obj_string[0, UNTRUNCATED_PORTION_LENGTH]
+            tmp << ELLIPSIS
+            tmp << obj_string[
+                obj_string.length - UNTRUNCATED_PORTION_LENGTH,
+                UNTRUNCATED_PORTION_LENGTH]
+            tmp.join
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceEventObject.include(Contrast::Api::Decorators::TraceEventObject)

data/lib/contrast/api/decorators/trace_event_signature.rb

@@ -0,0 +1,47 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::TraceEventSignature} protobuf
+      # model.
+      module TraceEventSignature
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for TraceEventSignature
+        module ClassMethods
+          def build ret_obj, policy_node, args
+            signature = new
+            return_type = ret_obj ? ret_obj.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
+            signature.return_type = Contrast::Utils::StringUtils.force_utf8(return_type)
+            signature.class_name = Contrast::Utils::StringUtils.force_utf8(policy_node.class_name)
+            signature.method_name = Contrast::Utils::StringUtils.force_utf8(policy_node.method_name)
+            if args
+              args&.each do |arg|
+                arg_type = arg ? arg.cs__class.name : Contrast::Utils::ObjectShare::NIL_STRING
+                signature.arg_types << Contrast::Utils::StringUtils.force_utf8(arg_type)
+              end
+            end
+            signature.constructor = policy_node.method_name == :new
+            # if there's a ret, then this method isn't nil. not 100% full proof since you can
+            # return nil, but this is the best we've got currently.
+            signature.void_method = ret_obj.nil?
+            # 8 is STATIC in Java... we have to placate them for now
+            # it has been requested that flags be removed since it isn't used
+            signature.flags = 8 unless policy_node.instance_method?
+            signature
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceEventSignature.include(Contrast::Api::Decorators::TraceEventSignature)

data/lib/contrast/api/decorators/trace_taint_range.rb

@@ -0,0 +1,52 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::TraceTaintRange} protobuf
+      # model.
+      module TraceTaintRange
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Class methods for TraceEventObject
+        module ClassMethods
+          # Convert the tags from Contrast::Agent::Assess::Property::Tagged to
+          # the form required for their Event's DTM.
+          #
+          # @param tags [Hash{String => Array<Contrast::Agent::Assess::Tag>}]
+          # @return [Array<Contrast::Api::Dtm::TraceTaintRange>]
+          def build_for_event tags
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tags&.any?
+
+            ranges = []
+            tags.each_value do |value|
+              next if value.empty?
+
+              value.each { |tag| ranges << build(tag) }
+            end
+            ranges
+          end
+
+          # Convert our Tags to their DTM equivalent
+          #
+          # @param tag [Contrast::Agent::Assess::Tag]
+          # @return [Contrast::Api::Dtm::TraceTaintRange]
+          def build tag
+            range = Contrast::Api::Dtm::TraceTaintRange.new
+            range.tag = Contrast::Utils::StringUtils.protobuf_safe_string(tag.label)
+            range.range = tag.start_idx.to_s + Contrast::Utils::ObjectShare::COLON + tag.end_idx.to_s
+            range
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::TraceTaintRange.include(Contrast::Api::Decorators::TraceTaintRange)

data/lib/contrast/api/decorators/trace_taint_range_tags.rb

@@ -0,0 +1,109 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Decorators
+      # A holder for the valid tags that can be sent to the Service, and
+      # ultimately TS, that we have to honor. Placed here so as not to clutter
+      # other code.
+      module TraceTaintRangeTags
+        # EventTagTypeDTM
+        VALID_TAGS = %w[
+          XML_ENCODED
+          XML_DECODED
+          HTML_ENCODED
+          HTML_DECODED
+          URL_ENCODED
+          URL_DECODED
+          CSS_ENCODED
+          CSS_DECODED
+          BASE64_ENCODED
+          BASE64_DECODED
+          JAVASCRIPT_ENCODED
+          JAVASCRIPT_DECODED
+          JAVA_ENCODED
+          JAVA_DECODED
+          CSV_ENCODED
+          CSV_DECODED
+          SQL_ENCODED
+          SQL_DECODED
+          LDAP_ENCODED
+          LDAP_DECODED
+          XPATH_ENCODED
+          XPATH_DECODED
+          OS_ENCODED
+          OS_DECODED
+          VBSCRIPT_ENCODED
+          VBSCRIPT_DECODED
+          POTENTIAL_SANITIZED
+          POTENTIAL_VALIDATED
+          NO_CONTROL_CHARS
+          CUSTOM
+
+          CUSTOM_ENCODED
+          CUSTOM_ENCODED_CMD_INJECTION
+          CUSTOM_ENCODED_EXPRESSION_LANGUAGE_INJECTION
+          CUSTOM_ENCODED_HEADER_INJECTION
+          CUSTOM_ENCODED_HQL_INJECTION
+          CUSTOM_ENCODED_LDAP_INJECTION
+          CUSTOM_ENCODED_LOG_INJECTION
+          CUSTOM_ENCODED_NOSQL_INJECTION
+          CUSTOM_ENCODED_PATH_TRAVERSAL
+          CUSTOM_ENCODED_REDOS
+          CUSTOM_ENCODED_REFLECTED_XSS
+          CUSTOM_ENCODED_REFLECTION_INJECTION
+          CUSTOM_ENCODED_SMTP_INJECTION
+          CUSTOM_ENCODED_SQL_INJECTION
+          CUSTOM_ENCODED_SSRF
+          CUSTOM_ENCODED_STORED_XSS
+          CUSTOM_ENCODED_TRUST_BOUNDARY_VIOLATION
+          CUSTOM_ENCODED_UNSAFE_CODE_EXECUTION
+          CUSTOM_ENCODED_UNSAFE_READLINE
+          CUSTOM_ENCODED_UNSAFE_XML_DECODE
+          CUSTOM_ENCODED_UNTRUSTED_DESERIALIZATION
+          CUSTOM_ENCODED_UNVALIDATED_FORWARD
+          CUSTOM_ENCODED_UNVALIDATED_REDIRECT
+          CUSTOM_ENCODED_XPATH_INJECTION
+          CUSTOM_ENCODED_XXE
+          CUSTOM_SECURITY_CONTROL_APPLIED
+
+          CUSTOM_VALIDATED
+          CUSTOM_VALIDATED_CMD_INJECTION
+          CUSTOM_VALIDATED_EXPRESSION_LANGUAGE_INJECTION
+          CUSTOM_VALIDATED_HEADER_INJECTION
+          CUSTOM_VALIDATED_HQL_INJECTION
+          CUSTOM_VALIDATED_LDAP_INJECTION
+          CUSTOM_VALIDATED_LOG_INJECTION
+          CUSTOM_VALIDATED_NOSQL_INJECTION
+          CUSTOM_VALIDATED_PATH_TRAVERSAL
+          CUSTOM_VALIDATED_REDOS
+          CUSTOM_VALIDATED_REFLECTED_XSS
+          CUSTOM_VALIDATED_REFLECTION_INJECTION
+          CUSTOM_VALIDATED_SMTP_INJECTION
+          CUSTOM_VALIDATED_SQL_INJECTION
+          CUSTOM_VALIDATED_SSRF
+          CUSTOM_VALIDATED_STORED_XSS
+          CUSTOM_VALIDATED_TRUST_BOUNDARY_VIOLATION
+          CUSTOM_VALIDATED_UNSAFE_CODE_EXECUTION
+          CUSTOM_VALIDATED_UNSAFE_READLINE
+          CUSTOM_VALIDATED_UNSAFE_XML_DECODE
+          CUSTOM_VALIDATED_UNTRUSTED_DESERIALIZATION
+          CUSTOM_VALIDATED_UNVALIDATED_FORWARD
+          CUSTOM_VALIDATED_UNVALIDATED_REDIRECT
+          CUSTOM_VALIDATED_XPATH_INJECTION
+          CUSTOM_VALIDATED_XXE
+
+          DATABASE_WRITE
+        ].cs__freeze
+
+        VALID_SOURCE_TAGS = %w[
+          NO_NEWLINES
+          UNTRUSTED
+          CROSS_SITE
+          LIMITED_CHARS
+        ].cs__freeze
+      end
+    end
+  end
+end

data/lib/contrast/api/decorators/user_input.rb

@@ -0,0 +1,40 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/string_utils'
+require 'contrast/utils/assess/tracking_util'
+require 'base64'
+
+module Contrast
+  module Api
+    module Decorators
+      # Used to decorate the {Contrast::Api::Dtm::UserInput} protobuf model.
+      module UserInput
+        UNKNOWN_USER_INPUT = Contrast::Api::Dtm::UserInput.new.tap do |user_input|
+          user_input.input_type = :UNKNOWN
+        end.cs__freeze
+
+        def self.included klass
+          klass.extend(ClassMethods)
+        end
+
+        # Used to add class methods to UserInput
+        module ClassMethods
+          def build_from_ia_result ia_result
+            return UNKNOWN_USER_INPUT.dup unless ia_result
+
+            user_input = new
+            user_input.input_type = ia_result.input_type.to_i
+            user_input.matcher_ids = ia_result.ids
+            user_input.path = ia_result.path.to_s
+            user_input.key = ia_result.key.to_s
+            user_input.value = ia_result.value.to_s
+            user_input
+          end
+        end
+      end
+    end
+  end
+end
+
+Contrast::Api::Dtm::UserInput.include(Contrast::Api::Decorators::UserInput)