contrast-agent 3.12.2 → 3.13.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.dockerignore +0 -1
- data/.gitignore +1 -1
- data/.simplecov +1 -1
- data/Rakefile +31 -0
- data/ext/build_funchook.rb +0 -2
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.c +2 -8
- data/ext/cs__assess_fiber_track/cs__assess_fiber_track.h +0 -1
- data/ext/cs__assess_string_interpolation26/cs__assess_string_interpolation26.c +1 -6
- data/ext/cs__assess_yield_track/cs__assess_yield_track.c +1 -5
- data/ext/cs__assess_yield_track/cs__assess_yield_track.h +0 -1
- data/ext/cs__common/cs__common.c +24 -0
- data/ext/cs__common/cs__common.h +3 -0
- data/ext/cs__common/extconf.rb +0 -14
- data/ext/extconf_common.rb +0 -28
- data/lib/contrast.rb +3 -1
- data/lib/contrast/agent.rb +14 -2
- data/lib/contrast/agent/assess/contrast_event.rb +28 -167
- data/lib/contrast/agent/assess/events/source_event.rb +3 -7
- data/lib/contrast/agent/assess/policy/dynamic_source_factory.rb +1 -1
- data/lib/contrast/agent/assess/policy/policy_node.rb +4 -98
- data/lib/contrast/agent/assess/policy/propagation_method.rb +1 -2
- data/lib/contrast/agent/assess/policy/propagation_node.rb +5 -1
- data/lib/contrast/agent/assess/policy/propagator/base.rb +1 -1
- data/lib/contrast/agent/assess/policy/propagator/insert.rb +1 -4
- data/lib/contrast/agent/assess/policy/propagator/match_data.rb +9 -1
- data/lib/contrast/agent/assess/policy/propagator/remove.rb +6 -11
- data/lib/contrast/agent/assess/policy/propagator/select.rb +4 -4
- data/lib/contrast/agent/assess/policy/propagator/split.rb +2 -2
- data/lib/contrast/agent/assess/policy/propagator/substitution.rb +4 -4
- data/lib/contrast/agent/assess/policy/propagator/trim.rb +6 -10
- data/lib/contrast/agent/assess/policy/source_method.rb +1 -2
- data/lib/contrast/agent/assess/policy/trigger_method.rb +1 -9
- data/lib/contrast/agent/assess/policy/trigger_node.rb +16 -4
- data/lib/contrast/agent/assess/properties.rb +4 -382
- data/lib/contrast/agent/assess/property/evented.rb +78 -0
- data/lib/contrast/agent/assess/property/tagged.rb +339 -0
- data/lib/contrast/agent/assess/rule/provider/hardcoded_value_rule.rb +2 -20
- data/lib/contrast/agent/assess/tag.rb +27 -12
- data/lib/contrast/agent/at_exit_hook.rb +3 -1
- data/lib/contrast/agent/exclusion_matcher.rb +2 -2
- data/lib/contrast/agent/inventory/policy/datastores.rb +0 -1
- data/lib/contrast/agent/middleware.rb +2 -14
- data/lib/contrast/agent/patching/policy/patch.rb +1 -1
- data/lib/contrast/agent/patching/policy/policy.rb +3 -3
- data/lib/contrast/agent/patching/policy/policy_node.rb +2 -2
- data/lib/contrast/agent/protect/policy/rule_applicator.rb +2 -2
- data/lib/contrast/agent/protect/rule/base.rb +19 -31
- data/lib/contrast/agent/protect/rule/base_service.rb +1 -1
- data/lib/contrast/agent/protect/rule/http_method_tampering.rb +2 -7
- data/lib/contrast/agent/protect/rule/xxe.rb +1 -0
- data/lib/contrast/agent/reaction_processor.rb +3 -3
- data/lib/contrast/agent/request.rb +92 -331
- data/lib/contrast/agent/request_context.rb +15 -15
- data/lib/contrast/agent/request_handler.rb +1 -1
- data/lib/contrast/agent/response.rb +2 -14
- data/lib/contrast/agent/scope.rb +1 -1
- data/lib/contrast/agent/service_heartbeat.rb +7 -9
- data/lib/contrast/agent/static_analysis.rb +1 -1
- data/lib/contrast/agent/thread_watcher.rb +49 -0
- data/lib/contrast/agent/version.rb +1 -1
- data/lib/contrast/agent/worker_thread.rb +24 -0
- data/lib/contrast/api.rb +3 -5
- data/lib/contrast/api/communication.rb +20 -0
- data/lib/contrast/api/communication/connection_status.rb +41 -0
- data/lib/contrast/api/communication/messaging_queue.rb +79 -0
- data/lib/contrast/{utils/service_response_util.rb → api/communication/response_processor.rb} +9 -18
- data/lib/contrast/api/communication/service_lifecycle.rb +61 -0
- data/lib/contrast/api/communication/socket.rb +45 -0
- data/lib/contrast/api/communication/socket_client.rb +76 -0
- data/lib/contrast/api/communication/speedracer.rb +111 -0
- data/lib/contrast/api/communication/tcp_socket.rb +31 -0
- data/lib/contrast/api/communication/unix_socket.rb +27 -0
- data/lib/contrast/api/decorators.rb +10 -0
- data/lib/contrast/api/decorators/address.rb +60 -0
- data/lib/contrast/api/decorators/application_settings.rb +7 -3
- data/lib/contrast/api/decorators/application_update.rb +0 -9
- data/lib/contrast/api/decorators/http_request.rb +139 -0
- data/lib/contrast/api/decorators/message.rb +75 -0
- data/lib/contrast/api/decorators/rasp_rule_sample.rb +28 -0
- data/lib/contrast/api/decorators/route_coverage.rb +57 -0
- data/lib/contrast/api/decorators/trace_event.rb +99 -0
- data/lib/contrast/api/decorators/trace_event_object.rb +57 -0
- data/lib/contrast/api/decorators/trace_event_signature.rb +46 -0
- data/lib/contrast/api/decorators/trace_taint_range.rb +51 -0
- data/lib/contrast/api/decorators/trace_taint_range_tags.rb +109 -0
- data/lib/contrast/api/decorators/user_input.rb +40 -0
- data/lib/contrast/components/app_context.rb +0 -7
- data/lib/contrast/components/config.rb +4 -9
- data/lib/contrast/components/interface.rb +1 -1
- data/lib/contrast/components/settings.rb +0 -6
- data/lib/contrast/extension/assess.rb +0 -1
- data/lib/contrast/extension/assess/assess_extension.rb +1 -2
- data/lib/contrast/extension/assess/fiber.rb +1 -1
- data/lib/contrast/extension/assess/string.rb +1 -1
- data/lib/contrast/extension/inventory.rb +0 -1
- data/lib/contrast/framework/base_support.rb +0 -23
- data/lib/contrast/framework/manager.rb +0 -9
- data/lib/contrast/framework/rails/patch/action_controller_live_buffer.rb +1 -3
- data/lib/contrast/framework/rails/patch/assess_configuration.rb +3 -4
- data/lib/contrast/framework/rails/support.rb +3 -32
- data/lib/contrast/framework/sinatra/patch/base.rb +1 -1
- data/lib/contrast/framework/sinatra/support.rb +11 -22
- data/lib/contrast/funchook/funchook.rb +45 -0
- data/lib/contrast/logger/application.rb +1 -1
- data/lib/contrast/logger/format.rb +51 -0
- data/lib/contrast/logger/log.rb +8 -2
- data/lib/contrast/utils/assess/tracking_util.rb +45 -20
- data/lib/contrast/utils/hash_digest.rb +11 -2
- data/lib/contrast/utils/invalid_configuration_util.rb +1 -17
- data/lib/contrast/utils/inventory_util.rb +2 -7
- data/lib/contrast/utils/object_share.rb +0 -1
- data/lib/contrast/utils/os.rb +16 -4
- data/lib/contrast/utils/stack_trace_utils.rb +0 -1
- data/lib/contrast/utils/tag_util.rb +1 -1
- data/lib/contrast/utils/thread_tracker.rb +1 -14
- data/lib/contrast/utils/timer.rb +1 -17
- data/ruby-agent.gemspec +4 -4
- metadata +48 -72
- data/funchook/Makefile +0 -29
- data/funchook/autom4te.cache/output.0 +0 -4964
- data/funchook/autom4te.cache/requests +0 -77
- data/funchook/autom4te.cache/traces.0 +0 -361
- data/funchook/config.log +0 -651
- data/funchook/config.status +0 -1015
- data/funchook/configure +0 -4964
- data/funchook/src/Makefile +0 -70
- data/funchook/src/config.h +0 -101
- data/funchook/src/config.h.in +0 -100
- data/funchook/src/decoder.o +0 -0
- data/funchook/src/distorm.o +0 -0
- data/funchook/src/funchook.o +0 -0
- data/funchook/src/funchook_io.o +0 -0
- data/funchook/src/funchook_syscall.o +0 -0
- data/funchook/src/funchook_unix.o +0 -0
- data/funchook/src/funchook_x86.o +0 -0
- data/funchook/src/instructions.o +0 -0
- data/funchook/src/insts.o +0 -0
- data/funchook/src/libfunchook.dylib +0 -0
- data/funchook/src/mnemonics.o +0 -0
- data/funchook/src/operands.o +0 -0
- data/funchook/src/os_func.o +0 -0
- data/funchook/src/os_func_unix.o +0 -0
- data/funchook/src/prefix.o +0 -0
- data/funchook/src/printf_base.o +0 -0
- data/funchook/src/textdefs.o +0 -0
- data/funchook/src/wstring.o +0 -0
- data/funchook/test/Makefile +0 -43
- data/funchook/test/funchook_test +0 -0
- data/funchook/test/libfunchook_test.so +0 -0
- data/funchook/test/libfunchook_test.so.dSYM/Contents/Info.plist +0 -20
- data/funchook/test/libfunchook_test.so.dSYM/Contents/Resources/DWARF/libfunchook_test.so +0 -0
- data/funchook/test/test_main.o +0 -0
- data/funchook/test/x86_64_test.o +0 -0
- data/lib/contrast/agent/assess/adjusted_span.rb +0 -27
- data/lib/contrast/agent/socket_client.rb +0 -134
- data/lib/contrast/api/connection_status.rb +0 -49
- data/lib/contrast/api/socket.rb +0 -43
- data/lib/contrast/api/speedracer.rb +0 -188
- data/lib/contrast/api/tcp_socket.rb +0 -29
- data/lib/contrast/api/unix_socket.rb +0 -25
- data/lib/contrast/framework/sinatra/application_helper.rb +0 -51
- data/lib/contrast/framework/view_technologies_descriptor.rb +0 -21
- data/lib/contrast/internal_exception.rb +0 -8
- data/lib/contrast/utils/cache.rb +0 -58
- data/lib/contrast/utils/service_sender_util.rb +0 -167
- data/lib/contrast/utils/sinatra_helper.rb +0 -49
@@ -17,14 +17,6 @@ module Contrast
|
|
17
17
|
klass.extend(ClassMethods)
|
18
18
|
end
|
19
19
|
|
20
|
-
def append_view_technology_descriptor_data view_technology_descriptors
|
21
|
-
view_technology_descriptors.each do |vtd|
|
22
|
-
vtd.technology_names.each do |tech_name|
|
23
|
-
technologies[tech_name] = true
|
24
|
-
end
|
25
|
-
end
|
26
|
-
end
|
27
|
-
|
28
20
|
def append_library_update library_dtm_list, library_tags
|
29
21
|
lib_tags = Contrast::Utils::StringUtils.protobuf_format(library_tags)
|
30
22
|
library_dtm_list.each do |library_dtm|
|
@@ -51,7 +43,6 @@ module Contrast
|
|
51
43
|
module ClassMethods
|
52
44
|
def build
|
53
45
|
msg = new
|
54
|
-
msg.append_view_technology_descriptor_data(Contrast::Agent.framework_manager.find_applicable_view_technologies)
|
55
46
|
msg.append_route_coverage_data(Contrast::Agent.framework_manager.find_route_discovery_data)
|
56
47
|
msg.append_platform_version(Contrast::Agent.framework_manager.platform_version)
|
57
48
|
msg.append_library_update(Contrast::Utils::GemfileReader.instance.library_pb_list, CONFIG.root.inventory.tags)
|
@@ -0,0 +1,139 @@
|
|
1
|
+
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
+
# frozen_string_literal: true
|
3
|
+
|
4
|
+
cs__scoped_require 'contrast/api/dtm.pb'
|
5
|
+
cs__scoped_require 'contrast/api/decorators/address'
|
6
|
+
cs__scoped_require 'contrast/components/interface'
|
7
|
+
cs__scoped_require 'contrast/utils/string_utils'
|
8
|
+
cs__scoped_require 'contrast/utils/timer'
|
9
|
+
|
10
|
+
module Contrast
|
11
|
+
module Api
|
12
|
+
module Decorators
|
13
|
+
# Used to decorate the HttpRequest protobuf model so it can own some of
|
14
|
+
# the data massaging required for Request dtm
|
15
|
+
module HttpRequest
|
16
|
+
include Contrast::Components::Interface
|
17
|
+
access_component :agent
|
18
|
+
|
19
|
+
OMITTED_BODY = '{{body-omitted-by-contrast}}'
|
20
|
+
|
21
|
+
def self.included klass
|
22
|
+
klass.extend(ClassMethods)
|
23
|
+
end
|
24
|
+
|
25
|
+
# Append the sender and receiver to self.
|
26
|
+
#
|
27
|
+
# @param request [Contrast::Api::Dtm::HttpRequest]
|
28
|
+
def append_addresses request
|
29
|
+
self.sender = Contrast::Api::Dtm::Address.build_sender(request)
|
30
|
+
self.receiver = Contrast::Api::Dtm::Address.build_receiver
|
31
|
+
end
|
32
|
+
|
33
|
+
# Append the connection to self.
|
34
|
+
#
|
35
|
+
# @param request [Contrast::Api::Dtm::HttpRequest]
|
36
|
+
def append_connection request
|
37
|
+
self.protocol = Contrast::Utils::StringUtils.force_utf8(request.scheme)
|
38
|
+
self.version = '1.1' # currently not in rack request; hard-coding
|
39
|
+
self.method = Contrast::Utils::StringUtils.force_utf8(request.request_method)
|
40
|
+
self.raw = Contrast::Utils::StringUtils.force_utf8(request.rack_request.path_info)
|
41
|
+
end
|
42
|
+
|
43
|
+
# Append the parameters to self, using the preferred
|
44
|
+
# normalized_request_params field.
|
45
|
+
#
|
46
|
+
# @param request [Contrast::Api::Dtm::HttpRequest]
|
47
|
+
def append_params request
|
48
|
+
request.parameters.each do |k, v|
|
49
|
+
append_pair(normalized_request_params, k, v)
|
50
|
+
end
|
51
|
+
end
|
52
|
+
|
53
|
+
# Append the normalized headers to self, using the preferred
|
54
|
+
# request_headers field.
|
55
|
+
#
|
56
|
+
# @param request [Contrast::Api::Dtm::HttpRequest]
|
57
|
+
def append_headers request
|
58
|
+
request.headers.each do |k, v|
|
59
|
+
next unless k && v
|
60
|
+
next if v.is_a?(Hash)
|
61
|
+
|
62
|
+
key = Contrast::Utils::StringUtils.force_utf8(k)
|
63
|
+
val = Contrast::Utils::StringUtils.force_utf8(v)
|
64
|
+
request_headers[key] = val
|
65
|
+
end
|
66
|
+
|
67
|
+
request.cookies.each do |k, v|
|
68
|
+
append_pair(normalized_cookies, k, v)
|
69
|
+
end
|
70
|
+
end
|
71
|
+
|
72
|
+
# Append the body to self, using the preferred
|
73
|
+
# request_body_binary field.
|
74
|
+
#
|
75
|
+
# @param request [Contrast::Api::Dtm::HttpRequest]
|
76
|
+
def append_body request
|
77
|
+
self.document_type = Contrast::Utils::StringUtils.force_utf8(request.document_type)
|
78
|
+
|
79
|
+
self.request_body_binary = if omit_body?(request)
|
80
|
+
OMITTED_BODY
|
81
|
+
else
|
82
|
+
Contrast::Utils::StringUtils.force_utf8(request.body)
|
83
|
+
end
|
84
|
+
return if request.file_names.empty?
|
85
|
+
|
86
|
+
request.file_names.each do |name, filename|
|
87
|
+
pair = Contrast::Api::Dtm::SimplePair.new
|
88
|
+
pair.key = Contrast::Utils::StringUtils.force_utf8(name)
|
89
|
+
pair.value = Contrast::Utils::StringUtils.force_utf8(filename)
|
90
|
+
multipart_headers << pair
|
91
|
+
end
|
92
|
+
end
|
93
|
+
|
94
|
+
def omit_body? request
|
95
|
+
return true if AGENT.omit_body?
|
96
|
+
return false if request.document_type != :NORMAL
|
97
|
+
|
98
|
+
request.content_type&.include?('multipart/form-data')
|
99
|
+
end
|
100
|
+
|
101
|
+
def append_pair map, key, value
|
102
|
+
return unless key && value
|
103
|
+
return if value.is_a?(Hash)
|
104
|
+
|
105
|
+
safe_key = Contrast::Utils::StringUtils.force_utf8(key)
|
106
|
+
map[safe_key] ||= Contrast::Api::Dtm::Pair.new
|
107
|
+
map[safe_key].key = safe_key
|
108
|
+
map[safe_key].values << Contrast::Utils::StringUtils.force_utf8(value)
|
109
|
+
end
|
110
|
+
|
111
|
+
# Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
|
112
|
+
module ClassMethods
|
113
|
+
include Contrast::Components::Interface
|
114
|
+
access_component :scope
|
115
|
+
|
116
|
+
# Convert our Request into a DTM
|
117
|
+
# @param request [Contrast::Agent::Request]
|
118
|
+
# @return [Contrast::Api::Dtm::HttpRequest]
|
119
|
+
def build request
|
120
|
+
with_contrast_scope do
|
121
|
+
msg = new
|
122
|
+
msg.uuid = Contrast::Utils::StringUtils.force_utf8(__id__)
|
123
|
+
msg.timestamp_ms = Contrast::Utils::Timer.now_ms.to_i
|
124
|
+
|
125
|
+
msg.append_addresses(request)
|
126
|
+
msg.append_connection(request)
|
127
|
+
msg.append_params(request)
|
128
|
+
msg.append_headers(request)
|
129
|
+
msg.append_body(request)
|
130
|
+
msg
|
131
|
+
end
|
132
|
+
end
|
133
|
+
end
|
134
|
+
end
|
135
|
+
end
|
136
|
+
end
|
137
|
+
end
|
138
|
+
|
139
|
+
Contrast::Api::Dtm::HttpRequest.include(Contrast::Api::Decorators::HttpRequest)
|
@@ -0,0 +1,75 @@
|
|
1
|
+
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
+
# frozen_string_literal: true
|
3
|
+
|
4
|
+
cs__scoped_require 'contrast/utils/string_utils'
|
5
|
+
|
6
|
+
module Contrast
|
7
|
+
module Api
|
8
|
+
module Decorators
|
9
|
+
# Used to decorate the Message protobuf model so it can handle instance data massaging
|
10
|
+
module Message
|
11
|
+
include Contrast::Components::Interface
|
12
|
+
access_component :app_context, :logging
|
13
|
+
|
14
|
+
def self.included klass
|
15
|
+
klass.extend(ClassMethods)
|
16
|
+
end
|
17
|
+
|
18
|
+
def append_event event
|
19
|
+
case event
|
20
|
+
when Contrast::Api::Dtm::ServerActivity
|
21
|
+
self.server_activity = event
|
22
|
+
when Contrast::Api::Dtm::AgentStartup
|
23
|
+
self.agent_startup = event
|
24
|
+
when Contrast::Api::Dtm::ApplicationCreate
|
25
|
+
self.application_create = event
|
26
|
+
when Contrast::Api::Dtm::ApplicationUpdate
|
27
|
+
self.application_update = event
|
28
|
+
when Contrast::Api::Dtm::Activity
|
29
|
+
self.activity = event
|
30
|
+
when Contrast::Api::Dtm::HttpRequest
|
31
|
+
self.prefilter = event
|
32
|
+
when Contrast::Api::Dtm::HttpResponse
|
33
|
+
self.postfilter = event
|
34
|
+
when Contrast::Api::Dtm::Poll
|
35
|
+
self.poll = event
|
36
|
+
when Contrast::Api::Dtm::ObservedRoute
|
37
|
+
self.observed_route = event
|
38
|
+
else
|
39
|
+
logger.error('Unknown event type received. Unsure how to send.', event_type: event.cs__class.name)
|
40
|
+
return
|
41
|
+
end
|
42
|
+
logger.debug('Wrapping event in message',
|
43
|
+
msg_id: __id__,
|
44
|
+
p_id: pid,
|
45
|
+
msg_count: message_count,
|
46
|
+
event_id: event.__id__,
|
47
|
+
event_type: event.cs__class.name)
|
48
|
+
end
|
49
|
+
|
50
|
+
# Used to add class methods to the ApplicationUpdate class on inclusion of the decorator
|
51
|
+
module ClassMethods
|
52
|
+
@@message_total = 0 # rubocop:disable Style/ClassVars
|
53
|
+
def message_count
|
54
|
+
@@message_total += 1 # rubocop:disable Style/ClassVars
|
55
|
+
end
|
56
|
+
|
57
|
+
def build event
|
58
|
+
msg = new
|
59
|
+
msg.app_name = APP_CONTEXT.name
|
60
|
+
msg.app_path = APP_CONTEXT.path
|
61
|
+
msg.app_language = Contrast::Utils::ObjectShare::RUBY
|
62
|
+
msg.client_id = APP_CONTEXT.client_id
|
63
|
+
msg.message_count = message_count
|
64
|
+
msg.pid = APP_CONTEXT.pid
|
65
|
+
msg.ppid = APP_CONTEXT.ppid
|
66
|
+
msg.append_event(event)
|
67
|
+
msg
|
68
|
+
end
|
69
|
+
end
|
70
|
+
end
|
71
|
+
end
|
72
|
+
end
|
73
|
+
end
|
74
|
+
|
75
|
+
Contrast::Api::Dtm::Message.include(Contrast::Api::Decorators::Message)
|
@@ -0,0 +1,28 @@
|
|
1
|
+
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
+
# frozen_string_literal: true
|
3
|
+
|
4
|
+
module Contrast
|
5
|
+
module Api
|
6
|
+
module Decorators
|
7
|
+
# Used to decorate the RaspRuleSample protobuf model
|
8
|
+
module RaspRuleSample
|
9
|
+
def self.included klass
|
10
|
+
klass.extend(ClassMethods)
|
11
|
+
end
|
12
|
+
|
13
|
+
# Used to add class methods to RaspRuleSample
|
14
|
+
module ClassMethods
|
15
|
+
def build context, ia_result
|
16
|
+
sample = new
|
17
|
+
sample.timestamp_ms = context.timer.start_ms
|
18
|
+
sample.user_input = Contrast::Api::Dtm::UserInput.build_from_ia_result(ia_result)
|
19
|
+
sample.user_input.document_type = Contrast::Utils::StringUtils.force_utf8(context.request.document_type)
|
20
|
+
sample
|
21
|
+
end
|
22
|
+
end
|
23
|
+
end
|
24
|
+
end
|
25
|
+
end
|
26
|
+
end
|
27
|
+
|
28
|
+
Contrast::Api::Dtm::RaspRuleSample.include(Contrast::Api::Decorators::RaspRuleSample)
|
@@ -0,0 +1,57 @@
|
|
1
|
+
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
+
# frozen_string_literal: true
|
3
|
+
|
4
|
+
cs__scoped_require 'contrast/utils/string_utils'
|
5
|
+
|
6
|
+
module Contrast
|
7
|
+
module Api
|
8
|
+
module Decorators
|
9
|
+
# Used to decorate the RouteCoverage protobuf model to handle conversion between framework route classes
|
10
|
+
module RouteCoverage
|
11
|
+
def self.included klass
|
12
|
+
klass.extend(ClassMethods)
|
13
|
+
end
|
14
|
+
|
15
|
+
# Class methods for RouteCoverage
|
16
|
+
module ClassMethods
|
17
|
+
def source_or_string obj
|
18
|
+
if obj.cs__is_a?(Regexp)
|
19
|
+
obj.source
|
20
|
+
elsif obj.cs__respond_to?(:safe_string)
|
21
|
+
obj.safe_string
|
22
|
+
else
|
23
|
+
obj.to_s
|
24
|
+
end
|
25
|
+
end
|
26
|
+
|
27
|
+
# Convert ActionDispatch::Journey::Route to Contrast::Api::Dtm::RouteCoverage
|
28
|
+
# @param journey_obj [ActionDispatch::Journey::Route] a rails route
|
29
|
+
# @return [Contrast::Api::Dtm::RouteCoverage]
|
30
|
+
def from_action_dispatch_journey journey_obj
|
31
|
+
msg = new
|
32
|
+
msg.route = "#{ journey_obj.defaults[:controller] }##{ journey_obj.defaults[:action] }"
|
33
|
+
|
34
|
+
verb = source_or_string(journey_obj.verb)
|
35
|
+
msg.verb = Contrast::Utils::StringUtils.force_utf8(verb)
|
36
|
+
|
37
|
+
url = source_or_string(journey_obj.path.spec)
|
38
|
+
msg.url = Contrast::Utils::StringUtils.force_utf8(url)
|
39
|
+
msg
|
40
|
+
end
|
41
|
+
|
42
|
+
def from_sinatra_route clazz, method, pattern
|
43
|
+
safe_pattern = source_or_string(pattern)
|
44
|
+
|
45
|
+
msg = new
|
46
|
+
msg.route = "#{ clazz }##{ method } #{ safe_pattern }"
|
47
|
+
msg.verb = Contrast::Utils::StringUtils.force_utf8(method)
|
48
|
+
msg.url = Contrast::Utils::StringUtils.force_utf8(safe_pattern)
|
49
|
+
msg
|
50
|
+
end
|
51
|
+
end
|
52
|
+
end
|
53
|
+
end
|
54
|
+
end
|
55
|
+
end
|
56
|
+
|
57
|
+
Contrast::Api::Dtm::RouteCoverage.include(Contrast::Api::Decorators::RouteCoverage)
|
@@ -0,0 +1,99 @@
|
|
1
|
+
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
+
# frozen_string_literal: true
|
3
|
+
|
4
|
+
cs__scoped_require 'contrast/utils/string_utils'
|
5
|
+
|
6
|
+
module Contrast
|
7
|
+
module Api
|
8
|
+
module Decorators
|
9
|
+
# Used to decorate the TraceEvent protobuf model
|
10
|
+
module TraceEvent
|
11
|
+
def self.included klass
|
12
|
+
klass.extend(ClassMethods)
|
13
|
+
end
|
14
|
+
|
15
|
+
# Wrapper around build_event_object for the args array. Handles
|
16
|
+
# tainting the correct argument.
|
17
|
+
def build_event_args contrast_event, taint_target
|
18
|
+
contrast_event.args.each_index do |idx|
|
19
|
+
truncate_arg = taint_target != idx
|
20
|
+
event_arg = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.args[idx], truncate_arg)
|
21
|
+
args << event_arg
|
22
|
+
end
|
23
|
+
end
|
24
|
+
|
25
|
+
# TeamServer only supports one object's taint ranges at a time.
|
26
|
+
# We'll find the taint ranges for the target and return those
|
27
|
+
def build_taint_ranges contrast_event, taint_target
|
28
|
+
# If there's no taint_target, this isn't a dataflow trace, but a
|
29
|
+
# trigger one
|
30
|
+
return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless taint_target
|
31
|
+
|
32
|
+
properties = case taint_target
|
33
|
+
when Contrast::Utils::ObjectShare::OBJECT_KEY
|
34
|
+
contrast_event.object.cs__properties
|
35
|
+
when Contrast::Utils::ObjectShare::RETURN_KEY
|
36
|
+
contrast_event.ret.cs__properties
|
37
|
+
else
|
38
|
+
target = contrast_event.args[taint_target]
|
39
|
+
if target.is_a?(Hash)
|
40
|
+
if contrast_event.policy_node&.targets&.any?
|
41
|
+
target[contrast_event.policy_node.targets[0]].cs__properties
|
42
|
+
else
|
43
|
+
target[contrast_event.policy_node.sources[0]].cs__properties
|
44
|
+
end
|
45
|
+
else
|
46
|
+
target.cs__properties
|
47
|
+
end
|
48
|
+
end
|
49
|
+
|
50
|
+
return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless properties.tracked?
|
51
|
+
|
52
|
+
properties.tags_to_dtm
|
53
|
+
end
|
54
|
+
|
55
|
+
# Class methods for TraceEvent
|
56
|
+
module ClassMethods
|
57
|
+
def build contrast_event
|
58
|
+
event_dtm = new
|
59
|
+
# Figure out what the target of this event was. It's a little
|
60
|
+
# annoying for us since P can be named (thanks, Ruby) where
|
61
|
+
# as for everyone else it is idx based.
|
62
|
+
taint_target = contrast_event.determine_taint_target(event_dtm) # This can't be pulled into the decorator because SourceEvent has a custom impl :/
|
63
|
+
|
64
|
+
event_dtm.type = contrast_event.policy_node.node_type
|
65
|
+
event_dtm.action = contrast_event.policy_node.build_action
|
66
|
+
event_dtm.timestamp_ms = contrast_event.time.to_i
|
67
|
+
event_dtm.thread = Contrast::Utils::StringUtils.force_utf8(contrast_event.thread)
|
68
|
+
truncate_obj = Contrast::Utils::ObjectShare::OBJECT_KEY != taint_target
|
69
|
+
event_dtm.object = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.object, truncate_obj)
|
70
|
+
truncate_ret = Contrast::Utils::ObjectShare::RETURN_KEY != taint_target
|
71
|
+
event_dtm.ret = Contrast::Api::Dtm::TraceEventObject.build(contrast_event.ret, truncate_ret)
|
72
|
+
event_dtm.build_event_args(contrast_event, taint_target)
|
73
|
+
|
74
|
+
taint_ranges = event_dtm.build_taint_ranges(contrast_event, taint_target)
|
75
|
+
taint_ranges.each do |range|
|
76
|
+
event_dtm.taint_ranges << range
|
77
|
+
end
|
78
|
+
|
79
|
+
# We delayed doing this as long as possible b/c it's expensive
|
80
|
+
stack = Contrast::Utils::StackTraceUtils.build_assess_stack_array(contrast_event.stack_trace)
|
81
|
+
event_dtm.stack += stack
|
82
|
+
|
83
|
+
event_dtm.object_id = contrast_event.event_id.to_i
|
84
|
+
contrast_event.parent_ids&.each do |id|
|
85
|
+
parent = Contrast::Api::Dtm::ParentObjectId.new
|
86
|
+
parent.id = id.to_i
|
87
|
+
event_dtm.parent_object_ids << parent
|
88
|
+
end
|
89
|
+
|
90
|
+
event_dtm.signature = Contrast::Api::Dtm::TraceEventSignature.build(contrast_event.ret, contrast_event.policy_node, contrast_event.args)
|
91
|
+
event_dtm
|
92
|
+
end
|
93
|
+
end
|
94
|
+
end
|
95
|
+
end
|
96
|
+
end
|
97
|
+
end
|
98
|
+
|
99
|
+
Contrast::Api::Dtm::TraceEvent.include(Contrast::Api::Decorators::TraceEvent)
|
@@ -0,0 +1,57 @@
|
|
1
|
+
# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
|
2
|
+
# frozen_string_literal: true
|
3
|
+
|
4
|
+
cs__scoped_require 'contrast/utils/string_utils'
|
5
|
+
cs__scoped_require 'contrast/utils/assess/tracking_util'
|
6
|
+
cs__scoped_require 'base64'
|
7
|
+
cs__scoped_require 'contrast/components/interface'
|
8
|
+
|
9
|
+
module Contrast
|
10
|
+
module Api
|
11
|
+
module Decorators
|
12
|
+
# Used to decorate the TraceEventObject protobuf model
|
13
|
+
module TraceEventObject
|
14
|
+
def self.included klass
|
15
|
+
klass.extend(ClassMethods)
|
16
|
+
end
|
17
|
+
|
18
|
+
# Class methods for TraceEventObject
|
19
|
+
module ClassMethods
|
20
|
+
include Contrast::Components::Interface
|
21
|
+
access_component :scope
|
22
|
+
# Build the event object. We were originally going to include taint on
|
23
|
+
# each one, but TS doesn't accept / use that, so it is a waste of time.
|
24
|
+
#
|
25
|
+
# We'll truncate any object that isn't important to the taint ranges of
|
26
|
+
# this event, so that we don't murder TeamServer by, for instance,
|
27
|
+
# hypothetically sending the entire rendered HTML page >_> <_< >_>
|
28
|
+
ELLIPSIS = '...'
|
29
|
+
UNTRUNCATED_PORTION_LENGTH = 25
|
30
|
+
TRUNCATION_LENGTH = (UNTRUNCATED_PORTION_LENGTH * 2) + ELLIPSIS.length
|
31
|
+
def build object, truncate
|
32
|
+
event_object = new
|
33
|
+
with_contrast_scope do
|
34
|
+
obj_string = Contrast::Utils::StringUtils.force_utf8(object)
|
35
|
+
obj_string = truncate(obj_string) if truncate && obj_string.length > TRUNCATION_LENGTH
|
36
|
+
event_object.value = Base64.encode64(obj_string)
|
37
|
+
event_object.tracked = Contrast::Utils::Assess::TrackingUtil.tracked?(object)
|
38
|
+
end
|
39
|
+
event_object
|
40
|
+
end
|
41
|
+
|
42
|
+
def truncate obj_string
|
43
|
+
tmp = []
|
44
|
+
tmp << obj_string[0, UNTRUNCATED_PORTION_LENGTH]
|
45
|
+
tmp << ELLIPSIS
|
46
|
+
tmp << obj_string[
|
47
|
+
obj_string.length - UNTRUNCATED_PORTION_LENGTH,
|
48
|
+
UNTRUNCATED_PORTION_LENGTH]
|
49
|
+
tmp.join
|
50
|
+
end
|
51
|
+
end
|
52
|
+
end
|
53
|
+
end
|
54
|
+
end
|
55
|
+
end
|
56
|
+
|
57
|
+
Contrast::Api::Dtm::TraceEventObject.include(Contrast::Api::Decorators::TraceEventObject)
|