contrast-agent 3.13.2 → 4.1.0

data/lib/contrast/agent/protect/rule/base.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -184,9 +184,10 @@ module Contrast
           end
 
           def update_successful_attack_response context, ia_result, result, attack_string = nil
-            if mode == Contrast::Api::Settings::ProtectionRule::Mode::MONITOR
+            case mode
+            when Contrast::Api::Settings::ProtectionRule::Mode::MONITOR
               result.response = Contrast::Api::Dtm::AttackResult::ResponseType::MONITORED
-            elsif mode == Contrast::Api::Settings::ProtectionRule::Mode::BLOCK
+            when Contrast::Api::Settings::ProtectionRule::Mode::BLOCK
               result.response = Contrast::Api::Dtm::AttackResult::ResponseType::BLOCKED
             end
 

data/lib/contrast/agent/protect/rule/base_service.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/base'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/cmd_injection.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/at_exit_hook'
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/at_exit_hook'
+require 'contrast/agent/protect/rule/base_service'
+require 'contrast/utils/stack_trace_utils'
+require 'contrast/utils/object_share'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/deserialization.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base'
+require 'contrast/agent/protect/rule/base'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/http_method_tampering.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base_service'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/no_sqli.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base_service'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/no_sqli/mongo_no_sql_scanner.rb

@@ -16,6 +16,7 @@ module Contrast
             def start_line_comment? char, index, query
               if char == Contrast::Utils::ObjectShare::SLASH &&
                     query[index + 1] == Contrast::Utils::ObjectShare::SLASH
+
                 return true
               end
 

data/lib/contrast/agent/protect/rule/path_traversal.rb

@@ -1,9 +1,9 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/stack_trace_utils'
+require 'contrast/agent/protect/rule/base_service'
+require 'contrast/components/interface'
+require 'contrast/utils/stack_trace_utils'
 
 module Contrast
   module Agent
@@ -52,8 +52,7 @@ module Contrast
           def find_attacker context, path
             attack_result = nil
             attack_result = super(context, path) if infilter?(context)
-            attack_result = check_rep_features(context, path, attack_result)
-            attack_result
+            check_rep_features(context, path, attack_result)
           end
 
           # Build a subclass of the RaspRuleSample using the query string and the

data/lib/contrast/agent/protect/rule/sqli.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
-cs__scoped_require 'contrast/agent/protect/policy/applies_sqli_rule'
+require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/policy/applies_sqli_rule'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/unsafe_file_upload.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base_service'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/xss.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/protect/rule/base_service'
 
 module Contrast
   module Agent

data/lib/contrast/agent/protect/rule/xxe.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/protect/rule/base'
-cs__scoped_require 'contrast/utils/timer'
+require 'contrast/agent/protect/rule/base'
+require 'contrast/utils/timer'
 
 module Contrast
   module Agent
@@ -50,14 +50,12 @@ module Contrast
             # string to the end of the last entity declaration.
             xxe_details.xml = Contrast::Utils::StringUtils.protobuf_safe_string(xml[0, last_idx])
             ia_result = build_evaluation(xxe_details.xml)
-            result = build_attack_with_match(
+            build_attack_with_match(
                 context,
                 ia_result,
                 nil,
                 nil,
                 details: xxe_details)
-
-            result
           end
 
           def build_details xml, _evaluation = nil

data/lib/contrast/agent/protect/rule/xxe/entity_wrapper.rb

@@ -27,14 +27,14 @@ module Contrast
             end
 
             # <!ENTITY name SYSTEM "URI">
-            SYSTEM_ID_REGEXP = /<!ENTITY\s+([a-zA-Z0-f]+)\s+SYSTEM\s+"(?<id>.*?)">/.cs__freeze
+            SYSTEM_ID_REGEXP = /<!ENTITY\s+(?<name>[a-zA-Z0-f]+)\s+SYSTEM\s+"(?<id>.*?)">/.cs__freeze
             def parse_system_id entity
               match = SYSTEM_ID_REGEXP.match(entity)
               match[:id] if match
             end
 
             # <!ENTITY name PUBLIC "public_ID" "URI">
-            PUBLIC_ID_REGEXP = /<!ENTITY\s+([a-zA-Z0-f]+)\s+PUBLIC\s+".*?"\s+"(?<id>.*?)">/.cs__freeze
+            PUBLIC_ID_REGEXP = /<!ENTITY\s+(?<name>[a-zA-Z0-f]+)\s+PUBLIC\s+".*?"\s+"(?<id>.*?)">/.cs__freeze
             def parse_public_id entity
               match = PUBLIC_ID_REGEXP.match(entity)
               match[:id] if match

data/lib/contrast/agent/railtie.rb

@@ -1,7 +1,7 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/job_servers_running'
+require 'contrast/utils/job_servers_running'
 
 module Contrast
   module Agent

data/lib/contrast/agent/reaction_processor.rb

@@ -1,8 +1,8 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/disable_reaction'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/agent/disable_reaction'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent

data/lib/contrast/agent/request.rb

@@ -1,13 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'resolv'
-cs__scoped_require 'timeout'
+require 'resolv'
+require 'timeout'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/hash_digest'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/hash_digest'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -21,8 +21,8 @@ module Contrast
 
       extend Forwardable
 
-      INNER_REST_TOKEN = %r{/[\d]+/}.cs__freeze
-      LAST_REST_TOKEN = %r{/[\d]+$}.cs__freeze
+      INNER_REST_TOKEN = %r{/\d+/}.cs__freeze
+      LAST_REST_TOKEN = %r{/\d+$}.cs__freeze
       INNER_NUMBER_MARKER = '/{n}/'
       LAST_NUMBER_MARKER = '/{n}'
 
@@ -46,42 +46,42 @@ module Contrast
       # Should also handle the ;jsessionid.
       def normalized_uri
         @_normalized_uri ||= begin
-                               path = rack_request.path
-                               uri = path.split(Contrast::Utils::ObjectShare::SEMICOLON)[0]    # remove ;jsessionid
-                               uri = uri.split(Contrast::Utils::ObjectShare::QUESTION_MARK)[0] # remove ?query_string=
-                               uri.gsub(INNER_REST_TOKEN, INNER_NUMBER_MARKER)                 # replace interior tokens
-                               uri.gsub(LAST_REST_TOKEN, LAST_NUMBER_MARKER)                   # replace last token
-                             end
+          path = rack_request.path
+          uri = path.split(Contrast::Utils::ObjectShare::SEMICOLON)[0]    # remove ;jsessionid
+          uri = uri.split(Contrast::Utils::ObjectShare::QUESTION_MARK)[0] # remove ?query_string=
+          uri.gsub(INNER_REST_TOKEN, INNER_NUMBER_MARKER)                 # replace interior tokens
+          uri.gsub(LAST_REST_TOKEN, LAST_NUMBER_MARKER)                   # replace last token
+        end
       end
 
       def document_type
         @_document_type ||= begin
-                              if /xml/i.match?(content_type) || body&.start_with?('<?xml')
-                                :XML
-                              elsif /json/i.match?(content_type) || body&.match?(/\s*[{\[]/)
-                                :JSON
-                              else
-                                :NORMAL
-                              end
-                            end
+          if /xml/i.match?(content_type) || body&.start_with?('<?xml')
+            :XML
+          elsif /json/i.match?(content_type) || body&.match?(/\s*[{\[]/)
+            :JSON
+          else
+            :NORMAL
+          end
+        end
       end
 
       # Header keys upcased and any underscores replaced with dashes
       def headers
         @_headers ||= begin
-                        with_contrast_scope do
-                          hash = {}
-                          env.each do |key, value|
-                            next unless key
-
-                            name = key.to_s
-                            next unless name.start_with?(Contrast::Utils::ObjectShare::HTTP_SCORE)
-
-                            hash[Contrast::Utils::StringUtils.normalized_key(name)] = value
-                          end
-                          hash
-                        end
-                      end
+          with_contrast_scope do
+            hash = {}
+            env.each do |key, value|
+              next unless key
+
+              name = key.to_s
+              next unless name.start_with?(Contrast::Utils::ObjectShare::HTTP_SCORE)
+
+              hash[Contrast::Utils::StringUtils.normalized_key(name)] = value
+            end
+            hash
+          end
+        end
       end
 
       def body
@@ -121,13 +121,13 @@ module Contrast
 
       def file_names
         @_file_names ||= begin
-                           names = {}
-                           parsed_data = Rack::Multipart.parse_multipart(rack_request.env)
-                           traverse_parsed_multipart(parsed_data, names)
-                         rescue StandardError => _e
-                           logger.warn('Unable to parse multipart request!')
-                           {}
-                         end
+          names = {}
+          parsed_data = Rack::Multipart.parse_multipart(rack_request.env)
+          traverse_parsed_multipart(parsed_data, names)
+        rescue StandardError => _e
+          logger.warn('Unable to parse multipart request!')
+          {}
+        end
       end
 
       def hash_id
@@ -168,7 +168,9 @@ module Contrast
         # (rather than breaking this out into two methods)
         case val
         when Tempfile
-          { prefix => Contrast::Utils::StringUtils.force_utf8(val.path) }
+          # Skip if it's the auto-generated value from rails when it handles
+          # file uploads. The file name will still be sent to SR for analysis.
+          {}
         when Hash
           res = val.each_with_object({}) do |(k, v), hash|
             k = Contrast::Utils::StringUtils.force_utf8(k)

data/lib/contrast/agent/request_context.rb

@@ -1,11 +1,11 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/utils/timer'
-cs__scoped_require 'contrast/agent/request'
-cs__scoped_require 'contrast/agent/response'
-cs__scoped_require 'contrast/utils/inventory_util'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/timer'
+require 'contrast/agent/request'
+require 'contrast/agent/response'
+require 'contrast/utils/inventory_util'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -19,6 +19,7 @@ module Contrast
       EMPTY_INPUT_ANALYSIS_PB = Contrast::Api::Settings::InputAnalysis.new
 
       attr_reader :timer,
+                  :logging_hash,
                   :speedracer_input_analysis,
                   :request,
                   :response,
@@ -29,8 +30,11 @@ module Contrast
 
       def initialize rack_request, app_loaded = true
         with_contrast_scope do
-          # all requests get a timer
+          # all requests get a timer and hash
           @timer = Contrast::Utils::Timer.new
+          @logging_hash = {
+              request_id: __id__
+          }
 
           # instantiate helper for request and response
           @request = Contrast::Agent::Request.new(rack_request)

data/lib/contrast/agent/request_handler.rb

@@ -18,7 +18,7 @@ module Contrast
       end
 
       def send_activity_messages
-        Contrast::Utils::GemfileReader.instance.generate_library_usage(context.activity)
+        Contrast::Agent::Inventory::DependencyUsageAnalysis.instance.generate_library_usage(context.activity)
         [context.server_activity, context.activity, context.observed_route].each do |message|
           Contrast::Agent.messaging_queue.send_event_eventually(message)
         end

data/lib/contrast/agent/response.rb

@@ -1,13 +1,13 @@
 # Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'resolv'
-cs__scoped_require 'timeout'
+require 'resolv'
+require 'timeout'
 
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/utils/string_utils'
-cs__scoped_require 'contrast/utils/hash_digest'
-cs__scoped_require 'contrast/components/interface'
+require 'contrast/utils/object_share'
+require 'contrast/utils/string_utils'
+require 'contrast/utils/hash_digest'
+require 'contrast/components/interface'
 
 module Contrast
   module Agent
@@ -44,14 +44,9 @@ module Contrast
         context_response = Contrast::Api::Dtm::HttpResponse.new
         context_response.response_code = response_code.to_i
         headers&.each_pair do |key, value|
-          k = Contrast::Utils::StringUtils.force_utf8(key)
-          v = Contrast::Utils::StringUtils.force_utf8(value)
-          context_response.response_headers[k] = v
+          append_pair(context_response.normalized_response_headers, key, value)
         end
-        context_response.parsed_response_headers = true
-
         context_response.response_body_binary = Contrast::Utils::StringUtils.force_utf8(body)
-        context_response.parsed_response_body = false
 
         doc_type = document_type
         context_response.document_type = doc_type if doc_type
@@ -97,6 +92,22 @@ module Contrast
 
       private
 
+      # From the dtm for normalized_response_headers:
+      #   Key is UPPERCASE_UNDERSCORE
+      #
+      #   Example: Content-Type: text/html; charset=utf-8
+      #   "CONTENT_TYPE" => Content-Type,["text/html; charset=utf8"]
+      def append_pair map, key, value
+        return unless key && value
+        return if value.is_a?(Hash)
+
+        safe_key = Contrast::Utils::StringUtils.force_utf8(key)
+        hash_key = Contrast::Utils::StringUtils.normalized_key(safe_key)
+        map[hash_key] ||= Contrast::Api::Dtm::Pair.new
+        map[hash_key].key = safe_key
+        map[hash_key].values << Contrast::Utils::StringUtils.force_utf8(value)
+      end
+
       HTTP_PREFIX = /^[Hh][Tt][Tt][Pp][_-]/i.cs__freeze
 
       # Given some holder of the content of the response's body, extract that

data/lib/contrast/agent/rewriter.rb

@@ -3,10 +3,10 @@
 
 # intentional -- we're using a << operator here
 
-cs__scoped_require 'contrast/agent/class_reopener'
-cs__scoped_require 'contrast/agent/patching/policy/patch_status'
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/ruby_ast_rewriter'
+require 'contrast/agent/class_reopener'
+require 'contrast/agent/patching/policy/patch_status'
+require 'contrast/components/interface'
+require 'contrast/utils/ruby_ast_rewriter'
 
 module Contrast
   module Agent
@@ -61,9 +61,7 @@ module Contrast
           status ||= Contrast::Agent::Patching::Policy::PatchStatus.get_status(mod)
           status.failed_rewrite!
         ensure
-          with_contrast_scope do
-            opener&.commit_patches
-          end
+          opener&.commit_patches
           logger.trace('Rewriting complete',
                        module: module_data.name,
                        result: Contrast::Agent::Patching::Policy::PatchStatus.get_status(
@@ -163,8 +161,7 @@ module Contrast
 
         def rewrite_method original_source_code
           new_code = rewrite(original_source_code)
-          new_code = remove_self_definition(new_code)
-          new_code
+          remove_self_definition(new_code)
         end
 
         def rewrite source