contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/assess/policy/trigger_node.rb

@@ -1,6 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/assess/policy/trigger/reflected_xss'
+require 'contrast/agent/assess/policy/trigger/xpath'
+require 'contrast/agent/reporting/reporting_events/finding_event_taint_range_tags'
+require 'contrast/components/logger'
+
 module Contrast
   module Agent
     module Assess
@@ -10,18 +15,37 @@ module Contrast
         # specifically for those methods which result in the trigger of a
         # vulnerability (indicate points in the application where uncontrolled
         # user input can do damage).
-        class TriggerNode < PolicyNode
+        class TriggerNode < PolicyNode # rubocop:disable Metrics/ClassLength
+          include Contrast::Components::Logger::InstanceMethods
+
           JSON_BAD_VALUE = 'bad_value'
           JSON_GOOD_VALUE = 'good_value'
           JSON_DISALLOWED_TAGS = 'disallowed_tags'
           JSON_REQUIRED_TAGS = 'required_tags'
-          JSON_NODES = 'nodes'
           JSON_RULE_NAME = 'name'
           JSON_CUSTOM_PATCH = 'custom_patch'
 
-          attr_reader :rule_id
-          attr_accessor :required_tags, :disallowed_tags, :good_value, :bad_value
+          # Our list with rules to be collected and reported back when we have response
+          # from the application. Some rules rely on Content-Type validation.
+          COLLECTABLE_RULES = %w[reflected-xss].cs__freeze
 
+          attr_reader :rule_id, :required_tags, :disallowed_tags, :good_value, :bad_value
+
+          ENCODER_START = 'CUSTOM_ENCODED_'
+          # By default, any rule will be triggered if the source
+          # of the rule event has an untrusted tag range that is
+          # not covered by one of its disallowed tags.
+          UNTRUSTED = 'UNTRUSTED'
+          TRIGGER = 'Trigger'
+          VALIDATOR_START = 'CUSTOM_VALIDATED_'
+          # If a level 1 rule comes from TeamServer, it will have the
+          # tag 'custom-encoder-#{ name }' or 'custom-validator-#{ name }'.
+          # All rules should take this into account.
+          # Additionally, if something is marked 'limited-chars' it means
+          # it has been properly vetted to not contain dangerous input.
+          LIMITED_CHARS = 'LIMITED_CHARS'
+          CUSTOM_ENCODED = 'CUSTOM_ENCODED'
+          CUSTOM_VALIDATED = 'CUSTOM_VALIDATED'
           def initialize trigger_hash = {}, rule_hash = {}
             super(trigger_hash)
             good_value = trigger_hash[JSON_GOOD_VALUE]
@@ -38,15 +62,17 @@ module Contrast
             @trigger_method = trigger_hash['trigger_method']
             @trigger_method = @trigger_method.to_sym if @trigger_method
             validate
+          rescue ArgumentError => e
+            logger.error('Trigger Node initialization failed with: ', e)
+            nil
           end
 
-          TRIGGER = 'Trigger'
           def node_class
             TRIGGER
           end
 
-          def apply_custom_trigger context, trigger_node, source, object, ret, invoked, *args
-            custom_trigger_class.send(@trigger_method, context, trigger_node, source, object, ret, invoked, *args)
+          def apply_custom_trigger trigger_node, source, object, ret, *args
+            custom_trigger_class.send(@trigger_method, trigger_node, source, object, ret, *args)
           end
 
           def custom_trigger_class
@@ -65,8 +91,12 @@ module Contrast
             :TYPE_METHOD
           end
 
+          def collectable?
+            COLLECTABLE_RULES.include?(rule_id)
+          end
+
           def rule_disabled?
-            Contrast::Agent::FeatureState.instance.assess_disabled_rules.include?(rule_id)
+            ::Contrast::ASSESS.rule_disabled?(rule_id)
           end
 
           # Indicate if this is a dataflow based trigger, meaning it has a proper
@@ -98,16 +128,17 @@ module Contrast
             # if the source isn't tracked, there can't be a violation
             # this condition may not hold true forever, but for now it's
             # a nice optimization
-            return false unless source.cs__tracked?
+            return false unless Contrast::Agent::Assess::Tracker.tracked?(source)
 
+            properties = Contrast::Agent::Assess::Tracker.properties(source)
             # find the ranges that violate the rule (untrusted, etc)
-            vulnerable_ranges = find_ranges_by_tag(source.cs__properties, required_tags)
+            vulnerable_ranges = ranges_with_all_tags(properties, required_tags)
             # if there aren't any vulnerable ranges, nope out
             return false if vulnerable_ranges.empty?
 
             # find the ranges that are exempt from the rule
             # (validated, sanitized, etc)
-            secure_ranges = find_ranges_by_tag(source.cs__properties, disallowed_tags)
+            secure_ranges = ranges_with_any_tag(properties, disallowed_tags)
             # if there are vulnerable ranges and no secure, report
             return true if secure_ranges.empty?
 
@@ -118,6 +149,7 @@ module Contrast
 
           # Standard validation + TS trace version two rules:
           # Must have source
+          # @raise[ArgumentError] raises if any of the required fields is invalid or missing
           def validate
             super
             # If this isn't a dataflow rule, it can't have a source
@@ -127,70 +159,161 @@ module Contrast
 
           private
 
-          # By default, any rule will be triggered if the source
-          # of the rule event has an untrusted tag range that is
-          # not covered by one of its disallowed tags.
-          UNTRUSTED = 'UNTRUSTED'
           def populate_tags required_tags
             return unless dataflow?
 
             validate_rule_tags(required_tags)
-            @required_tags = required_tags || []
+            @required_tags = Set.new(required_tags)
             @required_tags << UNTRUSTED
           end
 
-          ENCODER_START = 'CUSTOM_ENCODED_'
-          VALIDATOR_START = 'CUSTOM_VALIDATED_'
-          # If a level 1 rule comes from TeamServer, it will have the
-          # tag 'custom-encoder-#{ name }' or 'custom-validator-#{ name }'.
-          # All rules should take this into account.
-          # Additionally, if something is marked 'limited-chars' it means
-          # it has been properly vetted to not contain dangerous input.
-          LIMITED_CHARS = 'LIMITED_CHARS'
-          CUSTOM_ENCODED = 'CUSTOM_ENCODED'
-          CUSTOM_VALIDATED = 'CUSTOM_VALIDATED'
           def populate_disallowed disallowed_tags
             return unless dataflow?
 
             validate_rule_tags(disallowed_tags)
-            @disallowed_tags = disallowed_tags || []
+            @disallowed_tags = Set.new(disallowed_tags)
             @disallowed_tags << LIMITED_CHARS
             @disallowed_tags << CUSTOM_ENCODED
             @disallowed_tags << CUSTOM_VALIDATED
-            @disallowed_tags << ENCODER_START + loud_name
-            @disallowed_tags << VALIDATOR_START + loud_name
+            @disallowed_tags << (ENCODER_START + loud_name)
+            @disallowed_tags << (VALIDATOR_START + loud_name)
           end
 
-          ENCODED_MARKER = '_ENCODED'
+          # @raise[ArgumentError] raises if any of the tags is invalid
           def validate_rule_tags tags
             return unless tags
 
             tags.each do |tag|
               raise(ArgumentError, "Rule #{ rule_id } had an invalid tag. #{ tag } is not a known value.") unless
-                  Contrast::Agent::Assess::Policy::PolicyNode::VALID_TAGS.include?(tag) ||
-                      Contrast::Agent::Assess::Policy::PolicyNode::VALID_SOURCE_TAGS.include?(tag)
+                Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_TAGS.include?(tag) ||
+                    Contrast::Agent::Reporting::FindingEventTaintRangeTags::VALID_SOURCE_TAGS.include?(tag)
             end
           end
 
-          def find_ranges_by_tag cs__properties, tags
+          # Find the ranges that satisfy all of the given tags.
+          #
+          # @param properties [Contrast::Agent::Assess::Properties] the
+          #   properties to check for the tags
+          # @param required_tags [Set<String>] the list of tags on which to match
+          # @return [Array<Contrast::Agent::Assess::Tag>] the ranges satisfied
+          #   by the given conditions
+          def ranges_with_all_tags properties, required_tags
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless matches_tags?(properties, required_tags)
+
+            chunking = false
             ranges = []
+            # find the start and end range of required tags:
+            search_ranges = find_required_ranges(properties, required_tags)
+            start_range = search_ranges.first
+            end_range = search_ranges.last + 1
+
+            # find all the indicies on the source that have all the given tags
+            while start_range < end_range
+
+              tags_at = properties.tags_at(start_range).to_a
+              # only those that have all the required tags in the tags_at
+              # satisfy the requirement
+              satisfied = tags_at.any? && required_tags.all? { |tag| tags_at.any? { |found| found.label == tag } }
+              # if this range matches all the required tags and we're already
+              # chunking, meaning the previous range matched, do nothing
+
+              # if we are satisfied and we were not chunking, this represents
+              # the start of the next range, so create a new entry.
+              if satisfied
+                if chunking
+                  start_range += 1
+                  next
+                end
+                ranges << Contrast::Agent::Assess::Tag.new('required', 0, start_range)
+                chunking = true
+                # if we are chunking and not satisfied, this represents the end
+                # of the range, meaning the last index is what satisfied the
+                # range. Because the range is exclusive end, we can just use this
+                # index.
+              elsif chunking
+                ranges[-1]&.update_end(start_range)
+                chunking = false
+              end
+              start_range += 1
+            end
+            ranges
+          end
 
+          # Find the ranges that satisfy any of the given tags.
+          #
+          # @param properties [Contrast::Agent::Assess::Properties] the
+          #   properties to check for the tags
+          # @param tags [Set<String>] the list of tags on which to match
+          # @return [Array<Contrast::Agent::Assess::Tag>] the ranges satisfied
+          #   by the given conditions
+          def ranges_with_any_tag properties, tags
             # if there aren't any all_tags or tags, break early
-            return ranges unless cs__properties.tracked?
-            return ranges unless tags&.any?
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless search_tags?(properties, tags)
 
-            # find all tags that match the desired ones
+            ranges = []
             tags.each do |desired|
-              found = cs__properties.fetch_tag(desired)
+              found = properties.fetch_tag(desired)
               next unless found
 
               # we need to dup here so that we don't change the tags if target is
               # used in another trace
               ranges = Contrast::Utils::TagUtil.ordered_merge(ranges, found.dup)
             end
-
             ranges
           end
+
+          # We should only try to match tags on properties if those properties have any tags (are tracked) and there
+          # are tags to try and match on. Some rules, like regexp rules, have no tags. Some rules, like trigger, have
+          # no properties.
+          #
+          # @param properties [Contrast::Agent::Assess::Properties] the properties to check for the tags
+          # @param tags [Set<String>] the list of tags on which to match
+          # @return [Boolean] if the given properties has instances of every tag in tags
+          def search_tags? properties, tags
+            return false unless properties.tracked?
+            return false unless tags&.any?
+
+            true
+          end
+
+          # Determine if the given properties have instances of all the given tags or not.
+          #
+          # @param properties [Contrast::Agent::Assess::Properties] the properties to check for the tags
+          # @param tags [Set<String>] the list of tags on which to match
+          # @return [Boolean] if the given properties has instances of every tag in tags
+          def matches_tags? properties, tags
+            return false unless search_tags?(properties, tags)
+            return false unless tags.all? { |tag| properties.tag_keys.include?(tag) }
+
+            true
+          end
+
+          # Range finder helper for #ranges_with_all_tags
+          #
+          # @param properties [Contrast::Agent::Assess::Properties] the properties to check for the tags
+          # @param required_tags [Set<String>] the list of tags on which to match
+          # @return [Array] of required tags ranges to search
+          def find_required_ranges properties, required_tags
+            start_range = 0
+            end_range = 0
+            required_tags_arr = required_tags.to_a
+            idx = 0
+
+            while idx < required_tags_arr.length
+              # find the start and end range of required tags:
+              start_temp = properties.fetch_tag(required_tags_arr[idx])[0].start_idx
+              end_temp = properties.fetch_tag(required_tags_arr[idx])[0].end_idx
+              # first iteration only
+              start_range = start_temp if idx.zero?
+              end_range = end_temp if idx.zero?
+
+              # find the tag with smallest ranges
+              start_range = start_temp if start_range < start_temp
+              end_range = end_temp if end_range > end_temp
+              idx += 1
+            end
+            [start_range, end_range]
+          end
         end
       end
     end

data/lib/contrast/agent/assess/policy/trigger_validation/redos_validator.rb

@@ -0,0 +1,60 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Assess
+      module Policy
+        module TriggerValidation
+          # Validator used to assert a REDOS finding is actually vulnerable
+          # before serializing that finding as a DTM to report to the TeamServer.
+          module REDOSValidator
+            RULE_NAME = 'redos'
+
+            class << self
+              def valid? _patcher, object, _ret, args
+                # Can arrive here from either:
+                #   regexp =~ string
+                #   string =~ regexp
+                #   regexp.match string
+                #
+                # Thus object/args[0] can be string/regexp or regexp/string.
+                regexp = object.is_a?(Regexp) ? object : args[0]
+
+                # regexp must be exploitable.
+                return false unless regexp_vulnerable?(regexp)
+
+                true
+              end
+
+              protected
+
+              VULNERABLE_PATTERN = /[\[(].*?[\[(].*?[\])][*+?].*?[\])][*+?]/.cs__freeze
+
+              # Does the regexp
+              # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/redos.md
+              def regexp_vulnerable? regexp
+                # A pattern is considered vulnerable if it has 2 or more levels of nested multi-matching.
+                # A level is defined as any set of opening and closing control characters immediately followed by a
+                #   multi match control character.
+                # A control character is defined as one of the OPENING_CHARS, CLOSING_CHARS, or MULTI_MATCH_CHARS that
+                #   is not immediately preceded by an escaping \ character.
+                # OPENING_CHARS are ( and [ CLOSING_CHARS are ) and ] MULTI_MATCH_CHARS are +, *, and ?
+
+                # Nota bene about Regexp#to_s:  it doesn't necessarily give you the original Regexp back
+                # (in the sense of `my_str == Regexp.new(my_str).to_s`), it gives you a Regexp that
+                # will have the same functional characteristics as the original.
+                # Regexp#inspect gives you a "more nicely formatted" version than #to_s.
+                # Regexp#source will give you the original source.
+
+                # Use #match? because it doesn't fill out global variables
+                # in the way match or =~ do.
+                VULNERABLE_PATTERN.match?(regexp.source)
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/assess/policy/trigger_validation/ssrf_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -7,11 +7,10 @@ module Contrast
       module Policy
         module TriggerValidation
           # Validator used to assert a SSRF finding is actually vulnerable
-          # before serializing that finding as a DTM to report to the service.
+          # before serializing that finding as a DTM to report to the TeamServer.
           module SSRFValidator
-            SSRF_RULE = 'ssrf'
-            URL_PATTERN =
-              %r{(?<protocol>http|https|ftp|sftp|telnet|gopher|rtsp|rtsps|ssh|svn)://(?<host>[^/?]+)(?<path>/?[^?]*)(?<query_string>\?.*)?}i.cs__freeze
+            RULE_NAME = 'ssrf'
+            URL_PATTERN = %r{(?<protocol>http|https|ftp|sftp|telnet|gopher|rtsp|rtsps|ssh|svn)://(?<host>[^/?]+)(?<path>/?[^?]*)(?<query_string>\?.*)?}i.cs__freeze # rubocop:disable Layout/LineLength
             # The Net::HTTP class validates host format on instantiation. Since
             # our triggers for that class are on the instance, they already
             # have this validation done for them. We do not need to apply the
@@ -23,7 +22,6 @@ module Contrast
             # querystring
             # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/server_side_request_forgery.md
             def self.valid? patcher, _object, _ret, args
-              return true unless SSRF_RULE == patcher&.rule_id
               return true if patcher.id.to_s.start_with?(PATH_ONLY_PATCH_MARKER)
 
               url = args[0].to_s
@@ -32,42 +30,14 @@ module Contrast
 
               # It is dangerous for the user to control a section of the URL
               # between the start of the protocol and the beginning of the
-              # querystring. If there is no querystring, then the entire URL is
+              # querystring. If there is no path, then the entire URL is
               # dangerous for the User to control.
               start = match.begin(:protocol)
-              finish = match.begin(:query_string)
+              finish = match.begin(:path)
               finish ||= url.length
 
-              args[0].cs__properties.any_tags_between?(start, finish)
-            end
-
-            # Some SSRF triggers take multiple parameters to build the URL.
-            # For the net_http_# sources, if the first parameter is a String,
-            # the URL is built by appending the first and second parameters.
-            def self.composite? patcher, args
-              id = patcher.id.to_s
-              return false unless id.start_with?(PATH_ONLY_PATCH_MARKER)
-
-              args[0].is_a?(String)
-            end
-
-            def self.build_single_source args
-              return nil unless args[0].cs__respond_to?(:cs__properties)
-
-              args[0].to_s
-            end
-
-            def self.build_composite_source args
-              if args.length > 1
-                return nil unless args[0].cs__respond_to?(:cs__properties) ||
-                    args[1].cs__respond_to?(:cs__properties)
-
-                args[0] + args[1]
-              else
-                return nil unless args[0].cs__respond_to?(:cs__properties)
-
-                args[0].to_s
-              end
+              properties = Contrast::Agent::Assess::Tracker.properties(args[0])
+              properties&.any_tags_between?(start, finish)
             end
           end
         end

data/lib/contrast/agent/assess/policy/trigger_validation/trigger_validation.rb

@@ -1,8 +1,9 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'
-cs__scoped_require 'contrast/agent/assess/policy/trigger_validation/xss_validator'
+require 'contrast/agent/assess/policy/trigger_validation/ssrf_validator'
+require 'contrast/agent/assess/policy/trigger_validation/xss_validator'
+require 'contrast/agent/assess/policy/trigger_validation/redos_validator'
 
 module Contrast
   module Agent
@@ -15,13 +16,27 @@ module Contrast
         module TriggerValidation
           VALIDATORS = [
             Contrast::Agent::Assess::Policy::TriggerValidation::SSRFValidator,
-            Contrast::Agent::Assess::Policy::TriggerValidation::XSSValidator
+            Contrast::Agent::Assess::Policy::TriggerValidation::XSSValidator,
+            Contrast::Agent::Assess::Policy::TriggerValidation::REDOSValidator
           ].cs__freeze
 
+          # Determines if the conditions in which this trigger was called are
+          # valid and should result in the generation of a
+          # Contrast::Api::Dtm::Finding.
+          #
+          # @param patcher [Contrast::Agent::Assess::Policy::TriggerNode] the
+          #   Node which applies to the Trigger Method
+          # @param object [Object] the Object on which the Trigger Method was
+          #   invoked
+          # @param ret [Object] the return of the Trigger Method
+          # @param args [Array<Object>] the Arguments with which the Trigger
+          #   Method was invoked
+          # @return [Boolean] if the conditions are valid for the generation of
+          #   a Contrast::Api::Dtm::Finding
           def self.valid? patcher, object, ret, args
-            VALIDATORS.each do |validator|
-              return false unless validator.valid?(patcher, object, ret, args)
-            end
+            specific_validator = VALIDATORS.find { |validator| validator::RULE_NAME == patcher&.rule_id }
+            return specific_validator.valid?(patcher, object, ret, args) if specific_validator
+
             true
           end
         end

data/lib/contrast/agent/assess/policy/trigger_validation/xss_validator.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -8,26 +8,17 @@ module Contrast
         module TriggerValidation
           # Validator used to assert a Reflected XSS finding is actually
           # vulnerable before serializing that finding as a DTM to report to
-          # the service.
+          # the TeamServer.
           module XSSValidator
-            XSS_RULE = 'reflected-xss'
-            SAFE_CONTENT_TYPES = %w[
-              /csv
-              /javascript
-              /json
-              /pdf
-              /x-javascript
-              /x-json
-            ].cs__freeze
+            RULE_NAME = 'reflected-xss'
+            SAFE_CONTENT_TYPES = %w[/csv /javascript /json /pdf /x-javascript /x-json].cs__freeze
 
             # A finding is valid for XSS if the response type is not one of
             # those assumed to be safe
             # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/reflected_xss.md
-            def self.valid? patcher, _object, _ret, _args
-              return true unless XSS_RULE == patcher&.rule_id
-
+            def self.valid? _patcher, _object, _ret, _args
               content_type = Contrast::Agent::REQUEST_TRACKER.current&.response&.content_type
-              return true unless content_type
+              return false unless content_type
 
               content_type = content_type.downcase
               SAFE_CONTENT_TYPES.none? { |safe_type| content_type.index(safe_type) }