contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/protect/rule/cmdi/cmdi_base_rule.rb

@@ -0,0 +1,169 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/details/cmd_injection_details'
+require 'contrast/agent/reporting/attack_result/user_input'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect Command Injection Semantic
+        # Dangerous Path sub-rule. This rule should report
+        class CmdiBaseRule < Contrast::Agent::Protect::Rule::BaseService
+          include Contrast::Components::Logger::InstanceMethods
+          include Contrast::Agent::Reporting::InputType
+
+          CHAINED_COMMAND_CHARS = /[;&|<>]/.cs__freeze
+          APPLICABLE_USER_INPUTS = [
+            BODY, COOKIE_VALUE, HEADER, PARAMETER_NAME,
+            PARAMETER_VALUE, JSON_VALUE, MULTIPART_VALUE,
+            MULTIPART_FIELD_NAME, XML_VALUE, DWR_VALUE
+          ].cs__freeze
+
+          # CMDI infilter:
+          #
+          # @param context [Contrast::Agent::RequestContext] current request contest
+          # @param classname [String] Name of the class
+          # @param method [String] name of the method triggering the rule
+          # @param command [String] potential dangerous command executed.
+          # @raise [Contrast::SecurityException] if the rule mode ise set
+          # to BLOCK and valid cdmi is detected.
+          def infilter context, classname, method, command
+            if ::Contrast::APP_CONTEXT.in_new_process?
+              logger.trace('Running cmd-injection infilter within new process - creating new context')
+              context = Contrast::Agent::RequestContext.new(context.request.rack_request)
+              Contrast::Agent::REQUEST_TRACKER.update_current_context(context)
+            end
+            return unless infilter?(context)
+
+            result = find_attacker_with_results(context, command, nil, **{ classname: classname, method: method })
+            result ||= report_command_execution(context, command, **{ classname: classname, method: method })
+            return unless result
+
+            append_to_activity(context, result)
+            cef_logging(result, :successful_attack)
+            return unless blocked?
+
+            raise_error(classname, method)
+          end
+
+          def build_attack_with_match(context,
+                                      input_analysis_result,
+                                      result,
+                                      candidate_string,
+                                      **kwargs)
+            return result if mode == :NO_ACTION || mode == :PERMIT
+
+            result ||= build_attack_result(context)
+            update_successful_attack_response(context, input_analysis_result, result, candidate_string)
+            append_sample(context, input_analysis_result, result, candidate_string, **kwargs)
+            result
+          end
+
+          protected
+
+          # Used to customize the raised error message.
+          #
+          # @param classname [String] Name of the class
+          # @param method [String] name of the method triggering the rule
+          # @raise [Contrast::SecurityException]
+          def raise_error classname, method
+            raise(Contrast::SecurityException.new(self,
+                                                  'Command Injection Rule triggered. '\
+                                                  "Call to #{ classname }.#{ method } blocked."))
+          end
+
+          # Allows for the InputAnalysis from service to be extracted early.
+          # Because results are not necessarily on the context across
+          # processes; extract early and pass into the method
+          #
+          # @param context [Contrast::Agent::RequestContext]
+          # @param potential_attack_string [String, nil]
+          # @param ia_results [Array<Contrast::Agent::Reporting::InputAnalysis>]
+          # @param **kwargs
+          # @return [Contrast::Agent::Reporting, nil]
+          def find_attacker_with_results context, potential_attack_string, ia_results, **kwargs
+            logger.trace('Checking vectors for attacks', rule: rule_name, input: potential_attack_string)
+            result = super(context, potential_attack_string, ia_results, **kwargs) if ia_results
+            if result.nil? && potential_attack_string
+              result = find_probable_attacker(context, potential_attack_string, ia_results, **kwargs)
+            end
+            result
+          end
+
+          # Build a subclass of the RaspRuleSample using the query string and the
+          # evaluation
+          def build_sample context, input_analysis_result, candidate_string, **kwargs
+            sample = build_base_sample(context, input_analysis_result)
+            sample.details = Contrast::Agent::Reporting::Details::CmdInjectionDetails.new
+
+            # extract data from kwargs for the agent_lib check
+            agent_lib_result_struct = kwargs[:result_struct]
+            command = candidate_string || input_analysis_result.value
+            command = Contrast::Utils::StringUtils.protobuf_safe_string(command)
+            handle_with_agent_lib(sample, agent_lib_result_struct, command)
+
+            # This is a special case where the user input is UNKNOWN_USER_INPUT but
+            # we want to send the attack value
+            if input_analysis_result.nil?
+              ui = Contrast::Agent::Reporting::UserInput.new
+              ui.input_type = :UNKNOWN
+              ui.value = command
+              sample.user_input = ui
+            end
+
+            sample
+          end
+
+          private
+
+          def report_command_execution context, command, **kwargs
+            return unless report_any_command_execution?
+            return if protect_excluded_by_code?
+
+            build_attack_with_match(context, nil, nil, command, **kwargs)
+          end
+
+          def find_probable_attacker context, potential_attack_string, ia_results, **kwargs
+            return unless chained_command?(potential_attack_string)
+
+            likely_attacker = ia_results.find { |input_analysis_result| chained_command?(input_analysis_result.value) }
+            return unless likely_attacker
+
+            build_attack_with_match(context, likely_attacker, nil, potential_attack_string, **kwargs)
+          end
+
+          def chained_command? command
+            CHAINED_COMMAND_CHARS.match(command)
+          end
+
+          # Part of the Hardening for Command Injection detection is the
+          # ability to detect and prevent any command execution from within the
+          # application. This check determines if that hardening has been
+          # enabled.
+          # @return [Boolean] if the agent should report all command
+          #   executions.
+          def report_any_command_execution?
+            ::Contrast::PROTECT.report_any_command_execution?
+          end
+
+          # handle agent_lib data being attached
+          def handle_with_agent_lib sample, agent_lib_result_struct, command
+            sample.details.cmd = command
+            if agent_lib_result_struct&.cs__is_a?(Hash)
+              sample.details.start_idx = agent_lib_result_struct[:start_index]
+              sample.details.end_idx = if (agent_lib_result_struct[:end_index]).zero?
+                                         command.length
+                                       else
+                                         agent_lib_result_struct[:end_index]
+                                       end
+            else
+              sample.details.end_idx = command.length
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/cmdi/cmdi_chained_command.rb

@@ -0,0 +1,64 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/request_context'
+require 'contrast/utils/object_share'
+require 'contrast/agent/protect/rule/cmdi/cmdi_base_rule'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect Command Injection Semantic
+        # Chained Command sub-rule. This rule should report
+        class CmdiChainedCommand < Contrast::Agent::Protect::Rule::CmdiBaseRule
+          NAME = 'cmd-injection-semantic-chained-commands'
+
+          def rule_name
+            NAME
+          end
+
+          def sub_rules
+            Contrast::Utils::ObjectShare::EMPTY_ARRAY
+          end
+
+          protected
+
+          # Used to customize the raised error message.
+          #
+          # @param classname [String] Name of the class
+          # @param method [String] name of the method triggering the rule
+          # @raise [Contrast::SecurityException]
+          def raise_error classname, method
+            raise(Contrast::SecurityException.new(self,
+                                                  'Command Injection Semantic Chained Commands rule triggered. '\
+                                                  "Call to #{ classname }.#{ method } blocked."))
+          end
+
+          private
+
+          def find_probable_attacker context, potential_attack_string, _ia_results, **kwargs
+            chained = chained_command?(potential_attack_string)
+            return unless chained
+
+            build_attack_with_match(context, nil, nil, potential_attack_string, **kwargs)
+          end
+
+          # Check if potential chained attack is detected in user input.
+          #
+          # @param command [String] command to check.
+          # @return index[Boolean Returns the index of the command chaining if found.
+          # If the chaining index is >= 0, an injection is detected. Returns -1 when no
+          # command chaining is found.
+          def chained_command? command
+            return false unless (agent_lib = Contrast::AGENT_LIB) && command
+            return false if agent_lib.chained_cmdi_index(command).negative?
+
+            true
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/cmdi/cmdi_dangerous_path.rb

@@ -0,0 +1,63 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/protect/rule/base_service'
+require 'contrast/agent/request_context'
+require 'contrast/utils/object_share'
+require 'contrast/agent/protect/rule/cmdi/cmdi_base_rule'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # The Ruby implementation of the Protect Command Injection Semantic
+        # Dangerous Path sub-rule. This rule should report
+        class CmdiDangerousPath < Contrast::Agent::Protect::Rule::CmdiBaseRule
+          NAME = 'cmd-injection-semantic-dangerous-paths'
+
+          def rule_name
+            NAME
+          end
+
+          def sub_rules
+            Contrast::Utils::ObjectShare::EMPTY_ARRAY
+          end
+
+          protected
+
+          # Used to customize the raised error message.
+          #
+          # @param classname [String] Name of the class
+          # @param method [String] name of the method triggering the rule
+          # @raise [Contrast::SecurityException]
+          def raise_error classname, method
+            raise(Contrast::SecurityException.new(self,
+                                                  'Command Injection Dangerous Path rule triggered. '\
+                                                  "Call to #{ classname }.#{ method } blocked."))
+          end
+
+          private
+
+          def find_probable_attacker context, potential_attack_string, _ia_results, **kwargs
+            dangerous_path = dangerous_path?(potential_attack_string)
+            return unless dangerous_path
+
+            build_attack_with_match(context, nil, nil, potential_attack_string, **kwargs)
+          end
+
+          # Checks if a given shell command is trying to access a dangerous path.
+          # This is used for the cmd-injection-semantic-dangerous-paths rule.
+          #
+          # @param path [String] path to check.
+          # @return index[Boolean] Returns true if a dangerous path is found.
+          # Returns false if no dangerous paths are found.
+          def dangerous_path? path
+            return false unless (agent_lib = Contrast::AGENT_LIB) && path
+
+            agent_lib.dangerous_path?(path)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/cmdi/cmdi_input_classification.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/protect/rule/cmd_injection'
+require 'contrast/agent/reporting/input_analysis/score_level'
+require 'contrast/agent/protect/input_analyzer/input_analyzer'
+require 'contrast/utils/input_classification_base'
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Protect
+      module Rule
+        # This module will do the Input Classification stage of CMD Injection rule
+        # as a result input would be marked as WORTHWATCHING or IGNORE,
+        # to be analyzed at the sink level.
+        module CmdiInputClassification
+          WORTHWATCHING_MATCH = 'cmdi-worth-watching-v2'.cs__freeze
+          class << self
+            include InputClassificationBase
+            include Contrast::Components::Logger::InstanceMethods
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/protect/rule/default_scanner.rb

@@ -1,12 +1,14 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 # The base class used to determine if a user input crosses a token boundary or
 # state, indicating a successful attack using SQL or NoSQL Injection.
 #
 # @deprecated RUBY-356: this class and those that extend it are being phased out
-#   in favor of the more performant code in the Service.
+#   in favor of the more performant code in the Agent Library.
 class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/ClassAndModuleChildren
+  OPERATOR_PATTERN = %r{[+=*^/%><!-]}.cs__freeze
+
   # Potential states
   # :STATE_INSIDE_TOKEN
   # :STATE_INSIDE_NUMBER
@@ -18,11 +20,16 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
   # :STATE_INSIDE_BLOCK_COMMENT # inside a commend that will end with a closing tag
   # :STATE_SKIP_NEXT_CHARACTER
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the index of the input in the query
+  # @param input [String] the input value provided by the user
+  # @return [Array<Integer>, nil] the boundary overrun by the input or nil if no overrun
   def crosses_boundary query, index, input
     last_boundary = 0
-    token_boundaries(query).each do |boundary|
+    scan_token_boundaries(query).each do |boundary|
       if boundary > index
-        return last_boundary, boundary if boundary < index + input.length
+        # We should report the previous and overrun boundary if the input crosses one.
+        return last_boundary, boundary if boundary < (index + input.length)
 
         break
       end
@@ -31,11 +38,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     nil
   end
 
-  def token_boundaries query
-    @_token_boundaries ||= scan_token_boundaries(query)
-  end
+  private
 
-  CANARY = "select * from tbl where bar='bar';#' and pwd='sec3r3t'; # CANARY"
+  # @param query [String] the query being executed
+  # @return [Array<Integer>] the boundaries of the query
   def scan_token_boundaries query
     boundaries = []
     return boundaries unless query && !query.empty?
@@ -72,6 +78,11 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     boundaries
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param current_state [Symbol] the state of the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_state boundaries, current_state, char, index, query
     case current_state
     when :STATE_EXPECTING_TOKEN
@@ -87,6 +98,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_expecting_token boundaries, char, index, query
     if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
       boundaries << index
@@ -111,6 +126,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_inside_token boundaries, char, index, query
     if char == Contrast::Utils::ObjectShare::SINGLE_QUOTE
       boundaries << index
@@ -124,10 +143,7 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     elsif start_block_comment?(char, index, query)
       boundaries << index
       :STATE_INSIDE_BLOCK_COMMENT
-    elsif operator?(char)
-      boundaries << index
-      :STATE_EXPECTING_TOKEN
-    elsif char.match?(Contrast::Utils::ObjectShare::WHITE_SPACE_REGEXP)
+    elsif operator?(char) || char.match?(Contrast::Utils::ObjectShare::WHITE_SPACE_REGEXP)
       boundaries << index
       :STATE_EXPECTING_TOKEN
     else
@@ -135,6 +151,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param _query [String] the query being executed
   def process_number boundaries, char, index, _query
     if char.match?(Contrast::Utils::ObjectShare::DIGIT_REGEXP) || char == Contrast::Utils::ObjectShare::PERIOD
       :STATE_INSIDE_NUMBER
@@ -144,6 +164,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_double_quote boundaries, char, index, query
     if escape_char?(char)
       :STATE_SKIP_NEXT_CHARACTER
@@ -161,6 +185,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param boundaries [Array<Integer>] the indexes of the state changes in the query
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def process_single_quote boundaries, char, index, query
     if escape_char?(char)
       :STATE_SKIP_NEXT_CHARACTER
@@ -178,18 +206,24 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     end
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def double_quote? query, index
     return false unless index >= 0 && index < query.length
 
     query[index] == Contrast::Utils::ObjectShare::DOUBLE_QUOTE
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def single_quote? query, index
     return false unless index >= 0 && index < query.length
 
     query[index] == Contrast::Utils::ObjectShare::SINGLE_QUOTE
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_escape_sequence_boundary query, index
     idx = index
     while idx < query.length
@@ -201,6 +235,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_block_comment_boundary query, index
     idx = index
     while idx < query.length
@@ -212,6 +248,8 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
+  # @param query [String] the query being executed
+  # @param index [Integer] the location of the character in the query
   def find_new_line_boundary query, index
     idx = index
     while idx < query.length
@@ -224,13 +262,17 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     idx
   end
 
-  OPERATOR_PATTERN = %r{[+=*^/%><!-]}.cs__freeze
+  # @param char [String] the character being evaluated
   def operator? char
     char.match?(OPERATOR_PATTERN)
   end
 
   # @note: Any class extending this module should override these methods as needed
   # Are the current and subsequent characters both '-' ?
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def start_line_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::DASH
     return false unless (query.length - 2) >= index
@@ -240,6 +282,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
 
   # Is the current character / sequence of characters the start of a block comment
   # We assume '/*' starts the comment by default
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def start_block_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::SLASH
     return false unless (query.length - 2) >= index
@@ -249,6 +295,10 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
 
   # Is the current character / sequence of characters the end of a block comment
   # We assume '*/' ends the comment by default
+  #
+  # @param char [String] the character being evaluated
+  # @param index [Integer] the location of the character in the query
+  # @param query [String] the query being executed
   def end_block_comment? char, index, query
     return false unless char == Contrast::Utils::ObjectShare::ASTERISK
     return false unless (query.length - 2) >= index
@@ -268,32 +318,26 @@ class Contrast::Agent::Protect::Rule::DefaultScanner # rubocop:disable Style/Cla
     true
   end
 
-  # Does this language let the user redefine the escape character
-  # We assume no by default
-  def redefines_escape_char?
-    false
-  end
-
   # Is the character provided an escape character?
   # By default, we'll assume
+  #
+  # @param char [String] the character being evaluated
   def escape_char? char
     char == Contrast::Utils::ObjectShare::BACK_SLASH
   end
 
-  # Does this language support string escape sequences?
-  # We assume no by default
-  def support_string_escape_sequence?
-    false
-  end
-
   # Is this the start of a string escape sequence?
   # Since escape sequences aren't supported, the answer is always false
+  #
+  # @param _char [String] the character being evaluated
   def escape_sequence_start? _char
     false
   end
 
   # Is this the end of a string escape sequence?
   # Since escape sequences aren't supported, the answer is always false
+  #
+  # @param _char [String] the character being evaluated
   def escape_sequence_end? _char
     false
   end