contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/reporting/reporting_utilities/reporting_storage.rb

@@ -0,0 +1,66 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will be used to store everything that would be sent
+      # and depends on the response we receive
+      module ReportingStorage
+        class << self
+          include Contrast::Components::Logger::InstanceMethods
+
+          # So the collection will be used to store those events
+          def collection
+            @_collection ||= {}
+          end
+
+          # @param key[String] the key for the pair
+          # @param value[Object] the value we need to store
+          # @return [Object] the value we saved
+          def []= key, value
+            return unless key
+            return unless value
+
+            logger.debug('Saving new value', key: key)
+
+            key = key.to_s.downcase.strip
+            collection[key] = value
+
+            value # rubocop:disable Lint/Void
+          end
+
+          # @param key[String] the key for the pair
+          def [] key
+            return unless key
+
+            collection[key]
+          end
+          alias_method :get, :[]
+          alias_method :set, :[]=
+
+          def delete key
+            return unless key
+
+            logger.debug('Starting deleting value for', key: key)
+
+            deleted_value = collection.delete(key)
+            logger.debug('Key wasn\'t found') unless deleted_value
+
+            deleted_value
+          end
+
+          # @param rule_id [String] the rule_id
+          # @return [Array, nil] return array with key and value of the pair
+          def find_by_rule_id rule_id
+            return unless rule_id
+
+            collection.find { |_, v| v.rule_id == rule_id }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/response.rb

@@ -0,0 +1,98 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/application_settings'
+require 'contrast/agent/reporting/settings/server_features'
+require 'contrast/agent/reporting/settings/reaction'
+
+module Contrast
+  module Agent
+    module Reporting
+      # this class will hold the response from TS
+      class Response
+        # All of the settings from TeamServer that apply at the application level.
+        # At least one, but not necessarily all, setting will differ from the agent's current set.
+        # Agents are able to replace all application settings with those in this message.
+        #
+        # @return [Contrast::Agent::Reporting::Settings::ApplicationSettings, nil]
+        attr_accessor :application_settings
+
+        # All of the feature server_features
+        #
+        # @return [Contrast::Agent::Reporting::Settings::ServerFeatures, nil]
+        attr_accessor :server_features
+
+        # Success boolean message value
+        #
+        # @return [Boolean]
+        attr_accessor :success
+
+        # Message with reasons for success or fail.
+        #
+        # @return [Array<String>] Messages received from TS.
+        attr_accessor :messages
+
+        class << self
+          # All of the settings from TeamServer that apply at the application level.
+          #
+          # @return response [Contrast::Agent::Reporting::Response]
+          def build_application_response
+            res = new
+            res.application_settings = Contrast::Agent::Reporting::Settings::ApplicationSettings.new
+            res
+          end
+
+          # All of the settings from TeamServer that apply at the server level.
+          #
+          # @return response [Contrast::Agent::Reporting::Response]
+          def build_server_response
+            res = new
+            res.server_features = Contrast::Agent::Reporting::Settings::ServerFeatures.new
+            res
+          end
+        end
+
+        # Reaction the agent should take based on a state in TS.
+        # This is moved one level up because the responses we
+        # receive for feature and settings from TS have different
+        # place to store these reactions:
+        #
+        # body.reactions vs body.settings.reactions
+        #
+        # @return [Array<Contrast::Agent::Reporting::Settings::Reaction>]
+        def reactions
+          @_reactions ||= []
+        end
+
+        # Set the reaction
+        #
+        # @param reaction_array [Array<Reaction>] {
+        #   level     [String] The level at which the agent should log this reaction.
+        #                      [ERROR, WARN, INFO, DEBUG, TRACE]
+        #   message   [String] A message to log when receiving this reaction.
+        #   operation [String] What to do in response to this reaction.[NOOP, DISABLE] }
+        # @return [Array<Contrast::Agent::Reporting::Settings::Reaction>]
+        def reactions= reaction_array
+          return unless reaction_array.is_a?(Array)
+
+          reaction_array.each do |r|
+            reactions << Contrast::Agent::Reporting::Settings::Reaction.new(r[:level], r[:operation], r[:message])
+          end
+        end
+
+        # This method is used only for testing with golden files.
+        def to_controlled_hash
+          {
+              success: success,
+              messages: messages,
+              features: server_features.nil? ? nil : server_features.to_controlled_hash,
+              settings: application_settings.nil? ? nil : application_settings.to_controlled_hash,
+              logLevel: server_features&.log_level,
+              logFile: server_features&.log_file,
+              reactions: server_features.nil? ? nil : reactions.map(&:to_controlled_hash)
+          }.compact
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/response_extractor.rb

@@ -0,0 +1,176 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold the methods for TS response conversion to settings objects.
+      module ResponseExtractor
+        private
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_assess response_data, res
+          assessments = response_data[:settings][:assessment]
+          return unless assessments
+
+          res.application_settings.assess.disabled_rules = assessments[:disabledRules]
+          res.application_settings.assess.session_id = assessments[:session_id]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect response_data, res
+          protect = response_data[:settings][:defend]
+          return unless protect
+
+          res.application_settings.protect.protection_rules = protect[:protectionRules]
+          res.application_settings.protect.virtual_patches = protect[:virtualPatches]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_exclusions response_data, res
+          exclusions = response_data[:settings][:exceptions]
+          return unless exclusions
+
+          res.application_settings.exclusions.code_exclusions = exclusions[:codeExceptions]
+          res.application_settings.exclusions.input_exclusions = exclusions[:inputExceptions]
+          res.application_settings.exclusions.url_exclusions = exclusions[:urlExceptions]
+        end
+
+        # The responses we receive for feature and settings from TS have different
+        # place to store these reactions: body.reactions vs body.settings.reactions.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_reactions response_data, res
+          res.reactions = response_data[:settings][:reactions] if response_data[:settings]
+          res.reactions = response_data[:reactions] if response_data[:features]
+        end
+
+        # This method is universal and used for both ng endpoing of feature settings and the new
+        # Server settings endpoint. Used in both build_feature_settings and build_server_settings.
+        # Passing the ng_ flag determines the use of the endpoint and response used because some of
+        # the response fields are with different names or do not exist: [enabled vs enable]
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        # @param ng_ [Boolean]
+        def extract_assess_settings response_data, res, ng_: true
+          assess = ng_ ? response_data[:features][:assessment] : response_data[:assess]
+          return unless assess
+
+          res.server_features.assess.enabled = ng_ ? assess[:enabled] : assess[:enable]
+          res.server_features.assess.report_stacktraces = assess[:report_stacktraces] unless ng_
+          res.server_features.assess.sampling = assess[:sampling]
+          res.server_features.assess.sanitizers = assess[:sanitizers]
+          res.server_features.assess.validators = assess[:validators]
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect_server_features response_data, res
+          protect = response_data[:features][:defend]
+          return unless protect
+
+          res.server_features.protect.enabled = protect[:enabled]
+          res.server_features.protect.bot_blocker.enable = protect[:'bot-blocker']
+          res.server_features.protect.bot_blocker.bots = protect[:botBlockers]
+          extract_syslog(response_data, res)
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_syslog response_data, res
+          return unless (syslog = response_data[:features][:defend][:syslog])
+
+          res.server_features.protect.syslog.assign_array(syslog, ng_: true)
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect_lists response_data, res
+          protect = response_data[:features][:defend]
+          return unless protect
+
+          res.server_features.protect.ip_allowlist = protect[:ipAllowlist]
+          res.server_features.protect.ip_denylist = protect[:ipDenylist]
+          res.server_features.protect.log_enhancers = protect[:logEnhancers]
+          res.server_features.protect.rule_definition_list = protect[:ruleDefinitionList]
+        end
+
+        # Here we extract the rules and state for the sensitive data masking policy
+        # received from TS.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_sensitive_data_policy response_data, res
+          return unless (sensitive_data = response_data[:settings][:sensitive_data_masking_policy])
+
+          res.application_settings.sensitive_data_masking.mask_http_body = sensitive_data[:mask_http_body]
+          res.application_settings.sensitive_data_masking.mask_attack_vector = sensitive_data[:mask_attack_vector]
+          res.application_settings.sensitive_data_masking.build_rules_form_settings(sensitive_data[:rules])
+        end
+
+        # Here we extract the log settings received from TS.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_log_settings response_data, res
+          return unless (log_level = response_data[:logLevel])
+
+          res.server_features.log_level = log_level
+          res.server_features.log_file = response_data[:logFile] if response_data[:logFile]
+        end
+
+        # This method is used with ServerSettings as we expect to have data for
+        # all the loggers - security_logger, logger, syslog.
+        #
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_loggers response_data, res
+          logger = response_data[:logger]
+          security_logger = response_data[:security_logger]
+
+          if logger
+            res.server_features.log_level = logger[:level]
+            res.server_features.log_file = logger[:path]
+          end
+          return unless security_logger
+
+          log_level = security_logger[:level]
+          log_file = security_logger[:path]
+          res.server_features.security_logger.log_level = log_level
+          res.server_features.security_logger.log_file = log_file
+          res.server_features.security_logger.not_blank!
+          res.server_features.security_logger.syslog.assign_array(response_data[:security_logger][:syslog], ng_: false)
+        end
+
+        # @param response_data [Hash]
+        # @param res [Contrast::Agent::Reporting::Response]
+        def extract_protect_server_settings response_data, res
+          protect = response_data[:protect]
+          return unless protect
+
+          res.server_features.protect.enabled = protect[:enable]
+          res.server_features.protect.observability = protect[:observability]
+          res.server_features.protect.log_enhancers = protect[:log_enhancers]
+          update_protect_rules(protect, res)
+        end
+
+        # @param protect [Hash] response data
+        # @param res [Contrast::Agent::Reporting::Response]
+        def update_protect_rules protect, res
+          return unless (rules = protect[:rules])
+
+          res.server_features.protect.ip_allowlist = rules[:ip_allowlist]
+          res.server_features.protect.ip_denylist = rules[:ip_denylist]
+          res.server_features.protect.bot_blocker.enable = rules[:bot_blocker][:enable]
+          res.server_features.protect.bot_blocker.bots = rules[:bot_blocker][:bots]
+          res.server_features.protect.rules_to_definition_list(rules)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/response_handler.rb

@@ -0,0 +1,117 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_utilities/response'
+require 'contrast/agent/reporting/reporting_utilities/response_handler_utils'
+require 'contrast/agent/reporting/reporting_utilities/response_handler_mode'
+require 'contrast/components/logger'
+require 'json'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will facilitate the Response capture and analysis functionality.
+      class ResponseHandler
+        include Contrast::Components::Logger::InstanceMethods
+        include Contrast::Agent::Reporting::ResponseHandlerUtils
+        # 15 min
+        TIMEOUT = 900.cs__freeze
+
+        # Process the response from TS
+        #
+        # @param response [Net::HTTP::Response, nil]
+        # @param event [Contrast::Agent::Reporting::ReportingEvent] The event sent to TeamServer.
+        # @return response [Net::HTTP::Response, nil]
+        def process response, event
+          logger.debug('Reporter Received a response')
+          return unless analyze_response?(response)
+
+          # Handle the response body and obtain server_features or app_settings
+          report_response = convert_response(response, event)
+          return unless report_response
+
+          # Update Server Features and Application Settings to provide current agent settings
+          update_agent_settings(report_response)
+          # Process any reactions, including message logging and shutting down
+          update_reaction(report_response)
+          update_ruleset(report_response)
+          logger.trace('Agent settings updated in response to TeamServer', protect_on: ::Contrast::PROTECT.enabled?,
+                                                                           assess_on: ::Contrast::ASSESS.enabled?)
+          response
+        rescue StandardError => e
+          logger.error('Unable to process response from TeamServer', e)
+          nil
+        end
+
+        # If sleep is true puts reporting service to sleep.
+        def sleep?
+          @_sleep = wake_up if @_sleep.nil?
+          @_sleep
+        end
+
+        # For how long the agent should wait until retry
+        # to send message
+        #
+        # @return timeout [Integer] the time for reporter
+        # to be suspended.
+        def timeout
+          @_timeout ||= TIMEOUT
+        end
+
+        def mode
+          @_mode ||= Contrast::Agent::Reporting::ResponseHandlerMode.new
+        end
+
+        # Wakes the reporting service
+        def wake_up
+          @_sleep = false
+        end
+
+        private
+
+        # Handles the errors code received from TS and takes appropriate action.
+        # If we are here the response.code is an error that needs handling [4XX]
+        #
+        # @param response [Net::HTTP::Response]
+        def handle_error response
+          case response&.code
+          when ERROR_CODES[:message_not_sent]
+            handle_response_errors(response, UNSUCCESSFULLY_RECEIVED_MSG, mode.running)
+          when ERROR_CODES[:access_forbidden]
+            handle_response_errors(response, FORBIDDEN_MSG, mode.running)
+          when ERROR_CODES[:access_forbidden_no_action]
+            handle_response_errors(response, FORBIDDEN_NO_ACTION_MSG, mode.running)
+          when ERROR_CODES[:application_do_not_exist]
+            handle_response_errors(response, APP_NON_EXISTENT_MSG, mode.disabled)
+          when ERROR_CODES[:unprocessable_entity]
+            handle_response_errors(response, UNPROCESSABLE_ENTITY_MSG, mode.disabled)
+          when ERROR_CODES[:too_many_requests]
+            handle_response_errors(response, RETRY_AFTER_MSG, mode.resending)
+          else
+            logger.error('Unable to execute agent post_call')
+          end
+        end
+
+        # Suspend the reporter and try again in time. If not set
+        # the timeout is set to 15 min As default:
+        #
+        # @param message [String] Message to log.
+        # @param timeout [Integer,nil] The timeout to wait and retry after.
+        # @param error_message [String, nil] Error message if any received.
+        def suspend_reporting message, timeout, error_message
+          @_timeout = timeout || Contrast::Agent::Reporting::ResponseHandler::TIMEOUT
+          log_debug_msg(message, timeout: @_timeout, error_message: error_message || 'none')
+          @_sleep = true
+        end
+
+        # Log what we've received.
+        #
+        # @param message [String] Message to log
+        # @param info_hash [Hash] information about the context to log.
+        def log_debug_msg message, info_hash
+          logger.debug(message, info_hash)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_utilities/response_handler_mode.rb

@@ -0,0 +1,63 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This class will hold the mode state in which the reporter will send
+      # event ot TS.
+      class ResponseHandlerMode
+        # Reader for the running mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are running
+        # and responses are being processed.
+        attr_reader :running
+        # Reader for the disabled mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are disabled
+        # due to received Error. The Reporting is disabled for this application.
+        attr_reader :disabled
+        # Reader for the resending/retry mode type.
+        #
+        # @return [Symbol] Reporter's client and Response Handler are suspended
+        # for a TS received amount of time and will try to resend the previous
+        # request after that.
+        attr_reader :resending
+        # Reader for all supported modes.
+        #
+        # @return [Array<Symbol>] Reporter's client and Response Handler all
+        # available modes of operation.
+        attr_reader :modes
+
+        def initialize
+          @running = :running
+          @disabled = :disabled
+          @resending = :resending
+          @modes = [@running, @disabled, @resending].cs__freeze
+        end
+
+        # Current mode.
+        #
+        # @return [Symbol] Reporter's client and Response Handler
+        # current mode of operation.
+        def status
+          @_status ||= running
+        end
+
+        # Set current mode.
+        #
+        # @return [Symbol] Reporter's client and Response Handler
+        # current mode of operation.
+        def status= mode
+          @_status = mode if mode.cs__is_a?(Symbol) && modes.include?(mode)
+        end
+
+        # Reset mode
+        #
+        def reset_mode
+          @_status = running
+        end
+      end
+    end
+  end
+end