contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/reporting/settings/server_features.rb

@@ -0,0 +1,95 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/settings/assess_server_feature'
+require 'contrast/agent/reporting/settings/protect_server_feature'
+require 'contrast/agent/reporting/settings/security_logger'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This module will hold all the settings from the TS responce
+      module Settings
+        # All of the settings from TeamServer that apply at the server level.
+        # At least one, but not necessarily all, setting will differ from the agent's current set.
+        # agents are able to replace all server settings with those in this message.
+        class ServerFeatures
+          # The level at which the agent should log. Overridden by agent.logger.level
+          # if set in a local configuration
+          #
+          # @return log_level [String] [ ERROR, WARN, INFO, DEBUG, TRACE ]
+          def log_level
+            @_log_level ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # set the log level
+          #
+          # @param log_level [String]
+          # @return log_level [String] [ ERROR, WARN, INFO, DEBUG, TRACE ]
+          def log_level= log_level
+            @_log_level = log_level if log_level.is_a?(String)
+          end
+
+          # Where to log the agent's log file, if set by the user. Overridden by agent.logger.path
+          # if set in a local configuration.
+          #
+          # @return log_file [String] path
+          def log_file
+            @_log_file ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the log file
+          #
+          # @param log_file [String] path
+          # @return log_file [String] path
+          def log_file= log_file
+            @_log_file = log_file if log_file.is_a?(String)
+          end
+
+          # Class holding security logger settings:
+          #
+          # @return [Contrast::Agent::Reporting::Settings::SecurityLogger]
+          def security_logger
+            @_security_logger ||= Contrast::Agent::Reporting::Settings::SecurityLogger.new
+          end
+
+          # Controls for the reporting of telemetry events from the agent to TeamServer.
+          # This is NOT for the agent telemetry feature collecting metrics sent to other services.
+          #
+          # @return telemetry [Boolean]
+          def telemetry
+            @_telemetry
+          end
+
+          # sets the telemetry value
+          #
+          # @param telemetry [Boolean]
+          # @return telemetry [Boolean]
+          def telemetry= telemetry
+            @_telemetry = telemetry if !!telemetry == telemetry
+          end
+
+          # @return assess [Contrast::Agent::Reporting::Settings::AssessServerFeature]
+          def assess
+            @_assess ||= Contrast::Agent::Reporting::Settings::AssessServerFeature.new
+          end
+
+          # @return protect [Contrast::Agent::Reporting::Settings::ProtectServerFeature]
+          def protect
+            @_protect ||= Contrast::Agent::Reporting::Settings::ProtectServerFeature.new
+          end
+
+          def to_controlled_hash
+            {
+                security_logger: security_logger.settings_blank? ? nil : security_logger.to_controlled_hash,
+                assessment: @_assess ? assess.to_controlled_hash : {},
+                defend: @_protect ? protect.to_controlled_hash : {},
+                telemetry: telemetry
+            }.compact
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/syslog.rb

@@ -0,0 +1,205 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # Controls for the syslogging feature in the agent
+        class Syslog
+          CONNECTION_TYPE = %w[UNENCRYPTED ENCRYPTED].cs__freeze
+          # Used for:
+          # severity_blocked, severity_blocked_perimeter, severity_exploited, severity_probed,
+          # severity_probed_perimeter
+          SEVERITIES = %w[ALERT CRITICAL ERROR WARNING NOTICE INFO DEBUG].cs__freeze
+          # Order and elements matter, the same setter must be called against same response field.
+          SYSLOG_METHODS_NG = %i[
+            enable= ip= port= facility= protocol= connection_type= severity_exploited= severity_blocked=
+            severity_probed= severity_probed_suspicious= severity_blocked_perimeter= severity_probed_perimeter=
+          ].cs__freeze
+          SYSLOG_RESPONSE_KEYS_NG = %i[
+            syslogEnabled syslogIpAddress syslogPortNumber syslogFacilityCode syslogProtocol
+            syslogConnectionType syslogSeverityExploited syslogSeverityBlocked syslogSeverityProbed
+            syslogSeveritySuspicious syslogSeverityBlockedPerimeter syslogSeverityProbedPerimeter
+          ].cs__freeze
+          SYSLOG_METHODS = %i[
+            enable= ip= port= facility= connection_type= severity_blocked= severity_blocked_perimeter=
+            severity_exploited= severity_probed= severity_probed_perimeter=
+          ].cs__freeze
+          SYSLOG_RESPONSE_KEYS = %i[
+            enable ip facility connection_type severity_blocked severity_blocked_perimeter severity_exploited
+            severity_probed severity_probed_perimeter
+          ].cs__freeze
+
+          # @return enable [Boolean]
+          attr_accessor :enable
+          # @return ip [Integer]
+          attr_accessor :ip
+          # @return port [Integer]
+          attr_accessor :port
+          # @return facility [Integer]
+          attr_accessor :facility
+          # @return protocol [String]
+          attr_accessor :protocol
+
+          def initialize
+            @enable = false
+            @ip = Contrast::Utils::ObjectShare::EMPTY_STRING
+            @port = 0
+            @facility = 0
+            @blank = true
+          end
+
+          # check to see if object is being used
+          #
+          # @return [Boolean]
+          def settings_blank?
+            @blank
+          end
+
+          # Set the state of settings
+          #
+          # @return [Boolean]
+          def not_blank!
+            @blank = false
+          end
+
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def connection_type
+            @_connection_type ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the connection type
+          #
+          # @param type [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def connection_type= type
+            @_connection_type = type if valid_entry?(type, CONNECTION_TYPE)
+          end
+
+          # @return severity_blocked [String]
+          def severity_blocked
+            @_severity_blocked ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_blocked= severity
+            @_severity_blocked = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_blocked_perimeter
+            @_severity_blocked_perimeter ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_blocked_perimeter= severity
+            @_severity_blocked_perimeter = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_exploited
+            @_severity_exploited ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_exploited= severity
+            @_severity_exploited = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_probed
+            @_severity_probed ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_probed= severity
+            @_severity_probed = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_probed_perimeter
+            @_severity_probed_perimeter ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_probed_perimeter= severity
+            @_severity_probed_perimeter = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @return severity_blocked [String]
+          def severity_probed_suspicious
+            @_severity_probed_suspicious ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # Set the severity type
+          #
+          # @param severity [String, Symbol] one of UNENCRYPTED, ENCRYPTED
+          # @return connection_type [String] one of UNENCRYPTED, ENCRYPTED
+          def severity_probed_suspicious= severity
+            @_severity_probed_suspicious = severity if valid_entry?(severity, SEVERITIES)
+          end
+
+          # @param settings_array [Array] Settings retrieved from response
+          # @param ng_ [Boolean]
+          def assign_array settings_array, ng_: true
+            methods = ng_ ? SYSLOG_METHODS_NG : SYSLOG_METHODS
+            response_keys = ng_ ? SYSLOG_RESPONSE_KEYS_NG : SYSLOG_RESPONSE_KEYS
+
+            methods.each_with_index do |method, index|
+              send(method, settings_array[response_keys[index]])
+            end
+            not_blank!
+          end
+
+          def to_controlled_hash
+            {
+                syslogEnabled: enable,
+                syslogIpAddress: ip,
+                syslogPortNumber: port,
+                syslogFacilityCode: facility,
+                syslogConnectionType: connection_type,
+                syslogProtocol: protocol,
+                syslogSeverityExploited: severity_exploited,
+                syslogSeverityBlocked: severity_blocked,
+                syslogSeverityProbed: severity_probed,
+                syslogSeveritySuspicious: severity_probed_suspicious,
+                syslogSeverityBlockedPerimeter: severity_blocked_perimeter,
+                syslogSeverityProbedPerimeter: severity_probed_perimeter
+            }
+          end
+
+          private
+
+          # Gets String or Symbol value and assigns it to iv after
+          # validation with allowed types.
+          #
+          # @param value [String, Symbol] value to write
+          # @param validation_hash [Hash] to validate against
+          def valid_entry? value, validation_hash
+            return false unless value && validation_hash
+
+            validation_hash.include?(value)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/url_exclusion.rb

@@ -0,0 +1,42 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/exclusion_base'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # UrlExclusions class
+        class UrlExclusion < ExclusionBase
+          ATTRIBUTES = BASE_ATTRIBUTES.dup << :urls
+          ATTRIBUTES << :match_strategy
+          ATTRIBUTES.cs__freeze
+          STRATEGIES = %w[ALL ONLY].cs__freeze
+
+          # @return urls [Array<String>]
+          attr_accessor :urls
+
+          # @return match_strategy [String] The type of the input
+          def match_strategy
+            @_match_strategy ||= Contrast::Utils::ObjectShare::EMPTY_STRING
+          end
+
+          # @param new_strategy [String] Set new input type.
+          # @return type [String] The type of the input.
+          def match_strategy= new_strategy
+            @_match_strategy = new_strategy if STRATEGIES.include?(new_strategy)
+          end
+
+          def to_controlled_hash
+            hash = super
+            hash[:urls] = urls
+            hash[:matchStrategy] = match_strategy
+            hash
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/settings/validator.rb

@@ -0,0 +1,17 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/settings/sanitizer'
+
+module Contrast
+  module Agent
+    module Reporting
+      module Settings
+        # The validators defined by the user for use by the agent on this server for this organization.
+        class Validator < Sanitizer
+          # This uses the same fields as Sanitizer.
+        end
+      end
+    end
+  end
+end