contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent_lib/interface_base.rb

@@ -0,0 +1,118 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module AgentLib
+    # Base class to set basic rule sets and input list.
+    class InterfaceBase
+      # This could be changed to regular Hash.
+      # This format is used to supports this kind of log_level assignment:
+      # via Contrast::Api::Settings::LogLevel::WARN => 3
+      # ( note -1 is not supported in the protobuf LogLevel)
+      LOG_LEVEL = { -1 => 'OFF', 0 => 'TRACE', 1 => 'DEBUG', 2 => 'INFO', 3 => 'WARN', 4 => 'ERROR' }.cs__freeze
+      LOG_DIR = File.join(Dir.pwd).cs__freeze
+      # Named after Protect rule_id / Names
+      # Corresponding to Rust's ulong enum
+      RULE_SET = {
+          'unsafe-file-upload' => 1 << 0,
+          'path-traversal' => 1 << 1,
+          'reflected-xss' => 1 << 2,
+          'sql-injection' => 1 << 3,
+          'cmd-injection' => 1 << 4,
+          'nosql-injection' => 1 << 5,
+          'bot-blocker' => 1 << 6,
+          'ssjs-injection' => 1 << 7,
+          'method-tampering' => 1 << 8
+      }.cs__freeze
+      # Named same as Contrast::Agent::Reporting::InputTypes
+      INPUT_SET = {
+          COOKIE_NAME: 1,
+          COOKIE_VALUE: 2,
+          HEADER_NAME: 3,
+          HEADER_VALUE: 4,
+          JSON_NAME: 5,
+          JSON_VALUE: 6,
+          METHOD: 7,
+          PARAMETER_NAME: 8,
+          PARAMETER_VALUE: 9,
+          URI: 10,
+          URL_PARAMETER: 11,
+          MULTIPART_NAME: 12,
+          XML_VALUE: 13
+      }.cs__freeze
+      EVAL_OPTIONS = { NONE: 0, WORTHWATCHING: 1 }.cs__freeze
+
+      # Initializes the Agent lib.
+      #
+      # @param enable_logging [Boolean, nil] flag to enable or disable logging.
+      # @param set_log_level [Integer, nil]
+      # @param set_log_dir [String, nil] dir to write log files.
+      # @return [Boolean] true if success.
+      # @raise [StandardError] Any Errors raised in the init process are most
+      # likely to be a C segfaults and termination, probably redundant but safe.
+      def initialize enable_logging = nil, set_log_level = nil, set_log_dir = nil
+        # Override
+      end
+
+      # Return list of available rules
+      #
+      # @return [Hash]
+      def rule_set
+        RULE_SET
+      end
+
+      # Returns list of available input types.
+      #
+      # @return [Hash]
+      def input_set
+        INPUT_SET
+      end
+
+      # Return list of input evaluation options:
+      # WorthWatching or none
+      #
+      # @return [Hash]
+      def eval_option
+        EVAL_OPTIONS
+      end
+
+      private
+
+      # Updates the logging status:
+      # Enabled && Level
+      #
+      # @param level [Integer] one of:
+      # [-1...4]
+      # @param enabled [Boolean] logging status.
+      def update_logging level, enabled
+        update_log_level(level)
+        @enable_log = !!enabled
+      end
+
+      # Updates the log level for the AgentLib.
+      #
+      # @param level [Integer] one of:
+      # [-1...4]
+      def update_log_level level
+        value = LOG_LEVEL[level]
+        @log_level = value if value
+      end
+
+      # Creates the directory for AgentLib log files.
+      # If no path provided use default.
+      #
+      # @param log_dir [String, nil] path to log.
+      # @rescue [StandardError] any error concerning
+      # the directory creation.
+      def create_log_dir log_dir = nil
+        path = log_dir.nil? ? LOG_DIR : log_dir
+        FileUtils.mkdir_p(path)
+        path
+      rescue StandardError => e
+        logger.debug('Could not create log directory', error: e)
+        FileUtils.mkdir_p(LOG_DIR)
+        LOG_DIR
+      end
+    end
+  end
+end

data/lib/contrast/agent_lib/return_types/eval_result.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent_lib/interface'
+
+module Contrast
+  module AgentLib
+    # This class will hold resulst received form AgentLib structs.
+    class EvalResult
+      # Name of the Protect rule analyzed.
+      # @return [String]
+      attr_accessor :rule_id
+      # Type of the input.
+      # @return [String]
+      attr_accessor :input_type
+      # Score of the input after AgentLib
+      # Analysis
+      #
+      # @return score [Float]
+      attr_accessor :score
+
+      # Init a new EvalResult, and translate results to usable for
+      # reporting values.
+      #
+      # @param hsh [Hash, nil] return from AgentLib populated struct.
+      def initialize hsh
+        return unless hsh&.cs__is_a?(Hash)
+
+        @rule_id = Contrast::AgentLib::Interface::RULE_SET.key(hsh[:rule_id])
+        @input_type = Contrast::AgentLib::Interface::INPUT_SET.key(hsh[:input_type])
+        @score = hsh[:score]
+      end
+
+      # Used in specs.
+      def to_controlled_hash
+        {
+            rule_id: rule_id,
+            input_type: input_type,
+            score: score
+        }
+      end
+    end
+  end
+end

data/lib/contrast/agent_lib/test.rb

@@ -0,0 +1,29 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: false
+
+require_relative 'api/init'
+
+module Contrast # :nodoc:
+  module Test # :nodoc:
+    extend Contrast::AgentLib::Init
+
+    LOG_DIR = File.join(File.dirname(__FILE__))
+
+    class << self
+      def test_init_with_options enable_log, log_level
+        dl__init_with_options(enable_log, LOG_DIR, log_level)
+      end
+    end
+  end
+end
+
+# for the other cases - I tried with loop and everything, but nothing worked
+# Contrast::Test.test_init_with_options(true, "WARN")
+# Contrast::Test.test_init_with_options(true, "ERROR")
+# Contrast::Test.test_init_with_options(true, "DEBUG")
+# Contrast::Test.test_init_with_options(true, "TRACE")
+response = Contrast::Test.test_init_with_options(true, 'INFO')
+puts response # rubocop:disable Rails/Output
+
+# we cannot check here for the file as it's being created after the execution of the file is done
+raise(StandardError, 'Not Working') if response == false

data/lib/contrast/api/communication/connection_status.rb

@@ -0,0 +1,59 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Api
+    module Communication
+      # Keeps track of the state of connections to TeamServer.
+      class ConnectionStatus
+        def initialize
+          @last_success = nil
+          @last_failure = nil
+          @startup_messages_sent = false
+          @_startup_server_message_sent = false
+        end
+
+        # Whether we have sent startup message to TeamServer. True after successfully sending startup messages to
+        # TeamServer and reset to false if we lose connection.
+        #
+        # @return [Boolean]
+        def startup_messages_sent?
+          @startup_messages_sent
+        end
+
+        # Check to see if we have sent server message and received settings from TS.
+        #
+        # @return [Boolean]
+        def startup_server_message_sent?
+          @_startup_server_message_sent
+        end
+
+        # Set the server message status state
+        #
+        # @return [Boolean]
+        def server_response_success!
+          @_startup_server_message_sent = true
+        end
+
+        # The last message sent was successful or not
+        #
+        # @return [Boolean]
+        def connected?
+          @last_success && (@last_failure.nil? || @last_success > @last_failure)
+        end
+
+        # The current state of the TeamServer is active with a successful message sent
+        def success!
+          @startup_messages_sent = true
+          @last_success = Time.now.to_f
+        end
+
+        # The TeamServer may be in some sort of error state
+        def failure!
+          @startup_messages_sent = false
+          @last_failure = Time.now.to_f
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/agent.rb

@@ -1,21 +1,77 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'rubygems/version'
+require 'contrast/components/base'
+require 'contrast/agent/rule_set'
+require 'contrast/components/logger'
+require 'contrast/components/security_logger'
+require 'contrast/components/heap_dump'
+require 'contrast/components/ruby_component'
+require 'contrast/components/polling'
+
 module Contrast
   module Components
     module Agent
       # A wrapper build around the Common Agent Configuration project to allow
-      # for access of the values contained in its
-      # parent_configuration_spec.yaml.
+      # for access of the values contained in its parent_configuration_spec.yaml.
       # Specifically, this allows for querying the state of the Agent.
       class Interface
         include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
 
-        access_component :config
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+
+        CANON_NAME = 'agent'
+        CONFIG_VALUES = %w[enabled? omit_body?].cs__freeze
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @_enable = hsh[:enable]
+          @_omit_body = hsh[:omit_body]
+          @_polling = Contrast::Components::Polling::Interface.new(hsh[:polling])
+          @_logger = Contrast::Components::Logger::Interface.new(hsh[:logger])
+          @_security_logger = Contrast::Components::SecurityLogger::Interface.new(hsh[:security_logger])
+          @_ruby = Contrast::Components::Ruby::Interface.new(hsh[:ruby])
+          @_heap_dump = Contrast::Components::HeapDump::Interface.new(hsh[:heap_dump])
+        end
+
+        def logger
+          return @_logger unless @_logger.nil?
+
+          @_logger = Contrast::Components::Logger::Interface.new
+        end
+
+        def polling
+          @_polling ||= Contrast::Components::Polling::Interface.new
+        end
+
+        def security_logger
+          return @_security_logger unless @_security_logger.nil?
+
+          @_security_logger = Contrast::Components::SecurityLogger::Interface.new
+        end
+
+        def ruby
+          return @_ruby unless @_ruby.nil?
+
+          @_ruby = Contrast::Components::Ruby::Interface.new
+        end
+
+        def heap_dump
+          return @_heap_dump unless @_heap_dump.nil?
+
+          @_heap_dump = Contrast::Components::HeapDump::Interface.new
+        end
 
         def enabled?
-          !!@enabled
+          @_enable = !false?(::Contrast::CONFIG.enable) if @_enable.nil?
+          @_enable
         end
 
         def disabled?
@@ -23,63 +79,79 @@ module Contrast
         end
 
         def enable!
-          @enabled = true
+          @_enable = true
         end
 
         def disable!
-          @enabled = false
+          @_enable = false
+          Contrast::Agent::TracePointHook.disable
+          Contrast::Agent.thread_watcher&.shutdown!
         end
 
-        def unavailable?
-          !enabled?
+        def ruleset
+          @_ruleset ||= Contrast::Agent::RuleSet.new(retrieve_protect_ruleset.values)
+        end
+
+        def reset_ruleset
+          @_ruleset = nil
         end
 
-        def ready?
-          state.agent_ready?
+        def patch_yield?
+          !false?(ruby.propagate_yield)
         end
 
-        def patch_interpolation?
-          interpolation_patch_possible?
+        def omit_body?
+          @_omit_body
         end
 
-        def rewrite_interpolation?
-          !interpolation_patch_possible?
+        def disable_agent!
+          @_enable = false
         end
 
-        def interpolation_enabled?
-          !Contrast::Utils::BooleanUtil.false?(CONFIG.root.agent.ruby.interpolate)
+        def exception_control
+          @_exception_control ||= {
+              enable: true?(ruby.exceptions.capture),
+              status: ruby.exceptions.override_status || 403,
+              message: ruby.exceptions.override_message || Contrast::Utils::ObjectShare::OVERRIDE_MESSAGE
+          }
         end
 
-        def report_custom_code_sysfile_access?
-          Contrast::Agent::FeatureState.instance.report_custom_code_sysfile_access?
+        def skip_instrumentation? loaded_module_name
+          return true unless loaded_module_name
+
+          loaded_module_name.start_with?(*::Contrast::CONFIG.agent.ruby.uninstrument_namespace)
         end
 
-        # TODO: RUBY-564 Move instrumentation to a new component that handles
-        # one-time agent initialization procedures.
-        SHARED_LIBRARIES = %w[contrast/core_extensions/thread
-                              contrast/rails_extensions/rack
-                              contrast/rails_extensions/buffer
-                              contrast/sinatra_extensions/assess/cookie].cs__freeze
-        def run_instrumentation
-          Contrast::Agent::FeatureState.instance.tap do |settings|
-            SHARED_LIBRARIES.each { |lib| settings.instrument lib }
-          end
-          Contrast::Agent::Patching::Policy::Patcher.patch # This acts as a catch up for everything we didn't see get loaded
-          enable_tracepoint # This handles all class loads & required instrumentation going forward
+        # Insert ourselves into the application, keeping our middleware at the outermost layer of the onion
+        def insert_middleware app
+          app.middleware.insert_before(0, Contrast::Agent::Middleware)
         end
 
         def enable_tracepoint
           Contrast::Agent::TracePointHook.enable!
         end
 
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          super
+          logger&.to_effective_config(effective_config)
+          security_logger&.to_effective_config(effective_config)
+          ruby&.to_effective_config(effective_config)
+          heap_dump&.to_effective_config(effective_config)
+          polling&.to_effective_config(effective_config)
+        end
+
         protected
 
-        def interpolation_patch_possible?
-          Gem::Version.new(RUBY_VERSION) >= Gem::Version.new('2.6.0')
+        def retrieve_protect_ruleset
+          return {} unless enabled? && ::Contrast::PROTECT.enabled?
+
+          ::Contrast::PROTECT.defend_rules
         end
       end
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end

data/lib/contrast/components/api.rb

@@ -0,0 +1,159 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/base'
+require 'contrast/components/config'
+require 'contrast/config/api_proxy_configuration'
+require 'contrast/config/request_audit_configuration'
+require 'contrast/config/certification_configuration'
+
+module Contrast
+  module Components
+    module Api
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for Api keys to be mapped with their values contained in their
+      # parent_configuration_spec.yaml.
+      class Interface
+        include Contrast::Components::ComponentBase
+        include Contrast::Config::BaseConfiguration
+
+        CANON_NAME = 'api'
+        PROXY_NAME = "#{ CANON_NAME }.proxy"
+        CONFIG_VALUES = %w[api_key user_name service_key url].cs__freeze
+
+        # @return [String]
+        attr_accessor :api_key
+        # @return [String]
+        attr_accessor :user_name
+        # @return [String]
+        attr_accessor :service_key
+        attr_writer :url
+
+        DEFAULT_URL = 'https://app.contrastsecurity.com/Contrast'
+
+        def initialize hsh = {}
+          return unless hsh
+
+          @api_key = hsh[:api_key]
+          @url = hsh[:url]
+          @user_name = hsh[:user_name]
+          @service_key = hsh[:service_key]
+          @_proxy = Contrast::Config::ApiProxyConfiguration.new(hsh[:proxy])
+          @_request_audit = Contrast::Config::RequestAuditConfiguration.new(hsh[:request_audit])
+          @_certificate = Contrast::Config::CertificationConfiguration.new(hsh[:certificate])
+        end
+
+        def url
+          @url.nil? ? DEFAULT_URL : @url
+        end
+
+        # @return [Contrast::Config::ApiProxyConfiguration]
+        def proxy
+          return @_proxy unless @_proxy.nil?
+
+          @_proxy = Contrast::Config::ApiProxyConfiguration.new
+        end
+
+        # @return [Contrast::Config::RequestAuditConfiguration]
+        def request_audit
+          return @_request_audit unless @_request_audit.nil?
+
+          @_request_audit = Contrast::Config::RequestAuditConfiguration.new
+        end
+
+        # @return [Contrast::Config::CertificationConfiguration]
+        def certificate
+          return @_certificate unless @_certificate.nil?
+
+          @_certificate = Contrast::Config::CertificationConfiguration.new
+        end
+
+        def api_url
+          @_api_url ||= begin
+            tmp = Contrast::CONFIG.api.url
+            tmp += '/Contrast' unless tmp.end_with?('/Contrast')
+            tmp
+          end
+        end
+
+        def proxy_enable
+          return @_proxy_enable unless @_proxy_enable.nil?
+
+          @_proxy_enable = true?(::Contrast::CONFIG.api.proxy.enable)
+        end
+
+        def proxy_url
+          proxy.url
+        end
+
+        def request_audit_enable
+          return @_request_audit_enable unless @_request_audit_enable.nil?
+
+          @_request_audit_enable = true?(::Contrast::CONFIG.api.request_audit.enable)
+        end
+
+        def request_audit_requests
+          return @_request_audit_requests unless @_request_audit_requests.nil?
+
+          @_request_audit_requests = true?(::Contrast::CONFIG.api.request_audit.requests)
+        end
+
+        def request_audit_responses
+          return @_request_audit_responses unless @_request_audit_responses.nil?
+
+          @_request_audit_responses = true?(::Contrast::CONFIG.api.request_audit.responses)
+        end
+
+        def request_audit_path
+          @_request_audit_path ||= ::Contrast::CONFIG.api.request_audit.path.to_s
+        end
+
+        def certification_enable
+          @_certification_enable ||= certification_truly_enabled?(::Contrast::CONFIG.api.certificate)
+        end
+
+        def certification_ca_file
+          @_certification_ca_file ||= ::Contrast::CONFIG.api.certificate.ca_file
+        end
+
+        def certification_cert_file
+          @_certification_cert_file ||= ::Contrast::CONFIG.api.certificate.cert_file
+        end
+
+        def certification_key_file
+          @_certification_key_file ||= ::Contrast::CONFIG.api.certificate.key_file
+        end
+
+        # Converts current configuration to effective config values class and appends them to
+        # EffectiveConfig class.
+        #
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def to_effective_config effective_config
+          add_effective_config_values(effective_config, CONFIG_VALUES, CANON_NAME, CONTRAST)
+          effective_proxy(effective_config)
+          request_audit&.to_effective_config(effective_config)
+          certificate&.to_effective_config(effective_config)
+        end
+
+        private
+
+        # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+        def effective_proxy effective_config
+          add_single_effective_value(effective_config, ENABLE, proxy_enable.to_s, PROXY_NAME, "#{ CONTRAST }.proxy")
+          return unless proxy_url && proxy_enable
+
+          add_single_effective_value(effective_config, 'url', proxy_url, PROXY_NAME, "#{ CONTRAST }.proxy")
+        end
+
+        def certification_truly_enabled? config_path
+          return false unless true?(config_path.enable)
+          return true if file_exists?(certification_ca_file) && valid_cert?(certification_ca_file)
+          return true if file_exists?(certification_cert_file) && valid_cert?(certification_cert_file)
+          return true if file_exists?(certification_key_file) && valid_cert?(certification_key_file)
+
+          false
+        end
+      end
+    end
+  end
+end