contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/components/scope.rb

@@ -1,106 +1,137 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'monitor'
-cs__scoped_require 'fiber'
-cs__scoped_require 'contrast/agent/scope'
+require 'fiber'
+require 'contrast/agent/scope'
+require 'cs__scope/cs__scope'
 
 # This is the Scope component.
 #
-# It tracks /Contrast/ scope.  That is, "are we currently doing assess
-# or protect stuff within a patched method?" -- this is how we avoid doing
-# Contrast stuff on Contrast code.
-#
-# Separately from this component, there is also require scope, which is an
-# optimization on how we implement patching to `require`.
+# It tracks /Contrast/ scope.  That is, "are we currently doing assess or protect stuff within a patched method?" --
+# this is how we avoid doing Contrast stuff on Contrast code or creating infinite loops -- or "are we in some other
+# execution context for which we need to special case?".
 module Contrast
   module Components
-    module Scope # :nodoc:
-      MONITOR = Monitor.new
-      EXECUTION_CONTEXT = {} # rubocop:disable Style/MutableConstant
-
-      class Interface # :nodoc:
-        include Contrast::Components::ComponentBase
-
-        def initialize
-          # This is probably redundant with #scope_for_current_ec's nil check.
-          EXECUTION_CONTEXT[Fiber.current] = Contrast::Agent::Scope.new
-        end
-
-        # This returns the scope governing the current execution context.
-        # Use this sparingly, preferring the instance & class methods to
-        # access and query scope, rather than interacting with the scope
-        # object directly.
-        def scope_for_current_ec
-          MONITOR.synchronize do
-            return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
-          end
-        end
-      end
-
-      module InstanceMethods # :nodoc:
-        # These scopes can be meta-defined (RUBY-573)
-        #
-        # [:my_cool_scope, :another_good_one].each do |scope|
-        #   define_method "in_#{scope}_scope?" do
-        #     abc
-        #   end
-        # end
-
-        def in_contrast_scope?
-          scope_for_current_ec.in_contrast_scope?
-        end
-
-        def enter_contrast_scope!
-          scope_for_current_ec.enter_scope_for Contrast::Agent::Scope::CONTRAST_SCOPE
-          scope_for_current_ec
-        end
-
-        def exit_contrast_scope!
-          scope_for_current_ec.exit_scope_for Contrast::Agent::Scope::CONTRAST_SCOPE
-          scope_for_current_ec
-        end
-
+    # Constants defined in C:
+    #
+    # MONITOR = Mutex.new This was replaced from Monitor to Mutex.
+    # EXECUTION_CONTEXT = {} Hash containing all of the current ecs as keys pointing to their scope instances.
+    # EC_KEYS = [] set while we get the current ec, and used for sweeping the dead fibers in C.
+    #
+    # Methods defined in C:
+    #
+    # class Interface
+    #   initializes the scope for the current fiber context.
+    #   def initialize end;
+    #
+    #     This returns the scope governing the current execution context. Use this sparingly, preferring the instance
+    #    & class methods to access and query scope, rather than interacting with the scope object directly.
+    #   def scope_for_current_ec end;
+    # end
+    #
+    # module Scope
+    #   Singleton method for cleaning the dead fibers and unused scope instances, scope GC.
+    #   def self.sweep_dead_ecs end;
+    # end
+    module Scope
+      # Methods defined in C:
+      #
+      # For each instance method on a scope, define a forwarder to the scope on the
+      # current execution context's scope.
+      # def scope_for_current_ec end;
+      #
+      # all the methods bellow are used as forwarders to be executed in the current ec.
+      # exp: in_contrast_scope? => scope_for_current_ec.enter_contrast_scope!
+      #
+      # Check if we are in contrast scope.
+      # def in_contrast_scope? end;
+      # @return [Boolean] check if we are in contrast scope
+      #                   if the scope is above 0 return true.
+      #
+      # check if we are in deserialization scope.
+      # def in_deserialization_scope? end;
+      # @return [Boolean] check if we are in contrast scope
+      #                   if the scope is above 0 return true.
+      #
+      # check if we are in split scope.
+      # def in_split_scope? end;
+      # @return [Boolean] check if we are in contrast scope
+      #                   if the scope is above 0 return true.
+      #
+      # enter contrast scope.
+      # def enter_contrast_scope! end;
+      # @return @contrast_scope [Integer] contrast scope increased.
+      #
+      # enter deserialization scope.
+      # def enter_deserialization_scope! end;
+      # @return @deserialization_scope [Integer] deserialization scope increased.
+      #
+      # enter split scope.
+      # def enter_split_scope! end;
+      # @return @split_scope [Integer] split scope increased.
+      #
+      # check split scope depth.
+      # def split_scope_depth end;
+      # @return @split_scope [Integer] split scope depth.
+      #
+      # exit contrast scope.
+      # def exit_contrast_scope! end;
+      # @return @contrast_scope [Integer] contrast scope decreased.
+      #
+      # exit deserialization scope.
+      # def exit_deserialization_scope! end;
+      # @return @deserialization_scope [Integer] deserialization scope decreased.
+      #
+      # exit split scope.
+      # def exit_split_scope! end;
+      # @return @split_scope [Integer] split scope decreased.
+      #
+      # Static methods to be used, the cases are defined by the usage from the above methods
+      #
+      # check if are in specific scope.
+      # def in_scope? name end;
+      # @param name [Symbol] scope symbol representing scope to check.
+      # @return [Boolean] check if we are in passed scope.
+      #
+      # enter specific scope.
+      # def enter_scope! name end;
+      # @param name [Symbol] scope symbol representing scope to enter.
+      # @return scope [Integer] entered scope value increased.
+      #
+      # exit specific scope.
+      # def exit_cope! name end;
+      # @param name [Symbol] scope symbol representing scope to exit.
+      # @return scope [Integer] entered scope value decreased.
+      module InstanceMethods
+        # Forwarder to execute block in contrast scope under current
+        # method execution context. On completion exits scope.
         def with_contrast_scope
-          enter_contrast_scope!
+          scope_for_current_ec.enter_contrast_scope!
           yield
         ensure
-          exit_contrast_scope!
+          scope_for_current_ec.exit_contrast_scope!
         end
 
-        def scope_for_current_ec
-          MONITOR.synchronize do
-            return EXECUTION_CONTEXT[Fiber.current] ||= Contrast::Agent::Scope.new
-          end
-        end
-
-        # TODO: https://contrast.atlassian.net/browse/RUBY-290
-        #
-        # Current behavior is to no-op if we're not "in a request context".
-        # Our C functions were previously checking to see if we had a scope, because
-        # scope was tacked on to a request context -- so "we have a scope, therefore,
-        # we have a request context."  We've decoupled scopes from request contexts,
-        # so now it checks "do we have a request context."
-        # RUBY-290 should remove all of that, including this method.
-        def in_request_context?
-          !!Contrast::Agent::REQUEST_TRACKER.current
+        # Forwarder to execute block in deserialization scope under current
+        # method execution context. On completion exits scope.
+        def with_deserialization_scope
+          scope_for_current_ec.enter_deserialization_scope!
+          yield
+        ensure
+          scope_for_current_ec.exit_deserialization_scope!
         end
-      end
 
-      def self.sweep_dead_ecs
-        # TODO: RUBY-571, #sweep_dead_ecs compensates for a lack of weak tables
-        # 'ec' for execution context.  in this case, it's a Fiber.
-        # Threads rely on Fibers, so two birds, one stone.
-        MONITOR.synchronize do
-          EXECUTION_CONTEXT.delete_if do |ec, _scope|
-            !ec.alive?
-          end
+        # Forwarder to execute block in split scope under current
+        # method execution context. On completion exits scope.
+        def with_split_scope
+          scope_for_current_ec.enter_split_scope!
+          yield
+        ensure
+          scope_for_current_ec.exit_split_scope!
         end
       end
 
       ClassMethods = InstanceMethods
-
-      COMPONENT_INTERFACE = Interface.new
     end
   end
 end

data/lib/contrast/components/security_logger.rb

@@ -0,0 +1,36 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/base'
+
+module Contrast
+  module Components
+    module SecurityLogger
+      # Here we will read and store the setting for the CEF Logging functionality
+      class Interface
+        include Contrast::Components::ComponentBase
+
+        CANON_NAME = 'agent.security_logger'
+        CONFIG_VALUES = %w[path level].cs__freeze
+
+        # @return [String, nil]
+        attr_accessor :path
+        # @return [String, nil]
+        attr_accessor :level
+        # @return [String]
+        attr_reader :canon_name
+        # @return [Array]
+        attr_reader :config_values
+
+        def initialize hsh = {}
+          @config_values = CONFIG_VALUES
+          @canon_name = CANON_NAME
+          return unless hsh
+
+          @path = hsh[:path]
+          @level = hsh[:level]
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/settings.rb

@@ -1,6 +1,11 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/agent/excluder'
+require 'contrast/agent/reporting/settings/sensitive_data_masking'
+require 'contrast/components/config'
+require 'contrast/components/logger'
+
 module Contrast
   module Components
     # This component encapsulates the statefulness of settings.
@@ -8,133 +13,235 @@ module Contrast
     # directives (likely provided by TeamServer) about product operation.
     # 'Settings' is not a generic term for 'configurable stuff'.
     module Settings
-      # This is a class.
-      class Interface
-        include Contrast::Components::ComponentBase
-        include Contrast::Components::Interface
-        access_component :config
-
-        attr_reader :assess_rules,
-                    :protect_rules
+      APPLICATION_STATE_BASE = Struct.new(:modes_by_id).new(Hash.new(:NO_ACTION))
+      PROTECT_STATE_BASE = Struct.new(:enabled, :rules).new(false, {})
+      ASSESS_STATE_BASE = Struct.new(:enabled, :sampling_settings, :disabled_assess_rules, :session_id).new(false, nil,
+                                                                                                            [], nil) do
+        def sampling_settings= new_val
+          @sampling_settings = new_val
+          Contrast::Utils::Assess::SamplingUtil.instance.update
+        end
+      end
+      SENSITIVE_DATA_MASKING_BASE = Contrast::Agent::Reporting::Settings::SensitiveDataMasking.new
 
-        # Other stateful information that doesn't yet cleanly fit anywhere:
+      # This is a class.
+      class Interface # rubocop:disable Metrics/ClassLength
+        include Contrast::Components::Logger::InstanceMethods
+        extend Contrast::Components::Config
 
         # tainted_columns are database columns that receive unsanitized input.
-        # this statefulness
         attr_reader :tainted_columns # This can probably go into assess_state?
+        # Current state for Assess.
+        # enabled [Boolean] Indicate if the assess feature set is enabled for this server or not.
+        #
+        # sampling [Hash<AssessSampling>] Hash of AssessSampling Used to control the sampling feature in the agent: {
+        #  baseline          [Integer] The number of baseline requests to take before switching to sampling
+        #                               for the window.
+        #  enabled           [Boolean] If the sampling feature should be used or not.
+        #  frequency         [Integer] The number of requests to skip before observing during the sampling
+        #                               window after the baseline.
+        #  responseFrequency [Integer]
+        #  window            [Integer]
+        # }
+        #
+        # disabled_assess_rules [array<AssessRuleID(String)>] Assess rules to disable for this application.
+        attr_reader :assess_state
+        # Current State for Protect.
+        # enabled [Boolean] Indicate if the protect feature set is enabled for this server or not.
+        #
+        # Protection rules are returned as:
+        # rules [Hash<RULE_ID => MODE>, nil] Hash with rule_id as key and mode as value
+        attr_reader :protect_state
+        # Current Application State.
+        #
+        # modes_by_id [Hash<Rule_id => Mode] Returns Hash with rules and their current mode.
+        attr_reader :application_state
+        # This the structure that will hold the masking rules send from TS.
+        #
+        # @return [Contrast::Agent::Reporting::Settings::SensitiveDataMasking]:
+        #           mask_http_body [Boolean] Policy flag to enable the use of masking on request body.
+        #           rules          [Array<Contrast::Agent::Reporting::Settings::SensitiveDataMaskingRule>]
+        #                          Rules to follow when using the masking. Each rules contains Id [String]
+        #                          and Keywords [Array<String>].
+        attr_reader :sensitive_data_masking
+        # @return [Integer] the time, in ms, that application settings last changed
+        attr_reader :last_app_update_ms
+        # @return [Integer] the time, in ms, that server settings last changed
+        attr_reader :last_server_update_ms
+        # @return [Contrast::Agent::Excluder] a wrapper around the exclusion rules for the application
+        attr_reader :excluder
+        # @return [String] The last update but in string format used to build request header.
+        # This value should be sent be TS in the Last-Modified header to sync and save resources if the
+        # two dates are the same.
+        # format: <day-name>, <day> <month> <year> <hour>:<minute>:<second> GMT
+        attr_reader :server_settings_last_httpdate
 
-        # a vulnerability like padding oracle is exploited across
-        # multiple requests, as a timing attack.  these attempts must be
-        # accumulated, in order to recognize the pattern and block the attack.
-        attr_reader :accumulator_settings
-
-        # These three 'state' variables represent atomic config/setting state,
-        # outside of things like rule defs.
-
-        def assess_state
-          @assess_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              sampling_features: nil
-          }
+        def initialize
+          reset_state
         end
 
-        def protect_state
-          @protect_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              enabled: false,
-              accumulator_settings: Contrast::Api::Settings::AccumulatorSettings.new
-          }
+        def code_exclusions
+          excluder&.exclusions&.select(&:code?)
         end
 
-        def application_state
-          @application_state ||= { # rubocop:disable Naming/MemoizedInstanceVariableName
-              modes_by_id: Hash.new(:NO_ACTION),
-              exclusion_matchers: [],
-              disabled_assess_rules: []
-          }
+        # @param features_response [Contrast::Agent::Reporting::Response]
+        def update_from_server_features features_response
+          return unless (server_features = features_response&.server_features)
+
+          log_file = server_features.log_file
+          log_level = server_features.log_level
+          # Update logger:
+          Contrast::Logger::Log.instance.update(log_file, log_level) if log_file || log_level
+          # Update CEFlogger:
+          unless server_features.security_logger.settings_blank?
+            cef_logger.build_logger(server_features.security_logger.log_level, server_features.security_logger.log_file)
+          end
+          # TODO: RUBY-99999 Update Bot-Blocker from server settings - check enable value.
+          # For now all protection rules are rebuild on Application update. Bot blocker uses the default
+          # enable from the base rule, and update it's mode on app settings update.
+          # Here we receive also bots for that rule.
+          unless settings_empty?(server_features.protect.enabled?)
+            @protect_state.enabled = server_features.protect.enabled?
+            store_in_config(%i[protect enable], server_features.protect.enabled?)
+          end
+          update_assess_server_features(server_features.assess)
+          @last_server_update_ms = Contrast::Utils::Timer.now_ms
+          # update via response header. We receive header from TS with last update info, setting the
+          # next request's header with the same time will save needless update of settings if there
+          # are no new server features updates after the said time.
+          @server_settings_last_httpdate = header_last_update
         end
 
-        # These are settings that we receive & store.
-        # Rules are settings too, but they're more involved.
-        # So, between this block and rules, that's setting state.
-        PROTECT_STATE_ATTRS       = %i[].cs__freeze
-        ASSESS_STATE_ATTRS        = %i[sampling_features].cs__freeze
-        APPLICATION_STATE_ATTRS   = %i[modes_by_id exclusion_matchers disabled_assess_rules session_id].cs__freeze
-        STATE_ATTRS               = PROTECT_STATE_ATTRS | ASSESS_STATE_ATTRS | APPLICATION_STATE_ATTRS
-
-        # Meta-define an accessor for each state attribute.
-        begin
-          PROTECT_STATE_ATTRS.each do |attr|
-            define_method(attr) do
-              protect_state[attr]
-            end
-          end
+        # Update Assess server features
+        #
+        # @param assess [Contrast::Agent::Reporting::Settings::AssessServerFeature]
+        def update_assess_server_features assess
+          return if settings_empty?(assess.enabled?)
 
-          ASSESS_STATE_ATTRS.each do |attr|
-            define_method(attr) do
-              assess_state[attr]
-            end
-          end
+          @assess_state.enabled = assess.enabled?
+          store_in_config(%i[assess enable], assess.enabled?)
+          @assess_state.sampling_settings = assess.sampling
 
-          APPLICATION_STATE_ATTRS.each do |attr|
-            define_method(attr) do
-              application_state[attr]
-            end
+          Contrast::Components::Sampling::Interface::CONFIG_VALUES.each do |field|
+            lookup_field = field == 'enable' ? :enabled : field.to_sym
+            store_in_config(Contrast::Components::Sampling::Interface::CANON_NAME.split('.') + [field.to_sym],
+                            assess.sampling.send(lookup_field))
           end
         end
 
-        def initialize
-          reset_state
+        # @param settings_response [Contrast::Agent::Reporting::Response]
+        def update_from_application_settings settings_response
+          return unless (app_settings = settings_response&.application_settings)
+
+          @application_state.modes_by_id = app_settings.protect.protection_rules_to_settings_hash
+          update_exclusion_matchers(app_settings.exclusions)
+          update_sensitive_data_policy(app_settings.sensitive_data_masking)
+          @assess_state.disabled_assess_rules = app_settings.assess.disabled_rules
+          new_session_id = app_settings.assess.session_id
+          @assess_state.session_id = new_session_id if new_session_id && !new_session_id.blank?
+          @last_app_update_ms = Contrast::Utils::Timer.now_ms
         end
 
         # Wipe state to zero.
         def reset_state
-          @assess_rules = {}
-          @protect_rules = {}
-
+          @protect_state = PROTECT_STATE_BASE.dup
+          @assess_state = ASSESS_STATE_BASE.dup
+          @application_state = APPLICATION_STATE_BASE.dup
           @tainted_columns = {}
-
-          @assess_state = nil
-          @protect_state = nil
-          @application_state = nil
-        end
-
-        def build_assess_rules
-          @assess_rules = {}
-
-          Contrast::Agent::Assess::Rule::Csrf.new
-          Contrast::Agent::Assess::Rule::Redos.new
+          @sensitive_data_masking = SENSITIVE_DATA_MASKING_BASE.dup
+          @excluder = Contrast::Agent::Excluder.new
         end
 
         def build_protect_rules
-          @protect_rules = {}
+          @protect_state.rules = {}
 
-          # rules
-          Contrast::Agent::Protect::Rule::CmdInjection.new
+          # Rules. They add themselves on initialize.
+          Contrast::Agent::Protect::Rule::BotBlocker.new
+          cmdi = Contrast::Agent::Protect::Rule::CmdInjection.new
+          cmdi.sub_rules
           Contrast::Agent::Protect::Rule::Deserialization.new
           Contrast::Agent::Protect::Rule::HttpMethodTampering.new
           Contrast::Agent::Protect::Rule::NoSqli.new
-          Contrast::Agent::Protect::Rule::PathTraversal.new
-          Contrast::Agent::Protect::Rule::Sqli.new
+          path = Contrast::Agent::Protect::Rule::PathTraversal.new
+          path.sub_rules
+          sqli = Contrast::Agent::Protect::Rule::Sqli.new
+          sqli.sub_rules
           Contrast::Agent::Protect::Rule::UnsafeFileUpload.new
           Contrast::Agent::Protect::Rule::Xss.new
           Contrast::Agent::Protect::Rule::Xxe.new
+        end
 
-          # Beta Rules
-          Contrast::Agent::Protect::Rule::Csrf.new
+        # @param exclusions [Contrast::Agent::Reporting::Settings::Exclusions]
+        def update_exclusion_matchers exclusions
+          matchers = []
+          exclusions.url_exclusions.each do |exclusion|
+            matchers << Contrast::Agent::ExclusionMatcher.new(exclusion)
+          end
+          exclusions.input_exclusions.each do |exclusion|
+            matchers << Contrast::Agent::ExclusionMatcher.new(exclusion)
+          end
+          exclusions.code_exclusions.each do |exclusion|
+            matchers << Contrast::Agent::ExclusionMatcher.new(exclusion)
+          end
+          @excluder = Contrast::Agent::Excluder.new(matchers)
         end
 
-        def protect_rule name
-          @protect_rules[name]
+        # Update the sensitive data masking policy from settings,
+        # received from TS. In case the settings are empty,
+        # keep current ones.
+        #
+        # @param sensitive_data_masking [Contrast::Agent::Reporting::Settings::SensitiveDataMasking]
+        # Ts Response settings for sensitive data masking policy
+        def update_sensitive_data_policy sensitive_data_masking
+          @sensitive_data_masking.mask_http_body = sensitive_data_masking.mask_http_body? unless
+            settings_empty?(sensitive_data_masking.mask_http_body?)
+          @sensitive_data_masking.mask_attack_vector = sensitive_data_masking.mask_attack_vector? unless
+            settings_empty?(sensitive_data_masking.mask_attack_vector?)
+          return if settings_empty?(sensitive_data_masking.rules)
+
+          @sensitive_data_masking.rules = sensitive_data_masking.rules
+          # update with the newly received rules.
+          Contrast::Agent::Reporting::Masker.send(:update_dictionary)
         end
 
-        # these are less 'settings' and more 'how do I behave.'
-        # relocate to Agent or Assess/Protect.
-        def protect_rule_mode rule_id
-          CONFIG.root.protect.rules[rule_id]&.mode || modes_by_id[rule_id] || :NO_ACTION
+        private
+
+        # check if settings are empty and return true if so.
+        #
+        # @param settings [String, Boolean, Array, Hash]
+        # @return true | false
+        def settings_empty? settings
+          return false if !!settings == settings
+          return true if settings.nil? || settings.empty?
+
+          false
+        end
+
+        # update via response header.
+        # Used to build the next request header.
+        #
+        # @return [String]
+        def header_last_update
+          Contrast::Agent.reporter.client.response_handler.last_server_modified
         end
-      end
 
-      COMPONENT_INTERFACE = Interface.new
+        # Update the stored config values to ensure that we know about the correct values,
+        # and that the sources are correct for entries updated from the UI.
+        #
+        # @param parts [Array] the path to the setting in config
+        # @param value [String, Integer, Array, nil] the value for the configuration setting
+        def store_in_config parts, value
+          level = Contrast::CONFIG.config.loaded_config
+          parts[0...-1].each do |segment|
+            level[segment] ||= {}
+            level = level[segment]
+          end
+          return unless level.cs__is_a?(Hash)
+
+          level[parts[-1]] = value
+          Contrast::CONFIG.sources.set(parts.join('.'), Contrast::Components::Config::Sources::CONTRASTUI)
+        end
+      end
     end
   end
 end

data/lib/contrast/config/api_proxy_configuration.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Config
+    # Api Proxy keys configuration
+    class ApiProxyConfiguration
+      include Contrast::Config::BaseConfiguration
+
+      # @return [String] proxy url
+      attr_accessor :url
+      attr_writer :enable
+
+      def initialize hsh = {}
+        return unless hsh
+
+        @enable = hsh[:enable]
+        @url = hsh[:url]
+      end
+
+      # @return [Boolean, false]
+      def enable
+        @enable.nil? ? false : @enable
+      end
+    end
+  end
+end