contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/config/protect_rule_configuration.rb

@@ -1,36 +1,57 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
-cs__scoped_require 'set'
+require 'set'
 
 module Contrast
   module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # rule mode of a single protect rule in the Agent.
-    class ProtectRuleConfiguration < BaseConfiguration
-      # rubocop:disable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-      BLOCKING_RULES   = ::Set.new([:BLOCK , :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      PREFILTER_RULES  = ::Set.new([         :BLOCK_AT_PERIMETER                  ]).cs__freeze
-      POSTFILTER_RULES = ::Set.new([:BLOCK , :PERMIT, :MONITOR]).cs__freeze
-      # rubocop:enable Style/SymbolArray, Layout/SpaceBeforeComma, Layout/SpaceInsideArrayLiteralBrackets:
-
-      KEYS = {
-          enable: EMPTY_VALUE,
-          mode: EMPTY_VALUE,
-          disable_system_commands: EMPTY_VALUE,
-          detect_custom_code_accessing_system_files: Contrast::Config::DefaultValue.new('true')
-      }.cs__freeze
-
-      def initialize hsh
-        super(hsh, KEYS)
+    # Common Configuration settings. Those in this section pertain to the rule mode of a single protect rule in the
+    # Agent.
+    class ProtectRuleConfiguration
+      include Contrast::Config::BaseConfiguration
+
+      # @return [Boolean, nil]
+      attr_accessor :enable
+      # @return [String, nil]
+      attr_accessor :mode
+      # @return [Boolean, nil]
+      attr_accessor :disable_system_commands
+      attr_writer :detect_custom_code_accessing_system_files
+
+      def initialize hsh = {}
+        return unless hsh
+
+        @enable = hsh[:enable]
+        @mode = hsh[:mode]
+        @disable_system_commands = hsh[:disable_system_commands]
+        @detect_custom_code_accessing_system_files = hsh[:detect_custom_code_accessing_system_files]
       end
 
-      def off?
-        mode == 'off'
+      # @return [Boolean, true]
+      def detect_custom_code_accessing_system_files
+        @detect_custom_code_accessing_system_files.nil? ? true : @detect_custom_code_accessing_system_files
       end
 
-      def on?
-        !off?
+      # To convert the user input mode from config to a standard format used by TS & SR, we need to convert the given
+      # String to its recognized symbol equivalent. If a nonsense value is provided, it'll
+      # be treated the same as disabling the rule.
+      #
+      # @return [Symbol]
+      def applicable_mode
+        return unless mode
+
+        case mode.downcase
+        when 'permit'
+          :PERMIT
+        when 'block_at_perimeter'
+          :BLOCK_AT_PERIMETER
+        when 'block'
+          :BLOCK
+        when 'monitor'
+          :MONITOR
+        else
+          :NO_ACTION
+        end
       end
     end
   end

data/lib/contrast/config/protect_rules_configuration.rb

@@ -1,29 +1,104 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/config/protect_rule_configuration'
+
 module Contrast
   module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # protect rule modes of the Agent.
-    class ProtectRulesConfiguration < BaseConfiguration
-      KEYS = {
-          disabled_rules: EMPTY_VALUE,
-          'bot-blocker' => Contrast::Config::ProtectRuleConfiguration,
-          'cmd-injection' => Contrast::Config::ProtectRuleConfiguration,
-          'sql-injection' => Contrast::Config::ProtectRuleConfiguration,
-          'nosql-injection' => Contrast::Config::ProtectRuleConfiguration,
-          'untrusted-deserialization' => Contrast::Config::ProtectRuleConfiguration,
-          'method-tampering' => Contrast::Config::ProtectRuleConfiguration,
-          csrf: Contrast::Config::ProtectRuleConfiguration,
-          xxe: Contrast::Config::ProtectRuleConfiguration,
-          'path-traversal' => Contrast::Config::ProtectRuleConfiguration,
-          'reflected-xss' => Contrast::Config::ProtectRuleConfiguration,
-          'unsafe-file-upload' => Contrast::Config::ProtectRuleConfiguration,
-          'Contrast::Agent::Protect::Rule::Base' => Contrast::Config::ProtectRuleConfiguration
-      }.cs__freeze
-
-      def initialize hsh
-        super(hsh, KEYS)
+    # Common Configuration settings. Those in this section pertain to the protect rule modes of the Agent.
+    class ProtectRulesConfiguration
+      include Contrast::Config::BaseConfiguration
+
+      attr_accessor :disabled_rules
+      attr_reader :bot_blocker,
+                  :cmd_injection, :cmd_injection_command_backdoors,
+                  :cmd_injection_semantic_chained_commands, :cmd_injection_semantic_dangerous_paths,
+                  :method_tampering,
+                  :nosql_injection,
+                  :path_traversal, :path_traversal_semantic_file_security_bypass,
+                  :reflected_xss,
+                  :sql_injection, :sql_injection_semantic_dangerous_functions,
+                  :unsafe_file_upload,
+                  :untrusted_deserialization,
+                  :xxe,
+                  :rule_base
+
+      BASE_RULE = 'Contrast::Agent::Protect::Rule::Base'.cs__freeze
+
+      def initialize hsh = {} # rubocop:disable Metrics/AbcSize
+        return unless hsh
+
+        # IVs must be with the same name as rule_id
+        @disabled_rules = hsh[:disabled_rules]
+        @rule_base = Contrast::Config::ProtectRuleConfiguration.new(hsh[BASE_RULE.to_sym])
+        @bot_blocker = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'bot-blocker'])
+        @cmd_injection = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'cmd-injection'])
+        @cmd_injection_command_backdoors =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'cmd-injection-command-backdoors'])
+        @cmd_injection_semantic_chained_commands =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'cmd-injection-semantic-chained-commands'])
+        @cmd_injection_semantic_dangerous_paths =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'cmd-injection-semantic-dangerous-paths'])
+        @method_tampering = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'method-tampering'])
+        @nosql_injection = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'nosql-injection'])
+        @path_traversal = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'path-traversal'])
+        @path_traversal_semantic_file_security_bypass =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'path-traversal-semantic-file-security-bypass'])
+        @reflected_xss = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'reflected-xss'])
+        @sql_injection = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'sql-injection'])
+        @sql_injection_semantic_dangerous_functions =
+          Contrast::Config::ProtectRuleConfiguration.new(hsh[:'sql-injection-semantic-dangerous-functions'])
+        @unsafe_file_upload = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'unsafe-file-upload'])
+        @untrusted_deserialization = Contrast::Config::ProtectRuleConfiguration.new(hsh[:'untrusted-deserialization'])
+        @xxe = Contrast::Config::ProtectRuleConfiguration.new(hsh['xxe'])
+      end
+
+      def []= key, value
+        instance_variable_set("@#{ convert_key(key) }".to_sym, value)
+      end
+
+      def [] key
+        send(convert_key(key).to_sym)
+      end
+
+      def convert_key key
+        return_proper_class(key).to_s.tr('-', '_')
+      end
+
+      # Convert instance variable names to format expected by TS
+      # for adding to the hash
+      def to_contrast_hash
+        hsh = {}
+        instance_variables.each do |iv|
+          # strip the '@' to get the key
+          key = return_proper_class(iv.to_s.delete('@'))
+          hsh[key.tr('_', '-')] = send(key.to_sym)
+        end
+        hsh
+      end
+
+      # This method is to handle the specific case of
+      # Contrast::Agent::Protect::Rule::Base from protect/base.rb#initialize
+      #
+      # @param str_key [String] the key we want to check form the config
+      # @return String
+      def return_proper_class str_key
+        return BASE_RULE if str_key == 'rule_base'
+        return 'rule_base' if str_key == BASE_RULE
+
+        str_key
+      end
+
+      # if method 'Contrast::Agent::Protect::Rule::Base' is being called from convert_to_hash
+      # handle missing method and call original getter
+      def method_missing name, *_args
+        return unless name.to_s.include?('Base') || name.to_s.start_with?('Contrast')
+
+        @rule_base
+      end
+
+      def respond_to_missing? method_name, include_private = false
+        (method_name.to_s.include?('Base') || method_name.to_s.start_with?('Contrast')) || super
       end
     end
   end

data/lib/contrast/config/request_audit_configuration.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/base'
+
+module Contrast
+  module Config
+    # This class holds the Common Settings for the hidden functionality of the TS
+    class RequestAuditConfiguration
+      include Contrast::Config::BaseConfiguration
+      include Contrast::Components::ComponentBase
+
+      DEFAULT_PATH = './messages'
+      CANON_NAME = 'api.request_audit'
+      CONFIG_VALUES = %w[enable requests responses path].cs__freeze
+
+      attr_writer :enable, :requests, :responses, :path
+
+      def initialize hsh = {}
+        return unless hsh
+
+        @enable = hsh[:enable]
+        @requests = hsh[:requests]
+        @responses = hsh[:responses]
+        @path = hsh[:path]
+      end
+
+      # @return [Boolean, false]
+      def enable
+        @enable.nil? ? false : @enable
+      end
+
+      # @return [Boolean, false]
+      def requests
+        @requests.nil? ? false : @requests
+      end
+
+      # @return [Boolean, false]
+      def responses
+        @responses.nil? ? false : @responses
+      end
+
+      # @return [String, ::DEFAULT_PATH]
+      def path
+        @path.nil? ? DEFAULT_PATH : @path
+      end
+
+      # Converts current configuration to effective config values class and appends them to
+      # EffectiveConfig class.
+      #
+      # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+      def to_effective_config effective_config
+        add_effective_config_values(effective_config, CONFIG_VALUES, CANON_NAME, "#{ CONTRAST }.#{ CANON_NAME }")
+      end
+    end
+  end
+end

data/lib/contrast/config/server_configuration.rb

@@ -1,22 +1,74 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
+require 'contrast/config/base_configuration'
+
 module Contrast
   module Config
-    # Common Configuration settings. Those in this section pertain to the
-    # server identification functionality of the Agent.
-    class ServerConfiguration < BaseConfiguration
-      KEYS = {
-          name: EMPTY_VALUE,
-          path: EMPTY_VALUE,
-          type: EMPTY_VALUE,
-          tags: EMPTY_VALUE,
-          environment: EMPTY_VALUE,
-          version: EMPTY_VALUE
-      }.cs__freeze
-
-      def initialize hsh
-        super(hsh, KEYS)
+    # Common Configuration settings. Those in this section pertain to the server identification functionality of the
+    # Agent.
+    class ServerConfiguration
+      include Contrast::Config::BaseConfiguration
+      include Contrast::Components::ComponentBase
+
+      CANON_NAME = 'server'
+      CONFIG_VALUES = %w[tags environment version].cs__freeze
+
+      # @return [String, nil]
+      attr_reader :name
+      # @return [String, nil]
+      attr_accessor :path
+      # @return [String, nil]
+      attr_accessor :type
+      attr_writer :tags
+      # @return [String, nil]
+      attr_accessor :environment
+      # @return [String, nil]
+      attr_accessor :version
+      # @return [String]
+      attr_reader :canon_name
+      # @return [Array]
+      attr_reader :config_values
+
+      def initialize hsh = {}
+        @config_values = CONFIG_VALUES
+        @canon_name = CANON_NAME
+        return unless hsh
+
+        @path = hsh[:path]
+        @name = hsh[:name]
+        @type = hsh[:type]
+        @tags = hsh[:tags]
+        @environment = hsh[:environment]
+        @version = hsh[:version]
+      end
+
+      # @return [String, nil]
+      def tags
+        stringify_array(@tags)
+      end
+
+      # Converts current configuration to effective config values class and appends them to
+      # EffectiveConfig class.
+      #
+      # @param effective_config [Contrast::Agent::DiagnosticsConfig::EffectiveConfig]
+      def to_effective_config effective_config
+        super
+        add_single_effective_value(effective_config,
+                                   'type',
+                                   Contrast::APP_CONTEXT.server_type,
+                                   CANON_NAME,
+                                   "#{ CONTRAST }.#{ CANON_NAME }")
+        add_single_effective_value(effective_config,
+                                   'name',
+                                   Contrast::APP_CONTEXT.server_name,
+                                   CANON_NAME,
+                                   "#{ CONTRAST }.#{ CANON_NAME }")
+        add_single_effective_value(effective_config,
+                                   'path',
+                                   Contrast::APP_CONTEXT.server_path,
+                                   CANON_NAME,
+                                   "#{ CONTRAST }.#{ CANON_NAME }")
       end
     end
   end

data/lib/contrast/config.rb

@@ -1,4 +1,4 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
 # frozen_string_literal: true
 
 module Contrast
@@ -10,24 +10,8 @@ module Contrast
   end
 end
 
-cs__scoped_require 'contrast/config/base_configuration'
-cs__scoped_require 'contrast/config/default_value'
-
-cs__scoped_require 'contrast/config/logger_configuration'
-
-cs__scoped_require 'contrast/config/heap_dump_configuration'
-cs__scoped_require 'contrast/config/service_configuration'
-cs__scoped_require 'contrast/config/exception_configuration'
-cs__scoped_require 'contrast/config/assess_rules_configuration'
-cs__scoped_require 'contrast/config/protect_rule_configuration'
-cs__scoped_require 'contrast/config/protect_rules_configuration'
-cs__scoped_require 'contrast/config/sampling_configuration'
-
-cs__scoped_require 'contrast/config/ruby_configuration'
-cs__scoped_require 'contrast/config/agent_configuration'
-cs__scoped_require 'contrast/config/application_configuration'
-cs__scoped_require 'contrast/config/server_configuration'
-cs__scoped_require 'contrast/config/assess_configuration'
-cs__scoped_require 'contrast/config/inventory_configuration'
-cs__scoped_require 'contrast/config/protect_configuration'
-cs__scoped_require 'contrast/config/root_configuration'
+require 'contrast/config/base_configuration'
+require 'contrast/config/exception_configuration'
+require 'contrast/config/protect_rule_configuration'
+require 'contrast/config/protect_rules_configuration'
+require 'contrast/config/server_configuration'