contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/tasks/config.rb

@@ -0,0 +1,144 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'yaml'
+require 'contrast/configuration'
+require 'contrast/agent/reporting/reporter'
+
+module Contrast
+  # A Rake task to generate a contrast_security.yaml file with some basic settings
+  module Config
+    extend Rake::DSL
+    DEFAULT_CONFIG = {
+        'api' => {
+            'url' => 'Enter your Contrast URL ex: https://app.contrastsecurity.com/Contrast',
+            'api_key' => 'Enter your Contrast api key',
+            'service_key' => 'Enter your Contrast service key',
+            'user_name' => 'Enter your Contrast user name'
+        },
+        'agent' => {
+            'logger' => {
+                'level' => 'ERROR',
+                'path' => 'contrast_agent.log'
+            }
+        }
+    }.cs__freeze
+
+    SKIP_LOG = %w[service_key api_key].cs__freeze
+    REQUIRED = %i[url api_key service_key user_name].cs__freeze
+
+    namespace :contrast do
+      namespace :config do
+        desc 'Create a contrast_security.yaml in the applications root directory'
+        task :create do
+          execution_directory = Dir.pwd
+          target_path = File.join(execution_directory, 'contrast_security.yaml')
+          if File.exist?(target_path)
+            puts 'WARNING: contrast_security.yaml already exists'
+          else
+            File.write(target_path, YAML.dump(DEFAULT_CONFIG))
+
+            puts "Created contrast_security.yaml at #{ target_path }"
+            puts 'Open the file and enter your Contrast Security api keys or set them via environment variables'
+            puts 'Visit our documentation site for more details: https://docs.contrastsecurity.com/installation-rubyconfig.html'
+          end
+        end
+      end
+    end
+
+    namespace :contrast do
+      namespace :config do
+        desc 'Validate the provided Contrast configuration and confirm connectivity'
+        task validate: :environment do
+          puts 'Validating Agent Configuration...'
+          Contrast::Config.validate_config
+          puts '...done!'
+          puts 'Validating Contrast Reporter Headers...'
+          reporter = Contrast::Config.validate_headers
+          puts '...done!'
+          puts 'Testing Reporter Client Connection...'
+          Contrast::Config.test_connection(reporter) if reporter
+          puts '...done!'
+        end
+      end
+
+      def self.validate_config
+        config = Contrast::Configuration.new
+        abort('Unable to Build Config') unless config
+        missing = []
+
+        api_hash = config.api.to_contrast_hash
+
+        api_hash.each_key do |key|
+          value = mask_keys(api_hash, key)
+          if value.is_a?(Contrast::Config::ApiProxyConfiguration)
+            Contrast::Config.validate_proxy(value)
+          elsif value.is_a?(Contrast::Config::CertificationConfiguration)
+            Contrast::Config.validate_cert(value)
+            next
+          elsif value.is_a?(Contrast::Config::RequestAuditConfiguration)
+            Contrast::Config.validate_audit(value)
+            next
+          elsif value.nil? && REQUIRED.includes?(key.to_sym)
+            missing << key
+          end
+        end
+        abort("Missing required API configuration values: #{ missing.join(', ') }") unless missing.empty?
+      end
+
+      def self.validate_proxy config
+        puts("Proxy Enabled: #{ config.enable }")
+        return unless config.enable
+
+        puts("Proxy URL: #{ config.url }")
+        abort('Proxy Enabled but no Proxy URL given') unless config.url
+      end
+
+      def self.validate_cert config
+        puts("Certification Enabled: #{ config.enable }")
+        return unless config.enable
+
+        puts("CA File: #{ config.ca_file }")
+        abort('CA file path not provided') unless config.ca_file
+        puts("Cert File: #{ config.cert_file }")
+        abort('Cert file path not provided') unless config.cert_file
+        puts("Key File: #{ config.key_file }")
+        abort('Key file path not provided') unless config.key_file
+      end
+
+      def self.validate_audit config
+        puts("Request Audit Enabled: #{ config.enable }")
+        return unless config.enable
+
+        config.each do |k, v|
+          puts("#{ k }::#{ v }")
+        end
+      end
+
+      def self.validate_headers
+        missing = []
+        reporter = Contrast::Agent::Reporter.new
+        reporter_headers = reporter.client.headers.to_contrast_hash
+        reporter_headers.each_key do |key|
+          value = mask_keys(reporter_headers, key)
+          missing << key if value.nil?
+        end
+        abort("Missing required header values: #{ missing.join(', ') }") unless missing.empty?
+        reporter
+      end
+
+      def self.test_connection reporter
+        connection = reporter.connection
+        abort('Failed to Initialize Connection please check error logs for details') unless connection
+        abort('Failed to Start Client please check error logs for details') unless reporter.client.startup!(connection)
+      end
+
+      def self.mask_keys hash, key
+        value = hash[key]
+        redacted_value = Contrast::Configuration::REDACTED if SKIP_LOG.include?(key.to_s)
+        puts("#{ key }::#{ redacted_value || value }") unless value.is_a?(Contrast::Config::BaseConfiguration)
+        value
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/event_limit_utils.rb

@@ -0,0 +1,134 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/components/assess'
+
+module Contrast
+  module Utils
+    module Assess
+      # EventLimitUtils is used to check and validate the number of source, propagation, or trigger events collected
+      # during the reporting time frame
+      module EventLimitUtils
+        include Contrast::Components::Logger::InstanceMethods
+        # Checks to see if the event limit for the policy type has been met or exceeded
+        # @param policy [Contrast::Agent::Patching::Policy::MethodPolicy,
+        #   Contrast::Agent::Patching::Policy::TriggerNode] method to check for event limit
+        def event_limit? policy
+          return false unless (context = Contrast::Agent::REQUEST_TRACKER.current)
+
+          if policy.source_node
+            max =  ::Contrast::ASSESS.max_context_source_events
+            return at_limit?(policy, context.source_event_count, max, context)
+          end
+
+          if policy.propagation_node
+            max = ::Contrast::ASSESS.max_propagation_events
+            return at_limit?(policy, context.propagation_event_count, max, context)
+          end
+
+          false # policy does not have limit
+        end
+
+        def event_limit_for_rule? rule_id # rubocop:disable Metrics/AbcSize
+          return false unless (context = Contrast::Agent::REQUEST_TRACKER.current)
+
+          saved_request_ids = rule_counts.keys.map { |k| k.to_s.split('_')[1].to_i }
+
+          # if we passed the threshold and we actually have records for that request - wipe them
+          if saved_request_ids.uniq.include?(context.request.__id__)
+            restore_defaults
+            threshold_time_limit
+          end
+
+          # if we have recorded rule counts, but none of them are for the current request_id
+          # eventually we can try and play with the time_limit_threshold -> DEFAULT_MAX_RULE_TIME_THRESHOLD
+          if !rule_counts.empty? && !saved_request_ids.include?(context.request.__id__)
+            restore_defaults
+            threshold_time_limit
+          end
+
+          rule_key = "#{ rule_id }_#{ context.request.__id__ }"
+          rule_counts[rule_key] += 1
+          rule_counts[rule_key] >= ::Contrast::ASSESS.max_rule_reported
+        end
+
+        # Increments the event count for the type of event that is being tracked
+        #
+        # @param node [Contrast::Agent::Assess::Policy::PolicyNode] policy to increment
+        def increment_event_count node
+          return unless (context = Contrast::Agent::REQUEST_TRACKER.current)
+
+          context.source_event_count += 1 if node.cs__is_a?(Contrast::Agent::Assess::Policy::SourceNode)
+          context.propagation_event_count += 1 if node.cs__is_a?(Contrast::Agent::Assess::Policy::PropagationNode)
+        end
+
+        private
+
+        # helper method to check limit and log when necessary
+        def at_limit? method_policy, current_count, event_max, context
+          if current_count == event_max
+            return if event_limit_counts.key?(get_event_limit_key(method_policy, context))
+
+            logger.warn('Event Limit Reached:',
+                        {
+                            count: current_count,
+                            max: event_max,
+                            policy: method_policy.method_name,
+                            node: method_policy
+                        })
+            # increment to be over count for logging purposes
+            increment_event_count(method_policy)
+            increment_event_limit_logs(method_policy, context)
+
+            return true
+          elsif current_count > event_max
+            increment_event_count(method_policy)
+            return if event_limit_counts.key?(get_event_limit_key(method_policy, context))
+
+            # increment to be over count for logging purposes
+            logger.warn('Event Limit Exceeded:',
+                        {
+                            count: current_count,
+                            policy: method_policy.method_name,
+                            node: method_policy
+                        })
+            increment_event_limit_logs(method_policy, context)
+            return true
+          end
+          false
+        end
+
+        def rule_counts
+          @_rule_counts ||= Hash.new { |h, k| h[k] = 0 }
+        end
+
+        def event_limit_counts
+          @_event_limit_counts ||= Hash.new { |h, k| h[k] = 0 }
+        end
+
+        def get_event_limit_key method_policy, context
+          "#{ method_policy.method_name }_#{ context.request.__id__ }"
+        end
+
+        def increment_event_limit_logs method_policy, context
+          event_limit_counter = get_event_limit_key(method_policy, context)
+
+          event_limit_counts[event_limit_counter] += 1
+        end
+
+        # the time threshold for which to track rule counts resets when now >= threshold_time_limit
+        # @return [Integer]
+        def threshold_time_limit
+          @_threshold_time_limit ||= Contrast::Utils::Timer.now_ms + (::Contrast::ASSESS.time_limit_threshold || 0)
+        end
+
+        # @return nil
+        def restore_defaults
+          @_rule_counts = nil
+          @_threshold_time_limit = nil
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/object_store.rb

@@ -0,0 +1,36 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # keep track of object properties and events data
+      class ObjectStore
+        def initialize capacity = 500
+          @capacity = capacity
+          @cache = {}
+        end
+
+        def get
+          @cache
+        end
+
+        def [] key
+          @cache[key]
+        end
+
+        def delete key
+          @cache.delete(key)
+        end
+
+        # We would keep object ids with capacity.
+        # If a reference is kept to an object only by it's id,
+        # It would be CG-ted safely.
+        def []= key, value
+          @cache[key] = value
+          @cache.shift if @cache.length > @capacity
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/propagation_method_utils.rb

@@ -0,0 +1,155 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module will include all methods for some internal validations in the PropagationMethod module
+      # and some other module methods from the same place, so we can ease the main module
+      module PropagationMethodUtils
+        APPEND_ACTION = 'APPEND'
+        CENTER_ACTION = 'CENTER'
+        INSERT_ACTION = 'INSERT'
+        BUFFER_ACTION = 'BUFFER'
+        KEEP_ACTION = 'KEEP'
+        NEXT_ACTION = 'NEXT'
+        NOOP_ACTION = 'NOOP'
+        PREPEND_ACTION = 'PREPEND'
+        REPLACE_ACTION = 'REPLACE'
+        REMOVE_ACTION = 'REMOVE'
+        REVERSE_ACTION = 'REVERSE'
+        SPLAT_ACTION = 'SPLAT'
+        SPLIT_ACTION = 'SPLIT'
+        DB_WRITE_ACTION = 'DB_WRITE'
+        CUSTOM_ACTION = 'CUSTOM'
+
+        ZERO_LENGTH_ACTIONS = [DB_WRITE_ACTION, CUSTOM_ACTION, KEEP_ACTION, REPLACE_ACTION, SPLAT_ACTION].cs__freeze
+
+        PROPAGATION_ACTIONS = {
+            APPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Append,
+            CENTER_ACTION => Contrast::Agent::Assess::Policy::Propagator::Center,
+            INSERT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Insert,
+            KEEP_ACTION => Contrast::Agent::Assess::Policy::Propagator::Keep,
+            NEXT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Next,
+            BUFFER_ACTION => Contrast::Agent::Assess::Policy::Propagator::Buffer,
+            NOOP_ACTION => nil,
+            PREPEND_ACTION => Contrast::Agent::Assess::Policy::Propagator::Prepend,
+            REPLACE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Replace,
+            REMOVE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Remove,
+            REVERSE_ACTION => Contrast::Agent::Assess::Policy::Propagator::Reverse,
+            SPLAT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Splat,
+            SPLIT_ACTION => Contrast::Agent::Assess::Policy::Propagator::Split
+        }.cs__freeze
+
+        def determine_target propagation_node, ret, object, args
+          target = propagation_node.targets[0]
+          case target
+          when Contrast::Utils::ObjectShare::OBJECT_KEY
+            object
+          when Contrast::Utils::ObjectShare::RETURN_KEY
+            ret
+          else
+            args[target]
+          end
+        end
+
+        # Custom actions tend to be the more complex of our propagations. Often, the method has to make decisions
+        # about the target based on the context with which the method was called. As such, defer determining if the
+        # target is valid to that method.
+        #
+        # In all other cases, a target is valid for propagation if it is not nil
+        #
+        # @param target [Object] the thing to which to propagate
+        # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+        #   propagation event.
+        # @return [Boolean]
+        def valid_target? target, propagation_node
+          return true if propagation_node.action == CUSTOM_ACTION
+
+          !!target
+        end
+
+        # If the action required needs a length and the target does not have one, the length is not valid
+        #
+        # @param target [Object] the thing to which to propagate
+        # @param action [String] the name of the action taken during this propagation
+        # @return [Boolean]
+        def valid_length? target, action
+          return true if ZERO_LENGTH_ACTIONS.include?(action)
+
+          if Contrast::Utils::DuckUtils.quacks_to?(target, :length)
+            target.length != 0 # rubocop:disable Style/ZeroLengthPredicate
+          else
+            !target.to_s.empty?
+          end
+        end
+
+        # Before we do any work, we should check if we even need to. If the source and target of this patcher are
+        # not tracked, there's no need to do anything. A copy of nothing is still nothing.
+        #
+        # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+        #   propagation event.
+        # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+        #   the invocation of the patched method.
+        # @param target [Object] the thing to which to propagate
+        # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+        #                         object [Object] the Object on which the method was invoked
+        #                         args [Array<Object>] the Arguments with which the method was invoked
+        # @return [Boolean]
+        def can_propagate? propagation_node, preshift, target, propagation_data
+          return false unless appropriate_target?(propagation_node, target)
+          return true if Contrast::Utils::Assess::TrackingUtil.tracked?(target)
+          return false unless appropriate_source?(propagation_node, propagation_data, preshift)
+
+          propagation_node.sources.each do |source|
+            case source
+            when Contrast::Utils::ObjectShare::OBJECT_KEY
+              source_object = if propagation_node.use_original_object?
+                                propagation_data.object
+                              else
+                                preshift.object
+                              end
+              return true if Contrast::Utils::Assess::TrackingUtil.tracked?(source_object)
+            else
+              # has to be P, there's no ret source type (yet? ever?)
+              return true if preshift.args && Contrast::Utils::Assess::TrackingUtil.tracked?(preshift.args[source])
+            end
+          end
+          false
+        end
+
+        # We cannot propagate to frozen things that have not been updated to work with our property tracking,
+        # unless they're duplicable and the return. We probably shouldn't propagate to frozen things at all, as
+        # they're supposed to be immutable, but third parties do jenky things, so allow it as long as it is safe to
+        # do.
+        #
+        # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+        #   propagation event.
+        # @param target [Object] the Target to which to propagate.
+        # @return [Boolean] if the target can be propagated to
+        def appropriate_target? propagation_node, target
+          # special handle Returns b/c we can do unfreezing magic during propagation
+          return true if propagation_node.targets[0] == Contrast::Utils::ObjectShare::RETURN_KEY
+
+          Contrast::Agent::Assess::Tracker.trackable?(target)
+        end
+
+        # A source is appropriate if it is available for propagation
+        #
+        # @param propagation_node [Contrast::Agent::Assess::Policy::PropagationNode] the node that governs this
+        #   propagation event.
+        # @param propagation_data [Contrast::Agent::Assess::Events::EventData] this will hold the
+        #                         object [Object] the Object on which the method was invoked
+        #                         args [Array<Object>] the Arguments with which the method was invoked
+        # @param preshift [Contrast::Agent::Assess::PreShift] The capture of the state of the code just prior to
+        #   the invocation of the patched method.
+        # @return [Boolean]
+        def appropriate_source? propagation_node, propagation_data, preshift
+          return true if preshift
+
+          propagation_node.use_original_object? && propagation_data&.object
+        end
+      end
+    end
+  end
+end

data/lib/contrast/utils/assess/property/tagged_utils.rb

@@ -0,0 +1,165 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Utils
+    module Assess
+      # This module will include all methods for some internal validations in the Tagged property module
+      # and some other module methods from the same place, so we can ease the main module
+      # This module includes simple methods for the tags like
+      # adding tags, getting tags, deleting tags and similar
+      module TaggedUtils
+        # Is the given tag present?
+        # Used in testing, so found by `be_tagged`, if you're grepping for it
+        #
+        # @param label [Symbol] the tag to check for
+        # @return [Boolean]
+        def tagged? label
+          tracked? && tags.key?(label)
+        end
+
+        # Similar to #tracked?, but limited to a given range.
+        #
+        # @param start [Integer] the inclusive start index to check.
+        # @param finish [Integer] the exclusive end index to check.
+        # @return [Boolean]
+        def any_tags_between? start, finish
+          return false unless tracked?
+
+          tags.each_value do |tag_array|
+            return true if tag_array.any? { |tag| tag.overlaps?(start, finish) }
+          end
+          false
+        end
+
+        # Given a tag name and range object, add a new tag to this
+        # collection. If the given range touches an existing tag,
+        # we'll combine the two, adjusting the existing one and
+        # dropping this new one.
+        #
+        # @param label [String] the name of the tag
+        # @param range [Range] the Range that the tag covers, inclusive to
+        #   exclusive
+        def add_tag label, range
+          length = range.end - range.begin
+          tag = Contrast::Agent::Assess::Tag.new(label, length, range.begin)
+          existing = fetch_tag(label)
+          tags[label] = Contrast::Utils::TagUtil.ordered_merge(existing, tag)
+        end
+
+        def set_tags label, tag_ranges
+          tags[label] = tag_ranges
+        end
+
+        # Returns a list of all current tags.
+        #
+        # @return [Hash<Contrast::Agent::Assess::Tag>]
+        def get_tags # rubocop:disable Naming/AccessorMethodName
+          return Contrast::Utils::ObjectShare::EMPTY_HASH unless tracked?
+
+          tags
+        end
+
+        # We'll use this as a helper method to retrieve tags from the hash.
+        # Because the hash auto-populates an empty array when we try to
+        # access a tag in it, we cannot use the [] method without side
+        # effect. To get around this, we'll use a fetch work around.
+        #
+        # @param label [Symbol] the label to look up
+        # @return [Array<Contrast::Agent::Assess::Tag>] all the tags with
+        #   that label
+        def fetch_tag label
+          get_tags.fetch(label, nil) if tracked?
+        end
+
+        # Remove all tags with a given label
+        def delete_tags label
+          tags.delete(label) if tracked?
+        end
+
+        # Reset the tag hash
+        def clear_tags
+          tags.clear if tracked?
+        end
+
+        # Returns a list of all current tag labels, most likely to be used for
+        # a splat operation
+        def tag_keys
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tracked?
+
+          tags.keys
+        end
+
+        # Calls merge to combine touching or overlapping tags
+        # Deletes empty tags
+        def cleanup_tags
+          return unless tracked?
+
+          Contrast::Utils::TagUtil.merge_tags(tags)
+          tags.delete_if { |_, value| value.empty? }
+        end
+
+        # Find all of the ranges that span a given index. This is used
+        # in propagation when we need to shift tags about. For instance, in
+        # the append method when we need to see if any tag at the end needs
+        # to be expanded out to the size of the new String.
+        #
+        # Note: Tags do not know their key, so this is only the range covered
+        #
+        # @param idx [Integer] the index to check for tags
+        # @return [Array<Contrast::Agent::Assess::Tag>] a set of all the Tags
+        #   covering the given index. This is only the ranges, not the names.
+        def tags_at idx
+          return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless tracked?
+
+          at = []
+          tags.each_value do |tag_array|
+            tag_array.each do |tag|
+              if tag.covers?(idx)
+                at << tag
+              elsif tag.above?(idx)
+                break
+              end
+            end
+          end
+          at
+        end
+
+        # given a range, select all tags in that range the selected tags are
+        # shifted such that the start index of the new tag (0) aligns with
+        # the given start index in the range
+        #
+        # current tags: 5-15
+        # range       : 5-10
+        # result      : 0-05
+        #
+        # Note that we disable Lint/DuplicateBranch in this branch in order
+        # list out all tag range cases in the proper order to make this
+        # easier to understand
+        #
+        # @param range [Range] the span to check, inclusive to exclusive
+        # @return [Hash{String => Contrast::Agent::Assess::Tag}] the hash of
+        #   key to tags
+        def tags_at_range range
+          return Contrast::Utils::ObjectShare::EMPTY_HASH unless tracked?
+
+          at = Hash.new { |h, k| h[k] = [] }
+          tags.each_pair do |key, value|
+            add = nil
+            value.each do |tag|
+              within_range = resize_to_range(tag, range)
+              if within_range
+                add ||= []
+                add << within_range
+              end
+            end
+            next unless add&.any?
+
+            at[key] = add
+          end
+          at
+        end
+      end
+    end
+  end
+end