contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/assess/rule/csrf/csrf_applicator.rb

@@ -1,69 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        class Csrf
-          # This class is called by our patches to determine if a CSRF
-          # vulnerability exists within an application. It is used through a
-          # CUSTOM propagation in order to capture that a Database call was
-          # made in response to a request that did not have the Contrast CSRF
-          # token.
-          class CsrfApplicator
-            include Contrast::Components::Interface
-            access_component :logging, :analysis, :scope
-
-            CS__CSRF_LOG_MSG = 'applying CSRF assess rule'
-
-            def self.rule
-              @_rule ||= Contrast::Agent::FeatureState.instance.assess_rule(
-                  Contrast::Agent::Assess::Rule::Csrf::NAME)
-            end
-
-            def self.csrf_tagger patcher, preshift, _ret, _block
-              return unless rule&.enabled?
-
-              idx = patcher.sources[0].to_i
-              args = preshift.args
-              return unless args&.length.to_i > idx
-
-              sql = args[idx]
-              return unless sql
-
-              with_contrast_scope do
-                logger.debug(nil, CS__CSRF_LOG_MSG)
-                rule.record_db_state_change(
-                    Contrast::Agent::REQUEST_TRACKER.current,
-                    sql)
-              end
-            end
-
-            def self.cs__assess_apply_csrf_rule sql
-              context = Contrast::Agent::REQUEST_TRACKER.current
-
-              return unless context&.app_loaded?
-              return unless ASSESS.enabled?
-              return unless sql
-
-              rule = Contrast::Agent::FeatureState.instance.assess_rule(
-                  Contrast::Agent::Assess::Rule::Csrf::NAME)
-              return unless rule&.enabled?
-
-              with_contrast_scope do
-                logger.debug(CS__CSRF_LOG_MSG)
-                rule.record_db_state_change(context, sql)
-              end
-            rescue StandardError => e
-              logger.warn(e, 'Error running CSRF assess rule')
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/csrf/csrf_watcher.rb

@@ -1,132 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/agent/assess/rule/response_watcher'
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        class Csrf
-          # Watchers are how those Rules which do not act on dataflow function.
-          # This one is used by the CSRF rule to determine if a request was
-          # made in a way that is susceptible to a CSRF attack.
-          class Watcher < Contrast::Agent::Assess::Rule::ResponseWatcher
-            def supports? context
-              return false unless super(context)
-              return false unless user_agent?(context)
-              return false unless form_content_type?(context)
-              return false unless form_method?(context)
-              return false if empty_get?(context)
-
-              true
-            end
-
-            X_REQUESTED_WITH = 'X-REQUESTED-WITH'
-            # ignore this request if X-Requested-With is set
-            def x_requested_with? context
-              !context.request.normalized_request_headers[X_REQUESTED_WITH].nil?
-            end
-
-            USER_AGENT = 'USER-AGENT'
-            # ignore this request if User-Agent is NOT set
-            # since that indicates this isn't a browser interaction
-            def user_agent? context
-              !context.request.normalized_request_headers[USER_AGENT].nil?
-            end
-
-            CONTENT_TYPE = 'CONTENT-TYPE'
-            FORM_TYPES = %w[
-              text/plain
-              multipart/form-data
-              application/x-www-form-urlencoded
-            ].cs__freeze
-            # ignore this request if the Content-Type is NOT set
-            # to a form content type
-            def form_content_type? context
-              type = context.request.content_type
-              # We need to account for the charset being part of the header. It doesn't
-              # affect how we determine CSRF-ability or not
-              type = type.split(Contrast::Utils::ObjectShare::SEMICOLON)[0] if type
-              FORM_TYPES.include?(type)
-            end
-
-            FORM_METHODS = %w[GET POST].cs__freeze
-            # ignore this request if the request method
-            # is not one that can be set with forms
-            def form_method? context
-              FORM_METHODS.include?(context.request.request_method)
-            end
-
-            GET = 'GET'
-            # ignore this request if the method is get
-            # and the query string is empty
-            def empty_get? context
-              request = context.request
-              request.request_method ==
-                  GET &&
-                  (request.query_string.nil? || request.query_string.empty?)
-            end
-
-            # If a parameter contains 'csrf' or 'token', we consider
-            # it to be a guard against CSRF and therefore determine
-            # that this request is not vulnerable.
-            CSRF_PATTERN = /csrf/i.cs__freeze
-            TOKEN_PATTERN = /token/i.cs__freeze
-            def vulnerable? context
-              # having the property 'csrf.token.checked' indicates
-              # that a CSRF check was preformed at some point during
-              # this request, so we consider it to not be vulnerable
-              return false if context.get_property(CHECKED)
-
-              params = context.request.parameters
-              params.each_key do |key|
-                return false if key.match?(CSRF_PATTERN)
-                return false if key.match?(TOKEN_PATTERN) && looks_like_token?(params[key])
-              end
-              # having no actions means there's no vulnerability
-              return false unless context.get_property(STATE_CHANGING_ACTIONS_KEY)&.any?
-
-              true
-            end
-
-            MINIMUM_CSRF_TOKEN_SIZE = 8
-            MAXIMUM_CSRF_TOKEN_SIZE = 24
-            TOKEN_REGEXP = /^[A-Za-z0-9]*$/.cs__freeze
-            def looks_like_token? value
-              return false unless value
-
-              values = [value]
-              values.each do |parameter|
-                next unless parameter
-
-                length = parameter.length
-                next if length < MINIMUM_CSRF_TOKEN_SIZE
-                next if length > MAXIMUM_CSRF_TOKEN_SIZE
-                return true if parameter.match?(TOKEN_REGEXP)
-              end
-              false
-            end
-
-            DATA_KEY = 'actions'
-            def build_finding context
-              actions = context.get_property(STATE_CHANGING_ACTIONS_KEY)
-              return if actions.nil? || actions.empty?
-
-              string = actions.map(&:to_h).to_json
-              finding = Contrast::Api::Dtm::Finding.new
-              finding.rule_id = Contrast::Agent::Assess::Rule::Csrf::NAME
-              finding.session_id = Contrast::Agent::FeatureState.instance.current_session_id
-              hash_code = Contrast::Utils::HashDigest.generate_response_hash(finding)
-              finding.hash_code = Contrast::Utils::StringUtils.force_utf8(hash_code)
-              finding.properties[DATA_KEY] = Contrast::Utils::StringUtils.force_utf8(string)
-              finding
-            rescue StandardError => e
-              logger.error(e, 'Unable to build a finding for CSRF')
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/csrf.rb

@@ -1,66 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # The Ruby implementation of the CSRF Assess Rule.
-        class Csrf < Contrast::Agent::Assess::Rule::ResponseScanningRule
-          NAME = 'csrf'
-          def name
-            NAME
-          end
-
-          DB_STATE_CHANGE = 'db'
-          ACTION_LIMIT = 3
-          QUERY_SIZE_LIMIT = 50
-          STATE_CHANGING_ACTIONS_KEY = 'csrf.statechange.actions'
-          def record_db_state_change context, query
-            return unless context
-
-            changes = context.get_property(STATE_CHANGING_ACTIONS_KEY)
-            changes ||= []
-            return unless changes.length < ACTION_LIMIT
-
-            return unless state_change?(query)
-
-            action = Contrast::Agent::Assess::Rule::Csrf::CsrfAction.new
-            action.type = DB_STATE_CHANGE
-            action.evidence = query[0..QUERY_SIZE_LIMIT]
-
-            changes << action
-
-            context.add_property(STATE_CHANGING_ACTIONS_KEY, changes)
-          end
-
-          STATE_CHANGE_QUERY_ACTIONS = %w[
-            insert
-            update
-            delete
-            drop
-            create
-            alter
-            upsert
-          ].cs__freeze
-          # Returns true if the given query starts with any
-          # of the STATE_CHANGE_QUERY_ACTIONS listed above
-          def state_change? query
-            return false unless query.is_a?(String) && !query.empty?
-
-            query.downcase.start_with?(*STATE_CHANGE_QUERY_ACTIONS)
-          end
-
-          # some watchers keep state and need to be reset in each request.
-          # this one is not one of those.
-          def watcher
-            @_watcher ||= Contrast::Agent::Assess::Rule::Csrf::Watcher.new
-          end
-
-          # Indicates if this request has been checked for a CSRF token
-          CHECKED = 'csrf.token.checked'
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/redos.rb

@@ -1,68 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # A regexp is only vulnerable to REDOS if it's going to run
-        # with pathologically bad performance.
-        # We report a vulnerability if the regexp is liable to run
-        # with quadratic time for some input.
-        # This vastly errs on the side of false positives.
-        class Redos < Contrast::Agent::Assess::Rule::Base
-          class << self
-            NAME = 'redos'
-            def name
-              NAME
-            end
-
-            def regexp_complexity_check context, trigger_node, source, object, ret, invoked, *args
-              # we can arrive here either from:
-              #   regexp =~ string
-              #   string =~ regexp
-              #   regexp.match string
-              #
-              # so object/args[0] can be string/regexp or regexp/string.
-              regexp = object.is_a?(Regexp) ? object : args[0]
-              string = object.is_a?(String) ? object : args[0]
-
-              # (1) regexp must be exploitable
-              return unless regexp_vulnerable?(regexp)
-
-              # (2) regexp must evaluate against user input
-              if trigger_node.violated?(string) # rubocop:disable Style/GuardClause
-                Contrast::Agent::Assess::Policy::TriggerMethod.build_finding(context, trigger_node, source, object, ret, invoked + 1, args)
-              end
-            end
-
-            protected
-
-            VULNERABLE_PATTERN = /[\[(].*?[\[(].*?[\])][*+?].*?[\])][*+?]/.cs__freeze
-
-            # Does the regexp
-            # https://bitbucket.org/contrastsecurity/assess-specifications/src/master/rules/dataflow/redos.md
-            def regexp_vulnerable? regexp
-              # A pattern is considered vulnerable if it has 2 or more levels of nested multi-matching.
-              # A level is defined as any set of opening and closing control characters immediately followed by a multi match control character.
-              # A control character is defined as one of the OPENING_CHARS, CLOSING_CHARS,
-              # or MULTI_MATCH_CHARS that is not immediately preceded by an escaping \ character.
-              # OPENING_CHARS are ( and [ CLOSING_CHARS are ) and ] MULTI_MATCH_CHARS are +, *, and ?
-
-              # Nota bene about Regexp#to_s:  it doesn't necessarily give you the original Regexp back
-              # (in the sense of `my_str == Regexp.new(my_str).to_s`), it gives you a Regexp that
-              # will have the same functional characteristics as the original.
-              # Regexp#inspect gives you a "more nicely formatted" version than #to_s.
-              # Regexp#source will give you the original source.
-              # TODO RUBY-683, would we ever get a hit on one but not the other?
-
-              # Use #match? because it doesn't fill out global variables
-              # in the way match or =~ do.
-              VULNERABLE_PATTERN.match? regexp.source
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/response_scanning_rule.rb

@@ -1,47 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # Those rules which function by scanning the Response body in order to
-        # detect vulnerabilities. These rules should each have their own
-        # Contrast::Agent::Assess::RuleResponseWatcher.
-        #
-        # Note: Most have been moved to the Service, as they typically watch
-        #   the Request or Response bodies, parsing out vulnerabilities
-        #   therein. CSRF is an exception to this as the rule requires a change
-        #   to the Response body to function.
-        class ResponseScanningRule < Contrast::Agent::Assess::Rule::Base
-          def watcher
-            # raise(
-            #     NotImplementedError,
-            #     'A child rule should have overridden the watcher method')
-          end
-
-          def stream_safe?
-            false
-          end
-
-          def generate_hash finding
-            Contrast::Utils::HashDigest.generate_response_hash(finding)
-          end
-
-          def postfilter context
-            findings = watcher.postfilter(context) if watcher && context
-            return unless findings
-
-            if findings.is_a?(Array)
-              findings.each do |finding|
-                send_report(finding) if finding
-              end
-            else
-              send_report(findings)
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/response_watcher.rb

@@ -1,36 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # A watcher focused on the Response body, parsing out vulnerabilities
-        # therein.
-        #
-        # Note: Most have been moved to the Service, as they typically watch
-        #   the Request or Response bodies, parsing out vulnerabilities
-        #   therein. CSRF is an exception to this as the rule requires a change
-        #   to the Response body to function.
-        class ResponseWatcher < Contrast::Agent::Assess::Rule::Watcher
-          def postfilter context
-            return unless supports?(context)
-            return unless vulnerable?(context)
-
-            build_finding(context)
-          end
-
-          def vulnerable? _context
-            raise(
-                NotImplementedError,
-                'A child rule should have overridden the vulnerable? method')
-          end
-
-          def build_finding _context
-            Contrast::Api::Dtm::Finding.new
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule/watcher.rb

@@ -1,36 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      module Rule
-        # Watchers are how those Rules which do not act on dataflow function.
-        #
-        # Note: Most have been moved to the Service, as they typically watch
-        #   the Request or Response bodies, parsing out vulnerabilities
-        #   therein. CSRF is an exception to this as the rule requires a change
-        #   to the Response body to function.
-        class Watcher
-          def supports? context
-            return false if context.request.static_request?
-            return false unless context.response
-            return false if undesired_response_code? context.response.response_code
-            return false if undesired_response_type? context.response.content_type
-
-            true
-          end
-
-          UNDESIRED_RESPONSE_CODES = [301, 302, 307, 404, 410, 500].cs__freeze
-          def undesired_response_code? code
-            UNDESIRED_RESPONSE_CODES.include?(code)
-          end
-
-          def undesired_response_type? _type
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/agent/assess/rule.rb

@@ -1,18 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  module Agent
-    module Assess
-      # This is the base module for our assess rule classes. It is intended to
-      # facilitate the patching of the application for Assess functionality. Any
-      # class under this namespace should be required here, providing a single
-      # point of require for this functionality.
-      module Rule
-      end
-    end
-  end
-end
-
-cs__scoped_require 'contrast/agent/assess/rule/base'
-cs__scoped_require 'contrast/agent/assess/rule/provider'

data/lib/contrast/agent/class_reopener.rb

@@ -1,195 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: false
-
-cs__scoped_require 'ripper'
-cs__scoped_require 'contrast/core_extensions/module'
-cs__scoped_require 'contrast/components/interface'
-
-# This method is left purposefully at the top level namespace. Moving it
-# elsewhere will break functionality as it executes evaluations against the
-# namespace from which it is called -- ie putting it in Contrast would make all
-# changes it intends for Foo happen to Contrast::Foo instead
-#
-# @param class_name [String] the name of the class in which the eval will
-#   redefine functionality
-# @param content [String] the String content that will function as the code in
-#   the given class
-def unbound_eval class_name, content
-  # Yuck, this is a top-level method that has to break encapsulation
-  # in order to access scoping!
-  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.enter_contrast_scope
-  eval(content) # rubocop:disable Security/Eval
-rescue Exception # rubocop:disable Lint/RescueException
-  Contrast::Agent::SettingsState.log_error("Unable to perform unbound eval of new content for #{ class_name }.")
-ensure
-  Contrast::Components::Scope::COMPONENT_INTERFACE.scope_for_current_ec.exit_contrast_scope
-end
-
-module Contrast
-  module Agent
-    # Used for Ruby 2.4 & 2.5 to allow us to rewrite those methods which have
-    # interpolation in them.
-    # @deprecated Changes to this class are discouraged as this approach is
-    #   being phased out with support for those language versions.
-    class ClassReopener
-      END_NEW_LINE = "end\n".cs__freeze
-      PROTECTED_WITH_NEW_LINE = "protected\n".cs__freeze
-      PRIVATE_WITH_NEW_LINE = "private\n".cs__freeze
-      CLASS_SELF_LINE = "class << self\n".cs__freeze
-
-      attr_reader :public_singleton_methods, :class_module_path, :class_name, :files, :is_class, :name_space,
-                  :public_instance_methods, :protected_instance_methods, :private_instance_methods, :locations
-
-      def initialize module_data
-        @class_module_path = module_data.name
-        clazz = module_data.mod
-        @is_class = clazz.is_a?(Class)
-        @public_instance_methods = []
-        @protected_instance_methods = []
-        @private_instance_methods = []
-        @public_singleton_methods = []
-        @files = {}
-        @name_space = []
-        @class_name = nil
-        @locations = Hash.new { |h, k| h[k] = [] }
-        gather_modules
-      end
-
-      def gather_modules
-        return if class_module_path.nil?
-
-        segments = class_module_path.split(Contrast::Utils::ObjectShare::DOUBLE_COLON)
-        @class_name = segments.last
-        current = nil
-        segments[0..-2].each do |chunk|
-          defined = current ? current.cs__const_defined?(chunk) : Module.cs__const_defined?(chunk)
-          next unless defined
-
-          current = current ? current.cs__const_get(chunk) : Module.cs__const_get(chunk)
-          if current.is_a?(Class)
-            name_space << [chunk, Class]
-          elsif current.is_a?(Module)
-            name_space << [chunk, Module]
-          end
-        end
-      end
-
-      def staged_changes?
-        public_singleton_methods.any? ||
-            public_instance_methods.any? ||
-            protected_instance_methods.any? ||
-            private_instance_methods.any?
-      end
-
-      def written_from_location? source_location
-        return false unless source_location
-
-        file = source_location[0]
-        location = source_location[1]
-        locs = locations[file]
-        return true if locs.include?(location)
-
-        locs << location
-        false
-      end
-
-      def commit_patches
-        return unless staged_changes?
-
-        content = build_content
-        valid = Ripper.sexp(content)
-        unbound_eval(class_name, content) if !!valid && !class_name.empty?
-      end
-
-      def source_code location, method_name
-        file_name = location[0]
-        line_number = location[1]
-        return unless file_name && line_number
-
-        unless files.key?(file_name)
-          return unless File.exist?(file_name)
-
-          files[file_name] = File.readlines(file_name)
-        end
-
-        lines = files[file_name]
-
-        old_verbose = $VERBOSE
-        $VERBOSE = nil
-        code = ''
-        complete = false
-        # location#line_number is 1 based, arrays are 0 based
-        line_number -= 1
-        lines[line_number..-1].each do |line|
-          begin
-            code << line
-            RubyVM::InstructionSequence.compile(code) # this will raise SyntaxError for malformed code
-            # Assert that a line which ends with a , or \ is incomplete.
-            complete = code !~ /[,\\]\s*\z/
-            break if complete
-          rescue SyntaxError
-            code.gsub(/\#\{.*?\}/, 'temp')
-          end
-        end
-        $VERBOSE = old_verbose
-        raise SyntaxError, "Failure: method #{ method_name } in #{ file_name } at #{ line_number }" unless complete
-
-        code
-      end
-
-      private
-
-      def build_content
-        content = ''
-        name_space.each do |arr|
-          name = arr[0]
-          type = arr[1]
-          if type == Class
-            content << "class #{ name }\n"
-          elsif type == Module
-            content << "module #{ name }\n"
-          end
-        end
-
-        # Set the name to be a class or module
-        content << if is_class
-                     "class #{ class_name }\n"
-                   else
-                     "module #{ class_name }\n"
-                   end
-
-        # Recreate the updated class methods
-        if public_singleton_methods.any?
-          content << CLASS_SELF_LINE
-          content << public_singleton_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
-          content << Contrast::Utils::ObjectShare::NEW_LINE
-          content << END_NEW_LINE
-        end
-
-        # Recreate the updated instance methods
-        if public_instance_methods.any?
-          content << public_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
-          content << Contrast::Utils::ObjectShare::NEW_LINE
-        end
-
-        if protected_instance_methods.any?
-          content << PROTECTED_WITH_NEW_LINE
-          content << protected_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
-          content << Contrast::Utils::ObjectShare::NEW_LINE
-        end
-
-        if private_instance_methods.any?
-          content << PRIVATE_WITH_NEW_LINE
-          content << private_instance_methods.join(Contrast::Utils::ObjectShare::NEW_LINE)
-          content << Contrast::Utils::ObjectShare::NEW_LINE
-        end
-
-        content << END_NEW_LINE
-        name_space.length.times do
-          content << END_NEW_LINE
-        end
-        content
-      end
-    end
-  end
-end