contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/core_extensions/protect/applies_deserialization_rule.rb

@@ -1,58 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the Deserialization rule. It is called from
-      # our patches of the targeted methods in which deserialization occurs.
-      # It is responsible for deciding if the infilter methods of the rule
-      # should be invoked.
-      module AppliesDeserializationRule
-        include Contrast::Components::Interface
-        access_component :logging, :analysis
-
-        class << self
-          def cs__patched_apply_deserialization_rule method, _exception, _properties, object, args
-            return unless valid_input?(args)
-            return if cs__skip_analysis?
-
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, args[0])
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, "Error running untrusted-deserialization rule in #{ object }.#{ method }")
-          end
-
-          def cs__patched_apply_deserialization_command_check command
-            return unless command
-            return if cs__skip_analysis?
-
-            rule.check_command_scope(command)
-          end
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::Deserialization::NAME
-          end
-
-          def valid_input? args
-            return false unless args&.any?
-
-            input = args[0]
-            input.is_a?(String)
-          end
-
-          def cs__skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/core_extensions/protect/applies_no_sqli_rule.rb

@@ -1,81 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the NoSQL Injection rule. It is called from
-      # our patches of the targeted methods in which the execution of String
-      # based NoSQL queries occur. It is responsible for deciding if the
-      # infilter methods of the rule should be invoked.
-      module AppliesNoSqliRule
-        DATABASE_MONGO = 'MongoDB'
-        ACTION_DISPATCH = 'dispatch'
-        ACTION_READ = 'read'
-        ACTION_WRITE = 'write'
-        ACTION_PROCESS = 'process'
-
-        class << self
-          include Contrast::Components::Interface
-          access_component :logging, :analysis
-
-          def cs__patched_apply_nosql_rule method, _exception, properties, _object, args
-            return unless valid_input?(args)
-            return if cs__skip_analysis?
-
-            database = properties['database']
-            operations = args[0]
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            if operations.is_a?(Array)
-              operations.each do |m|
-                handle_operation(context, database, method, m)
-              end
-            else
-              handle_operation(context, database, method, operations)
-            end
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, "Error running NoSQLi rule in #{ properties['database'] }")
-          end
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::NoSqli::NAME
-          end
-
-          def valid_input? args
-            return false unless args&.any?
-
-            args[0]
-          end
-
-          def cs__skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-
-          def handle_operation context, database, action, operation
-            data = extract_mongo_data(operation)
-            return unless data && !data.empty?
-
-            logger.debug(nil, "applying nosqli rule #{ database }##{ action }")
-            rule.infilter(context, database, data)
-          end
-
-          def extract_mongo_data operation
-            if operation.cs__respond_to? :selector
-              operation.selector
-            elsif operation.cs__respond_to? :documents
-              operation.documents
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/core_extensions/protect/applies_path_traversal_rule.rb

@@ -1,119 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/utils/object_share'
-cs__scoped_require 'contrast/components/interface'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the Path Traversal rule. It is called from
-      # our patches of the targeted methods in which File or IO access occur.
-      # It is responsible for deciding if the infilter methods of the rule
-      # should be invoked.
-      module AppliesPathTraversalRule
-        include Contrast::Components::Interface
-
-        access_component :logging, :analysis
-
-        class << self
-          def cs__possible_write input
-            input.cs__respond_to?(:to_s) &&
-                input.to_s.include?(Contrast::Utils::ObjectShare::WRITE_FLAG)
-          end
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::PathTraversal::NAME
-          end
-
-          def cs__skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-          end
-
-          def cs__patched_apply_path_traversal_rule method, _exception, properties, _object, args
-            return unless args&.any?
-
-            path = args[0]
-            return unless path.is_a?(String)
-            return if cs__skip_analysis?
-
-            action = properties['action']
-            write_marker = write?(action, *args)
-            possible_write = write_marker && cs__possible_write(write_marker)
-            cs__patched_path_traversal_rule(path, possible_write, method)
-
-            # If the action was copy, we need to handle the write half of it.
-            # We handled read in line above.
-            return unless action == COPY
-            return unless args.length > 1
-
-            dst = args[1]
-            return unless dst.is_a?(String)
-
-            cs__patched_path_traversal_rule(dst, true, method)
-          end
-
-          READ = 'read'
-          WRITE = 'write'
-          COPY = 'copy'
-          def write? action, *args
-            return false if action == READ
-            return false if action == COPY
-            return true if action == WRITE
-
-            write_marker = args.length > 1 ? args[1] : nil
-            write_marker && cs__possible_write(write_marker)
-          end
-
-          def cs__patched_path_traversal_rule path, possible_write, method
-            return unless cs__patched_applies_to?(path, possible_write)
-
-            logger.debug(nil, "checking path traversal: write=true path=#{ path }")
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, method, path)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, 'path traversal')
-          end
-
-          CS__SAFER_REL_PATHS = %w[public app log tmp].cs__freeze
-          def cs__patched_safer_abs_paths
-            @_cs__patched_safer_abs_paths ||= begin
-              pwd = ENV['PWD']
-              if pwd
-                tmp = CS__SAFER_REL_PATHS.map { |r| "#{ pwd }/#{ r }" }
-                gems = ENV['GEM_PATH']
-                tmp += gems.split(Contrast::Utils::ObjectShare::COLON) if gems
-                tmp
-              else
-                []
-              end
-            end
-          end
-
-          def cs__patched_applies_to? path, possible_write = false
-            # any possible write is a potential risk
-            return true if possible_write
-
-            # any path that moves 'up' is a potential risk
-            return true if path.index(Contrast::Utils::ObjectShare::PARENT_PATH)
-
-            path = path.downcase
-            if path.start_with?(Contrast::Utils::ObjectShare::SLASH)
-              cs__patched_safer_abs_paths.each do |prefix|
-                return false if path.start_with?(prefix)
-              end
-            else
-              CS__SAFER_REL_PATHS.each do |prefix|
-                return false if path.start_with?(prefix)
-              end
-            end
-            true
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/core_extensions/protect/applies_sqli_rule.rb

@@ -1,63 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/data_store_util'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the SQL Injection rule. It is called from
-      # our patches of the targeted methods in which the execution of String
-      # based SQL queries occur. It is responsible for deciding if the infilter
-      # methods of the rule should be invoked.
-      module AppliesSqliRule
-        DATABASE_MYSQL =    'MySQL'
-        DATABASE_SQLITE =   'SQLite3'
-        DATABASE_PG =       'PostgreSQL'
-
-        class << self
-          include Contrast::Components::Interface
-
-          access_component :logging, :analysis
-
-          def cs__patched_apply_sql_rule method, _exception, properties, object, args
-            database = properties['database']
-            return unless database
-
-            index = properties[Contrast::Utils::ObjectShare::INDEX]
-            return unless valid_input?(index, args)
-            return if cs__skip_analysis?
-
-            sql = args[index]
-            logger.debug(nil, "applying sqli rule on #{ object } for #{ method }")
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, database, sql)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            logger.error(e, "Error running SQLi rule in #{ object }")
-          end
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::Sqli::NAME
-          end
-
-          def valid_input? index, args
-            return false unless args && args.length > index
-
-            sql = args[index]
-            sql && !sql.empty?
-          end
-
-          def cs__skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/core_extensions/protect/applies_xxe_rule.rb

@@ -1,141 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-cs__scoped_require 'contrast/utils/object_share'
-
-module Contrast
-  module CoreExtensions
-    module Protect
-      # This Module is how we apply the XXE rule. It is called from our patches
-      # of the targeted methods in which XML parsing and entity resolution
-      # occurs. It is responsible for deciding if the infilter methods of the
-      # rule should be invoked.
-      module AppliesXxeRule
-        include Contrast::Components::Interface
-        access_component :logging, :analysis
-
-        class << self
-          def cs__patched_apply_xxe_rule _method, _exception, _properties, object, args
-            return unless valid_input?(args)
-            return if cs__skip_analysis?
-
-            xml = args.first
-            parser = determine_parser(object)
-            return unless parser
-
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, xml)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
-            logger.error(e, "Error running XXE rule in #{ parser }")
-          end
-
-          # IO is tricky. If we can't rewind it, we can't fix it back to the
-          # original state. To be safe, we'll skip non-rewindable IO objects.
-          def cs__patched_apply_xxe_rule__io _method, _exception, _properties, object, args
-            need_rewind = false
-            return unless valid_io_input?(args)
-            return if cs__skip_analysis?
-
-            need_rewind = true
-            xml = args.first.read
-            parser = determine_parser(object)
-            return unless parser
-
-            rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, xml)
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
-            logger.error(e, "Error running XXE rule in #{ parser }")
-          ensure
-            args.first.rewind if need_rewind
-          end
-
-          # Oga's Lexer is a special case b/c the information we need is on the
-          # object itself -- specifically in the @data instance variable
-          def cs__patched_apply_xxe_rule__lexer _method, _exception, _properties, object, _args
-            return unless valid_data_input?(object)
-            return if cs__skip_analysis?
-
-            parser = determine_parser(object)
-            return unless parser
-
-            data = object.instance_variable_get(DATA_KEY)
-
-            if data.cs__is_a?(String)
-              rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, data)
-            elsif data.cs__respond_to?(:each_line)
-              data.each_line do |line|
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, line)
-              end
-              data.rewind if data.cs__respond_to?(:rewind)
-            elsif data.cs__respond_to?(:each)
-              data.each do |chunk|
-                rule.infilter(Contrast::Agent::REQUEST_TRACKER.current, parser, chunk)
-              end
-              data.rewind if data.cs__respond_to?(:rewind)
-            end
-          rescue Contrast::SecurityException => e
-            raise e
-          rescue StandardError => e
-            parser ||= Contrast::Utils::ObjectShare::UNKNOWN
-            logger.error(e, "Error running XXE rule in #{ parser }")
-          end
-
-          def rule
-            PROTECT.rule Contrast::Agent::Protect::Rule::Xxe::NAME
-          end
-
-          def valid_input? args
-            return false unless args&.any?
-
-            args.first
-          end
-
-          def valid_io_input? args
-            return false unless valid_input?(args)
-
-            io = args.first
-            io&.respond_to?(:rewind)
-          end
-
-          DATA_KEY = '@data'.to_sym
-          def valid_data_input? object
-            object.instance_variable_defined?(DATA_KEY) &&
-                object.instance_variable_get(DATA_KEY)
-          end
-
-          def cs__skip_analysis?
-            context = Contrast::Agent::REQUEST_TRACKER.current
-            return true unless context&.app_loaded?
-            return true unless rule&.enabled?
-
-            false
-          end
-
-          NOKOGIRI_MARKER = 'Nokogiri::'
-          PARSER_NOKOGIRI = 'Nokogiri'
-          OX_MARKER = 'Ox' # breaks marker pattern b/c Ox is entire classname
-          PARSER_OX = 'Ox'
-          OGA_MARKER = 'Oga::'
-          PARSER_OGA = 'Oga'
-          def determine_parser object
-            clazz = object.is_a?(Module) ? object : object.cs__class
-            name = clazz.cs__name
-
-            if name.start_with?(NOKOGIRI_MARKER)
-              PARSER_NOKOGIRI
-            elsif name.start_with?(OX_MARKER)
-              PARSER_OX
-            elsif name.start_with?(OGA_MARKER)
-              PARSER_OGA
-            end
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/core_extensions/protect/kernel.rb

@@ -1,30 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-# This Module functions as our patch into the Kernel class for Protect,
-# allowing us to track activity as it crosses spawned processes.
-module Kernel
-  class << self
-    include Contrast::Components::Interface
-    access_component :contrast_service
-
-    def cs__protect_build_wrapper
-      lambda {
-        Kernel.cs__protect_proc_start
-        yield
-        # AtExitHook handles sending any messages generated in the new forked process
-      }
-    end
-
-    def cs__protect_proc_start
-      context = Contrast::Agent::REQUEST_TRACKER.current
-      return unless context
-
-      context.reset_activity
-    end
-  end
-end
-
-cs__scoped_require 'cs__protect_kernel/cs__protect_kernel'

data/lib/contrast/core_extensions/protect/psych.rb

@@ -1,7 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-if defined?(Psych)
-  cs__scoped_require 'contrast/core_extensions/protect/applies_deserialization_rule'
-  cs__scoped_require 'cs__patched_psych/cs__patched_psych'
-end

data/lib/contrast/core_extensions/thread.rb

@@ -1,31 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-# ensure that we're being loaded with an agent
-# NOTE: THIS CLASS WILL NOT BE RELOADED B/C WE CANNOT RELOAD THE STANDARD
-# thread file
-
-# Request context is still tracked per-thread.  There isn't anything
-# particularly order-dependent or stateful about request contexts.  It
-# exists mostly for reference.
-#
-# Scope HAS to exist per-fiber.
-
-# Monkey-patching Thread#initialize.
-class Thread
-  alias_method :cs__initialize, :initialize
-
-  def initialize *args, &block
-    # Thread.current still references the original(callee) thread that is
-    # instantiating this new fiber during initialization
-    Contrast::Components::Scope::MONITOR.synchronize do
-      if (current_context = Thread.current[:current_context])
-        self[:current_context] = current_context.dup
-      end
-
-      Contrast::Components::Scope.sweep_dead_ecs
-    end
-
-    cs__initialize(*args, &block)
-  end
-end

data/lib/contrast/internal_exception.rb

@@ -1,8 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-module Contrast
-  # Used to type a StandardError raised by Contrast code.
-  class InternalException < StandardError
-  end
-end

data/lib/contrast/rails_extensions/assess/action_controller_inheritance.rb

@@ -1,48 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-if defined?(ActionController) &&
-      defined?(ActionController::Railties) &&
-      defined?(ActionController::Railties::Helpers)
-  module ActionController
-    module Railties
-      # Used to monkey patch all the inherited calls in action_pack
-      #
-      # This is the usual entry point for Rails inheritance work, so it should
-      # catch most of the calls to inherited.
-      module Helpers
-        alias_method :cs__patched_inherited, :inherited
-        def inherited klass
-          klass&.instance_variable_set(:@cs__defining_class, true)
-          cs__patched_inherited(klass)
-        ensure
-          klass&.instance_variable_set(:@cs__defining_class, false)
-        end
-      end
-    end
-  end
-end
-
-if defined?(ActiveRecord) &&
-      defined?(ActiveRecord::AttributeMethods) &&
-      defined?(ActiveRecord::AttributeMethods::TimeZoneConversion) &&
-      defined?(ActiveRecord::AttributeMethods::TimeZoneConversion::ClassMethods)
-  module ActiveRecord
-    module AttributeMethods
-      # Used to monkey patch all the inherited calls in action_pack
-      module TimeZoneConversion
-        module ClassMethods #:nodoc:
-          private
-
-          alias_method :cs__patched_inherited, :inherited
-          def inherited klass
-            klass&.instance_variable_set(:@cs__defining_class, true)
-            cs__patched_inherited(klass)
-          ensure
-            klass&.instance_variable_set(:@cs__defining_class, false)
-          end
-        end
-      end
-    end
-  end
-end

data/lib/contrast/rails_extensions/assess/active_record.rb

@@ -1,32 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-if defined?(ActiveRecord) &&
-      defined?(ActiveRecord::AttributeMethods) &&
-      defined?(ActiveRecord::AttributeMethods::Read) &&
-      defined?(ActiveRecord::AttributeMethods::Read::ClassMethods)
-
-  module ActiveRecord
-    module AttributeMethods
-      module Read
-        # Rails / ActiveRecord are sneaky a.f. They define attributes of a
-        # class in one method, then monkey patch allocate in another and
-        # finally invoke module_eval in this method... but of course they use a
-        # '_tmp_' header for the method name and then alias it in this module
-        # to name it what we expect
-        module ClassMethods
-          alias_method :cs__patched_define_method_attribute, :define_method_attribute
-
-          def define_method_attribute *args, &block
-            ret = cs__patched_define_method_attribute(*args, &block)
-            method_name = args[0]
-            Contrast::Agent::Assess::Policy::Patcher.patch_assess_method(self, method_name)
-            ret
-          end
-
-          protected :cs__patched_define_method_attribute, :define_method_attribute
-        end
-      end
-    end
-  end
-end

data/lib/contrast/rails_extensions/assess/active_record_named.rb

@@ -1,61 +0,0 @@
-# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
-# frozen_string_literal: true
-
-cs__scoped_require 'contrast/components/interface'
-
-if defined?(ActiveRecord) &&
-      defined?(ActiveRecord::Scoping) &&
-      defined?(ActiveRecord::Scoping::Named) &&
-      defined?(ActiveRecord::Scoping::Named::ClassMethods) &&
-      ActiveRecord::Scoping::Named::ClassMethods.
-            instance_methods(false).
-            include?(:scope)
-  module ActiveRecord
-    module Scoping
-      module Named
-        # Our patch into the ActiveRecord::Scoping::Named::ClassMethods Module,
-        # allowing for the runtime rewrite of interpolation calls defined in
-        # methods defined dynamically during application execution.
-        #
-        # TODO: RUBY-534
-        module ClassMethods
-          include Contrast::Components::Interface
-          access_component :logging, :agent
-
-          def _cs__rewrite method_name, body
-            return body unless AGENT.rewrite_interpolation?
-            return body unless body.is_a?(Proc)
-
-            location = body.source_location
-            return body if location.nil?
-
-            # Good news, once we patch the body once, the source location
-            # becomes eval. We may need to fix this later though (so it may
-            # be bad news)
-            return body if location.empty? || location[0].empty? || location[0].include?('eval')
-
-            opener = Contrast::Agent::ClassReopener.new(Contrast::Agent::ModuleData.new(self))
-            original_source_code = opener.source_code(location, method_name)
-            return body unless original_source_code
-            return body if Contrast::Agent::Rewriter.send(:unrepeatable?, original_source_code)
-            return body unless Contrast::Agent::Rewriter.send(:interpolations?, original_source_code)
-
-            # the code looks like 'source :some_method_name, ->lambda_literal'
-            # we just need the lambda
-            body_start = original_source_code.index(',') + 1
-            original_source_code = original_source_code[body_start..-1]
-
-            new_method_source = Contrast::Agent::Rewriter.send(:rewrite_method, original_source_code)
-            return body unless Contrast::Agent::Rewriter.send(:valid_code?, new_method_source)
-
-            unbound_eval(cs__name, new_method_source)
-          rescue SyntaxError, StandardError => e
-            logger.debug(e, "Can't parse method source in scoped method #{ method_name }: #{ e.message }")
-            body
-          end
-        end
-      end
-    end
-  end
-  cs__scoped_require 'cs__assess_active_record_named/cs__assess_active_record_named'
-end