contrast-agent 3.8.4

data/resources/csrf/inject.js

@@ -0,0 +1,44 @@
+<script>
+  function _contrast_isSameOrigin(action) {
+    var thisDomain = document.domain;
+    var parser = document.createElement('a');
+    parser.href = action;
+    return parser.hostname == thisDomain;
+  }
+
+  function _contrast_addTokenToForms() {
+    for(var i=0;i<document.forms.length;i++) {
+      var form = document.forms[i];
+      var action = form.action;
+      if(!!action || _contrast_isSameOrigin(action)) {
+        if(!form._contrast_tokenized) {
+          var input = document.createElement("input");
+          input.setAttribute("type", "hidden");
+          input.setAttribute("name", "!TOKEN_NAME!");
+          input.setAttribute("value", "!TOKEN_VALUE!");
+          form.appendChild(input);
+          form._contrast_tokenized = true;
+        }
+      }
+    }
+  }
+
+  (function() {_contrast_addTokenToForms();})();
+
+  var _contrast_watchNewForms = (function() {
+    var MutationObserver = window.MutationObserver || window.WebKitMutationObserver, eventListenerSupported = window.addEventListener;
+    return function(obj, callback) {
+      if(MutationObserver) {
+        var obs = new MutationObserver(function(mutations, observer) {
+          if( mutations[0].addedNodes.length )
+            callback();
+        });
+        obs.observe(obj, { childList:true, subtree:true });
+      } else if(eventListenerSupported) {
+        obj.addEventListener('DOMNodeInserted', callback, false);
+      }
+    }
+  })();
+
+  _contrast_watchNewForms(document.body, function() { _contrast_addTokenToForms(); });
+</script>

data/resources/deadzone/policy.json

@@ -0,0 +1,55 @@
+{
+  "deadzones":[
+    {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"content_type"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"host_authority"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"host_with_port"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"ip"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"logger"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"request_method"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"scheme"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"script_name"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"server_authority"
+    }, {
+      "class_name":"Rack::Request::Helpers",
+      "instance_method":true,
+      "method_visibility": "public",
+      "method_name":"server_name"
+    }
+  ]
+}

data/resources/factory-bot-spec/spec_helper.rb

@@ -0,0 +1,30 @@
+require "rspec"
+require "rspec/its"
+
+require "simplecov"
+
+require "factory_bot"
+require 'contrast-agent'
+Contrast::Agent::Patching::Policy::Patcher.patch
+
+Dir["spec/support/**/*.rb"].each { |f| require File.expand_path(f) }
+
+RSpec.configure do |config|
+  config.mock_with :rspec do |mocks|
+    # Prevents you from mocking or stubbing a method that does not exist on a
+    # real object. This is generally recommended, and will default to `true` in
+    # RSpec 4.
+    mocks.verify_partial_doubles = true
+  end
+
+  config.include DeclarationMatchers
+
+  config.before do
+    FactoryBot.reload
+  end
+
+  config.order = :random
+  Kernel.srand config.seed
+
+  config.example_status_persistence_file_path = "tmp/rspec_examples.txt"
+end

data/resources/inventory/policy.json

@@ -0,0 +1,110 @@
+{
+  "rules":[
+    {
+      "name":"data_store",
+      "applicator": "Contrast::CoreExtensions::Inventory::DataStores",
+      "applicator_method": "cs__patched_report_data_store",
+      "required_properties": ["data_store"],
+      "optional_properties": [],
+      "triggers":[
+        {
+          "class_name":"SQLite3::Database",
+          "instance_method":true,
+          "method_name":"execute",
+          "method_visibility": "public",
+          "properties": {
+            "data_store" : "SQLite3"
+          }
+        }, {
+          "class_name":"SQLite3::Statement",
+          "instance_method":true,
+          "method_name":"initialize",
+          "method_visibility": "private",
+          "properties": {
+            "data_store" : "SQLite3"
+          }
+        }, {
+          "class_name":"Mysql2::Client",
+          "instance_method":true,
+          "method_name":"query",
+          "method_visibility": "public",
+          "properties": {
+            "data_store" : "MySQL"
+          }
+        }, {
+          "class_name":"Mysql2::Statement",
+          "instance_method":true,
+          "method_name":"execute",
+          "method_visibility": "public",
+          "properties": {
+            "data_store" : "MySQL"
+          }
+        }, {
+          "class_name":"PG::Connection",
+          "instance_method":true,
+          "method_name":"exec",
+          "method_visibility": "public",
+          "properties": {
+            "data_store" : "PostgreSQL"
+          }
+        }, {
+          "class_name":"PG::Connection",
+          "instance_method":true,
+          "method_name":"exec_params",
+          "method_visibility": "public",
+          "properties": {
+            "data_store" : "PostgreSQL"
+          }
+        }, {
+          "class_name":"PG::Connection",
+          "instance_method":true,
+          "method_name":"async_exec",
+          "method_visibility": "public",
+          "properties": {
+            "data_store" : "PostgreSQL"
+          }
+        }, {
+          "class_name": "ActiveRecord::Querying",
+          "instance_method": false,
+          "method_name": "select",
+          "method_visibility": "public",
+          "properties": {
+            "data_store": "PostgreSQL"
+          }
+        }, {
+          "class_name": "Mongo::Server::Connection",
+          "instance_method": true,
+          "method_name": "dispatch",
+          "method_visibility": "public",
+          "properties": {
+            "data_store": "MongoDB"
+          }
+        },{
+          "class_name": "Moped::Node",
+          "instance_method": true,
+          "method_name": "read",
+          "method_visibility": "public",
+          "properties": {
+            "data_store": "MongoDB"
+          }
+        },{
+          "class_name": "Moped::Node",
+          "instance_method": true,
+          "method_name": "write",
+          "method_visibility": "public",
+          "properties": {
+            "data_store": "MongoDB"
+          }
+        },{
+          "class_name": "Moped::Node",
+          "instance_method": true,
+          "method_name": "process",
+          "method_visibility": "public",
+          "properties": {
+            "data_store": "MongoDB"
+          }
+        }
+      ]
+    }
+  ]
+}

data/resources/protect/policy.json

@@ -0,0 +1,417 @@
+{
+  "rules":[
+    {
+      "name": "cmd-injection",
+      "applicator": "Contrast::CoreExtensions::Protect::AppliesCommandInjectionRule",
+      "applicator_method": "cs__patched_apply_command_injection_rule",
+      "required_properties": [],
+      "optional_properties": [],
+      "triggers": [
+        {
+          "class_name":"IO",
+          "method_name":"popen",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Open3",
+          "method_name":"pipeline",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Open3",
+          "method_name":"pipeline_r",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Open3",
+          "method_name":"pipeline_rw",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Open3",
+          "method_name":"pipeline_start",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Open3",
+          "method_name":"pipeline_w",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Open3",
+          "method_name":"popen2",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Open3",
+          "method_name":"popen2e",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Open3",
+          "method_name":"popen3",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Kernel",
+          "method_name":"`",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Kernel",
+          "method_name":"`",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {}
+        }, {
+          "class_name":"Kernel",
+          "method_name":"system",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Kernel",
+          "method_name":"system",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {}
+        }, {
+          "class_name":"Kernel",
+          "method_name":"exec",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Kernel",
+          "method_name":"exec",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {}
+        }, {
+          "class_name":"Kernel",
+          "method_name":"spawn",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name":"Kernel",
+          "method_name":"spawn",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {}
+        }
+      ]
+    },
+    {
+      "name": "nosql-injection",
+      "applicator": "Contrast::CoreExtensions::Protect::AppliesNoSqliRule",
+      "applicator_method": "cs__patched_apply_nosql_rule",
+      "required_properties": ["database"],
+      "optional_properties": [],
+      "triggers": [
+        {
+          "class_name": "Mongo::Server::Connection",
+          "method_name": "dispatch",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {
+            "database": "MongoDB"
+          }
+        },{
+          "class_name": "Moped::Node",
+          "method_name": "read",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {
+            "database": "MongoDB"
+          }
+        },{
+          "class_name": "Moped::Node",
+          "method_name": "write",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {
+            "database": "MongoDB"
+          }
+        },{
+          "class_name": "Moped::Node",
+          "method_name": "process",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {
+            "database": "MongoDB"
+          }
+        }
+      ]
+    },
+    {
+      "name":"path-traversal",
+      "applicator": "Contrast::CoreExtensions::Protect::AppliesPathTraversalRule",
+      "applicator_method": "cs__patched_apply_path_traversal_rule",
+      "required_properties": ["action"],
+      "optional_properties": [],
+      "triggers":[
+        {
+          "class_name":"File",
+          "method_name":"initialize",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {
+            "action": "dynamic"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"open",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "dynamic"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"initialize",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {
+            "action": "dynamic"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"binread",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "read"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"binwrite",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "write"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"read",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "read"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"readlines",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "read"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"copy_stream",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "copy"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"foreach",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "read"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"sysopen",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "dynamic"
+          }
+        }, {
+          "class_name":"IO",
+          "method_name":"write",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {
+            "action": "write"
+          }
+        }
+      ]
+    },
+    {
+      "name": "sql-injection",
+      "applicator": "Contrast::CoreExtensions::Protect::AppliesSqliRule",
+      "applicator_method": "cs__patched_apply_sql_rule",
+      "required_properties": ["index", "database"],
+      "optional_properties": [],
+      "triggers": [
+        {
+          "class_name": "Mysql2::Client",
+          "method_name": "query",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {
+            "index": 0,
+            "database": "MySQL"
+          }
+        },{
+          "class_name": "Mysql2::Statement",
+          "method_name": "execute",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {
+            "index": 0,
+            "database": "MySQL"
+          }
+        }, {
+          "class_name": "PG::Connection",
+          "method_name": "sync_exec",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {
+            "index": 0,
+            "database": "PostgreSQL"
+          }
+        }, {
+          "class_name": "PG::Connection",
+          "method_name": "sync_exec_params",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {
+            "index": 0,
+            "database": "PostgreSQL"
+          }
+        }, {
+          "class_name": "PG::Connection",
+          "method_name": "async_exec",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {
+            "index": 0,
+            "database": "PostgreSQL"
+          }
+        }, {
+          "class_name": "PG::Connection",
+          "method_name": "async_exec_params",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {
+            "index": 0,
+            "database": "PostgreSQL"
+          }
+        }, {
+          "class_name": "SQLite3::Statement",
+          "method_name": "initialize",
+          "instance_method": true,
+          "method_visibility": "private",
+          "properties": {
+            "index": 1,
+            "database": "SQLite3"
+          }
+        }, {
+          "class_name":"SQLite3::Database",
+          "method_name":"execute",
+          "instance_method":true,
+          "method_visibility": "public",
+          "properties": {
+            "index": 0,
+            "database": "SQLite3"
+          }
+        }
+      ]
+    },
+    {
+      "name": "untrusted-deserialization",
+      "applicator": "Contrast::CoreExtensions::Protect::AppliesDeserializationRule",
+      "applicator_method": "cs__patched_apply_deserialization_rule",
+      "required_properties": [],
+      "optional_properties": [],
+      "triggers": [
+        {
+          "class_name": "Marshal",
+          "method_name": "load",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        },
+        {
+          "class_name": "Psych",
+          "method_name": "load",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }
+      ]
+    },
+    {
+      "name": "xxe",
+      "applicator": "Contrast::CoreExtensions::Protect::AppliesXxeRule",
+      "applicator_method": "cs__patched_apply_xxe_rule",
+      "required_properties": [],
+      "optional_properties": [],
+      "triggers": [
+        {
+          "class_name": "Nokogiri::XML::Document",
+          "method_name": "read_memory",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name": "Nokogiri::XML::Document",
+          "method_name": "read_io",
+          "instance_method": false,
+          "method_visibility": "public",
+          "applicator_method": "cs__patched_apply_xxe_rule__io",
+          "properties": {}
+        },{
+          "class_name": "Nokogiri::XML::SAX::Parser",
+          "method_name": "parse_memory",
+          "instance_method": true,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name": "Nokogiri::XML::SAX::Parser",
+          "method_name": "parse_io",
+          "instance_method": true,
+          "method_visibility": "public",
+          "applicator_method": "cs__patched_apply_xxe_rule__io",
+          "properties": {}
+        },{
+          "class_name": "Ox",
+          "method_name": "parse",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name": "Ox",
+          "method_name": "load",
+          "instance_method": false,
+          "method_visibility": "public",
+          "properties": {}
+        }, {
+          "class_name": "Oga::XML::Lexer",
+          "method_name": "read_data",
+          "instance_method": true,
+          "method_visibility": "public",
+          "applicator_method": "cs__patched_apply_xxe_rule__lexer",
+          "properties": {}
+        }
+
+      ]
+    }
+  ]
+}